diff --git a/apps/multiplatform/android/build.gradle.kts b/apps/multiplatform/android/build.gradle.kts
index c16aced912..bcdfbab7d9 100644
--- a/apps/multiplatform/android/build.gradle.kts
+++ b/apps/multiplatform/android/build.gradle.kts
@@ -21,7 +21,7 @@ android {
         versionCode = (extra["android.version_code"] as String).toInt()
         versionName = extra["android.version_name"] as String
 
-        testInstrumentationRunner = "android.support.test.runner.AndroidJUnitRunner"
+        testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
         vectorDrawables {
             useSupportLibrary = true
         }
@@ -93,6 +93,7 @@ android {
         jniLibs.useLegacyPackaging = rootProject.extra["compression.level"] as Int != 0
     }
     android.sourceSets["main"].assets.setSrcDirs(listOf("../common/src/commonMain/resources/assets"))
+    android.sourceSets["androidTest"].java.srcDir("../common/src/uiTestShared/kotlin")
     val isRelease = gradle.startParameter.taskNames.find { it.lowercase().contains("release") } != null
     val isBundle = gradle.startParameter.taskNames.find { it.lowercase().contains("bundle") } != null
     // Comma separated list of languages that will be included in the apk
@@ -187,8 +188,11 @@ dependencies {
 
     testImplementation("junit:junit:4.13.2")
     androidTestImplementation("androidx.test.ext:junit:1.2.1")
+    androidTestImplementation("androidx.test:runner:1.6.1")
+    androidTestImplementation("androidx.test:core:1.6.1")
     androidTestImplementation("androidx.test.espresso:espresso-core:3.6.1")
-    //androidTestImplementation("androidx.compose.ui:ui-test-junit4:$compose_version")
+    androidTestImplementation("androidx.test.espresso:espresso-intents:3.6.1")
+    androidTestImplementation("androidx.compose.ui:ui-test-junit4:1.8.2")
     debugImplementation("androidx.compose.ui:ui-tooling:1.6.4")
 }
 
diff --git a/apps/multiplatform/android/src/androidTest/java/chat/simplex/app/ExampleInstrumentedTest.kt b/apps/multiplatform/android/src/androidTest/java/chat/simplex/app/ExampleInstrumentedTest.kt
deleted file mode 100644
index f49be92003..0000000000
--- a/apps/multiplatform/android/src/androidTest/java/chat/simplex/app/ExampleInstrumentedTest.kt
+++ /dev/null
@@ -1,22 +0,0 @@
-package chat.simplex.app
-
-import androidx.test.ext.junit.runners.AndroidJUnit4
-import androidx.test.platform.app.InstrumentationRegistry
-import org.junit.Assert.assertEquals
-import org.junit.Test
-import org.junit.runner.RunWith
-
-/**
- * Instrumented test, which will execute on an Android device.
- *
- * See [testing documentation](http://d.android.com/tools/testing).
- */
-@RunWith(AndroidJUnit4::class)
-class ExampleInstrumentedTest {
-  @Test
-  fun useAppContext() {
-    // Context of the app under test.
-    val appContext = InstrumentationRegistry.getInstrumentation().targetContext
-    assertEquals("chat.simplex.app", appContext.packageName)
-  }
-}
\ No newline at end of file
diff --git a/apps/multiplatform/android/src/androidTest/java/chat/simplex/app/ui/SmokeTest.kt b/apps/multiplatform/android/src/androidTest/java/chat/simplex/app/ui/SmokeTest.kt
new file mode 100644
index 0000000000..eac29f857b
--- /dev/null
+++ b/apps/multiplatform/android/src/androidTest/java/chat/simplex/app/ui/SmokeTest.kt
@@ -0,0 +1,12 @@
+package chat.simplex.app.ui
+
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.common.ui.Ui
+import org.junit.Test
+
+class SmokeTest : UiTest() {
+  @Test fun bootCreatesUserAndShowsChatList() = uiTest {
+    app("alice")
+    waitFor(Ui.ChatList.NewChat, 60_000)
+  }
+}
diff --git a/apps/multiplatform/android/src/androidTest/java/chat/simplex/app/ui/back/BackKeyHelpers.kt b/apps/multiplatform/android/src/androidTest/java/chat/simplex/app/ui/back/BackKeyHelpers.kt
new file mode 100644
index 0000000000..fa3985f913
--- /dev/null
+++ b/apps/multiplatform/android/src/androidTest/java/chat/simplex/app/ui/back/BackKeyHelpers.kt
@@ -0,0 +1,50 @@
+package chat.simplex.app.ui.back
+
+import androidx.core.view.ViewCompat
+import androidx.core.view.WindowInsetsCompat
+import androidx.test.core.app.ActivityScenario
+import androidx.test.espresso.Espresso
+import androidx.test.runner.lifecycle.ActivityLifecycleMonitorRegistry
+import androidx.test.runner.lifecycle.Stage
+import chat.simplex.app.MainActivity
+import chat.simplex.app.ui.harness.UiScope
+import chat.simplex.app.ui.harness.UiTestApp
+
+private fun liveMainActivities(): List<MainActivity> {
+  var live = emptyList<MainActivity>()
+  UiTestApp.onMain {
+    val monitor = ActivityLifecycleMonitorRegistry.getInstance()
+    live = Stage.values().filter { it != Stage.DESTROYED }.flatMap { monitor.getActivitiesInStage(it) }.filterIsInstance<MainActivity>()
+  }
+  return live
+}
+
+internal fun mainActivityFinished(): Boolean = liveMainActivities().all { it.isFinishing }
+
+internal fun UiScope.backFromRoot() {
+  Espresso.pressBackUnconditionally()
+  poll(what = "MainActivity to finish") { mainActivityFinished() }
+}
+
+internal fun UiScope.relaunch(body: () -> Unit) {
+  poll(what = "the finished MainActivity to be destroyed") { liveMainActivities().isEmpty() }
+  ActivityScenario.launch(MainActivity::class.java).use {
+    rule.waitForIdle()
+    body()
+  }
+}
+
+internal fun keyboardShown(): Boolean {
+  var shown = false
+  UiTestApp.onMain {
+    val decor = ActivityLifecycleMonitorRegistry.getInstance().getActivitiesInStage(Stage.RESUMED).firstOrNull()?.window?.decorView
+    shown = decor != null && ViewCompat.getRootWindowInsets(decor)?.isVisible(WindowInsetsCompat.Type.ime()) == true
+  }
+  return shown
+}
+
+internal fun UiScope.hideKeyboard() {
+  runCatching { poll(timeoutMs = 2_000, what = "the soft keyboard to show", screenshot = false) { keyboardShown() } }
+  Espresso.closeSoftKeyboard()
+  poll(what = "the soft keyboard to hide") { !keyboardShown() }
+}
diff --git a/apps/multiplatform/android/src/androidTest/java/chat/simplex/app/ui/back/BackKeyTest.kt b/apps/multiplatform/android/src/androidTest/java/chat/simplex/app/ui/back/BackKeyTest.kt
new file mode 100644
index 0000000000..cbdd7ceecc
--- /dev/null
+++ b/apps/multiplatform/android/src/androidTest/java/chat/simplex/app/ui/back/BackKeyTest.kt
@@ -0,0 +1,197 @@
+package chat.simplex.app.ui.back
+
+import chat.simplex.app.ui.harness.ChatScreen
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.app.ui.harness.connect
+import chat.simplex.app.ui.harness.whatsNewFromSettings
+import chat.simplex.common.model.ChatController.appPrefs
+import chat.simplex.common.platform.chatController
+import chat.simplex.common.platform.chatModel
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.views.helpers.ModalManager
+import chat.simplex.common.views.helpers.SharedContent
+import chat.simplex.common.views.onboarding.OnboardingStage
+import org.junit.Test
+
+class BackKeyTest : UiTest() {
+  @Test fun back_chatToChatList() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    alice.chatList.open("bob")
+    waitFor(Ui.Chat.Bar.part("title"))
+    escape()
+    poll(what = "the chat list") { chatModel.chatId.value == null && !exists(Ui.Chat.Bar.part("title")) }
+    check(!mainActivityFinished()) { "Back from a chat finished MainActivity" }
+  }
+
+  @Test fun back_closesChatSearchBeforeChat() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    bob sends "@alice apple"
+    bob sends "@alice banana"
+    val bobId = alice.chatList.chatId("bob")
+    val chat = alice.chatList.open("bob")
+    chat.itemId("banana")
+    chat.openSearch()
+    typeInto(Ui.Chat.Bar.part("search"), "apple")
+    poll(what = "search results without `banana`") { chat.itemTexts().let { "apple" in it && "banana" !in it } }
+    hideKeyboard()
+    escape()
+    poll(what = "the search to close and the full chat to return") {
+      !exists(Ui.Chat.Bar.part("search")) && exists(Ui.Chat.Bar.part("title")) && "banana" in chat.itemTexts()
+    }
+    check(chatModel.chatId.value == bobId) { "the first Back left the chat" }
+    escape()
+    poll(what = "the chat list") { chatModel.chatId.value == null && !exists(Ui.Chat.Bar.part("title")) }
+  }
+
+  @Test fun back_exitsSelectionMode() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    bob sends "@alice one"
+    bob sends "@alice two"
+    val bobId = alice.chatList.chatId("bob")
+    val chat = alice.chatList.open("bob")
+    val two = chat.itemId("two")
+    chat.menu("one", "select")
+    click(Ui.Chat.Item(two))
+    poll(what = "two messages selected") { exists(Ui.Chat.Selection.part("title")) && "Selected 2" in textsOf(Ui.Chat.Selection.part("title")) }
+    escape()
+    poll(what = "selection mode to end") { !exists(Ui.Chat.Selection.part("title")) && exists(Ui.Chat.Bar.part("title")) }
+    check(chatModel.chatId.value == bobId) { "Back in selection mode left the chat" }
+  }
+
+  @Test fun back_closesContactAndGroupInfo() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    val bobId = alice.chatList.chatId("bob")
+    alice.chatList.open("bob").info()
+    waitFor(Ui.Info.Alias)
+    escape()
+    poll(what = "contact info to close to bob's chat") { !ModalManager.end.hasModalsOpen() && !exists(Ui.Info.Alias) && chatModel.chatId.value == bobId }
+    escape()
+    poll(what = "the chat list") { chatModel.chatId.value == null && !exists(Ui.Chat.Bar.part("title")) }
+    alice.newChat().createGroup("team")
+    val teamId = alice.chatList.chatId("team")
+    poll(what = "the invite members sheet over team") { chatModel.chatId.value == teamId && ModalManager.end.openModalCount() == 1 }
+    hideKeyboard()
+    escape()
+    poll(what = "the invite members sheet to close") { !ModalManager.end.hasModalsOpen() && exists(Ui.Chat.Bar.part("title")) }
+    ChatScreen(this).info()
+    waitFor(Ui.Info.Alias)
+    escape()
+    poll(what = "group info to close to team's chat") { !ModalManager.end.hasModalsOpen() && !exists(Ui.Info.Alias) && chatModel.chatId.value == teamId }
+  }
+
+  @Test fun back_hidesKeyboardFirst() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    val bobId = alice.chatList.chatId("bob")
+    alice.chatList.open("bob")
+    click(Ui.Chat.Message)
+    poll(what = "the soft keyboard to show") { keyboardShown() }
+    escape()
+    poll(what = "the soft keyboard to hide") { !keyboardShown() }
+    check(chatModel.chatId.value == bobId && exists(Ui.Chat.Bar.part("title"))) { "the first Back closed the chat" }
+  }
+
+  @Test fun back_clearsChatListSearch() = uiTest {
+    app("alice")
+    typeInto(Ui.ChatList.Search, "zz")
+    hideKeyboard()
+    escape()
+    poll(what = "the search text to clear") { editableText(Ui.ChatList.Search) == "" }
+    check(!mainActivityFinished()) { "Back with search text finished MainActivity" }
+    backFromRoot()
+  }
+
+  @Test fun back_closesUserPicker() = uiTest {
+    val alice = app("alice")
+    alice.userPicker()
+    waitFor(Ui.UserPicker.Sheet)
+    escape()
+    poll(what = "the user picker to hide") { !exists(Ui.UserPicker.Sheet) }
+    check(chatModel.chatId.value == null && !ModalManager.start.hasModalsOpen() && !mainActivityFinished()) { "Back did not return to the chat list" }
+  }
+
+  @Test fun back_closesNewChatSheet() = uiTest {
+    val alice = app("alice")
+    alice.newChat()
+    waitFor(Ui.NewChat.CreateLink)
+    escape()
+    poll(what = "the new chat sheet to close") { !chatModel.newChatSheetVisible.value && !ModalManager.start.hasModalsOpen() && !exists(Ui.NewChat.CreateLink) }
+    check(!mainActivityFinished()) { "Back on the new chat sheet finished MainActivity" }
+  }
+
+  @Test fun back_closesModalsOneByOne() = uiTest {
+    val alice = app("alice")
+    alice.appearance()
+    poll(what = "Appearance over Your settings") { ModalManager.start.openModalCount() == 2 && exists(Ui.Appearance.ColorMode) }
+    escape()
+    poll(what = "Your settings again") { ModalManager.start.openModalCount() == 1 && exists(Ui.Settings.Appearance) && !exists(Ui.Appearance.ColorMode) }
+    escape()
+    poll(what = "the chat list with nothing open") { !ModalManager.start.hasModalsOpen() && !exists(Ui.Settings.Appearance) && !exists(Ui.UserPicker.Sheet) }
+    check(!mainActivityFinished()) { "Back on Your settings finished MainActivity" }
+    backFromRoot()
+  }
+
+  @Test fun back_onChatListRootFinishesActivity() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    alice.chatList.row("bob")
+    val ctrl = chatController.getChatCtrl()
+    backFromRoot()
+    relaunch {
+      alice.chatList.row("bob")
+      check(chatModel.chatRunning.value == true && chatController.getChatCtrl() == ctrl) { "the core was restarted" }
+    }
+  }
+
+  @Test fun back_duringForward_returnsToSourceChat() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    bob sends "@alice hello"
+    val bobId = alice.chatList.chatId("bob")
+    alice.chatList.open("bob").menu("hello", "forward")
+    poll(what = "the forward list") { chatModel.sharedContent.value is SharedContent.Forward && !exists(Ui.Chat.Bar.part("title")) }
+    escape()
+    poll(what = "bob's chat again") { chatModel.sharedContent.value == null && chatModel.chatId.value == bobId && exists(Ui.Chat.Bar.part("title")) }
+    check(!mainActivityFinished()) { "Back during a forward finished MainActivity" }
+  }
+
+  @Test fun back_onboardingProfile_returnsToWelcome() = uiTest {
+    app(null)
+    click(Ui.Onboarding.GetStarted)
+    waitFor(Ui.Onboarding.ProfileName)
+    hideKeyboard()
+    escape()
+    poll(what = "the welcome screen") {
+      appPrefs.onboardingStage.get() == OnboardingStage.Step1_SimpleXInfo && exists(Ui.Onboarding.GetStarted) && !exists(Ui.Onboarding.ProfileName)
+    }
+    check(chatModel.currentUser.value == null && chatModel.users.isEmpty()) { "a profile was created" }
+  }
+
+  @Test fun back_onboardingYourNetwork_finishesActivity() = uiTest {
+    app(null)
+    click(Ui.Onboarding.GetStarted)
+    typeInto(Ui.Onboarding.ProfileName, "alice")
+    hideKeyboard()
+    poll(what = "Create profile to be enabled") { isEnabled(Ui.Onboarding.CreateProfile) }
+    click(Ui.Onboarding.CreateProfile)
+    poll(timeoutMs = 30_000, what = "the Your network step") { appPrefs.onboardingStage.get() == OnboardingStage.Step3_ChooseServerOperators && seesText("Your network") }
+    backFromRoot()
+    check(appPrefs.onboardingStage.get() == OnboardingStage.Step3_ChooseServerOperators) { "Back changed the onboarding stage" }
+    relaunch {
+      poll(what = "Your network again") { seesText("Your network") }
+      check(appPrefs.onboardingStage.get() == OnboardingStage.Step3_ChooseServerOperators) { "relaunch changed the onboarding stage" }
+    }
+  }
+
+  @Test fun back_closesWhatsNew() = uiTest {
+    val alice = app("alice")
+    whatsNewFromSettings(alice)
+    poll(what = "What's new over Help & support") { ModalManager.start.openModalCount() == 3 && !exists(Ui.Help.WhatsNew) }
+    escape()
+    poll(what = "Help & support again") { ModalManager.start.openModalCount() == 2 && exists(Ui.Help.WhatsNew) }
+  }
+}
diff --git a/apps/multiplatform/android/src/androidTest/java/chat/simplex/app/ui/harness/CliPeer.kt b/apps/multiplatform/android/src/androidTest/java/chat/simplex/app/ui/harness/CliPeer.kt
new file mode 100644
index 0000000000..af64bd3671
--- /dev/null
+++ b/apps/multiplatform/android/src/androidTest/java/chat/simplex/app/ui/harness/CliPeer.kt
@@ -0,0 +1,54 @@
+package chat.simplex.app.ui.harness
+
+import java.io.BufferedReader
+import java.io.BufferedWriter
+import java.net.Socket
+
+object Bridge {
+  private const val PORT = 7777
+  private const val READ_TIMEOUT_MS = 60_000
+  private var socket: Socket? = null
+  private lateinit var input: BufferedReader
+  private lateinit var output: BufferedWriter
+
+  @Synchronized fun call(cmd: String): List<String> =
+    try {
+      exchange(cmd)
+    } catch (e: java.io.IOException) {
+      runCatching { socket?.close() }
+      socket = null
+      throw e
+    }
+
+  private fun exchange(cmd: String): List<String> {
+    if (socket == null) {
+      val s = Socket("127.0.0.1", PORT).apply { soTimeout = READ_TIMEOUT_MS }
+      socket = s
+      input = s.getInputStream().bufferedReader(Charsets.UTF_8)
+      output = s.getOutputStream().bufferedWriter(Charsets.UTF_8)
+    }
+    output.write(cmd); output.write("\n"); output.flush()
+    val head = input.readLine() ?: throw java.io.EOFException("bridge closed the connection (command: $cmd)")
+    if (head.startsWith("err ")) throw AssertionError("bridge: ${head.removePrefix("err ")} (command: $cmd)")
+    if (head.startsWith("lines ")) return List(head.removePrefix("lines ").toInt()) { input.readLine() }
+    return listOf(head)
+  }
+
+  fun servers(): Pair<String, String> = call("servers").first().split(" ").let { it[1] to it[2] }
+}
+
+class CliPeer(name: String, private val flags: PeerFlags, waiter: Waiter) : PeerLines(name, waiter) {
+  fun start() {
+    val f = listOfNotNull("reactions".takeIf { flags.reactions }, "markRead".takeIf { flags.markRead }, "fullLinks".takeIf { flags.fullLinks })
+    Bridge.call("start $name ${f.joinToString(",")}")
+  }
+
+  fun stop() { runCatching { Bridge.call("stop $name") } }
+
+  override fun fill() {
+    val ls = Bridge.call("drain $name")
+    synchronized(lines) { lines.addAll(ls) }
+  }
+
+  override fun type(text: String) { Bridge.call("type $name $text") }
+}
diff --git a/apps/multiplatform/android/src/androidTest/java/chat/simplex/app/ui/harness/PrefStores.kt b/apps/multiplatform/android/src/androidTest/java/chat/simplex/app/ui/harness/PrefStores.kt
new file mode 100644
index 0000000000..f08b61cbf0
--- /dev/null
+++ b/apps/multiplatform/android/src/androidTest/java/chat/simplex/app/ui/harness/PrefStores.kt
@@ -0,0 +1,47 @@
+package chat.simplex.app.ui.harness
+
+import android.content.Context
+import android.content.SharedPreferences
+import chat.simplex.common.model.AppPreferences
+import chat.simplex.common.platform.androidAppContext
+import chat.simplex.common.platform.getPreferenceFilePath
+import java.io.File
+
+object PrefStores {
+  private val stores = listOf(AppPreferences.SHARED_PREFS_ID, "chat.simplex.app.THEMES")
+  private val themesYaml get() = File(getPreferenceFilePath("themes.yaml"))
+  private var captured: Map<String, Map<String, *>> = emptyMap()
+  private var yamlCapture: ByteArray? = null
+
+  fun capture() {
+    captured = stores.associateWith { prefs(it).all.toMap() }
+    yamlCapture = themesYaml.takeIf { it.exists() }?.readBytes()
+  }
+
+  fun restore() {
+    for ((name, values) in captured) {
+      val e = prefs(name).edit().clear()
+      values.forEach { (k, v) -> e.put(k, v) }
+      check(e.commit()) { "could not restore preferences $name" }
+    }
+    val yaml = yamlCapture
+    if (yaml == null) themesYaml.delete() else themesYaml.apply { parentFile?.mkdirs() }.writeBytes(yaml)
+    UiTestApp.onMain { CommonPrefs.reload() }
+  }
+
+  private fun prefs(name: String): SharedPreferences = androidAppContext.getSharedPreferences(name, Context.MODE_PRIVATE)
+
+  @Suppress("UNCHECKED_CAST")
+  private fun SharedPreferences.Editor.put(k: String, v: Any?) {
+    when (v) {
+      null -> remove(k)
+      is String -> putString(k, v)
+      is Int -> putInt(k, v)
+      is Long -> putLong(k, v)
+      is Float -> putFloat(k, v)
+      is Boolean -> putBoolean(k, v)
+      is Set<*> -> putStringSet(k, v as Set<String>)
+      else -> error("unsupported preference type ${v.javaClass} for $k")
+    }
+  }
+}
diff --git a/apps/multiplatform/android/src/androidTest/java/chat/simplex/app/ui/harness/UiTest.kt b/apps/multiplatform/android/src/androidTest/java/chat/simplex/app/ui/harness/UiTest.kt
new file mode 100644
index 0000000000..1dfa769a2c
--- /dev/null
+++ b/apps/multiplatform/android/src/androidTest/java/chat/simplex/app/ui/harness/UiTest.kt
@@ -0,0 +1,354 @@
+package chat.simplex.app.ui.harness
+
+import android.widget.EditText
+import androidx.compose.ui.semantics.SemanticsActions
+import androidx.compose.ui.semantics.SemanticsProperties
+import androidx.compose.ui.test.*
+import androidx.compose.ui.test.junit4.ComposeTestRule
+import androidx.compose.ui.test.junit4.createEmptyComposeRule
+import androidx.test.core.app.ActivityScenario
+import androidx.test.espresso.Espresso
+import androidx.test.espresso.action.ViewActions
+import androidx.test.espresso.matcher.ViewMatchers
+import chat.simplex.app.MainActivity
+import chat.simplex.common.model.AppPreferences
+import chat.simplex.common.platform.androidAppContext
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.UiKey
+import chat.simplex.common.ui.UiIdle
+import android.content.Context
+import org.junit.Rule
+import android.app.Activity
+import android.app.Instrumentation
+import android.content.Intent
+import androidx.test.espresso.intent.Intents
+import androidx.test.espresso.intent.matcher.IntentMatchers
+
+abstract class UiTest {
+  @get:Rule val rule: ComposeTestRule = createEmptyComposeRule()
+
+  fun uiTest(body: UiScope.() -> Unit) {
+    val watchdog = Watchdog.start(HARD_TIMEOUT_MS)
+    try {
+      UiTestApp.bootOnce()
+      val scope = UiScope(rule)
+      try {
+        scope.body()
+      } finally {
+        scope.finish()
+      }
+    } finally {
+      watchdog.cancel()
+    }
+  }
+
+  private companion object {
+    const val HARD_TIMEOUT_MS = 300_000L
+  }
+}
+
+class Watchdog private constructor(private val thread: Thread) {
+  fun cancel() = thread.interrupt()
+
+  companion object {
+    fun start(timeoutMs: Long): Watchdog = Watchdog(Thread {
+      try {
+        Thread.sleep(timeoutMs)
+      } catch (e: InterruptedException) {
+        return@Thread
+      }
+      val dump = Thread.getAllStackTraces().entries.joinToString("\n\n") { (t, st) -> "\"${t.name}\" ${t.state}\n" + st.joinToString("\n") { "  at $it" } }
+      dump.lines().forEach { android.util.Log.e("UITEST", it) }
+      android.util.Log.e("UITEST", "hard timeout after $timeoutMs ms; killing the process so the runner can resume")
+      android.os.Process.killProcess(android.os.Process.myPid())
+    }.apply { isDaemon = true; name = "uitest-watchdog"; start() })
+  }
+}
+
+class UiScope(val rule: ComposeTestRule) {
+  private var scenario: ActivityScenario<MainActivity>? = null
+  private val peers = mutableListOf<CliPeer>()
+  private var intentsActive = false
+
+  fun app(user: String?): App {
+    Timing.phase("reset") { UiTestApp.resetForTest(user) }
+    Timing.phase("launch") { launch() }
+    return App(this)
+  }
+
+  fun restart(): App {
+    UiTestApp.restartCore()
+    poll(timeoutMs = 60_000, what = "the core to start again with chat running") {
+      val m = chat.simplex.common.platform.chatModel
+      m.chatDbStatus.value != null && !m.ctrlInitInProgress.value && m.chatRunning.value == true && m.currentUser.value != null && m.users.isNotEmpty()
+    }
+    Timing.phase("close") { close() }
+    Timing.phase("launch") { launch() }
+    return App(this)
+  }
+
+  fun assumeCamera() {
+    val cameras = androidx.test.platform.app.InstrumentationRegistry.getInstrumentation().targetContext
+      .getSystemService(android.hardware.camera2.CameraManager::class.java).cameraIdList
+    org.junit.Assume.assumeTrue("the device has no camera for the QR scanner", cameras.isNotEmpty())
+  }
+
+  fun finish() {
+    peers.forEach { it.stop() }
+    Timing.phase("close") { close() }
+    Timing.phase("drain") { UiTestApp.drain() }
+  }
+
+  private fun launch() {
+    Intents.init()
+    intentsActive = true
+    Intents.intending(org.hamcrest.CoreMatchers.not(IntentMatchers.isInternal())).respondWith(Instrumentation.ActivityResult(Activity.RESULT_CANCELED, null))
+    scenario = ActivityScenario.launch(MainActivity::class.java)
+    rule.waitForIdle()
+  }
+
+  private fun close() {
+    if (intentsActive) Intents.release()
+    intentsActive = false
+    scenario?.close()
+    scenario = null
+  }
+
+  fun cli(name: String, flags: PeerFlags = PeerFlags()): CliPeer =
+    CliPeer(name, flags) { t, what, cond -> poll(t, what, cond = cond) }.also { peers += it; Timing.phase("peer $name") { it.start() } }
+
+  fun poll(timeoutMs: Long = 10_000, what: String, screenshot: Boolean = true, cond: () -> Boolean) {
+    val start = System.currentTimeMillis()
+    val deadline = start + timeoutMs
+    var busyAtDeadline: Set<Long>? = null
+    var lastError: Throwable? = null
+    while (true) {
+      rule.mainClock.advanceTimeBy(48, ignoreFrameDuration = true)
+      rule.waitForIdle()
+      if (runCatching(cond).onFailure { lastError = it }.getOrDefault(false)) {
+        Timing.wait(what, System.currentTimeMillis() - start)
+        return
+      }
+      val now = System.currentTimeMillis()
+      val busy = if (now > deadline) busyAtDeadline ?: UiIdle.inFlight().map { it.id }.toSet().also { busyAtDeadline = it } else emptySet()
+      if (now > deadline && (UiIdle.inFlight().none { it.id in busy } || now > deadline + EXTENSION_MS)) {
+        val shot = if (screenshot) FailureShots.take(what) else null
+        throw AssertionError("timed out after $timeoutMs ms waiting for $what; ${lastError?.let { "last condition error: $it; " } ?: ""}in flight: ${UiIdle.inFlight().joinToString { it.what }}; screenshot: $shot; visible texts: ${texts().take(60)}")
+      }
+      Thread.sleep(50)
+    }
+  }
+
+  fun matcher(key: UiKey): SemanticsMatcher =
+    if (key.id == DESCRIBED) hasContentDescription(key.arg as String) and hasClickAction() else hasTestTag(key.tag)
+  fun exists(key: UiKey): Boolean = rule.onAllNodes(matcher(key)).fetchSemanticsNodes().isNotEmpty()
+  fun waitFor(key: UiKey, timeoutMs: Long = 10_000) = poll(timeoutMs, "node ${key.tag}") { exists(key) }
+
+  private fun waitPopupsClosedUnlessInside(key: UiKey) {
+    if (rule.onAllNodes(matcher(key) and hasAnyAncestor(isPopup())).fetchSemanticsNodes().isNotEmpty()) return
+    poll(what = "open popups to close before acting on ${key.tag}") { rule.onAllNodes(isPopup()).fetchSemanticsNodes().isEmpty() }
+  }
+
+  fun settle() {
+    rule.mainClock.advanceTimeBy(SETTLE_MS, ignoreFrameDuration = true)
+    rule.waitForIdle()
+  }
+
+
+  fun scrollTo(key: UiKey) {
+    poll(what = "a list to scroll to ${key.tag}") {
+      exists(key) || rule.onAllNodes(SemanticsMatcher.keyIsDefined(SemanticsActions.ScrollToIndex)).let { lists ->
+        lists.fetchSemanticsNodes().indices.any { i -> runCatching { lists[i].performScrollToNode(matcher(key)) }.isSuccess && exists(key) }
+      }
+    }
+  }
+
+  fun waitStable(key: UiKey) {
+    var last: androidx.compose.ui.geometry.Rect? = null
+    try {
+      poll(what = "node ${key.tag} to stop moving") {
+        val b = rule.onAllNodes(matcher(key)).fetchSemanticsNodes().firstOrNull()?.boundsInRoot
+        (b != null && !b.isEmpty && b == last).also { last = b }
+      }
+    } catch (e: AssertionError) {
+      throw AssertionError("${e.message}; last bounds $last", e)
+    }
+  }
+
+  fun click(key: UiKey) {
+    waitFor(key)
+    runCatching { rule.onNode(matcher(key)).performScrollTo() }
+    centerInScrollParent(key)
+    waitStable(key)
+    poll(what = "node ${key.tag} to be enabled") { isEnabled(key) }
+    waitPopupsClosedUnlessInside(key)
+    val node = rule.onNode(matcher(key), useUnmergedTree = key.id != DESCRIBED).fetchSemanticsNode()
+    val point = tapPointInNode(node)
+    rule.onNode(matcher(key)).performTouchInput { click(point) }
+    rule.waitForIdle()
+  }
+
+  private fun centerInScrollParent(key: UiKey) {
+    val node = rule.onAllNodes(matcher(key)).fetchSemanticsNodes().firstOrNull() ?: return
+    var parent = node.parent
+    while (parent != null && !parent.config.contains(SemanticsActions.ScrollBy)) parent = parent.parent
+    val scroller = parent ?: return
+    val dy = node.boundsInRoot.center.y - scroller.boundsInRoot.center.y
+    if (kotlin.math.abs(dy) < 1f) return
+    rule.runOnUiThread { scroller.config[SemanticsActions.ScrollBy].action?.invoke(0f, dy) }
+    rule.waitForIdle()
+  }
+
+  fun rightClick(key: UiKey) {
+    waitFor(key)
+    waitStable(key)
+    waitPopupsClosedUnlessInside(key)
+    rule.onNode(matcher(key)).performTouchInput { longClick() }
+    rule.waitForIdle()
+  }
+
+  fun escape() {
+    Espresso.pressBack()
+    rule.waitForIdle()
+  }
+
+  private fun isMessageField(key: UiKey) = key.tag == Ui.Chat.Message.tag
+
+  private fun setMessageField(key: UiKey, value: String) {
+    waitFor(key)
+    val deadline = System.currentTimeMillis() + 10_000
+    while (true) {
+      Espresso.onView(ViewMatchers.isAssignableFrom(EditText::class.java)).perform(ViewActions.replaceText(value))
+      try {
+        poll(timeoutMs = 2_000, what = "message field to hold `$value`", screenshot = false) { editableText(key) == value }
+        return
+      } catch (e: AssertionError) {
+        if (System.currentTimeMillis() > deadline) throw AssertionError("${e.message}; field holds `${editableText(key)}`", e)
+      }
+    }
+  }
+
+  fun enterText(key: UiKey, text: String) {
+    waitFor(key)
+    rule.onNode(matcher(key)).performTextInput(text)
+    rule.waitForIdle()
+  }
+
+  fun typeInto(key: UiKey, text: String) {
+    if (isMessageField(key)) {
+      waitFor(key)
+      setMessageField(key, editableText(key).orEmpty() + text)
+      return
+    }
+    waitFor(key)
+    val before = editableText(key).orEmpty()
+    rule.onNode(matcher(key)).performTextInput(text)
+    poll(what = "field ${key.tag} to hold `$text`") { editableText(key) == before + text }
+  }
+
+  fun replaceText(key: UiKey, text: String) {
+    if (isMessageField(key)) {
+      setMessageField(key, text)
+      return
+    }
+    waitFor(key)
+    rule.onNode(matcher(key)).performTextReplacement(text)
+    poll(what = "field ${key.tag} to hold `$text`") { editableText(key) == text }
+  }
+
+  fun pressEnter(key: UiKey) {
+    if (isMessageField(key)) click(Ui.Chat.Send) else rule.onNode(matcher(key)).performImeAction()
+    rule.waitForIdle()
+  }
+
+  fun isEnabled(key: UiKey): Boolean =
+    rule.onAllNodes(matcher(key)).fetchSemanticsNodes().firstOrNull()?.let { !it.config.contains(SemanticsProperties.Disabled) } ?: false
+
+  fun editableText(key: UiKey): String? {
+    if (isMessageField(key)) {
+      var t: String? = null
+      Espresso.onView(ViewMatchers.isAssignableFrom(EditText::class.java)).check { v, _ -> t = (v as? EditText)?.text?.toString() }
+      return t
+    }
+    return rule.onAllNodes((matcher(key) or hasAnyAncestor(matcher(key))) and SemanticsMatcher.keyIsDefined(SemanticsProperties.EditableText), useUnmergedTree = true)
+      .fetchSemanticsNodes().firstOrNull()?.config?.get(SemanticsProperties.EditableText)?.text
+  }
+
+  fun textsOf(key: UiKey): List<String> {
+    waitFor(key)
+    val own = rule.onNode(matcher(key)).fetchSemanticsNode().config.getOrElseNullable(SemanticsProperties.Text) { null }.orEmpty().map { it.text }
+    val inner = rule.onAllNodes(hasAnyAncestor(matcher(key)) and SemanticsMatcher.keyIsDefined(SemanticsProperties.Text), useUnmergedTree = true)
+      .fetchSemanticsNodes().flatMap { it.config[SemanticsProperties.Text].map { t -> t.text } }
+    return own + inner
+  }
+
+  fun textOf(key: UiKey): String? = textsOf(key).firstOrNull()
+
+  fun descriptionsOf(key: UiKey): List<String> {
+    waitFor(key)
+    return rule.onAllNodes((matcher(key) or hasAnyAncestor(matcher(key))) and SemanticsMatcher.keyIsDefined(SemanticsProperties.ContentDescription), useUnmergedTree = true)
+      .fetchSemanticsNodes().flatMap { it.config[SemanticsProperties.ContentDescription] }
+  }
+
+  fun texts(): List<String> =
+    rule.onAllNodes(hasText("", substring = true), useUnmergedTree = true).fetchSemanticsNodes()
+      .flatMap { it.config.getOrElseNullable(SemanticsProperties.Text) { null }.orEmpty() }.map { it.text }
+
+  fun seesDescription(text: String, substring: Boolean = false) =
+    rule.onAllNodes(hasContentDescription(text, substring = substring), useUnmergedTree = true).fetchSemanticsNodes().isNotEmpty()
+
+  fun seesText(text: String, substring: Boolean = false) =
+    rule.onAllNodes(hasText(text, substring = substring), useUnmergedTree = true).fetchSemanticsNodes().isNotEmpty()
+
+  fun storedSetting(key: String): String? =
+    androidAppContext.getSharedPreferences(AppPreferences.SHARED_PREFS_ID, Context.MODE_PRIVATE).all[key]?.toString()
+
+  fun sliderValue(key: UiKey): Float {
+    waitFor(key)
+    return rule.onNode(matcher(key)).fetchSemanticsNode().config[SemanticsProperties.ProgressBarRangeInfo].current
+  }
+
+  fun setSlider(key: UiKey, value: Float) {
+    waitFor(key)
+    runCatching { rule.onNode(matcher(key)).performScrollTo() }
+    centerInScrollParent(key)
+    waitStable(key)
+    rule.onNode(matcher(key)).performSemanticsAction(SemanticsActions.SetProgress) { it(value) }
+    rule.waitForIdle()
+  }
+
+  fun clipboardText(): String? =
+    Intents.getIntents().asReversed().firstNotNullOfOrNull { i ->
+      val inner = if (i.action == Intent.ACTION_CHOOSER) i.getParcelableExtra(Intent.EXTRA_INTENT) as? Intent else i
+      inner?.getStringExtra(Intent.EXTRA_TEXT)
+    } ?: (androidAppContext.getSystemService(Context.CLIPBOARD_SERVICE) as android.content.ClipboardManager).primaryClip?.getItemAt(0)?.text?.toString()
+}
+
+object FailureShots {
+  private var n = 0
+
+  fun take(what: String): String? = runCatching {
+    val inst = androidx.test.platform.app.InstrumentationRegistry.getInstrumentation()
+    val dir = java.io.File(androidAppContext.getExternalFilesDir(null) ?: error("no external files dir"), "failures").apply { mkdirs() }
+    val name = "%02d-%s.png".format(++n, what.replace(Regex("[^A-Za-z0-9]+"), "_").take(60))
+    val bmp = inst.uiAutomation.takeScreenshot() ?: error("UiAutomation.takeScreenshot returned null")
+    java.io.File(dir, name).outputStream().use { bmp.compress(android.graphics.Bitmap.CompressFormat.PNG, 100, it) }
+    name
+  }.onFailure { android.util.Log.e("UITEST", "failure screenshot: $it") }.getOrNull()
+}
+
+object Timing {
+  private const val TAG = "UITEST"
+
+  fun <T> phase(name: String, body: () -> T): T {
+    val start = System.currentTimeMillis()
+    return body().also { android.util.Log.i(TAG, "phase ${System.currentTimeMillis() - start} ms: $name") }
+  }
+
+  fun wait(what: String, ms: Long) {
+    if (ms >= 500) android.util.Log.i(TAG, "wait $ms ms: $what")
+  }
+}
+
+private const val SETTLE_MS = 500L
+private const val EXTENSION_MS = 60_000L
diff --git a/apps/multiplatform/android/src/androidTest/java/chat/simplex/app/ui/harness/UiTestApp.kt b/apps/multiplatform/android/src/androidTest/java/chat/simplex/app/ui/harness/UiTestApp.kt
new file mode 100644
index 0000000000..c93b489d45
--- /dev/null
+++ b/apps/multiplatform/android/src/androidTest/java/chat/simplex/app/ui/harness/UiTestApp.kt
@@ -0,0 +1,153 @@
+package chat.simplex.app.ui.harness
+
+import chat.simplex.common.model.ChatController.appPrefs
+import chat.simplex.common.views.helpers.DBMigrationResult
+import chat.simplex.common.model.ChatError
+import chat.simplex.common.model.Profile
+import chat.simplex.common.platform.chatCloseStore
+import chat.simplex.common.platform.chatController
+import chat.simplex.common.platform.chatModel
+import chat.simplex.common.platform.initChatController
+import chat.simplex.common.platform.initChatControllerOnStart
+import chat.simplex.common.views.database.deleteChatDatabaseFilesAndState
+import chat.simplex.common.views.onboarding.OnboardingStage
+import chat.simplex.common.views.onboarding.setLastVersionDefault
+import chat.simplex.common.platform.agentDatabaseFileName
+import chat.simplex.common.platform.chatDatabaseFileName
+import chat.simplex.common.platform.dataDir
+import chat.simplex.common.views.helpers.DatabaseUtils
+import java.io.File
+import kotlinx.coroutines.runBlocking
+
+object UiTestApp {
+  private var booted = false
+
+  fun bootOnce() {
+    if (booted) return
+    booted = true
+    waitUntil(STARTUP_MS, "the app's own startup init") { chatModel.chatDbStatus.value != null && !chatModel.ctrlInitInProgress.value }
+    check(chatModel.chatDbStatus.value == DBMigrationResult.OK) { "startup database: ${chatModel.chatDbStatus.value}" }
+    Timing.phase("boot.saveTemplate") {
+      if (runBlocking { chatController.listUsers(null) }.isNotEmpty()) {
+        stopCore()
+        deleteChatDatabaseFilesAndState()
+        runBlocking { initChatController() }
+        check(chatModel.chatDbStatus.value == DBMigrationResult.OK) { "fresh database: ${chatModel.chatDbStatus.value}" }
+      }
+      val key = DatabaseUtils.ksDatabasePassword.get() ?: ""
+      val decryptError = if (key.isEmpty()) null else runBlocking {
+        chatController.apiStopChat()
+        chatController.apiStorageEncryption(currentKey = key, newKey = "")
+      }
+      if (decryptError != null) android.util.Log.e("UITEST", "template stays encrypted, removing encryption failed: ${chat.simplex.common.model.json.encodeToString(ChatError.serializer(), decryptError)}")
+      stopCore()
+      if (decryptError == null) DatabaseUtils.ksDatabasePassword.remove()
+      DbTemplate.save()
+    }
+    presetAndroidPrefs()
+    PrefStores.capture()
+    ModelSnapshot.capture()
+  }
+
+  fun drain() {
+    val deadline = System.currentTimeMillis() + DRAIN_MS
+    while (chat.simplex.common.ui.UiIdle.inFlight().isNotEmpty() && System.currentTimeMillis() < deadline) Thread.sleep(20)
+    val stuck = chat.simplex.common.ui.UiIdle.inFlight()
+    if (stuck.isNotEmpty()) {
+      android.util.Log.w("UITEST", "drain gave up after ${DRAIN_MS / 1000} s; abandoned: ${stuck.joinToString { it.what }}")
+      chat.simplex.common.ui.UiIdle.abandon(stuck)
+    }
+  }
+
+  fun onMain(action: () -> Unit) = androidx.test.platform.app.InstrumentationRegistry.getInstrumentation().runOnMainSync(action)
+
+  private fun presetAndroidPrefs() {
+    appPrefs.appearanceBarsBlurRadius.set(0)
+    appPrefs.notificationsMode.set(chat.simplex.common.model.NotificationsMode.OFF)
+    appPrefs.backgroundServiceNoticeShown.set(true)
+    appPrefs.backgroundServiceBatteryNoticeShown.set(true)
+    appPrefs.canAskToEnableNotifications.set(false)
+    appPrefs.privacyProtectScreen.set(false)
+  }
+
+  fun resetForTest(user: String?) {
+    Timing.phase("reset.stop running=${chatModel.chatRunning.value}") { stopCore() }
+    Timing.phase("reset.delete") { deleteChatDatabaseFilesAndState() }
+    Timing.phase("reset.prefs") { PrefStores.restore() }
+    Timing.phase("reset.ui") { CommonUiState.clear(::onMain) }
+    if (user != null) TestPrefs.preset()
+    DbTemplate.install()
+    Timing.phase("reset.init") { runBlocking { initChatController() } }
+    check(chatModel.chatDbStatus.value == DBMigrationResult.OK) { "database: ${chatModel.chatDbStatus.value}" }
+    if (user == null) return
+    val u = Timing.phase("reset.createUser") { runBlocking { chatController.apiCreateActiveUser(null, Profile(user, "", null)) } } ?: error("apiCreateActiveUser($user) failed")
+    chatModel.currentUser.value = u
+    chatModel.localUserCreated.value = true
+    appPrefs.onboardingStage.set(OnboardingStage.OnboardingComplete)
+    Timing.phase("reset.startChat") { runBlocking { chatController.startChat(u) } }
+    val (smp, xftp) = Bridge.servers()
+    Timing.phase("reset.servers") { configureServers(smp, xftp) }
+    setLastVersionDefault(chatModel)
+    CommonUiState.clearTransient(::onMain)
+  }
+
+  fun restartCore() {
+    runBlocking {
+      val ctrl = chatController.getChatCtrl()
+      if (ctrl != null && ctrl != -1L && chatModel.chatRunning.value != false) chatController.apiStopChat()
+    }
+    chatModel.chatRunning.value = null
+    val ctrl = chatController.getChatCtrl()
+    if (ctrl != null && ctrl != -1L) chatCloseStore(ctrl).let { check(it.isEmpty()) { "chatCloseStore failed: $it" } }
+    chatController.setChatCtrl(null)
+    CommonUiState.clear(::onMain)
+    initChatControllerOnStart()
+  }
+
+  private fun stopCore() {
+    waitUntil(10_000, "ctrlInitInProgress to clear") { !chatModel.ctrlInitInProgress.value }
+    runBlocking {
+      val ctrl = chatController.getChatCtrl()
+      if (ctrl != null && ctrl != -1L && chatModel.chatRunning.value == true) chatController.apiStopChat()
+    }
+    chatModel.chatRunning.value = null
+    val ctrl = chatController.getChatCtrl()
+    if (ctrl != null && ctrl != -1L) chatCloseStore(ctrl).let { check(it.isEmpty()) { "chatCloseStore failed: $it" } }
+    chatController.setChatCtrl(null)
+  }
+
+  private fun waitUntil(timeoutMs: Long, what: String, cond: () -> Boolean) {
+    val deadline = System.currentTimeMillis() + timeoutMs
+    while (!cond()) {
+      if (System.currentTimeMillis() > deadline) throw AssertionError("timed out after $timeoutMs ms waiting for $what")
+      Thread.sleep(50)
+    }
+  }
+
+  private const val STARTUP_MS = 180_000L
+  private const val DRAIN_MS = 30_000L
+}
+
+object DbTemplate {
+  private val dir get() = File(dataDir, "uitest-db-template")
+  private val keyFile get() = File(dir, "key")
+
+  fun install() {
+    check(keyFile.isFile) { "no database template; bootOnce saves it" }
+    dbFiles(dir).forEach { it.copyTo(File(dataDir, it.name), overwrite = true) }
+    val key = keyFile.readText()
+    if (key.isEmpty()) DatabaseUtils.ksDatabasePassword.remove() else DatabaseUtils.ksDatabasePassword.set(key)
+    appPrefs.storeDBPassphrase.set(true)
+    appPrefs.initialRandomDBPassphrase.set(true)
+  }
+
+  fun save() {
+    dir.deleteRecursively()
+    dir.mkdirs()
+    dbFiles(dataDir).forEach { it.copyTo(File(dir, it.name)) }
+    keyFile.writeText(DatabaseUtils.ksDatabasePassword.get() ?: "")
+  }
+
+  private fun dbFiles(from: File): List<File> =
+    from.listFiles { f -> f.isFile && (f.name.startsWith(chatDatabaseFileName) || f.name.startsWith(agentDatabaseFileName)) }.orEmpty().toList()
+}
diff --git a/apps/multiplatform/android/src/main/java/chat/simplex/app/SimplexApp.kt b/apps/multiplatform/android/src/main/java/chat/simplex/app/SimplexApp.kt
index 1a4c836b2e..40b8d56f8b 100644
--- a/apps/multiplatform/android/src/main/java/chat/simplex/app/SimplexApp.kt
+++ b/apps/multiplatform/android/src/main/java/chat/simplex/app/SimplexApp.kt
@@ -3,6 +3,7 @@ package chat.simplex.app
 import android.annotation.SuppressLint
 import android.app.*
 import android.content.Context
+import chat.simplex.common.ui.initUiTags
 import chat.simplex.common.platform.Log
 import android.content.Intent
 import android.content.pm.ActivityInfo
@@ -189,6 +190,7 @@ class SimplexApp: Application(), LifecycleEventObserver {
 
   private fun initMultiplatform() {
     androidAppContext = this
+    initUiTags(this)
     APPLICATION_ID = BuildConfig.APPLICATION_ID
     ntfManager = object : chat.simplex.common.platform.NtfManager() {
       override fun notifyCallInvitation(invitation: RcvCallInvitation): Boolean = NtfManager.notifyCallInvitation(invitation)
diff --git a/apps/multiplatform/common/build.gradle.kts b/apps/multiplatform/common/build.gradle.kts
index e9503bc6ce..13d9fb3b39 100644
--- a/apps/multiplatform/common/build.gradle.kts
+++ b/apps/multiplatform/common/build.gradle.kts
@@ -1,3 +1,4 @@
+import java.time.Duration
 plugins {
   kotlin("multiplatform")
   id("org.jetbrains.compose")
@@ -146,7 +147,17 @@ kotlin {
         implementation("com.squareup.okhttp3:okhttp:4.12.0")
       }
     }
-    val desktopTest by getting
+    val desktopTest by getting {
+      kotlin.srcDir("src/uiTestShared/kotlin")
+      languageSettings.optIn("androidx.compose.ui.test.ExperimentalTestApi")
+      languageSettings.optIn("androidx.compose.ui.test.InternalTestApi")
+      languageSettings.optIn("androidx.compose.ui.InternalComposeUiApi")
+      dependencies {
+        implementation(compose.desktop.uiTestJUnit4)
+        implementation(compose.desktop.currentOs)
+        implementation("org.jetbrains.pty4j:pty4j:0.13.13")
+      }
+    }
   }
 }
 
@@ -347,3 +358,54 @@ afterEvaluate {
     }
   }
 }
+
+tasks.named<Test>("desktopTest") { exclude("chat/simplex/app/ui/**") }
+
+tasks.register<org.jetbrains.kotlin.gradle.targets.jvm.tasks.KotlinJvmTest>("desktopUiTest") {
+  targetName = "desktop"
+  onlyIf { System.getenv("SIMPLEX_UITEST_RUNNER") == "1" }
+  val dt = tasks.named<Test>("desktopTest").get()
+  testClassesDirs = dt.testClassesDirs; classpath = dt.classpath
+  include("chat/simplex/app/ui/**")
+  forkEvery = (findProperty("uiForkEvery") as String?)?.toLong() ?: 0
+  maxParallelForks = (findProperty("uiForks") as String?)?.toInt() ?: 1
+  maxHeapSize = "2g"
+  timeout.set(Duration.ofHours(12))
+  filter { isFailOnNoMatchingTests = findProperty("uiAllowEmpty") == null }
+  val runDir = findProperty("uiRunDir") as String?
+  environment.remove("XDG_DATA_HOME"); environment.remove("XDG_CONFIG_HOME")
+  environment("GSETTINGS_BACKEND", "memory")
+  if (runDir != null) environment("XDG_CACHE_HOME", "$runDir/cache")
+  environment.remove("FREETYPE_PROPERTIES")
+  jvmArgs("-Duser.language=en", "-Duser.country=US", "-Duser.timezone=UTC")
+  if (runDir != null) jvmArgs("-Djava.io.tmpdir=$runDir/jvmtmp", "-XX:+HeapDumpOnOutOfMemoryError", "-XX:HeapDumpPath=$runDir", "-XX:ErrorFile=$runDir/hs_err_pid%p.log")
+  systemProperty("java.awt.headless", "true")
+  systemProperty("skiko.data.path", rootProject.file("build/uitest/skiko").absolutePath)
+  systemProperty("simplex.uitest.env", rootProject.file("build/uitest/env.properties").absolutePath)
+  systemProperty("kotlinx.coroutines.io.parallelism", "256")
+  testLogging { events("passed", "failed", "skipped"); showStandardStreams = true; exceptionFormat = org.gradle.api.tasks.testing.logging.TestExceptionFormat.FULL }
+  outputs.upToDateWhen { false }
+  val pass = (findProperty("uiPass") as String?) ?: "1"
+  reports.junitXml.outputLocation.set(layout.buildDirectory.dir("test-results/desktopUiTest/pass$pass"))
+  reports.html.outputLocation.set(layout.buildDirectory.dir("reports/tests/desktopUiTest/pass$pass"))
+  binaryResultsDirectory.set(layout.buildDirectory.dir("test-results/desktopUiTest/pass$pass/binary"))
+}
+
+tasks.register("uitestPrepare") {
+  val runtime = configurations.getByName("desktopTestRuntimeClasspath")
+  doLast { runtime.resolve() }
+}
+
+tasks.register("uitestBridgeClasspath") {
+  val dt = tasks.named<Test>("desktopTest").get()
+  dependsOn("desktopTestClasses")
+  doLast {
+    val snapshot = rootProject.file("build/uitest/bridge-classes")
+    snapshot.deleteRecursively()
+    val testDirs = dt.testClassesDirs.files
+    testDirs.forEach { d -> project.copy { from(d); include("chat/simplex/app/ui/harness/**"); into(snapshot) } }
+    val cp = listOf(snapshot) + dt.classpath.files.filter { it !in testDirs }
+    rootProject.file("build/uitest/bridge.classpath").writeText(cp.joinToString(File.pathSeparator))
+  }
+}
+
diff --git a/apps/multiplatform/common/src/androidMain/kotlin/chat/simplex/common/platform/PlatformTextField.android.kt b/apps/multiplatform/common/src/androidMain/kotlin/chat/simplex/common/platform/PlatformTextField.android.kt
index 71d7ff3cb4..96a6a1e14d 100644
--- a/apps/multiplatform/common/src/androidMain/kotlin/chat/simplex/common/platform/PlatformTextField.android.kt
+++ b/apps/multiplatform/common/src/androidMain/kotlin/chat/simplex/common/platform/PlatformTextField.android.kt
@@ -36,6 +36,8 @@ import chat.simplex.common.R
 import chat.simplex.common.helpers.toURI
 import chat.simplex.common.model.ChatController.appPrefs
 import chat.simplex.common.model.ChatModel
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.CurrentColors
 import chat.simplex.common.views.chat.*
 import chat.simplex.common.views.helpers.*
@@ -96,7 +98,7 @@ actual fun PlatformTextField(
   }
 
   val isRtl = LocalLayoutDirection.current == LayoutDirection.Rtl
-  AndroidView(modifier = Modifier, factory = { context ->
+  AndroidView(modifier = Modifier.ui(Ui.Chat.Message), factory = { context ->
     val editText = @SuppressLint("AppCompatCustomView") object: EditText(context) {
       override fun setOnReceiveContentListener(
         mimeTypes: Array<out String>?,
diff --git a/apps/multiplatform/common/src/androidMain/kotlin/chat/simplex/common/ui/UiTags.android.kt b/apps/multiplatform/common/src/androidMain/kotlin/chat/simplex/common/ui/UiTags.android.kt
new file mode 100644
index 0000000000..fc698b9869
--- /dev/null
+++ b/apps/multiplatform/common/src/androidMain/kotlin/chat/simplex/common/ui/UiTags.android.kt
@@ -0,0 +1,8 @@
+package chat.simplex.common.ui
+
+import android.content.Context
+import android.content.pm.ApplicationInfo
+
+fun initUiTags(context: Context) {
+  uiTestHooksEnabled = context.applicationInfo.flags and ApplicationInfo.FLAG_DEBUGGABLE != 0
+}
diff --git a/apps/multiplatform/common/src/androidMain/kotlin/chat/simplex/common/views/chatlist/ChatListNavLinkView.android.kt b/apps/multiplatform/common/src/androidMain/kotlin/chat/simplex/common/views/chatlist/ChatListNavLinkView.android.kt
index 9a3d9e5e4f..84249b3e7f 100644
--- a/apps/multiplatform/common/src/androidMain/kotlin/chat/simplex/common/views/chatlist/ChatListNavLinkView.android.kt
+++ b/apps/multiplatform/common/src/androidMain/kotlin/chat/simplex/common/views/chatlist/ChatListNavLinkView.android.kt
@@ -8,6 +8,8 @@ import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.unit.dp
 import chat.simplex.common.platform.onRightClick
+import chat.simplex.common.ui.UiKey
+import chat.simplex.common.ui.ui
 import chat.simplex.common.views.helpers.*
 
 @Composable
@@ -19,8 +21,9 @@ actual fun ChatListNavLinkLayout(
   disabled: Boolean,
   selectedChat: State<Boolean>,
   nextChatSelected: State<Boolean>,
+  uiKey: UiKey?,
 ) {
-  var modifier = Modifier.fillMaxWidth()
+  var modifier = Modifier.fillMaxWidth().ui(uiKey)
 
   if (!disabled) modifier = modifier
     .combinedClickable(onClick = click, onLongClick = { showMenu.value = true })
diff --git a/apps/multiplatform/common/src/androidMain/kotlin/chat/simplex/common/views/chatlist/UserPicker.android.kt b/apps/multiplatform/common/src/androidMain/kotlin/chat/simplex/common/views/chatlist/UserPicker.android.kt
index 9649e37c0f..702fef3e99 100644
--- a/apps/multiplatform/common/src/androidMain/kotlin/chat/simplex/common/views/chatlist/UserPicker.android.kt
+++ b/apps/multiplatform/common/src/androidMain/kotlin/chat/simplex/common/views/chatlist/UserPicker.android.kt
@@ -22,6 +22,8 @@ import androidx.compose.ui.unit.*
 import chat.simplex.common.model.User
 import chat.simplex.common.model.UserInfo
 import chat.simplex.common.platform.*
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.helpers.*
 import kotlinx.coroutines.CancellationException
@@ -78,6 +80,7 @@ fun UserPickerUserBox(
   Row(
     modifier = modifier
       .userPickerBoxModifier()
+      .ui(Ui.UserPicker.User(userInfo.user.userId))
       .clickable (
         onClick = { onClick(userInfo.user) },
         enabled = !stopped
@@ -144,6 +147,7 @@ actual fun PlatformUserPicker(modifier: Modifier, pickerState: MutableStateFlow<
     Box(
       Modifier
         .fillMaxSize()
+        .ui(if (pickerIsVisible) Ui.UserPicker.Sheet else null)
         .then(clickableModifier)
         .drawBehind {
           val pos = calculatePosition(dismissState)
diff --git a/apps/multiplatform/common/src/androidMain/kotlin/chat/simplex/common/views/onboarding/SimpleXInfo.android.kt b/apps/multiplatform/common/src/androidMain/kotlin/chat/simplex/common/views/onboarding/SimpleXInfo.android.kt
index 0e1cf9472a..eda66f24f7 100644
--- a/apps/multiplatform/common/src/androidMain/kotlin/chat/simplex/common/views/onboarding/SimpleXInfo.android.kt
+++ b/apps/multiplatform/common/src/androidMain/kotlin/chat/simplex/common/views/onboarding/SimpleXInfo.android.kt
@@ -5,12 +5,14 @@ import androidx.compose.runtime.Composable
 import androidx.compose.ui.Modifier
 import chat.simplex.common.model.SharedPreference
 import chat.simplex.common.model.User
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.ui
 import chat.simplex.res.*
 
 @Composable
 actual fun OnboardingActionButton(user: User?, onboardingStage: SharedPreference<OnboardingStage>, onclick: (() -> Unit)?) {
   if (user == null) {
-    OnboardingActionButton(Modifier.fillMaxWidth(), labelId = MR.strings.get_started, onboarding = OnboardingStage.Step2_CreateProfile, onclick = onclick)
+    OnboardingActionButton(Modifier.fillMaxWidth().ui(Ui.Onboarding.GetStarted), labelId = MR.strings.get_started, onboarding = OnboardingStage.Step2_CreateProfile, onclick = onclick)
   } else {
     OnboardingActionButton(Modifier.fillMaxWidth(), labelId = MR.strings.make_private_connection, onboarding = OnboardingStage.OnboardingComplete, onclick = onclick)
   }
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/model/ChatModel.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/model/ChatModel.kt
index 1afea4541b..ed007e11a7 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/model/ChatModel.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/model/ChatModel.kt
@@ -839,7 +839,7 @@ object ChatModel {
       private val chatsToPop = mutableMapOf<ChatId, Instant>()
 
       init {
-        withLongRunningApi {
+        withLongRunningApi(idle = false) {
           subject
             .throttleLatest(2000)
             .collect {
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/model/SimpleXAPI.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/model/SimpleXAPI.kt
index faf27d3ceb..90ed85b6fb 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/model/SimpleXAPI.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/model/SimpleXAPI.kt
@@ -3,6 +3,7 @@ package chat.simplex.common.model
 import SectionItemView
 import androidx.compose.foundation.layout.*
 import androidx.compose.material.*
+import chat.simplex.common.ui.UiIdle
 import chat.simplex.common.views.helpers.*
 import androidx.compose.runtime.*
 import androidx.compose.runtime.saveable.Saver
@@ -807,10 +808,10 @@ object ChatController {
           val msg = recvMsg(ctrl)
           releaseLock = getWakeLock(timeout = 60000)
           if (msg != null) {
-            val finishedWithoutTimeout = withTimeoutOrNull(60_000L) {
+            val finishedWithoutTimeout = UiIdle.trackEvent({ "event ${msg.responseType}" }) { withTimeoutOrNull(60_000L) {
               processReceivedMsg(msg)
               messagesChannel.trySend(msg)
-            }
+            } }
             if (finishedWithoutTimeout == null) {
               Log.e(TAG, "Timeout reached while processing received message: " + msg.responseType)
               if (appPreferences.developerTools.get() && appPreferences.showSlowApiCalls.get()) {
@@ -938,7 +939,7 @@ object ChatController {
   suspend fun sendCmd(rhId: Long?, cmd: CC, otherCtrl: ChatCtrl? = null, retryNum: Int = 0, log: Boolean = true): API {
     val ctrl = otherCtrl ?: chatCtrl ?: throw Exception("Controller is not initialized")
 
-    return withContext(Dispatchers.IO) {
+    return UiIdle.track(if (cmd is CC.GetAgentSubsTotal || cmd is CC.GetAgentServersSummary) null else { { "cmd ${cmd.cmdType}" } }) { withContext(Dispatchers.IO) {
       val c = cmd.cmdString
       if (log) {
         chatModel.addTerminalItem(TerminalItem.cmd(rhId, cmd.obfuscated))
@@ -956,7 +957,7 @@ object ChatController {
         chatModel.addTerminalItem(TerminalItem.resp(rhId, r))
       }
       r
-    }
+    } }
   }
 
   // Spec: spec/api.md#recvMsg
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/ui/Ui.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/ui/Ui.kt
new file mode 100644
index 0000000000..27eab85491
--- /dev/null
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/ui/Ui.kt
@@ -0,0 +1,176 @@
+package chat.simplex.common.ui
+
+import androidx.compose.runtime.Immutable
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.testTag
+
+@Immutable
+data class UiKey(val id: String, val arg: Any? = null) {
+  val tag: String get() = if (arg == null) id else "$id[$arg]"
+  fun option(value: Any) = UiKey("$id.option", value)
+  fun part(name: String) = UiKey("$id.$name", arg)
+}
+
+@PublishedApi
+@Volatile
+internal var uiTestHooksEnabled = false
+
+fun Modifier.ui(key: UiKey?): Modifier = if (key == null || !uiTestHooksEnabled) this else testTag(key.tag)
+
+object Ui {
+  object ChatList {
+    val NewChat = UiKey("chatList.newChat")
+    val NewChatFab = UiKey("chatList.newChatFab")
+    val UserPicker = UiKey("chatList.userPicker")
+    val Search = UiKey("chatList.search")
+    val Bar = UiKey("chatList.bar")
+    val Stopped = UiKey("chatList.stopped")
+    val Subscriptions = UiKey("chatList.subscriptions")
+    val UnreadFilter = UiKey("chatList.unreadFilter")
+    val NoUnreadChats = UiKey("chatList.noUnreadChats")
+    val ConnectByName = UiKey("chatList.connectByName")
+    val OneHandCard = UiKey("chatList.oneHandCard")
+    val ConnectBanner = UiKey("chatList.connectBanner")
+    val PresetMenu = UiKey("chatList.presetMenu")
+    fun PresetTag(kind: String) = UiKey("chatList.presetTag", kind)
+    fun PresetMenuItem(kind: String) = UiKey("chatList.presetMenu.item", kind)
+    val PresetMenuAll = UiKey("chatList.presetMenu.all")
+    val AddList = UiKey("chatList.addList")
+    fun UserTag(tagId: Long) = UiKey("chatList.userTag", tagId)
+    fun UserTagMenu(tagId: Long, action: String) = UiKey("chatList.userTag.menu.$action", tagId)
+    fun Row(chatId: String, remoteHostId: Long? = null) = UiKey("chatList.row", rowArg(chatId, remoteHostId))
+    fun RowMenu(chatId: String, action: String, remoteHostId: Long? = null) = UiKey("chatList.row.menu.$action", rowArg(chatId, remoteHostId))
+    private fun rowArg(chatId: String, rh: Long?) = if (rh == null) chatId else "$rh:$chatId"
+  }
+  object TagList {
+    fun Tag(tagId: Long) = UiKey("tagList.tag", tagId)
+  }
+  object TagEditor {
+    val Emoji = UiKey("tagEditor.emoji")
+    val Name = UiKey("tagEditor.name")
+    val Save = UiKey("tagEditor.save")
+  }
+  object NewChat {
+    val CreateLink = UiKey("newChat.createLink")
+    val CreateGroup = UiKey("newChat.createGroup")
+  }
+  object UserPicker {
+    fun User(userId: Long) = UiKey("userPicker.user", userId)
+    val Address = UiKey("userPicker.address")
+    val Settings = UiKey("userPicker.settings")
+    val Profiles = UiKey("userPicker.profiles")
+    val Sheet = UiKey("userPicker.sheet")
+  }
+  object Settings {
+    val Appearance = UiKey("settings.appearance")
+    val Help = UiKey("settings.help")
+  }
+  object Help {
+    val WhatsNew = UiKey("help.whatsNew")
+  }
+  object WhatsNew {
+    val Ok = UiKey("whatsNew.ok")
+    val ViewConditions = UiKey("whatsNew.viewConditions")
+  }
+  object ServersSummary {
+    val ShowPercentage = UiKey("serversSummary.showPercentage")
+  }
+  object Onboarding {
+    val GetStarted = UiKey("onboarding.getStarted")
+    val ProfileName = UiKey("onboarding.profileName")
+    val CreateProfile = UiKey("onboarding.createProfile")
+    val LinkAMobile = UiKey("onboarding.linkAMobile")
+    val WhyBuilt = UiKey("onboarding.whyBuilt")
+    val Migrate = UiKey("onboarding.migrate")
+    val NewPassphrase = UiKey("onboarding.newPassphrase")
+    val ConfirmPassphrase = UiKey("onboarding.confirmPassphrase")
+    val SetPassphrase = UiKey("onboarding.setPassphrase")
+    val RandomPassphrase = UiKey("onboarding.randomPassphrase")
+    val SetupRouters = UiKey("onboarding.setupRouters")
+    val SetupNotifications = UiKey("onboarding.setupNotifications")
+    val Continue = UiKey("onboarding.continue")
+    fun Operator(operatorId: Long) = UiKey("onboarding.operator", operatorId)
+    val OperatorsOk = UiKey("onboarding.operatorsOk")
+    val HowItHelps = UiKey("onboarding.howItHelps")
+    val ConditionsLink = UiKey("onboarding.conditionsLink")
+    val Accept = UiKey("onboarding.accept")
+    val ConditionsAccept = UiKey("onboarding.conditionsAccept")
+  }
+  object Remote {
+    val DeviceName = UiKey("remote.deviceName")
+    val ShareLink = UiKey("remote.shareLink")
+  }
+  object Appearance {
+    val ColorMode = UiKey("appearance.colorMode")
+    val FontScale = UiKey("appearance.fontScale")
+    val Zoom = UiKey("appearance.zoom")
+  }
+  object Address {
+    val Create = UiKey("address.create")
+    val Share = UiKey("address.share")
+  }
+  object NewGroup {
+    val Name = UiKey("newGroup.name")
+    val Create = UiKey("newGroup.create")
+  }
+  object Profile {
+    val Name = UiKey("profile.name")
+    val Save = UiKey("profile.save")
+  }
+  object Profiles {
+    val Add = UiKey("profiles.add")
+  }
+  object NewProfile {
+    val Name = UiKey("newProfile.name")
+    val Create = UiKey("newProfile.create")
+  }
+  object Link {
+    val Text = UiKey("link.text")
+    val ShareProfile = UiKey("link.shareProfile")
+    val ProfileIncognito = UiKey("link.profile.incognito")
+  }
+  object Chat {
+    val Bar = UiKey("chat.bar")
+    val Message = UiKey("chat.compose")
+    val Send = UiKey("chat.send")
+    val Connect = UiKey("chat.connect")
+    val BarMenu = UiKey("chat.bar.menu")
+    fun BarMenuItem(action: String) = UiKey("chat.bar.menu.$action")
+    val Selection = UiKey("chat.selection")
+    val RequestAccept = UiKey("chat.request.accept")
+    val RequestReject = UiKey("chat.request.reject")
+    fun Item(itemId: Long) = UiKey("chat.item", itemId)
+    fun ItemMenu(itemId: Long, action: String) = UiKey("chat.item.menu.$action", itemId)
+    fun ItemReaction(itemId: Long, emoji: String) = UiKey("chat.item.menu.react", "$itemId:$emoji")
+    fun ReactionChip(itemId: Long, emoji: String) = UiKey("chat.item.reaction", "$itemId:$emoji")
+  }
+  object Share {
+    fun Row(chatId: String) = UiKey("share.row", chatId)
+  }
+  object Info {
+    val Alias = UiKey("info.alias")
+    val DeleteContact = UiKey("info.deleteContact")
+    val VerifyCode = UiKey("info.verifyCode")
+  }
+  object VerifyCode {
+    val Code = UiKey("verifyCode.code")
+    val Mark = UiKey("verifyCode.mark")
+  }
+  object InviteMembers {
+    fun Contact(contactId: Long) = UiKey("inviteMembers.contact", contactId)
+    val Invite = UiKey("inviteMembers.invite")
+  }
+  object GroupInfo {
+    fun Member(groupMemberId: Long) = UiKey("groupInfo.member", groupMemberId)
+  }
+  object MemberInfo {
+    val Role = UiKey("memberInfo.role")
+    val Remove = UiKey("memberInfo.remove")
+  }
+  enum class AlertSource { Shared, PrivacySensitive }
+  object Alert {
+    fun Confirm(src: AlertSource) = UiKey("alert.confirm", src)
+    fun Dismiss(src: AlertSource) = UiKey("alert.dismiss", src)
+    fun Option(src: AlertSource, name: String) = UiKey("alert.option.$name", src)
+  }
+}
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/ui/UiIdle.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/ui/UiIdle.kt
new file mode 100644
index 0000000000..efc8532d42
--- /dev/null
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/ui/UiIdle.kt
@@ -0,0 +1,53 @@
+package chat.simplex.common.ui
+
+import java.util.concurrent.ConcurrentHashMap
+import java.util.concurrent.atomic.AtomicLong
+
+object UiIdle {
+  class Item(val id: Long, val what: String)
+
+  private val items = ConcurrentHashMap<Long, Item>()
+  private val abandoned = ConcurrentHashMap.newKeySet<Long>()
+  private val nextId = AtomicLong()
+  @Volatile var lastEventAt = 0L
+    private set
+
+  fun start(what: () -> String): Long {
+    if (!uiTestHooksEnabled) return 0
+    val id = nextId.incrementAndGet()
+    items[id] = Item(id, what())
+    return id
+  }
+
+  fun finish(id: Long) {
+    if (id == 0L) return
+    items.remove(id)
+    abandoned.remove(id)
+  }
+
+  inline fun <T> track(noinline what: (() -> String)?, block: () -> T): T {
+    val id = if (what == null) 0 else start(what)
+    try {
+      return block()
+    } finally {
+      finish(id)
+    }
+  }
+
+  inline fun <T> trackEvent(noinline what: () -> String, block: () -> T): T =
+    try {
+      track(what, block)
+    } finally {
+      if (uiTestHooksEnabled) eventProcessed()
+    }
+
+  fun eventProcessed() {
+    lastEventAt = System.currentTimeMillis()
+  }
+
+  fun inFlight(): List<Item> = items.values.filter { it.id !in abandoned }.sortedBy { it.id }
+
+  fun abandon(stuck: List<Item>) {
+    stuck.forEach { abandoned.add(it.id) }
+  }
+}
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/WelcomeView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/WelcomeView.kt
index e4a187783a..b9cf956091 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/WelcomeView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/WelcomeView.kt
@@ -34,6 +34,9 @@ import chat.simplex.common.model.*
 import chat.simplex.common.model.ChatController.appPrefs
 import chat.simplex.common.model.ChatModel.controller
 import chat.simplex.common.platform.*
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.UiKey
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.helpers.*
 import chat.simplex.common.views.migration.MigrateToDeviceView
@@ -134,7 +137,7 @@ fun CreateProfile(chatModel: ChatModel, close: () -> Unit) {
               }
             }
           }
-          ProfileNameField(displayName, "", { it.trim() == mkValidName(it) }, focusRequester)
+          ProfileNameField(displayName, "", { it.trim() == mkValidName(it) }, focusRequester, uiKey = Ui.NewProfile.Name)
 
           Spacer(Modifier.height(DEFAULT_PADDING))
 
@@ -157,6 +160,7 @@ fun CreateProfile(chatModel: ChatModel, close: () -> Unit) {
         SettingsActionItem(
           painterResource(MR.images.ic_check),
           stringResource(MR.strings.create_another_profile_button),
+          uiKey = Ui.NewProfile.Create,
           disabled = !canCreateProfile(displayName.value) || !bioFitsLimit(shortDescr.value),
           textColor = MaterialTheme.colors.primary,
           iconColor = MaterialTheme.colors.primary,
@@ -213,7 +217,7 @@ private fun RowScope.MigrateButton(refocusTrigger: MutableState<Int>) {
         }
       }
     },
-    modifier = Modifier.padding(end = DEFAULT_PADDING_HALF)
+    modifier = Modifier.padding(end = DEFAULT_PADDING_HALF).ui(Ui.Onboarding.Migrate)
   ) {
     Icon(painterResource(MR.images.ic_download), null, Modifier.size(22.dp), tint = MaterialTheme.colors.primary)
     Spacer(Modifier.width(4.dp))
@@ -283,13 +287,13 @@ private fun CreateFirstProfileMobile(chatModel: ChatModel, close: () -> Unit) {
           modifier = Modifier.padding(top = DEFAULT_PADDING_HALF)
         )
         Spacer(Modifier.height(DEFAULT_PADDING_HALF))
-        ProfileNameField(displayName, stringResource(MR.strings.enter_profile_name), { it.trim() == mkValidName(it) }, focusRequester)
+        ProfileNameField(displayName, stringResource(MR.strings.enter_profile_name), { it.trim() == mkValidName(it) }, focusRequester, uiKey = Ui.Onboarding.ProfileName)
 
         Spacer(Modifier.weight(1f))
 
         Column(Modifier.widthIn(max = 450.dp).padding(bottom = DEFAULT_PADDING * 2).align(Alignment.CenterHorizontally), horizontalAlignment = Alignment.CenterHorizontally) {
           OnboardingActionButton(
-            Modifier.fillMaxWidth(),
+            Modifier.fillMaxWidth().ui(Ui.Onboarding.CreateProfile),
             labelId = MR.strings.create_profile,
             onboarding = null,
             enabled = canCreateProfile(displayName.value),
@@ -328,12 +332,12 @@ private fun CreateFirstProfileDesktop(chatModel: ChatModel, close: () -> Unit) {
           Spacer(Modifier.height(DEFAULT_PADDING))
           ReadableText(MR.strings.onboarding_no_account, TextAlign.Center, style = MaterialTheme.typography.body2.copy(color = MaterialTheme.colors.secondary))
           Spacer(Modifier.height(DEFAULT_PADDING))
-          ProfileNameField(displayName, stringResource(MR.strings.enter_profile_name), { it.trim() == mkValidName(it) }, focusRequester)
+          ProfileNameField(displayName, stringResource(MR.strings.enter_profile_name), { it.trim() == mkValidName(it) }, focusRequester, uiKey = Ui.Onboarding.ProfileName)
         }
         Spacer(Modifier.fillMaxHeight().weight(1f))
         Column(Modifier.widthIn(max = 1000.dp).align(Alignment.CenterHorizontally), horizontalAlignment = Alignment.CenterHorizontally) {
           OnboardingActionButton(
-            Modifier.widthIn(min = 300.dp),
+            Modifier.widthIn(min = 300.dp).ui(Ui.Onboarding.CreateProfile),
             labelId = MR.strings.create_profile,
             onboarding = null,
             enabled = canCreateProfile(displayName.value),
@@ -412,7 +416,7 @@ fun createProfileOnboarding(chatModel: ChatModel, displayName: String, close: ()
 }
 
 @Composable
-fun ProfileNameField(name: MutableState<String>, placeholder: String = "", isValid: (String) -> Boolean = { true }, focusRequester: FocusRequester? = null) {
+fun ProfileNameField(name: MutableState<String>, placeholder: String = "", isValid: (String) -> Boolean = { true }, focusRequester: FocusRequester? = null, uiKey: UiKey? = null) {
   var valid by rememberSaveable { mutableStateOf(true) }
   var focused by rememberSaveable { mutableStateOf(false) }
   val strokeColor by remember {
@@ -427,6 +431,7 @@ fun ProfileNameField(name: MutableState<String>, placeholder: String = "", isVal
     }
   }
   val modifier = Modifier
+    .ui(uiKey)
     .fillMaxWidth()
     .heightIn(min = 50.dp)
     .onFocusChanged { focused = it.isFocused }
@@ -453,7 +458,7 @@ fun ProfileNameField(name: MutableState<String>, placeholder: String = "", isVal
           leadingIcon = null,
           trailingIcon = if (!valid && placeholder != "") {
             {
-              IconButton({ showInvalidNameAlert(mkValidName(name.value), name) }, Modifier.size(20.dp)) {
+              IconButton({ showInvalidNameAlert(mkValidName(name.value), name) }, Modifier.size(20.dp).ui(uiKey?.part("invalid"))) {
                 Icon(painterResource(MR.images.ic_info), null, tint = MaterialTheme.colors.error)
               }
             }
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/ChatInfoView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/ChatInfoView.kt
index 9c019ad535..73d8318206 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/ChatInfoView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/ChatInfoView.kt
@@ -21,6 +21,8 @@ import androidx.compose.ui.Modifier
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.graphics.painter.Painter
 import androidx.compose.ui.platform.*
+import chat.simplex.common.ui.ui
+import chat.simplex.common.ui.Ui
 import chat.simplex.common.views.call.CallMediaType
 import chat.simplex.common.views.chatlist.*
 import androidx.compose.ui.text.*
@@ -266,7 +268,7 @@ private fun deleteContactOrConversationDialog(chat: Chat, contact: Contact, chat
         SectionItemView({
           AlertManager.shared.hideAlert()
           deleteActiveContactDialog(chat, contact, chatModel, close)
-        }) {
+        }, uiKey = Ui.Alert.Option(Ui.AlertSource.Shared, "deleteContact")) {
           Text(generalGetString(MR.strings.button_delete_contact), Modifier.fillMaxWidth(), textAlign = TextAlign.Center, color = MaterialTheme.colors.error)
         }
         // Cancel
@@ -347,7 +349,7 @@ private fun deleteActiveContactDialog(chat: Chat, contact: Contact, chatModel: C
           if (contactDeleteMode.value is ContactDeleteMode.Entity && chatModel.controller.appPrefs.showDeleteContactNotice.get()) {
             showDeleteContactNotice(contact)
           }
-        }) {
+        }, uiKey = Ui.Alert.Option(Ui.AlertSource.Shared, "deleteAndNotify")) {
           Text(generalGetString(MR.strings.delete_and_notify_contact), Modifier.fillMaxWidth(), textAlign = TextAlign.Center, color = MaterialTheme.colors.error)
         }
         // Cancel
@@ -833,9 +835,9 @@ fun LocalAliasEditor(
   }
   var updatedValueAtLeastOnce = remember { false }
   val modifier = if (center)
-    Modifier.padding(horizontal = if (!leadingIcon) DEFAULT_PADDING else 0.dp).widthIn(min = 100.dp)
+    Modifier.ui(Ui.Info.Alias).padding(horizontal = if (!leadingIcon) DEFAULT_PADDING else 0.dp).widthIn(min = 100.dp)
   else
-    Modifier.padding(horizontal = if (!leadingIcon) DEFAULT_PADDING else 0.dp).fillMaxWidth()
+    Modifier.ui(Ui.Info.Alias).padding(horizontal = if (!leadingIcon) DEFAULT_PADDING else 0.dp).fillMaxWidth()
   Row(Modifier.fillMaxWidth(), horizontalArrangement = if (center) Arrangement.Center else Arrangement.Start) {
     DefaultBasicTextField(
       modifier,
@@ -1212,6 +1214,7 @@ fun VerifyCodeButton(contactVerified: Boolean, onClick: () -> Unit, disabled: Bo
     click = onClick,
     iconColor = MaterialTheme.colors.secondary,
     disabled = disabled,
+    uiKey = Ui.Info.VerifyCode,
   )
 }
 
@@ -1267,6 +1270,7 @@ private fun DeleteContactButton(onClick: () -> Unit) {
     click = onClick,
     textColor = Color.Red,
     iconColor = Color.Red,
+    uiKey = Ui.Info.DeleteContact,
   )
 }
 
@@ -1278,6 +1282,7 @@ fun ShareAddressButton(onClick: () -> Unit) {
     onClick,
     iconColor = MaterialTheme.colors.primary,
     textColor = MaterialTheme.colors.primary,
+    uiKey = Ui.Address.Share,
   )
 }
 
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/ChatView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/ChatView.kt
index e9dbb3b157..502088d03a 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/ChatView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/ChatView.kt
@@ -33,6 +33,8 @@ import chat.simplex.common.model.CIDirection.GroupRcv
 import chat.simplex.common.model.ChatController.appPrefs
 import chat.simplex.common.model.ChatModel.activeCall
 import chat.simplex.common.model.ChatModel.controller
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.call.*
 import chat.simplex.common.views.chat.group.*
@@ -1294,7 +1296,7 @@ fun BoxScope.ChatInfoToolbar(
         }
       }
       menuItems.add {
-        ItemAction(stringResource(MR.strings.search_verb), painterResource(MR.images.ic_search), onClick = {
+        ItemAction(stringResource(MR.strings.search_verb), painterResource(MR.images.ic_search), uiKey = Ui.Chat.BarMenuItem("search"), onClick = {
           showMenu.value = false
           showSearch.value = true
         })
@@ -1324,7 +1326,7 @@ fun BoxScope.ChatInfoToolbar(
         }
       }
       menuItems.add {
-        ItemAction(stringResource(MR.strings.search_verb), painterResource(MR.images.ic_search), onClick = {
+        ItemAction(stringResource(MR.strings.search_verb), painterResource(MR.images.ic_search), uiKey = Ui.Chat.BarMenuItem("search"), onClick = {
           showMenu.value = false
           showSearch.value = true
         })
@@ -1422,7 +1424,7 @@ fun BoxScope.ChatInfoToolbar(
 
   if (menuItems.isNotEmpty()) {
     barButtons.add {
-      IconButton({ showMenu.value = true }) {
+      IconButton({ showMenu.value = true }, Modifier.ui(Ui.Chat.BarMenu)) {
         Icon(MoreVertFilled, stringResource(MR.strings.icon_descr_more_button), tint = MaterialTheme.colors.primary)
       }
     }
@@ -1444,6 +1446,7 @@ fun BoxScope.ChatInfoToolbar(
     navigationButton = { if (appPlatform.isAndroid || showSearch.value) { NavigationButtonBack(onBackClicked) }  },
     title = { ChatInfoToolbarTitle(chatInfo) },
     onTitleClick = if (chatInfo is ChatInfo.Local) null else info,
+    uiKey = Ui.Chat.Bar,
     showSearch = showSearch.value,
     searchAlwaysVisible = contentFilter.value != null,
     onTop = !oneHandUI.value || !chatBottomBar.value,
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/ComposeContextContactRequestActionsView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/ComposeContextContactRequestActionsView.kt
index c10e28ce11..d6011feda6 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/ComposeContextContactRequestActionsView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/ComposeContextContactRequestActionsView.kt
@@ -15,6 +15,8 @@ import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.text.style.TextAlign
 import androidx.compose.ui.unit.dp
 import chat.simplex.common.platform.chatModel
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.ui
 import chat.simplex.common.views.chatlist.acceptContactRequest
 import chat.simplex.common.views.chatlist.rejectContactRequest
 import chat.simplex.common.views.helpers.*
@@ -63,7 +65,7 @@ fun ComposeContextContactRequestActionsView(
           .fillMaxWidth(),
         horizontalArrangement = Arrangement.SpaceEvenly,
       ) {
-        var rejectButtonModifier = Modifier.fillMaxWidth().fillMaxHeight().weight(1F)
+        var rejectButtonModifier = Modifier.ui(Ui.Chat.RequestReject).fillMaxWidth().fillMaxHeight().weight(1F)
         rejectButtonModifier =
           if (inProgress.value) rejectButtonModifier
           else rejectButtonModifier.clickable { showRejectRequestAlert(rhId, contactRequestId) }
@@ -83,7 +85,7 @@ fun ComposeContextContactRequestActionsView(
             color = if (inProgress.value) MaterialTheme.colors.secondary else Color.Red
           )
         }
-        var acceptButtonModifier = Modifier.fillMaxWidth().fillMaxHeight().weight(1F)
+        var acceptButtonModifier = Modifier.ui(Ui.Chat.RequestAccept).fillMaxWidth().fillMaxHeight().weight(1F)
         acceptButtonModifier =
           if (inProgress.value) acceptButtonModifier
           else
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/ComposeView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/ComposeView.kt
index 92ccd92f93..81bd12df08 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/ComposeView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/ComposeView.kt
@@ -32,6 +32,7 @@ import chat.simplex.common.model.*
 import chat.simplex.common.model.ChatModel.controller
 import chat.simplex.common.model.ChatModel.filesToDelete
 import chat.simplex.common.platform.*
+import chat.simplex.common.ui.Ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.badges.openBadgesView
 import chat.simplex.common.views.chat.group.hostFromRelayLink
@@ -1546,6 +1547,7 @@ fun ComposeView(
           style = MaterialTheme.typography.body2,
           color = if (composeState.value.inProgress) MaterialTheme.colors.secondary else MaterialTheme.colors.primary,
           disabled = composeState.value.inProgress,
+          uiKey = Ui.Chat.Connect,
           click = { withApi { sendRequest() } }
         )
       }
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/SelectableChatItemToolbars.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/SelectableChatItemToolbars.kt
index 3f3278ee58..5e252dae3a 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/SelectableChatItemToolbars.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/SelectableChatItemToolbars.kt
@@ -15,6 +15,7 @@ import androidx.compose.ui.unit.dp
 import chat.simplex.common.model.*
 import chat.simplex.common.platform.BackHandler
 import chat.simplex.common.platform.chatModel
+import chat.simplex.common.ui.Ui
 import chat.simplex.common.views.helpers.*
 import dev.icerock.moko.resources.compose.stringResource
 import chat.simplex.res.*
@@ -43,7 +44,8 @@ fun BoxScope.SelectedItemsCounterToolbar(selectedItems: MutableState<Set<Long>?>
       onTitleClick = null,
       onTop = onTop,
       onSearchValueChanged = {},
-      buttons = if (selectAll != null) { { SelectAllButton(selectAll) } } else {{}}
+      buttons = if (selectAll != null) { { SelectAllButton(selectAll) } } else {{}},
+      uiKey = Ui.Chat.Selection
     )
   }
 }
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/SendMsgView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/SendMsgView.kt
index 8205071225..eddb5d727d 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/SendMsgView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/SendMsgView.kt
@@ -20,6 +20,8 @@ import androidx.compose.ui.text.TextStyle
 import androidx.compose.ui.unit.*
 import chat.simplex.common.model.*
 import chat.simplex.common.ui.theme.*
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.ui
 import chat.simplex.common.views.chat.item.ItemAction
 import chat.simplex.common.views.helpers.*
 import chat.simplex.common.model.ChatItem
@@ -462,7 +464,7 @@ private fun SendMsgButton(
   val interactionSource = remember { MutableInteractionSource() }
   val ripple = remember { ripple(bounded = false, radius = 24.dp) }
   Box(
-    modifier = Modifier.requiredSize(36.dp)
+    modifier = Modifier.ui(Ui.Chat.Send).requiredSize(36.dp)
       .combinedClickable(
         onClick = {
           if (sendToConnect != null) {
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/VerifyCodeView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/VerifyCodeView.kt
index 3610147804..931ebc5be6 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/VerifyCodeView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/VerifyCodeView.kt
@@ -18,6 +18,8 @@ import androidx.compose.ui.text.font.FontFamily
 import androidx.compose.ui.unit.dp
 import androidx.compose.ui.unit.sp
 import chat.simplex.common.platform.*
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.helpers.*
 import chat.simplex.common.views.newchat.QRCode
@@ -79,6 +81,7 @@ private fun VerifyCodeLayout(
       SelectionContainer(Modifier.padding(vertical = DEFAULT_PADDING_HALF, horizontal = DEFAULT_PADDING_HALF)) {
         Text(
           splitCode,
+          Modifier.ui(Ui.VerifyCode.Code),
           fontFamily = FontFamily.Monospace,
           fontSize = 18.sp,
           maxLines = 20
@@ -114,7 +117,7 @@ private fun VerifyCodeLayout(
             }
           }
         }
-        SimpleButton(generalGetString(MR.strings.mark_code_verified), painterResource(MR.images.ic_verified_user)) {
+        SimpleButton(generalGetString(MR.strings.mark_code_verified), painterResource(MR.images.ic_verified_user), uiKey = Ui.VerifyCode.Mark) {
           withApi {
             val verified = verifyCode(connectionCode)
             if (!verified) {
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/group/AddGroupMembersView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/group/AddGroupMembersView.kt
index 731b125955..86380f9580 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/group/AddGroupMembersView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/group/AddGroupMembersView.kt
@@ -30,6 +30,7 @@ import chat.simplex.common.views.helpers.*
 import chat.simplex.common.views.usersettings.SettingsActionItem
 import chat.simplex.common.model.GroupInfo
 import chat.simplex.common.platform.*
+import chat.simplex.common.ui.Ui
 import chat.simplex.res.*
 import dev.icerock.moko.resources.StringResource
 import kotlinx.coroutines.*
@@ -248,6 +249,7 @@ fun InviteMembersButton(titleId: StringResource, onClick: () -> Unit, disabled:
     textColor = MaterialTheme.colors.primary,
     iconColor = MaterialTheme.colors.primary,
     disabled = disabled,
+    uiKey = Ui.InviteMembers.Invite,
   )
 }
 
@@ -349,7 +351,8 @@ fun ContactCheckRow(
         else
           removeContact(contact.apiId)
       }
-    } else null
+    } else null,
+    uiKey = Ui.InviteMembers.Contact(contact.contactId)
   ) {
     ProfileImage(size = 36.dp, contact.image)
     Spacer(Modifier.width(DEFAULT_SPACE_AFTER_ICON))
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/group/GroupChatInfoView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/group/GroupChatInfoView.kt
index 973b684d38..203c3a643a 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/group/GroupChatInfoView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/group/GroupChatInfoView.kt
@@ -39,6 +39,7 @@ import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.*
 import chat.simplex.common.model.*
 import chat.simplex.common.model.ChatController.appPrefs
+import chat.simplex.common.ui.Ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.helpers.*
 import chat.simplex.common.views.usersettings.*
@@ -794,7 +795,8 @@ fun ModalData.GroupChatInfoLayout(
             },
             longClick = { showMenu.value = true },
             minHeight = 54.dp,
-            padding = PaddingValues(horizontal = DEFAULT_PADDING)
+            padding = PaddingValues(horizontal = DEFAULT_PADDING),
+            uiKey = Ui.GroupInfo.Member(member.groupMemberId)
           ) {
             Box(contentAlignment = Alignment.CenterStart) {
               androidx.compose.animation.AnimatedVisibility(selectedItems.value != null, enter = fadeIn(), exit = fadeOut()) {
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/group/GroupMemberInfoView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/group/GroupMemberInfoView.kt
index ac1c6915b4..c41a3fe032 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/group/GroupMemberInfoView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/group/GroupMemberInfoView.kt
@@ -28,6 +28,7 @@ import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.*
 import chat.simplex.common.model.*
 import chat.simplex.common.model.ChatModel.controller
+import chat.simplex.common.ui.Ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.chat.*
 import chat.simplex.common.views.helpers.*
@@ -314,7 +315,7 @@ fun removeMemberDialog(rhId: Long?, groupInfo: GroupInfo, member: GroupMember, c
           SectionItemView({
             AlertManager.shared.hideAlert()
             removeMember(rhId, groupInfo, member, withMessages = false, chatModel, close)
-          }) {
+          }, uiKey = Ui.Alert.Option(Ui.AlertSource.Shared, "remove")) {
             Text(generalGetString(MR.strings.remove_member_confirmation), Modifier.fillMaxWidth(), textAlign = TextAlign.Center, color = Color.Red)
           }
           SectionItemView({
@@ -850,6 +851,7 @@ fun RemoveMemberButton(useRelays: Boolean = false, isRelay: Boolean = false, onC
     click = onClick,
     textColor = Color.Red,
     iconColor = Color.Red,
+    uiKey = Ui.MemberInfo.Remove,
   )
 }
 
@@ -921,6 +923,7 @@ private fun RoleSelectionRow(
       selectedRole,
       icon = null,
       enabled = remember { mutableStateOf(true) },
+      uiKey = Ui.MemberInfo.Role,
       onSelected = onSelected
     )
   }
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/item/ChatItemView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/item/ChatItemView.kt
index 822aef9aa2..d26e47ccc6 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/item/ChatItemView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chat/item/ChatItemView.kt
@@ -31,6 +31,9 @@ import chat.simplex.common.model.ChatModel.controller
 import chat.simplex.common.model.ChatModel.currentUser
 import chat.simplex.common.platform.*
 import chat.simplex.common.ui.theme.*
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.UiKey
+import chat.simplex.common.ui.ui
 import chat.simplex.common.views.chat.*
 import chat.simplex.common.views.chatlist.openChat
 import chat.simplex.common.views.helpers.*
@@ -153,7 +156,7 @@ fun ChatItemView(
             }
           }
 
-          var modifier = Modifier.padding(horizontal = 5.dp, vertical = 2.dp).clip(RoundedCornerShape(8.dp))
+          var modifier = Modifier.ui(Ui.Chat.ReactionChip(cItem.id, r.reaction.text)).padding(horizontal = 5.dp, vertical = 2.dp).clip(RoundedCornerShape(8.dp))
           if (cInfo.featureEnabled(ChatFeature.Reactions)) {
             fun showReactionsMenu() {
               when (cInfo) {
@@ -322,6 +325,7 @@ fun ChatItemView(
           }
           Column(
             Modifier
+              .ui(Ui.Chat.Item(cItem.id))
               .clipChatItem(cItem, itemSeparation.largeGap, revealed.value)
               .hoverable(bubbleInteractionSource)
               .combinedClickable(
@@ -360,7 +364,7 @@ fun ChatItemView(
                 Row(modifier = Modifier.padding(horizontal = DEFAULT_PADDING).horizontalScroll(rememberScrollState()), verticalAlignment = Alignment.CenterVertically) {
                   rs.forEach() { r ->
                     Box(
-                      Modifier.size(36.dp).clip(CircleShape).clickable {
+                      Modifier.ui(Ui.Chat.ItemReaction(cItem.id, r.text)).size(36.dp).clip(CircleShape).clickable {
                         setReaction(cInfo, cItem, true, r)
                         showMenu.value = false
                       },
@@ -379,7 +383,7 @@ fun ChatItemView(
                 DeleteItemAction(chatsCtx, cInfo, cItem, revealed, showMenu, questionText = deleteMessageQuestionText(), deleteMessage, deleteMessages)
                 if (cItem.canBeDeletedForSelf) {
                   Divider()
-                  SelectItemAction(showMenu, selectChatItem)
+                  SelectItemAction(showMenu, Ui.Chat.ItemMenu(cItem.id, "select"), selectChatItem)
                 }
               }
             }
@@ -396,7 +400,7 @@ fun ChatItemView(
                     }
                     DeleteItemAction(chatsCtx, cInfo, cItem, revealed, showMenu, questionText = deleteMessageQuestionText(), deleteMessage, deleteMessages, buttonText = stringResource(MR.strings.delete_report))
                     Divider()
-                    SelectItemAction(showMenu, selectChatItem)
+                    SelectItemAction(showMenu, Ui.Chat.ItemMenu(cItem.id, "select"), selectChatItem)
                   }
                 }
                 cItem.content.msgContent != null && cItem.id >= 0 && !cItem.isReport -> {
@@ -405,7 +409,7 @@ fun ChatItemView(
                       MsgReactionsMenu()
                     }
                     if (cItem.meta.itemDeleted == null && !live && !cItem.localNote && cInfo.sendMsgEnabled) {
-                      ItemAction(stringResource(MR.strings.reply_verb), painterResource(MR.images.ic_reply), onClick = {
+                      ItemAction(stringResource(MR.strings.reply_verb), painterResource(MR.images.ic_reply), uiKey = Ui.Chat.ItemMenu(cItem.id, "reply"), onClick = {
                         if (composeState.value.editing) {
                           composeState.value = ComposeState(contextItem = ComposeContextItem.QuotedItem(cItem), useLinkPreviews = useLinkPreviews)
                         } else {
@@ -462,7 +466,7 @@ fun ChatItemView(
                       })
                     }
                     if (cItem.meta.editable && cItem.content.msgContent !is MsgContent.MCVoice && !live) {
-                      ItemAction(stringResource(MR.strings.edit_verb), painterResource(MR.images.ic_edit_filled), onClick = {
+                      ItemAction(stringResource(MR.strings.edit_verb), painterResource(MR.images.ic_edit_filled), uiKey = Ui.Chat.ItemMenu(cItem.id, "edit"), onClick = {
                         composeState.value = ComposeState(editingItem = cItem, useLinkPreviews = useLinkPreviews)
                         showMenu.value = false
                       })
@@ -471,7 +475,7 @@ fun ChatItemView(
                       (cItem.file == null || cItem.file.forwardingAllowed()) &&
                       !cItem.isLiveDummy && !live
                     ) {
-                      ItemAction(stringResource(MR.strings.forward_chat_item), painterResource(MR.images.ic_forward), onClick = {
+                      ItemAction(stringResource(MR.strings.forward_chat_item), painterResource(MR.images.ic_forward), uiKey = Ui.Chat.ItemMenu(cItem.id, "forward"), onClick = {
                         forwardItem(cInfo, cItem)
                         showMenu.value = false
                       })
@@ -496,7 +500,7 @@ fun ChatItemView(
                     }
                     if (cItem.canBeDeletedForSelf) {
                       Divider()
-                      SelectItemAction(showMenu, selectChatItem)
+                      SelectItemAction(showMenu, Ui.Chat.ItemMenu(cItem.id, "select"), selectChatItem)
                     }
                   }
                 }
@@ -513,7 +517,7 @@ fun ChatItemView(
                     DeleteItemAction(chatsCtx, cInfo, cItem, revealed, showMenu, questionText = deleteMessageQuestionText(), deleteMessage, deleteMessages)
                     if (cItem.canBeDeletedForSelf) {
                       Divider()
-                      SelectItemAction(showMenu, selectChatItem)
+                      SelectItemAction(showMenu, Ui.Chat.ItemMenu(cItem.id, "select"), selectChatItem)
                     }
                   }
                 }
@@ -523,7 +527,7 @@ fun ChatItemView(
                     DeleteItemAction(chatsCtx, cInfo, cItem, revealed, showMenu, questionText = deleteMessageQuestionText(), deleteMessage, deleteMessages)
                     if (cItem.canBeDeletedForSelf) {
                       Divider()
-                      SelectItemAction(showMenu, selectChatItem)
+                      SelectItemAction(showMenu, Ui.Chat.ItemMenu(cItem.id, "select"), selectChatItem)
                     }
                   }
                 }
@@ -537,7 +541,7 @@ fun ChatItemView(
                     DeleteItemAction(chatsCtx, cInfo, cItem, revealed, showMenu, questionText = deleteMessageQuestionText(), deleteMessage, deleteMessages)
                     if (cItem.canBeDeletedForSelf) {
                       Divider()
-                      SelectItemAction(showMenu, selectChatItem)
+                      SelectItemAction(showMenu, Ui.Chat.ItemMenu(cItem.id, "select"), selectChatItem)
                     }
                   }
                 }
@@ -546,7 +550,7 @@ fun ChatItemView(
                     DeleteItemAction(chatsCtx, cInfo, cItem, revealed, showMenu, questionText = deleteMessageQuestionText(), deleteMessage, deleteMessages)
                     if (selectedChatItems.value == null) {
                       Divider()
-                      SelectItemAction(showMenu, selectChatItem)
+                      SelectItemAction(showMenu, Ui.Chat.ItemMenu(cItem.id, "select"), selectChatItem)
                     }
                   }
                 }
@@ -563,7 +567,7 @@ fun ChatItemView(
                 DeleteItemAction(chatsCtx, cInfo, cItem, revealed, showMenu, questionText = deleteMessageQuestionText(), deleteMessage, deleteMessages)
                 if (cItem.canBeDeletedForSelf) {
                   Divider()
-                  SelectItemAction(showMenu, selectChatItem)
+                  SelectItemAction(showMenu, Ui.Chat.ItemMenu(cItem.id, "select"), selectChatItem)
                 }
               }
             }
@@ -592,7 +596,7 @@ fun ChatItemView(
                 DeleteItemAction(chatsCtx, cInfo, cItem, revealed, showMenu, questionText = deleteMessageQuestionText(), deleteMessage, deleteMessages)
                 if (cItem.canBeDeletedForSelf) {
                   Divider()
-                  SelectItemAction(showMenu, selectChatItem)
+                  SelectItemAction(showMenu, Ui.Chat.ItemMenu(cItem.id, "select"), selectChatItem)
                 }
               }
             }
@@ -666,7 +670,7 @@ fun ChatItemView(
                 DeleteItemAction(chatsCtx, cInfo, cItem, revealed, showMenu, questionText = generalGetString(MR.strings.delete_message_cannot_be_undone_warning), deleteMessage, deleteMessages)
                 if (cItem.canBeDeletedForSelf) {
                   Divider()
-                  SelectItemAction(showMenu, selectChatItem)
+                  SelectItemAction(showMenu, Ui.Chat.ItemMenu(cItem.id, "select"), selectChatItem)
                 }
               }
             }
@@ -880,6 +884,7 @@ fun DeleteItemAction(
   ItemAction(
     buttonText,
     painterResource(MR.images.ic_delete),
+    uiKey = Ui.Chat.ItemMenu(cItem.id, "delete"),
     onClick = {
       showMenu.value = false
       if (!revealed.value) {
@@ -935,11 +940,13 @@ fun ModerateItemAction(
 @Composable
 fun SelectItemAction(
   showMenu: MutableState<Boolean>,
+  uiKey: UiKey? = null,
   selectItem: () -> Unit,
 ) {
   ItemAction(
     stringResource(MR.strings.select_verb),
     painterResource(MR.images.ic_check_circle),
+    uiKey = uiKey,
     onClick = {
       showMenu.value = false
       selectItem()
@@ -1093,11 +1100,11 @@ fun showArchiveReportsAlert(ids: List<Long>, allowForAll: Boolean, archiveReport
 }
 
 @Composable
-fun ItemAction(text: String, icon: Painter, color: Color = Color.Unspecified, onClick: () -> Unit) {
+fun ItemAction(text: String, icon: Painter, color: Color = Color.Unspecified, uiKey: UiKey? = null, onClick: () -> Unit) {
   val finalColor = if (color == Color.Unspecified) {
     MenuTextColor
   } else color
-  DropdownMenuItem(onClick, contentPadding = PaddingValues(horizontal = DEFAULT_PADDING * 1.5f)) {
+  DropdownMenuItem(onClick, Modifier.ui(uiKey), contentPadding = PaddingValues(horizontal = DEFAULT_PADDING * 1.5f)) {
     Row(verticalAlignment = Alignment.CenterVertically) {
       Text(
         text,
@@ -1113,11 +1120,11 @@ fun ItemAction(text: String, icon: Painter, color: Color = Color.Unspecified, on
 }
 
 @Composable
-fun ItemAction(text: String, icon: ImageBitmap, textColor: Color = Color.Unspecified, iconColor: Color = Color.Unspecified, onClick: () -> Unit) {
+fun ItemAction(text: String, icon: ImageBitmap, textColor: Color = Color.Unspecified, iconColor: Color = Color.Unspecified, uiKey: UiKey? = null, onClick: () -> Unit) {
   val finalColor = if (textColor == Color.Unspecified) {
     MenuTextColor
   } else textColor
-  DropdownMenuItem(onClick, contentPadding = PaddingValues(horizontal = DEFAULT_PADDING * 1.5f)) {
+  DropdownMenuItem(onClick, Modifier.ui(uiKey), contentPadding = PaddingValues(horizontal = DEFAULT_PADDING * 1.5f)) {
     Row(verticalAlignment = Alignment.CenterVertically) {
       Text(
         text,
@@ -1144,12 +1151,13 @@ fun ItemAction(
   composable: @Composable () -> Unit,
   color: Color = Color.Unspecified,
   onClick: () -> Unit,
-  lineLimit: Int = Int.MAX_VALUE
+  lineLimit: Int = Int.MAX_VALUE,
+  uiKey: UiKey? = null,
 ) {
   val finalColor = if (color == Color.Unspecified) {
     MenuTextColor
   } else color
-  DropdownMenuItem(onClick, contentPadding = PaddingValues(horizontal = DEFAULT_PADDING * 1.5f)) {
+  DropdownMenuItem(onClick, Modifier.ui(uiKey), contentPadding = PaddingValues(horizontal = DEFAULT_PADDING * 1.5f)) {
     Row(verticalAlignment = Alignment.CenterVertically) {
       Text(
         text,
@@ -1167,11 +1175,11 @@ fun ItemAction(
 }
 
 @Composable
-fun ItemAction(text: String, icon: ImageVector, onClick: () -> Unit, color: Color = Color.Unspecified) {
+fun ItemAction(text: String, icon: ImageVector, onClick: () -> Unit, color: Color = Color.Unspecified, uiKey: UiKey? = null) {
   val finalColor = if (color == Color.Unspecified) {
     MenuTextColor
   } else color
-  DropdownMenuItem(onClick, contentPadding = PaddingValues(horizontal = DEFAULT_PADDING * 1.5f)) {
+  DropdownMenuItem(onClick, Modifier.ui(uiKey), contentPadding = PaddingValues(horizontal = DEFAULT_PADDING * 1.5f)) {
     Row(verticalAlignment = Alignment.CenterVertically) {
       Text(
         text,
@@ -1187,11 +1195,11 @@ fun ItemAction(text: String, icon: ImageVector, onClick: () -> Unit, color: Colo
 }
 
 @Composable
-fun ItemAction(text: String, color: Color = Color.Unspecified, onClick: () -> Unit) {
+fun ItemAction(text: String, color: Color = Color.Unspecified, uiKey: UiKey? = null, onClick: () -> Unit) {
   val finalColor = if (color == Color.Unspecified) {
     MenuTextColor
   } else color
-  DropdownMenuItem(onClick, contentPadding = PaddingValues(horizontal = DEFAULT_PADDING * 1.5f)) {
+  DropdownMenuItem(onClick, Modifier.ui(uiKey), contentPadding = PaddingValues(horizontal = DEFAULT_PADDING * 1.5f)) {
     Text(
       text,
       modifier = Modifier
@@ -1409,14 +1417,14 @@ fun deleteMessageAlertDialog(chatItem: ChatItem, questionText: String, chatInfo:
           TextButton(onClick = {
             deleteMessage(chatItem.id, CIDeleteMode.cidmInternal)
             AlertManager.shared.hideAlert()
-          }) { Text(stringResource(MR.strings.for_me_only), color = MaterialTheme.colors.error) }
+          }, Modifier.ui(Ui.Alert.Option(Ui.AlertSource.Shared, "forMe"))) { Text(stringResource(MR.strings.for_me_only), color = MaterialTheme.colors.error) }
         }
         if (canDeleteForEveryone) {
           Spacer(Modifier.padding(horizontal = 4.dp))
           TextButton(onClick = {
             deleteMessage(chatItem.id, CIDeleteMode.cidmBroadcast)
             AlertManager.shared.hideAlert()
-          }) { Text(stringResource(MR.strings.for_everybody), color = MaterialTheme.colors.error) }
+          }, Modifier.ui(Ui.Alert.Option(Ui.AlertSource.Shared, "forEveryone"))) { Text(stringResource(MR.strings.for_everybody), color = MaterialTheme.colors.error) }
         }
       }
     }
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chatlist/ChatListNavLinkView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chatlist/ChatListNavLinkView.kt
index 32e0befa3f..e917d75d99 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chatlist/ChatListNavLinkView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chatlist/ChatListNavLinkView.kt
@@ -21,6 +21,8 @@ import androidx.compose.ui.unit.sp
 import chat.simplex.common.model.*
 import chat.simplex.common.model.ChatModel.controller
 import chat.simplex.common.platform.*
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.UiKey
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.chat.*
 import chat.simplex.common.views.chat.group.*
@@ -80,6 +82,7 @@ fun ChatListNavLinkView(chat: Chat, nextChatSelected: State<Boolean>) {
         disabled,
         selectedChat,
         nextChatSelected,
+        uiKey = Ui.ChatList.Row(chat.id, chat.remoteHostId),
       )
     }
     is ChatInfo.Group -> {
@@ -100,6 +103,7 @@ fun ChatListNavLinkView(chat: Chat, nextChatSelected: State<Boolean>) {
         disabled,
         selectedChat,
         nextChatSelected,
+        uiKey = Ui.ChatList.Row(chat.id, chat.remoteHostId),
       )
     }
     is ChatInfo.Local -> {
@@ -120,6 +124,7 @@ fun ChatListNavLinkView(chat: Chat, nextChatSelected: State<Boolean>) {
         disabled,
         selectedChat,
         nextChatSelected,
+        uiKey = Ui.ChatList.Row(chat.id, chat.remoteHostId),
       )
     }
     is ChatInfo.ContactRequest ->
@@ -132,13 +137,14 @@ fun ChatListNavLinkView(chat: Chat, nextChatSelected: State<Boolean>) {
         click = { contactRequestAlertDialog(chat.remoteHostId, chat.chatInfo, chatModel) { onRequestAccepted(it) } },
         dropdownMenuItems = {
           tryOrShowError("${chat.id}ChatListNavLinkDropdown", error = {}) {
-            ContactRequestMenuItems(chat.remoteHostId, contactRequestId = chat.chatInfo.apiId, chatModel, showMenu)
+            ContactRequestMenuItems(chat.remoteHostId, contactRequestId = chat.chatInfo.apiId, chatModel, showMenu, chatId = chat.id)
           }
         },
         showMenu,
         disabled,
         selectedChat,
         nextChatSelected,
+        uiKey = Ui.ChatList.Row(chat.id, chat.remoteHostId),
       )
     is ChatInfo.ContactConnection ->
       ChatListNavLinkLayout(
@@ -159,6 +165,7 @@ fun ChatListNavLinkView(chat: Chat, nextChatSelected: State<Boolean>) {
         disabled,
         selectedChat,
         nextChatSelected,
+        uiKey = Ui.ChatList.Row(chat.id, chat.remoteHostId),
       )
     is ChatInfo.InvalidJSON ->
       ChatListNavLinkLayout(
@@ -175,6 +182,7 @@ fun ChatListNavLinkView(chat: Chat, nextChatSelected: State<Boolean>) {
         disabled,
         selectedChat,
         nextChatSelected,
+        uiKey = Ui.ChatList.Row(chat.id, chat.remoteHostId),
       )
   }
 }
@@ -278,7 +286,7 @@ suspend fun setGroupMembers(rhId: Long?, groupInfo: GroupInfo, chatModel: ChatMo
 fun ContactMenuItems(chat: Chat, contact: Contact, chatModel: ChatModel, showMenu: MutableState<Boolean>, showMarkRead: Boolean) {
   if (contact.nextAcceptContactRequest) {
     if (contact.contactRequestId != null) {
-      ContactRequestMenuItems(chat.remoteHostId, contactRequestId = contact.contactRequestId, chatModel, showMenu)
+      ContactRequestMenuItems(chat.remoteHostId, contactRequestId = contact.contactRequestId, chatModel, showMenu, chatId = chat.id)
     } else if (contact.groupDirectInv != null && !contact.groupDirectInv.memberRemoved) {
       MemberContactRequestMenuItems(chat.remoteHostId, contact, showMenu)
     } else {
@@ -366,6 +374,7 @@ fun MarkReadChatAction(chat: Chat, showMenu: MutableState<Boolean>) {
   ItemAction(
     stringResource(MR.strings.mark_read),
     painterResource(MR.images.ic_check),
+    uiKey = Ui.ChatList.RowMenu(chat.id, "markRead", chat.remoteHostId),
     onClick = {
       markChatRead(chat)
       ntfManager.cancelNotificationsForChat(chat.id)
@@ -379,6 +388,7 @@ fun MarkUnreadChatAction(chat: Chat, chatModel: ChatModel, showMenu: MutableStat
   ItemAction(
     stringResource(MR.strings.mark_unread),
     painterResource(MR.images.ic_mark_chat_unread),
+    uiKey = Ui.ChatList.RowMenu(chat.id, "markUnread", chat.remoteHostId),
     onClick = {
       markChatUnread(chat, chatModel)
       showMenu.value = false
@@ -395,6 +405,7 @@ fun TagListAction(
   ItemAction(
     stringResource(if (chat.chatInfo.chatTags.isNullOrEmpty()) MR.strings.add_to_list else MR.strings.change_list),
     painterResource(MR.images.ic_label),
+    uiKey = Ui.ChatList.RowMenu(chat.id, "tagList", chat.remoteHostId),
     onClick = {
       ModalManager.start.showModalCloseable { close ->
         if (userTags.value.isEmpty()) {
@@ -413,6 +424,7 @@ fun ToggleFavoritesChatAction(chat: Chat, chatModel: ChatModel, favorite: Boolea
   ItemAction(
     if (favorite) stringResource(MR.strings.unfavorite_chat) else stringResource(MR.strings.favorite_chat),
     if (favorite) painterResource(MR.images.ic_star_off) else painterResource(MR.images.ic_star),
+    uiKey = Ui.ChatList.RowMenu(chat.id, if (favorite) "unfavorite" else "favorite", chat.remoteHostId),
     onClick = {
       toggleChatFavorite(chat.remoteHostId, chat.chatInfo, !favorite, chatModel)
       showMenu.value = false
@@ -425,6 +437,7 @@ fun ToggleNotificationsChatAction(chat: Chat, chatModel: ChatModel, nextMsgFilte
   ItemAction(
     generalGetString(nextMsgFilter.text(chat.chatInfo.hasMentions)),
     painterResource(nextMsgFilter.icon),
+    uiKey = Ui.ChatList.RowMenu(chat.id, "ntfs.${nextMsgFilter.name}", chat.remoteHostId),
     onClick = {
       toggleNotifications(chat.remoteHostId, chat.chatInfo, nextMsgFilter, chatModel)
       showMenu.value = false
@@ -441,7 +454,8 @@ fun ClearChatAction(chat: Chat, showMenu: MutableState<Boolean>) {
       clearChatDialog(chat)
       showMenu.value = false
     },
-    color = WarningOrange
+    color = WarningOrange,
+    uiKey = Ui.ChatList.RowMenu(chat.id, "clear", chat.remoteHostId)
   )
 }
 
@@ -454,7 +468,8 @@ fun ClearNoteFolderAction(chat: Chat, showMenu: MutableState<Boolean>) {
       clearNoteFolderDialog(chat)
       showMenu.value = false
     },
-    color = WarningOrange
+    color = WarningOrange,
+    uiKey = Ui.ChatList.RowMenu(chat.id, "clear", chat.remoteHostId)
   )
 }
 
@@ -467,7 +482,8 @@ fun DeleteContactAction(chat: Chat, chatModel: ChatModel, showMenu: MutableState
       deleteContactDialog(chat, chatModel)
       showMenu.value = false
     },
-    color = Color.Red
+    color = Color.Red,
+    uiKey = Ui.ChatList.RowMenu(chat.id, "delete", chat.remoteHostId)
   )
 }
 
@@ -519,16 +535,18 @@ fun LeaveGroupAction(rhId: Long?, groupInfo: GroupInfo, chatModel: ChatModel, sh
       leaveGroupDialog(rhId, groupInfo, chatModel)
       showMenu.value = false
     },
-    color = Color.Red
+    color = Color.Red,
+    uiKey = Ui.ChatList.RowMenu(groupInfo.id, "leave", rhId)
   )
 }
 
 @Composable
-fun ContactRequestMenuItems(rhId: Long?, contactRequestId: Long, chatModel: ChatModel, showMenu: MutableState<Boolean>, onSuccess: ((chat: Chat) -> Unit)? = null) {
+fun ContactRequestMenuItems(rhId: Long?, contactRequestId: Long, chatModel: ChatModel, showMenu: MutableState<Boolean>, onSuccess: ((chat: Chat) -> Unit)? = null, chatId: String? = null) {
   ItemAction(
     stringResource(MR.strings.accept_contact_button),
     painterResource(MR.images.ic_check),
     color = MaterialTheme.colors.onBackground,
+    uiKey = chatId?.let { Ui.ChatList.RowMenu(it, "accept", rhId) },
     onClick = {
       acceptContactRequest(rhId, incognito = false, contactRequestId, true, chatModel, onSuccess)
       showMenu.value = false
@@ -539,6 +557,7 @@ fun ContactRequestMenuItems(rhId: Long?, contactRequestId: Long, chatModel: Chat
       stringResource(MR.strings.accept_contact_incognito_button),
       painterResource(MR.images.ic_theater_comedy),
       color = MaterialTheme.colors.onBackground,
+      uiKey = chatId?.let { Ui.ChatList.RowMenu(it, "acceptIncognito", rhId) },
       onClick = {
         acceptContactRequest(rhId, incognito = true, contactRequestId, true, chatModel, onSuccess)
         showMenu.value = false
@@ -552,7 +571,8 @@ fun ContactRequestMenuItems(rhId: Long?, contactRequestId: Long, chatModel: Chat
       rejectContactRequest(rhId, contactRequestId, chatModel)
       showMenu.value = false
     },
-    color = Color.Red
+    color = Color.Red,
+    uiKey = chatId?.let { Ui.ChatList.RowMenu(it, "reject", rhId) }
   )
 }
 
@@ -591,6 +611,7 @@ fun ContactConnectionMenuItems(rhId: Long?, chatInfo: ChatInfo.ContactConnection
       }
       showMenu.value = false
     },
+    uiKey = Ui.ChatList.RowMenu(chatInfo.id, "setName", rhId),
   )
   ItemAction(
     stringResource(MR.strings.delete_verb),
@@ -601,7 +622,8 @@ fun ContactConnectionMenuItems(rhId: Long?, chatInfo: ChatInfo.ContactConnection
       }
       showMenu.value = false
     },
-    color = Color.Red
+    color = Color.Red,
+    uiKey = Ui.ChatList.RowMenu(chatInfo.id, "delete", rhId),
   )
 }
 
@@ -1032,6 +1054,7 @@ expect fun ChatListNavLinkLayout(
   disabled: Boolean,
   selectedChat: State<Boolean>,
   nextChatSelected: State<Boolean>,
+  uiKey: UiKey? = null,
 )
 
 @Preview/*(
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chatlist/ChatListView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chatlist/ChatListView.kt
index 17101c35d1..5b5e96abb0 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chatlist/ChatListView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chatlist/ChatListView.kt
@@ -35,6 +35,9 @@ import chat.simplex.common.BuildConfigCommon
 import chat.simplex.common.model.*
 import chat.simplex.common.model.ChatController.appPrefs
 import chat.simplex.common.model.ChatController.stopRemoteHostAndReloadHosts
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.UiKey
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.*
 import SectionItemView
 import chat.simplex.common.views.helpers.*
@@ -142,6 +145,7 @@ fun ToggleChatListCard() {
   val selectedBg = MaterialTheme.colors.background.mixWith(MaterialTheme.colors.onBackground, 0.92f)
   Row(
     Modifier
+      .ui(Ui.ChatList.OneHandCard)
       .padding(horizontal = 16.dp, vertical = 12.dp)
       .fillMaxWidth()
       .height(IntrinsicSize.Min)
@@ -154,7 +158,7 @@ fun ToggleChatListCard() {
       isSelected = oneHandUI.value,
       selectedBg = selectedBg,
       activeBg = activeBg,
-      modifier = Modifier.weight(1f)
+      modifier = Modifier.weight(1f).ui(Ui.ChatList.OneHandCard.part("bottom"))
     ) { appPrefs.oneHandUI.set(true) }
     Box(Modifier.weight(1f).fillMaxHeight()) {
       ToolbarSegment(
@@ -163,13 +167,14 @@ fun ToggleChatListCard() {
         isSelected = !oneHandUI.value,
         selectedBg = selectedBg,
         activeBg = activeBg,
-        modifier = Modifier.fillMaxSize()
+        modifier = Modifier.fillMaxSize().ui(Ui.ChatList.OneHandCard.part("top"))
       ) { appPrefs.oneHandUI.set(false) }
       Icon(
         painterResource(MR.images.ic_close), null,
         Modifier
           .align(Alignment.CenterEnd)
           .padding(end = 4.dp)
+          .ui(Ui.ChatList.OneHandCard.part("close"))
           .clip(CircleShape)
           .clickable(onClick = onClose)
           .padding(8.dp)
@@ -381,7 +386,7 @@ private fun ConnectBannerCard() {
         .clip(RoundedCornerShape(18.dp))
     ) {
       Column(
-        Modifier.weight(1f).clickable {
+        Modifier.weight(1f).ui(Ui.ChatList.ConnectBanner.part("newLink")).clickable {
           ModalManager.start.showModalCloseable { close ->
             NewChatView(chatModel.currentRemoteHost.value, NewChatOption.INVITE, close = close)
           }
@@ -412,7 +417,7 @@ private fun ConnectBannerCard() {
       }
       Spacer(Modifier.width(2.dp).fillMaxHeight().background(MaterialTheme.colors.background))
       Column(
-        Modifier.weight(1f).clickable {
+        Modifier.weight(1f).ui(Ui.ChatList.ConnectBanner.part("pasteLink")).clickable {
           ModalManager.start.showModalCloseable { close ->
             NewChatView(chatModel.currentRemoteHost.value, NewChatOption.CONNECT, showQRCodeScanner = appPlatform.isAndroid, close = close)
           }
@@ -483,7 +488,7 @@ private fun BoxScope.NewChatSheetFloatingButton(oneHandUI: State<Boolean>, stopp
         showNewChatSheet(oneHandUI)
       }
     },
-    Modifier
+    Modifier.ui(Ui.ChatList.NewChatFab)
       .navigationBarsPadding()
       .padding(end = DEFAULT_PADDING, bottom = DEFAULT_PADDING)
       .align(Alignment.BottomEnd)
@@ -549,7 +554,7 @@ private fun ChatListToolbar(userPickerState: MutableStateFlow<AnimatedViewState>
           generalGetString(MR.strings.chat_is_stopped_indication),
           generalGetString(MR.strings.you_can_start_chat_via_setting_or_by_restarting_the_app)
         )
-      }) {
+      }, Modifier.ui(Ui.ChatList.Stopped)) {
         Icon(
           painterResource(MR.images.ic_report_filled),
           generalGetString(MR.strings.chat_is_stopped_indication),
@@ -587,6 +592,7 @@ private fun ChatListToolbar(userPickerState: MutableStateFlow<AnimatedViewState>
           onClick = {
             showNewChatSheet(oneHandUI)
           },
+          Modifier.ui(Ui.ChatList.NewChat),
         ) {
           Box(
             contentAlignment = Alignment.Center,
@@ -622,7 +628,7 @@ private fun ChatListToolbar(userPickerState: MutableStateFlow<AnimatedViewState>
         val allRead = users
           .filter { u -> !u.user.activeUser && !u.user.hidden }
           .all { u -> u.unreadCount == 0 }
-        UserProfileButton(chatModel.currentUser.value?.profile?.image, allRead) {
+        UserProfileButton(chatModel.currentUser.value?.profile?.image, allRead, Ui.ChatList.UserPicker) {
             userPickerState.value = AnimatedViewState.VISIBLE
         }
       }
@@ -660,7 +666,8 @@ private fun ChatListToolbar(userPickerState: MutableStateFlow<AnimatedViewState>
     onTitleClick = if (canScrollToZero.value) { { scrollToBottom(scope, listState) } } else null,
     onTop = !oneHandUI.value,
     onSearchValueChanged = {},
-    buttons = { barButtons.forEach { it() } }
+    buttons = { barButtons.forEach { it() } },
+    uiKey = Ui.ChatList.Bar,
   )
 }
 
@@ -694,6 +701,7 @@ fun SubscriptionStatusIndicator(click: (() -> Unit)) {
 
   SimpleButtonFrame(
     click = click,
+    Modifier.ui(Ui.ChatList.Subscriptions),
     disabled = chatModel.chatRunning.value != true
   ) {
     SubscriptionStatusIndicatorView(subs = subs, hasSess = hasSess)
@@ -701,9 +709,9 @@ fun SubscriptionStatusIndicator(click: (() -> Unit)) {
 }
 
 @Composable
-fun UserProfileButton(image: String?, allRead: Boolean, onButtonClicked: () -> Unit) {
+fun UserProfileButton(image: String?, allRead: Boolean, uiKey: UiKey? = null, onButtonClicked: () -> Unit) {
   Row(verticalAlignment = Alignment.CenterVertically) {
-    IconButton(onClick = onButtonClicked) {
+    IconButton(onClick = onButtonClicked, Modifier.ui(uiKey)) {
       Box {
         ProfileImage(
           image = image,
@@ -753,7 +761,7 @@ private fun ToggleFilterEnabledButton() {
     } else {
       chatModel.activeChatTagFilter.value = ActiveFilter.Unread
     }
-  }) {
+  }, Modifier.ui(Ui.ChatList.UnreadFilter)) {
     val sp16 = with(LocalDensity.current) { 16.sp.toDp() }
     Icon(
       painterResource(MR.images.ic_filter_list),
@@ -797,7 +805,7 @@ private fun ChatListSearchBar(listState: LazyListState, searchText: MutableState
         tint = MaterialTheme.colors.secondary
       )
       SearchTextField(
-        Modifier.weight(1f).onFocusChanged { focused = it.hasFocus }.focusRequester(focusRequester),
+        Modifier.ui(Ui.ChatList.Search).weight(1f).onFocusChanged { focused = it.hasFocus }.focusRequester(focusRequester),
         placeholder = stringResource(MR.strings.search_or_paste_simplex_link),
         alwaysVisible = true,
         searchText = searchText,
@@ -1208,6 +1216,7 @@ internal fun ConnectByNameRow(name: String, searchText: MutableState<TextFieldVa
   val view = LocalMultiplatformView()
   Row(
     Modifier
+      .ui(Ui.ChatList.ConnectByName)
       .fillMaxWidth()
       .clickable {
         hideKeyboard(view)
@@ -1243,7 +1252,7 @@ private fun NoChatsView(searchText: MutableState<TextFieldValue>) {
       is ActiveFilter.UserTag -> Text(String.format(generalGetString(MR.strings.no_chats_in_list), activeFilter.tag.chatTagText), color = MaterialTheme.colors.secondary, textAlign = TextAlign.Center)
       is ActiveFilter.Unread -> {
           Row(
-            Modifier.clip(shape = CircleShape).clickable { chatModel.activeChatTagFilter.value = null }.padding(DEFAULT_PADDING_HALF),
+            Modifier.ui(Ui.ChatList.NoUnreadChats).clip(shape = CircleShape).clickable { chatModel.activeChatTagFilter.value = null }.padding(DEFAULT_PADDING_HALF),
             horizontalArrangement = Arrangement.spacedBy(4.dp),
             verticalAlignment = Alignment.CenterVertically
           ) {
@@ -1314,6 +1323,7 @@ private fun TagsView(searchText: MutableState<TextFieldValue>) {
       Box {
         Row(
           rowSizeModifier
+            .ui(Ui.ChatList.UserTag(tag.chatTagId))
             .clip(shape = CircleShape)
             .combinedClickable(
               onClick = {
@@ -1388,7 +1398,7 @@ private fun TagsView(searchText: MutableState<TextFieldValue>) {
       }
 
     if (userTags.value.isEmpty()) {
-      Row(rowSizeModifier.clip(shape = CircleShape).then(plusClickModifier).padding(start = 2.dp, top = 4.dp, end = 6.dp, bottom = 4.dp), verticalAlignment = Alignment.CenterVertically) {
+      Row(rowSizeModifier.ui(Ui.ChatList.AddList).clip(shape = CircleShape).then(plusClickModifier).padding(start = 2.dp, top = 4.dp, end = 6.dp, bottom = 4.dp), verticalAlignment = Alignment.CenterVertically) {
         Icon(painterResource(MR.images.ic_add), stringResource(MR.strings.chat_list_add_list), Modifier.size(18.sp.toDp()), tint = MaterialTheme.colors.secondary)
         Spacer(Modifier.width(2.dp))
         Text(stringResource(MR.strings.chat_list_add_list), color = MaterialTheme.colors.secondary, fontSize = 15.sp)
@@ -1396,7 +1406,7 @@ private fun TagsView(searchText: MutableState<TextFieldValue>) {
     } else {
       Box(rowSizeModifier, contentAlignment = Alignment.Center) {
         Icon(
-          painterResource(MR.images.ic_add), stringResource(MR.strings.chat_list_add_list), Modifier.clip(shape = CircleShape).then(plusClickModifier).padding(2.dp), tint = MaterialTheme.colors.secondary
+          painterResource(MR.images.ic_add), stringResource(MR.strings.chat_list_add_list), Modifier.ui(Ui.ChatList.AddList).clip(shape = CircleShape).then(plusClickModifier).padding(2.dp), tint = MaterialTheme.colors.secondary
         )
       }
     }
@@ -1418,6 +1428,7 @@ private fun ExpandedTagFilterView(tag: PresetTagKind) {
 
   Row(
     modifier = Modifier
+      .ui(Ui.ChatList.PresetTag(tag.name))
       .sizeIn(minHeight = TAG_MIN_HEIGHT * fontSizeSqrtMultiplier)
       .clip(shape = CircleShape)
       .clickable {
@@ -1469,6 +1480,7 @@ private fun CollapsedTagsFilterView(searchText: MutableState<TextFieldValue>) {
   }
 
   Box(Modifier
+    .ui(Ui.ChatList.PresetMenu)
     .clip(shape = CircleShape)
     .size(TAG_MIN_HEIGHT * fontSizeSqrtMultiplier)
     .clickable { showMenu.value = true },
@@ -1497,6 +1509,7 @@ private fun CollapsedTagsFilterView(searchText: MutableState<TextFieldValue>) {
         ItemAction(
           stringResource(MR.strings.chat_list_all),
           painterResource(MR.images.ic_menu),
+          uiKey = Ui.ChatList.PresetMenuAll,
           onClick = {
             onCloseMenuAction.value = {
               searchText.value = TextFieldValue()
@@ -1528,6 +1541,7 @@ fun ItemPresetFilterAction(
     stringResource(text),
     painterResource(icon),
     color = if (active) MaterialTheme.colors.primary else Color.Unspecified,
+    uiKey = Ui.ChatList.PresetMenuItem(presetTag.name),
     onClick = {
       onCloseMenuAction.value = {
         chatModel.activeChatTagFilter.value = ActiveFilter.PresetTag(presetTag)
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chatlist/ServersSummaryView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chatlist/ServersSummaryView.kt
index 31941e1f77..e44293ad55 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chatlist/ServersSummaryView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chatlist/ServersSummaryView.kt
@@ -47,6 +47,7 @@ import chat.simplex.common.model.ServerSessions
 import chat.simplex.common.model.XFTPServerSummary
 import chat.simplex.common.model.localTimestamp
 import chat.simplex.common.platform.*
+import chat.simplex.common.ui.Ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.helpers.*
 import chat.simplex.common.views.usersettings.SettingsPreferenceItem
@@ -346,7 +347,7 @@ private fun SMPSubscriptionsSection(totals: SMPTotals) {
         generalGetString(MR.strings.servers_info_subscriptions_total),
         numOrDash(totals.subs.total)
       )
-      SettingsPreferenceItem(null, stringResource(MR.strings.subscription_percentage), chatModel.controller.appPrefs.networkShowSubscriptionPercentage)
+      SettingsPreferenceItem(null, stringResource(MR.strings.subscription_percentage), chatModel.controller.appPrefs.networkShowSubscriptionPercentage, uiKey = Ui.ServersSummary.ShowPercentage)
     }
   }
 }
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chatlist/ShareListNavLinkView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chatlist/ShareListNavLinkView.kt
index b1fe42cdfc..87f87f0346 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chatlist/ShareListNavLinkView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chatlist/ShareListNavLinkView.kt
@@ -10,6 +10,8 @@ import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.dp
 import chat.simplex.common.model.*
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.UiKey
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.helpers.*
 import chat.simplex.res.*
@@ -37,7 +39,8 @@ fun ShareListNavLinkView(
             scope.launch { directChatAction(chat.remoteHostId, chat.chatInfo.contact, chatModel) }
           }
         },
-        stopped
+        stopped,
+        uiKey = Ui.Share.Row(chat.id)
       )
     }
     is ChatInfo.Group -> {
@@ -54,14 +57,16 @@ fun ShareListNavLinkView(
             scope.launch { groupChatAction(chat.remoteHostId, chat.chatInfo.groupInfo, chatModel) }
           }
         },
-        stopped
+        stopped,
+        uiKey = Ui.Share.Row(chat.id)
       )
     }
     is ChatInfo.Local ->
       ShareListNavLinkLayout(
         chatLinkPreview = { SharePreviewView(chat, disabled = false) },
         click = { scope.launch { noteFolderChatAction(chat.remoteHostId, chat.chatInfo.noteFolder) } },
-        stopped
+        stopped,
+        uiKey = Ui.Share.Row(chat.id)
       )
     is ChatInfo.ContactRequest, is ChatInfo.ContactConnection, is ChatInfo.InvalidJSON -> {}
   }
@@ -79,8 +84,9 @@ private fun ShareListNavLinkLayout(
   chatLinkPreview: @Composable () -> Unit,
   click: () -> Unit,
   stopped: Boolean,
+  uiKey: UiKey,
 ) {
-  SectionItemView(padding = PaddingValues(horizontal = DEFAULT_PADDING, vertical = 8.dp), click = click, disabled = stopped) {
+  SectionItemView(padding = PaddingValues(horizontal = DEFAULT_PADDING, vertical = 8.dp), click = click, disabled = stopped, uiKey = uiKey) {
     chatLinkPreview()
   }
   Divider(Modifier.padding(horizontal = 8.dp))
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chatlist/TagListView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chatlist/TagListView.kt
index 17e288ff00..4eae4a2161 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chatlist/TagListView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chatlist/TagListView.kt
@@ -32,6 +32,8 @@ import chat.simplex.common.model.ChatController.apiSetChatTags
 import chat.simplex.common.model.ChatController.appPrefs
 import chat.simplex.common.model.ChatModel.clearActiveChatFilterIfNeeded
 import chat.simplex.common.platform.*
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.chat.item.ItemAction
 import chat.simplex.common.views.chat.item.ReactionIcon
@@ -110,6 +112,7 @@ fun TagListView(rhId: Long?, chat: Chat? = null, close: () -> Unit, reorderMode:
 
             Row(
               Modifier
+                .ui(Ui.TagList.Tag(tag.chatTagId))
                 .fillMaxWidth()
                 .sizeIn(minHeight = DEFAULT_MIN_SECTION_ITEM_HEIGHT)
                 .clickable(
@@ -261,7 +264,7 @@ fun ModalData.TagListEditor(
         trimmedName.value.isEmpty() ||
         isDuplicateEmojiOrName.value
 
-    SectionItemView(click = { if (tagId == null) createTag() else updateTag() }, disabled = disabled) {
+    SectionItemView(click = { if (tagId == null) createTag() else updateTag() }, disabled = disabled, uiKey = Ui.TagEditor.Save) {
       Text(
         generalGetString(if (chat != null) MR.strings.add_to_list else MR.strings.save_list),
         color = if (disabled) colors.secondary else colors.primary
@@ -311,7 +314,8 @@ private fun DeleteTagAction(rhId: Long?, tag: ChatTag, showMenu: MutableState<Bo
       deleteTagDialog(rhId, tag, saving)
       showMenu.value = false
     },
-    color = Color.Red
+    color = Color.Red,
+    uiKey = Ui.ChatList.UserTagMenu(tag.chatTagId, "delete")
   )
 }
 
@@ -332,7 +336,8 @@ private fun EditTagAction(rhId: Long?, tag: ChatTag, showMenu: MutableState<Bool
         )
       }
     },
-    color = MenuTextColor
+    color = MenuTextColor,
+    uiKey = Ui.ChatList.UserTagMenu(tag.chatTagId, "edit")
   )
 }
 
@@ -370,6 +375,7 @@ fun TagListNameTextField(name: MutableState<String>, showError: State<Boolean>)
     onValueChange = { name.value = it },
     interactionSource = interactionSource,
     modifier = Modifier
+      .ui(Ui.TagEditor.Name)
       .fillMaxWidth()
       .indicatorLine(true, showError.value, interactionSource, colors)
       .heightIn(min = TextFieldDefaults.MinHeight)
@@ -483,7 +489,7 @@ private fun deleteTagDialog(rhId: Long?, tag: ChatTag, saving: MutableState<Bool
       SectionItemView({
         AlertManager.shared.hideAlert()
         deleteTag(rhId, tag, saving)
-      }) {
+      }, uiKey = Ui.Alert.Confirm(Ui.AlertSource.Shared)) {
         Text(
           generalGetString(MR.strings.confirm_verb),
           Modifier.fillMaxWidth(),
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chatlist/UserPicker.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chatlist/UserPicker.kt
index 62fd634d29..39e2705946 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chatlist/UserPicker.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/chatlist/UserPicker.kt
@@ -26,6 +26,8 @@ import chat.simplex.common.model.*
 import chat.simplex.common.model.ChatController.appPrefs
 import chat.simplex.common.model.ChatController.stopRemoteHostAndReloadHosts
 import chat.simplex.common.model.ChatModel.controller
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.UiKey
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.helpers.*
 import chat.simplex.common.platform.*
@@ -209,7 +211,7 @@ fun UserPicker(
           )
         }
       } else if (currentUser != null) {
-        SectionItemView({ onUserClicked(currentUser) }, 80.dp, padding = PaddingValues(start = 16.dp, end = DEFAULT_PADDING), disabled = stopped) {
+        SectionItemView({ onUserClicked(currentUser) }, 80.dp, padding = PaddingValues(start = 16.dp, end = DEFAULT_PADDING), disabled = stopped, uiKey = Ui.UserPicker.User(currentUser.userId)) {
           ProfilePreview(currentUser.profile, iconColor = iconColor, stopped = stopped, badge = currentUser.profile.localBadge)
         }
       }
@@ -230,7 +232,8 @@ fun UserPicker(
               if (ModalManager.start.isLastModal(modal)) close()
             }
           }
-        }, disabled = stopped
+        }, disabled = stopped,
+        uiKey = Ui.UserPicker.Address
       )
       UserPickerOptionRow(
         painterResource(MR.images.ic_toggle_on),
@@ -315,7 +318,8 @@ fun UserPicker(
                 })
             }
           },
-          disabled = stopped
+          disabled = stopped,
+          uiKey = Ui.UserPicker.Profiles
         )
       }
     }
@@ -402,7 +406,8 @@ private fun GlobalSettingsSection(
         SettingsView(chatModel, setPerformLA, close)
       }
     },
-    padding = if (appPlatform.isDesktop) PaddingValues(start = DEFAULT_PADDING * 1.7f, end = DEFAULT_PADDING + 2.dp) else PaddingValues(start = DEFAULT_PADDING, end = DEFAULT_PADDING_HALF)
+    padding = if (appPlatform.isDesktop) PaddingValues(start = DEFAULT_PADDING * 1.7f, end = DEFAULT_PADDING + 2.dp) else PaddingValues(start = DEFAULT_PADDING, end = DEFAULT_PADDING_HALF),
+    uiKey = Ui.UserPicker.Settings,
   ) {
     val text = generalGetString(MR.strings.settings_section_title_settings).lowercase().capitalize(Locale.current)
     Icon(painterResource(MR.images.ic_settings), text, tint = MaterialTheme.colors.secondary)
@@ -498,8 +503,8 @@ fun UserProfileRow(u: User, enabled: Boolean = remember { chatModel.chatRunning
 }
 
 @Composable
-fun UserPickerOptionRow(icon: Painter, text: String, click: (() -> Unit)? = null, disabled: Boolean = false) {
-  SectionItemView(click, disabled = disabled, extraPadding = appPlatform.isDesktop) {
+fun UserPickerOptionRow(icon: Painter, text: String, click: (() -> Unit)? = null, disabled: Boolean = false, uiKey: UiKey? = null) {
+  SectionItemView(click, disabled = disabled, extraPadding = appPlatform.isDesktop, uiKey = uiKey) {
     Icon(icon, text, tint = if (disabled) MaterialTheme.colors.secondary else MaterialTheme.colors.secondary)
     TextIconSpaced()
     Text(text = text, color = if (disabled) MaterialTheme.colors.secondary else Color.Unspecified)
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/AlertManager.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/AlertManager.kt
index 9c64e7ce85..63cc48c13a 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/AlertManager.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/AlertManager.kt
@@ -23,6 +23,8 @@ import androidx.compose.ui.unit.*
 import chat.simplex.common.model.ChatModel
 import chat.simplex.common.model.LocalBadge
 import chat.simplex.common.platform.*
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.res.*
 import dev.icerock.moko.resources.StringResource
@@ -155,11 +157,11 @@ class AlertManager {
               TextButton(onClick = {
                 onDismiss?.invoke()
                 hideAlert()
-              }) { Text(dismissText) }
+              }, Modifier.ui(Ui.Alert.Dismiss(uiSource))) { Text(dismissText) }
               TextButton(onClick = {
                 onConfirm?.invoke()
                 hideAlert()
-              }, Modifier.focusRequester(focusRequester)) { Text(confirmText, color = if (destructive) MaterialTheme.colors.error else Color.Unspecified) }
+              }, Modifier.ui(Ui.Alert.Confirm(uiSource)).focusRequester(focusRequester)) { Text(confirmText, color = if (destructive) MaterialTheme.colors.error else Color.Unspecified) }
             }
           }
           if (parseHtml) {
@@ -196,11 +198,11 @@ class AlertManager {
               TextButton(onClick = {
                 onDismiss?.invoke()
                 hideAlert()
-              }) { Text(dismissText) }
+              }, Modifier.ui(Ui.Alert.Dismiss(uiSource))) { Text(dismissText) }
               TextButton(onClick = {
                 onConfirm?.invoke()
                 hideAlert()
-              }) { Text(confirmText, color = if (destructive) Color.Red else Color.Unspecified, textAlign = TextAlign.End) }
+              }, Modifier.ui(Ui.Alert.Confirm(uiSource))) { Text(confirmText, color = if (destructive) Color.Red else Color.Unspecified, textAlign = TextAlign.End) }
             }
           }
         },
@@ -246,7 +248,7 @@ class AlertManager {
                   onConfirm?.invoke()
                   hideAlert()
                 },
-                Modifier.focusRequester(focusRequester)
+                Modifier.ui(Ui.Alert.Confirm(uiSource)).focusRequester(focusRequester)
               ) {
                 Text(confirmText, color = Color.Unspecified)
               }
@@ -400,7 +402,7 @@ class AlertManager {
                   TextButton(onClick = {
                     onConfirm.invoke()
                     hideAlert()
-                  }, Modifier.focusRequester(focusRequester)) {
+                  }, Modifier.ui(Ui.Alert.Confirm(uiSource)).focusRequester(focusRequester)) {
                     Text(confirmText)
                   }
                 }
@@ -415,7 +417,7 @@ class AlertManager {
                 TextButton(onClick = {
                   onDismiss?.invoke()
                   hideAlert()
-                }, if (confirmText == null) Modifier.focusRequester(focusRequester) else Modifier) {
+                }, Modifier.ui(Ui.Alert.Dismiss(uiSource)).then(if (confirmText == null) Modifier.focusRequester(focusRequester) else Modifier)) {
                   Text(dismissText)
                 }
               }
@@ -427,6 +429,9 @@ class AlertManager {
     }
   }
 
+  private val uiSource: Ui.AlertSource
+    get() = if (this === privacySensitive) Ui.AlertSource.PrivacySensitive else Ui.AlertSource.Shared
+
   @Composable
   fun showInView() {
     alertViews.collectAsState().value.lastOrNull()?.invoke()
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/DefaultTopAppBar.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/DefaultTopAppBar.kt
index 1c2ef93a09..a6ff2d233c 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/DefaultTopAppBar.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/DefaultTopAppBar.kt
@@ -15,6 +15,8 @@ import androidx.compose.ui.unit.*
 import dev.icerock.moko.resources.compose.painterResource
 import dev.icerock.moko.resources.compose.stringResource
 import chat.simplex.common.model.ChatController.appPrefs
+import chat.simplex.common.ui.UiKey
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.chat.item.CenteredRowLayout
 import chat.simplex.res.*
@@ -33,10 +35,11 @@ fun DefaultAppBar(
   onSearchValueChanged: (String) -> Unit = {},
   searchTrailingContent: @Composable (() -> Unit)? = null,
   buttons: @Composable RowScope.() -> Unit = {},
+  uiKey: UiKey? = null,
 ) {
   // If I just disable clickable modifier when don't need it, it will stop passing clicks to search. Replacing the whole modifier
   val modifier = if (!showSearch) {
-    Modifier.clickable(enabled = onTitleClick != null, onClick = onTitleClick ?: { })
+    Modifier.ui(uiKey?.part("title")).clickable(enabled = onTitleClick != null, onClick = onTitleClick ?: { })
   } else if (!onTop) Modifier.imePadding()
   else Modifier
 
@@ -81,7 +84,7 @@ fun DefaultAppBar(
         title = {
           if (showSearch) {
             val placeholder = searchPlaceholder ?: stringResource(MR.strings.search_verb)
-            SearchTextField(Modifier.fillMaxWidth(), alwaysVisible = searchAlwaysVisible, placeholder = placeholder, trailingContent = searchTrailingContent, reducedCloseButtonPadding = 12.dp, onValueChange = onSearchValueChanged)
+            SearchTextField(Modifier.ui(uiKey?.part("search")).fillMaxWidth(), alwaysVisible = searchAlwaysVisible, placeholder = placeholder, trailingContent = searchTrailingContent, reducedCloseButtonPadding = 12.dp, onValueChange = onSearchValueChanged)
           } else if (title != null) {
             title()
           } else if (titleText.value.isNotEmpty() && connection != null) {
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/ExposedDropDownSettingRow.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/ExposedDropDownSettingRow.kt
index 2867f6d8a3..b646fc31fa 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/ExposedDropDownSettingRow.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/ExposedDropDownSettingRow.kt
@@ -17,6 +17,8 @@ import androidx.compose.ui.semantics.Role
 import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.*
 import chat.simplex.res.*
+import chat.simplex.common.ui.UiKey
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.usersettings.SettingsActionItemWithContent
 import dev.icerock.moko.resources.ImageResource
@@ -31,6 +33,7 @@ fun <T> ExposedDropDownSetting(
   enabled: State<Boolean> = mutableStateOf(true),
   minWidth: Dp = 200.dp,
   maxWidth: Dp = with(LocalDensity.current) { 180.sp.toDp() },
+  uiKey: UiKey? = null,
   onSelected: (T) -> Unit
 ) {
   val expanded = remember { mutableStateOf(false) }
@@ -38,7 +41,8 @@ fun <T> ExposedDropDownSetting(
     expanded = expanded.value,
     onExpandedChange = {
       expanded.value = !expanded.value && enabled.value
-    }
+    },
+    modifier = Modifier.ui(uiKey)
   ) {
     Row(
       Modifier.padding(start = 10.dp),
@@ -70,6 +74,7 @@ fun <T> ExposedDropDownSetting(
             onSelected(selectionOption.first)
             expanded.value = false
           },
+          modifier = Modifier.ui(uiKey?.option(selectionOption.first ?: "null")),
           contentPadding = PaddingValues(horizontal = DEFAULT_PADDING * 1.5f)
         ) {
           Text(
@@ -164,9 +169,10 @@ fun <T> ExposedDropDownSettingRow(
   enabled: State<Boolean> = mutableStateOf(true),
   minWidth: Dp = 200.dp,
   maxWidth: Dp = with(LocalDensity.current) { 180.sp.toDp() },
+  uiKey: UiKey? = null,
   onSelected: (T) -> Unit
 ) {
   SettingsActionItemWithContent(icon, title, iconColor = iconTint, disabled = !enabled.value) {
-    ExposedDropDownSetting(values, selection ,textColor, label = label, enabled = enabled, minWidth = minWidth, maxWidth = maxWidth, onSelected = onSelected)
+    ExposedDropDownSetting(values, selection ,textColor, label = label, enabled = enabled, minWidth = minWidth, maxWidth = maxWidth, uiKey = uiKey, onSelected = onSelected)
   }
 }
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/ProcessedErrors.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/ProcessedErrors.kt
index 27064b21d5..19aede73ab 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/ProcessedErrors.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/ProcessedErrors.kt
@@ -16,7 +16,7 @@ class ProcessedErrors <T: AgentErrorType>(val interval: Long) {
 
   fun newError(error: T, offerRestart: Boolean) {
     timer.cancel()
-    timer = withLongRunningApi(slow = 130_000) {
+    timer = withLongRunningApi(slow = 130_000, idle = false) {
       val delayBeforeNext = (lastShownTimestamp + interval) - System.currentTimeMillis()
       if ((lastShownOfferRestart || !offerRestart) && delayBeforeNext >= 0) {
         delay(delayBeforeNext)
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/Section.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/Section.kt
index 32370ce290..04893b3242 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/Section.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/Section.kt
@@ -22,6 +22,8 @@ import androidx.compose.ui.unit.*
 import androidx.compose.ui.text.font.FontWeight
 import chat.simplex.common.platform.onRightClick
 import chat.simplex.common.platform.windowWidth
+import chat.simplex.common.ui.UiKey
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.helpers.*
 import chat.simplex.common.views.onboarding.SelectableCard
@@ -204,9 +206,11 @@ fun SectionItemView(
     PaddingValues(start = DEFAULT_PADDING * 1.7f, end = itemHPadding, top = DEFAULT_MIN_SECTION_ITEM_PADDING_VERTICAL, bottom = DEFAULT_MIN_SECTION_ITEM_PADDING_VERTICAL)
   else
     PaddingValues(horizontal = itemHPadding, vertical = DEFAULT_MIN_SECTION_ITEM_PADDING_VERTICAL),
+  uiKey: UiKey? = null,
   content: (@Composable RowScope.() -> Unit)
 ) {
   val modifier = Modifier
+    .ui(uiKey)
     .fillMaxWidth()
     .sizeIn(minHeight = minHeight)
   Row(
@@ -227,9 +231,10 @@ fun SectionItemViewWithoutMinPadding(
     PaddingValues(start = DEFAULT_PADDING * 1.7f, end = itemHPadding)
   else
     PaddingValues(horizontal = itemHPadding),
+  uiKey: UiKey? = null,
   content: (@Composable RowScope.() -> Unit)
 ) {
-  SectionItemView(click, minHeight, disabled, extraPadding, padding, content)
+  SectionItemView(click, minHeight, disabled, extraPadding, padding, uiKey = uiKey, content = content)
 }
 
 @Composable
@@ -243,9 +248,11 @@ fun SectionItemViewLongClickable(
     PaddingValues(start = DEFAULT_PADDING * 1.7f, end = itemHPadding, top = DEFAULT_MIN_SECTION_ITEM_PADDING_VERTICAL, bottom = DEFAULT_MIN_SECTION_ITEM_PADDING_VERTICAL)
   else
     PaddingValues(horizontal = itemHPadding, vertical = DEFAULT_MIN_SECTION_ITEM_PADDING_VERTICAL),
+  uiKey: UiKey? = null,
   content: (@Composable RowScope.() -> Unit)
 ) {
   val modifier = Modifier
+    .ui(uiKey)
     .fillMaxWidth()
     .sizeIn(minHeight = minHeight)
   Row(
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/SimpleButton.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/SimpleButton.kt
index d59fc1fe13..99f94e941c 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/SimpleButton.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/SimpleButton.kt
@@ -19,14 +19,17 @@ import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.text.style.TextDecoration
 import androidx.compose.ui.unit.dp
 import chat.simplex.common.platform.appPlatform
+import chat.simplex.common.ui.UiKey
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.SimpleXTheme
 import chat.simplex.res.*
 
 @Composable
 fun SimpleButton(text: String, icon: Painter,
                  color: Color = MaterialTheme.colors.primary,
+                 uiKey: UiKey? = null,
                  click: () -> Unit) {
-  SimpleButtonFrame(click) {
+  SimpleButtonFrame(click, Modifier.ui(uiKey)) {
     Icon(
       icon, text, tint = color,
       modifier = Modifier.padding(end = 8.dp)
@@ -73,9 +76,10 @@ fun SimpleButtonIconEnded(
   style: TextStyle = MaterialTheme.typography.caption,
   color: Color = MaterialTheme.colors.primary,
   disabled: Boolean = false,
+  uiKey: UiKey? = null,
   click: () -> Unit
 ) {
-  SimpleButtonFrame(click, disabled = disabled) {
+  SimpleButtonFrame(click, Modifier.ui(uiKey), disabled = disabled) {
     Text(text, style = style, color = color)
     Icon(
       icon, text, tint = color,
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/Utils.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/Utils.kt
index 81a64cb527..8c0aaeda16 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/Utils.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/helpers/Utils.kt
@@ -10,6 +10,7 @@ import androidx.compose.ui.unit.*
 import chat.simplex.common.model.*
 import chat.simplex.common.model.ChatController.appPrefs
 import chat.simplex.common.platform.*
+import chat.simplex.common.ui.UiIdle
 import chat.simplex.common.ui.theme.ThemeModeOverrides
 import chat.simplex.common.ui.theme.ThemeOverrides
 import chat.simplex.common.views.chatlist.connectIfOpenedViaUri
@@ -35,19 +36,26 @@ private val singleThreadDispatcher = Executors.newSingleThreadExecutor().asCorou
 
 fun withApi(action: suspend CoroutineScope.() -> Unit): Job =
   Exception().let {
-    CoroutineScope(Dispatchers.Main).launch(block = { wrapWithLogging(action, it) })
+    CoroutineScope(Dispatchers.Main).launch(block = { wrapWithLogging(action, it) }).trackedBy("withApi")
   }
 
 fun withBGApi(action: suspend CoroutineScope.() -> Unit): Job =
   Exception().let {
-    CoroutineScope(singleThreadDispatcher).launch(block = { wrapWithLogging(action, it) })
+    CoroutineScope(singleThreadDispatcher).launch(block = { wrapWithLogging(action, it) }).trackedBy("withBGApi")
   }
 
-fun withLongRunningApi(slow: Long = Long.MAX_VALUE, action: suspend CoroutineScope.() -> Unit): Job =
+fun withLongRunningApi(slow: Long = Long.MAX_VALUE, idle: Boolean = true, action: suspend CoroutineScope.() -> Unit): Job =
   Exception().let {
-    CoroutineScope(Dispatchers.Default).launch(block = { wrapWithLogging(action, it, slow = slow) })
+    val job = CoroutineScope(Dispatchers.Default).launch(block = { wrapWithLogging(action, it, slow = slow) })
+    if (idle) job.trackedBy("withLongRunningApi") else job
   }
 
+private fun Job.trackedBy(what: String): Job {
+  val id = UiIdle.start { what }
+  if (id != 0L) invokeOnCompletion { UiIdle.finish(id) }
+  return this
+}
+
 private suspend fun wrapWithLogging(action: suspend CoroutineScope.() -> Unit, exception: java.lang.Exception, slow: Long = 20_000) = coroutineScope {
   val start = System.currentTimeMillis()
   action()
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/newchat/AddGroupView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/newchat/AddGroupView.kt
index e2c89940ab..72d5816d76 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/newchat/AddGroupView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/newchat/AddGroupView.kt
@@ -18,6 +18,7 @@ import dev.icerock.moko.resources.compose.stringResource
 import androidx.compose.ui.unit.dp
 import androidx.compose.ui.unit.sp
 import chat.simplex.common.model.*
+import chat.simplex.common.ui.Ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.chat.group.AddGroupMembersView
 import chat.simplex.common.views.chatlist.setGroupMembers
@@ -146,13 +147,14 @@ fun AddGroupLayout(
             }
           }
           Box(Modifier.padding(horizontal = DEFAULT_PADDING)) {
-            ProfileNameField(displayName, "", { isValidDisplayName(it.trim()) }, focusRequester)
+            ProfileNameField(displayName, "", { isValidDisplayName(it.trim()) }, focusRequester, uiKey = Ui.NewGroup.Name)
           }
           Spacer(Modifier.height(8.dp))
 
           SettingsActionItem(
             painterResource(MR.images.ic_check),
             stringResource(MR.strings.create_group_button),
+            uiKey = Ui.NewGroup.Create,
             click = {
               createGroup(incognito.value, GroupProfile(
                 displayName = displayName.value.trim(),
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/newchat/NewChatSheet.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/newchat/NewChatSheet.kt
index bdad9d19c4..00fbf2db3c 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/newchat/NewChatSheet.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/newchat/NewChatSheet.kt
@@ -28,6 +28,8 @@ import androidx.compose.ui.unit.*
 import chat.simplex.common.model.*
 import chat.simplex.common.model.ChatController.appPrefs
 import chat.simplex.common.platform.*
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.UiKey
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.chat.item.CIFileViewScope
 import chat.simplex.common.views.chat.topPaddingToContent
@@ -184,30 +186,19 @@ private fun ModalData.NewChatSheetLayout(
   }
 
   val actionButtonsOriginal = listOf(
-    Triple(
-      painterResource(MR.images.ic_add_link),
-      stringResource(MR.strings.create_1_time_link),
-      addContact,
-    ),
-    Triple(
+    NewChatAction(painterResource(MR.images.ic_add_link), stringResource(MR.strings.create_1_time_link), Ui.NewChat.CreateLink, addContact),
+    NewChatAction(
       painterResource(MR.images.ic_qr_code),
       if (appPlatform.isAndroid) stringResource(MR.strings.scan_paste_link) else stringResource(MR.strings.paste_link),
+      null,
       scanPaste,
     ),
-    Triple(
-      painterResource(MR.images.ic_group),
-      stringResource(MR.strings.create_group_button),
-      createGroup,
-    ),
-    Triple(
-      painterResource(MR.images.ic_bigtop_updates),
-      stringResource(MR.strings.create_channel_button),
-      createChannel,
-    )
+    NewChatAction(painterResource(MR.images.ic_group), stringResource(MR.strings.create_group_button), Ui.NewChat.CreateGroup, createGroup),
+    NewChatAction(painterResource(MR.images.ic_bigtop_updates), stringResource(MR.strings.create_channel_button), null, createChannel),
   )
 
   @Composable
-  fun DeletedChatsItem(actionButtons: List<Triple<Painter, String, () -> Unit>>) {
+  fun DeletedChatsItem(actionButtons: List<NewChatAction>) {
     if (searchText.value.text.isEmpty()) {
       Spacer(Modifier.padding(bottom = 27.dp))
     }
@@ -217,9 +208,10 @@ private fun ModalData.NewChatSheetLayout(
         SectionView {
           actionButtons.map {
             NewChatButton(
-              icon = it.first,
-              text = it.second,
-              click = it.third,
+              icon = it.icon,
+              text = it.text,
+              click = it.click,
+              uiKey = it.uiKey,
             )
           }
         }
@@ -454,6 +446,8 @@ private fun ModalData.NewChatSheetLayout(
   }
 }
 
+private class NewChatAction(val icon: Painter, val text: String, val uiKey: UiKey?, val click: () -> Unit)
+
 @Composable
 private fun NewChatButton(
   icon: Painter,
@@ -461,9 +455,10 @@ private fun NewChatButton(
   click: () -> Unit,
   textColor: Color = Color.Unspecified,
   iconColor: Color = MaterialTheme.colors.primary,
-  disabled: Boolean = false
+  disabled: Boolean = false,
+  uiKey: UiKey? = null,
 ) {
-  SectionItemView(click, disabled = disabled) {
+  SectionItemView(click, disabled = disabled, uiKey = uiKey) {
     Row {
       Icon(icon, text, tint = if (disabled) MaterialTheme.colors.secondary else iconColor)
       TextIconSpaced(false)
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/newchat/NewChatView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/newchat/NewChatView.kt
index 29819f21cb..e60059bc24 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/newchat/NewChatView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/newchat/NewChatView.kt
@@ -36,6 +36,9 @@ import chat.simplex.common.model.*
 import chat.simplex.common.model.ChatController.appPrefs
 import chat.simplex.common.model.ChatModel.controller
 import chat.simplex.common.platform.*
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.UiKey
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.chat.item.CIFileViewScope
 import chat.simplex.common.views.chat.topPaddingToContent
@@ -231,12 +234,14 @@ private fun ProfilePickerOption(
   onSelected: () -> Unit,
   image: @Composable () -> Unit,
   onInfo: (() -> Unit)? = null,
-  badge: LocalBadge? = null
+  badge: LocalBadge? = null,
+  uiKey: UiKey? = null
 ) {
   Row(
     Modifier
       .fillMaxWidth()
       .sizeIn(minHeight = DEFAULT_MIN_SECTION_ITEM_HEIGHT + 8.dp)
+      .ui(uiKey)
       .clickable(enabled = !disabled, onClick = onSelected)
       .padding(horizontal = DEFAULT_PADDING, vertical = 4.dp),
     horizontalArrangement = Arrangement.SpaceBetween,
@@ -401,6 +406,7 @@ fun ActiveProfilePicker(
         IncognitoOptionImage()
       },
       onInfo = { ModalManager.start.showModal { IncognitoView() } },
+      uiKey = Ui.Link.ProfileIncognito
     )
   }
 
@@ -529,6 +535,7 @@ private fun InviteView(rhId: Long?, connLinkInvitation: CreatedConnLink, contact
           start = 16.dp,
           end = 16.dp
         ),
+        uiKey = Ui.Link.ShareProfile,
         click = {
           ModalManager.start.showCustomModal(keyboardCoversBar = false) { close ->
             val search = rememberSaveable { mutableStateOf("") }
@@ -716,7 +723,7 @@ private fun PasteLinkView(rhId: Long?, pastedLink: MutableState<String>, showQRC
 fun LinkTextView(link: String, share: Boolean) {
   val clipboard = LocalClipboardManager.current
   Row(Modifier.fillMaxWidth().heightIn(min = DEFAULT_MIN_SECTION_ITEM_HEIGHT).padding(horizontal = DEFAULT_PADDING), verticalAlignment = Alignment.CenterVertically) {
-    Box(Modifier.weight(1f).clickable {
+    Box(Modifier.weight(1f).ui(Ui.Link.Text).clickable {
       chatModel.markShowingInvitationUsed()
       clipboard.shareText(link)
     }) {
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/onboarding/ChooseServerOperators.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/onboarding/ChooseServerOperators.kt
index 30be129aa8..8255e0db66 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/onboarding/ChooseServerOperators.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/onboarding/ChooseServerOperators.kt
@@ -28,6 +28,8 @@ import chat.simplex.common.BuildConfigCommon
 import chat.simplex.common.model.*
 import chat.simplex.common.model.ChatController.appPrefs
 import chat.simplex.common.platform.*
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.helpers.*
 import chat.simplex.common.views.newchat.darkStops
@@ -104,6 +106,7 @@ fun OnboardingConditionsView(chatModel: ChatModel) {
                   fontWeight = FontWeight.Medium,
                   color = MaterialTheme.colors.primary,
                   modifier = Modifier
+                    .ui(Ui.Onboarding.ConditionsLink)
                     .clickable(
                       interactionSource = remember { MutableInteractionSource() },
                       indication = null
@@ -150,6 +153,7 @@ private fun OnboardingConditionsDesktop(selectedOperatorIds: MutableState<Set<Lo
               fontWeight = FontWeight.Medium,
               color = MaterialTheme.colors.primary,
               modifier = Modifier
+                .ui(Ui.Onboarding.ConditionsLink)
                 .clickable(
                   interactionSource = remember { MutableInteractionSource() },
                   indication = null
@@ -197,7 +201,8 @@ fun ModalData.ChooseServerOperators(
         Column(Modifier.fillMaxWidth().padding(horizontal = DEFAULT_PADDING), horizontalAlignment = Alignment.CenterHorizontally) {
           OnboardingInformationButton(
             stringResource(MR.strings.how_it_helps_privacy),
-            onClick = { ModalManager.fullscreen.showModal { ChooseServerOperatorsInfoView() } }
+            onClick = { ModalManager.fullscreen.showModal { ChooseServerOperatorsInfoView() } },
+            uiKey = Ui.Onboarding.HowItHelps
           )
         }
 
@@ -240,6 +245,7 @@ private fun OperatorCheckView(serverOperator: ServerOperator, selectedOperatorId
       selectedOperatorIds.value += serverOperator.operatorId
     }
   },
+    modifier = Modifier.ui(Ui.Onboarding.Operator(serverOperator.operatorId)),
     border = BorderStroke(1.dp, color = if (checked) MaterialTheme.colors.primary else MaterialTheme.colors.secondary.copy(alpha = 0.5f)),
     shape = RoundedCornerShape(18.dp)
   ) {
@@ -280,7 +286,7 @@ private fun CircleCheckbox(checked: Boolean) {
 @Composable
 private fun SetOperatorsButton(enabled: Boolean, close: () -> Unit) {
   OnboardingActionButton(
-    modifier = if (appPlatform.isAndroid) Modifier.padding(horizontal = DEFAULT_ONBOARDING_HORIZONTAL_PADDING).fillMaxWidth() else Modifier.widthIn(min = 300.dp),
+    modifier = (if (appPlatform.isAndroid) Modifier.padding(horizontal = DEFAULT_ONBOARDING_HORIZONTAL_PADDING).fillMaxWidth() else Modifier.widthIn(min = 300.dp)).ui(Ui.Onboarding.OperatorsOk),
     labelId = MR.strings.ok,
     onboarding = null,
     enabled = enabled,
@@ -316,7 +322,7 @@ private fun AcceptConditionsButton(
   selectedOperatorIds: State<Set<Long>>
 ) {
   OnboardingActionButton(
-    modifier = if (appPlatform.isAndroid) Modifier.padding(horizontal = DEFAULT_ONBOARDING_HORIZONTAL_PADDING).fillMaxWidth() else Modifier.widthIn(min = 300.dp),
+    modifier = (if (appPlatform.isAndroid) Modifier.padding(horizontal = DEFAULT_ONBOARDING_HORIZONTAL_PADDING).fillMaxWidth() else Modifier.widthIn(min = 300.dp)).ui(Ui.Onboarding.Accept),
     labelId = MR.strings.onboarding_conditions_accept,
     onboarding = null,
     enabled = enabled,
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/onboarding/SetupDatabasePassphrase.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/onboarding/SetupDatabasePassphrase.kt
index f198fe1f7a..f812c92de2 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/onboarding/SetupDatabasePassphrase.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/onboarding/SetupDatabasePassphrase.kt
@@ -17,6 +17,8 @@ import androidx.compose.ui.text.style.TextAlign
 import androidx.compose.ui.unit.dp
 import chat.simplex.common.model.*
 import chat.simplex.common.platform.*
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.database.*
 import chat.simplex.common.views.helpers.*
@@ -140,6 +142,7 @@ private fun SetupDatabasePassphraseLayout(
             newKey,
             generalGetString(MR.strings.new_passphrase),
             modifier = Modifier
+              .ui(Ui.Onboarding.NewPassphrase)
               .padding(horizontal = DEFAULT_PADDING)
               .focusRequester(focusRequester)
               .onPreviewKeyEvent {
@@ -160,6 +163,7 @@ private fun SetupDatabasePassphraseLayout(
             confirmNewKey,
             generalGetString(MR.strings.confirm_new_passphrase),
             modifier = Modifier
+              .ui(Ui.Onboarding.ConfirmPassphrase)
               .padding(horizontal = DEFAULT_PADDING)
               .onPreviewKeyEvent {
                 if (!disabled && (it.key == Key.Enter || it.key == Key.NumPadEnter) && it.type == KeyEventType.KeyUp) {
@@ -193,7 +197,7 @@ private fun SetupDatabasePassphraseLayout(
 @Composable
 private fun SetPassphraseButton(disabled: Boolean, onClick: () -> Unit) {
   OnboardingActionButton(
-    if (appPlatform.isAndroid) Modifier.padding(horizontal = DEFAULT_PADDING).fillMaxWidth() else Modifier.widthIn(min = 300.dp),
+    (if (appPlatform.isAndroid) Modifier.padding(horizontal = DEFAULT_PADDING).fillMaxWidth() else Modifier.widthIn(min = 300.dp)).ui(Ui.Onboarding.SetPassphrase),
     labelId = MR.strings.set_database_passphrase,
     onboarding = null,
     onclick = onClick,
@@ -203,7 +207,7 @@ private fun SetPassphraseButton(disabled: Boolean, onClick: () -> Unit) {
 
 @Composable
 private fun SkipButton(disabled: Boolean, onClick: () -> Unit) {
-  TextButtonBelowOnboardingButton(stringResource(MR.strings.use_random_passphrase), onClick = if (disabled) null else onClick)
+  TextButtonBelowOnboardingButton(stringResource(MR.strings.use_random_passphrase), onClick = if (disabled) null else onClick, uiKey = Ui.Onboarding.RandomPassphrase)
 }
 
 @Composable
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/onboarding/SimpleXInfo.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/onboarding/SimpleXInfo.kt
index 41229037b5..fe4f2b4670 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/onboarding/SimpleXInfo.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/onboarding/SimpleXInfo.kt
@@ -28,6 +28,9 @@ import chat.simplex.common.BuildConfigCommon
 import chat.simplex.common.model.*
 import chat.simplex.common.model.ChatController.appPrefs
 import chat.simplex.common.platform.*
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.UiKey
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.helpers.*
 import chat.simplex.common.views.newchat.darkStops
@@ -86,7 +89,7 @@ private fun SimpleXInfoDesktop(chatModel: ChatModel) {
         Spacer(Modifier.fillMaxHeight().weight(1f))
         Column(Modifier.widthIn(max = 1000.dp).align(Alignment.CenterHorizontally), horizontalAlignment = Alignment.CenterHorizontally) {
           OnboardingActionButton(user, onboardingStage)
-          TextButtonBelowOnboardingButton(stringResource(MR.strings.why_simplex_is_built), icon = painterResource(MR.images.ic_info), onClick = {
+          TextButtonBelowOnboardingButton(stringResource(MR.strings.why_simplex_is_built), icon = painterResource(MR.images.ic_info), uiKey = Ui.Onboarding.WhyBuilt, onClick = {
             ModalManager.fullscreen.showModal(forceAnimated = true) { HowItWorks(user, onboardingStage) }
           })
         }
@@ -154,7 +157,7 @@ fun SimpleXInfoLayout(
       if (onboardingStage != null) {
         Column(Modifier.widthIn(max = if (appPlatform.isAndroid) 450.dp else 1000.dp), horizontalAlignment = Alignment.CenterHorizontally) {
           OnboardingActionButton(user, onboardingStage)
-          TextButtonBelowOnboardingButton(stringResource(MR.strings.why_simplex_is_built), icon = painterResource(MR.images.ic_info), onClick = {
+          TextButtonBelowOnboardingButton(stringResource(MR.strings.why_simplex_is_built), icon = painterResource(MR.images.ic_info), uiKey = Ui.Onboarding.WhyBuilt, onClick = {
             ModalManager.fullscreen.showModal { HowItWorks(user, onboardingStage) }
           })
         }
@@ -220,13 +223,13 @@ fun OnboardingActionButton(
 }
 
 @Composable
-fun TextButtonBelowOnboardingButton(text: String, onClick: (() -> Unit)?, icon: Painter? = null) {
+fun TextButtonBelowOnboardingButton(text: String, onClick: (() -> Unit)?, icon: Painter? = null, uiKey: UiKey? = null) {
   val state = getKeyboardState()
   val enabled = onClick != null
   val topPadding by animateDpAsState(if (appPlatform.isAndroid && state.value == KeyboardState.Opened) 0.dp else 7.5.dp)
   val bottomPadding by animateDpAsState(if (appPlatform.isAndroid && state.value == KeyboardState.Opened) 0.dp else 7.5.dp)
   if ((appPlatform.isAndroid && state.value == KeyboardState.Closed) || topPadding > 0.dp) {
-    TextButton({ onClick?.invoke() }, Modifier.padding(top = topPadding, bottom = bottomPadding).clip(CircleShape), enabled = enabled) {
+    TextButton({ onClick?.invoke() }, Modifier.ui(uiKey).padding(top = topPadding, bottom = bottomPadding).clip(CircleShape), enabled = enabled) {
       if (icon != null) {
         Icon(icon, null, tint = MaterialTheme.colors.primary)
         Spacer(Modifier.width(4.dp))
@@ -249,9 +252,11 @@ fun TextButtonBelowOnboardingButton(text: String, onClick: (() -> Unit)?, icon:
 fun OnboardingInformationButton(
   text: String,
   onClick: () -> Unit,
+  uiKey: UiKey? = null,
 ) {
   Box(
     modifier = Modifier
+      .ui(uiKey)
       .clip(CircleShape)
       .clickable { onClick() }
   ) {
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/onboarding/WhatsNewView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/onboarding/WhatsNewView.kt
index 81ea810acb..6f7ccb31a5 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/onboarding/WhatsNewView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/onboarding/WhatsNewView.kt
@@ -53,6 +53,8 @@ import chat.simplex.common.model.*
 import chat.simplex.common.model.ChatController.setConditionsNotified
 import chat.simplex.common.model.ServerOperator.Companion.dummyOperatorInfo
 import chat.simplex.common.platform.*
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.chat.item.CIFileViewScope
 import chat.simplex.common.views.helpers.*
@@ -199,6 +201,7 @@ fun ModalData.WhatsNewView(updatedConditions: Boolean = false, viaSettings: Bool
           stringResource(MR.strings.view_updated_conditions),
           color = MaterialTheme.colors.primary,
           modifier = Modifier
+            .ui(Ui.WhatsNew.ViewConditions)
             .clickable(
               interactionSource = remember { MutableInteractionSource() },
               indication = null
@@ -225,6 +228,7 @@ fun ModalData.WhatsNewView(updatedConditions: Boolean = false, viaSettings: Bool
               verticalAlignment = Alignment.CenterVertically,
               horizontalArrangement = Arrangement.Center,
               modifier = Modifier
+                .ui(Ui.WhatsNew.Ok)
                 .clickable { close() }
                 .padding(8.dp)
             ) {
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/onboarding/YourNetwork.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/onboarding/YourNetwork.kt
index 45f7927c8b..125fab7b86 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/onboarding/YourNetwork.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/onboarding/YourNetwork.kt
@@ -24,6 +24,8 @@ import chat.simplex.common.BuildConfigCommon
 import chat.simplex.common.model.*
 import chat.simplex.common.model.ChatController.appPrefs
 import chat.simplex.common.platform.*
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.helpers.*
 import chat.simplex.common.views.newchat.darkStops
@@ -116,7 +118,7 @@ fun YourNetworkView(chatModel: ChatModel) {
               horizontalAlignment = Alignment.CenterHorizontally
             ) {
               OnboardingActionButton(
-                modifier = Modifier.padding(horizontal = DEFAULT_ONBOARDING_HORIZONTAL_PADDING).fillMaxWidth(),
+                modifier = Modifier.padding(horizontal = DEFAULT_ONBOARDING_HORIZONTAL_PADDING).fillMaxWidth().ui(Ui.Onboarding.Continue),
                 labelId = MR.strings.onboarding_network_operators_continue,
                 onboarding = null,
                 onclick = {
@@ -155,7 +157,7 @@ private fun YourNetworkDesktop(
         Spacer(Modifier.fillMaxHeight().weight(1f))
         Column(Modifier.widthIn(max = 1000.dp).align(Alignment.CenterHorizontally), horizontalAlignment = Alignment.CenterHorizontally) {
           OnboardingActionButton(
-            Modifier.widthIn(min = 300.dp),
+            Modifier.widthIn(min = 300.dp).ui(Ui.Onboarding.Continue),
             labelId = MR.strings.onboarding_network_operators_continue,
             onboarding = null,
             onclick = {
@@ -173,6 +175,7 @@ private fun YourNetworkDesktop(
 private fun ConfigureRoutersButton(serverOperators: State<List<ServerOperator>>, selectedOperatorIds: State<Set<Long>>, onClick: () -> Unit) {
   Box(
     modifier = Modifier
+      .ui(Ui.Onboarding.SetupRouters)
       .clip(CircleShape)
       .clickable { onClick() }
   ) {
@@ -206,6 +209,7 @@ private fun ConfigureNotificationsButton(notificationMode: State<NotificationsMo
   }
   Box(
     modifier = Modifier
+      .ui(Ui.Onboarding.SetupNotifications)
       .clip(CircleShape)
       .clickable { onClick() }
   ) {
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/remote/ConnectMobileView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/remote/ConnectMobileView.kt
index 57700aeba3..004611b842 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/remote/ConnectMobileView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/remote/ConnectMobileView.kt
@@ -29,6 +29,8 @@ import chat.simplex.common.model.*
 import chat.simplex.common.model.ChatController.stopRemoteHostAndReloadHosts
 import chat.simplex.common.model.ChatModel.controller
 import chat.simplex.common.platform.*
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.chat.item.ItemAction
 import chat.simplex.common.views.chatlist.*
@@ -158,7 +160,7 @@ fun DeviceNameField(
   DefaultConfigurableTextField(
     state = state,
     placeholder = generalGetString(MR.strings.enter_this_device_name),
-    modifier = Modifier.fillMaxWidth().padding(start = DEFAULT_PADDING),
+    modifier = Modifier.ui(Ui.Remote.DeviceName).fillMaxWidth().padding(start = DEFAULT_PADDING),
     isValid = { true },
   )
   KeyChangeEffect(state.value) {
@@ -207,7 +209,7 @@ private fun ConnectMobileViewLayout(
         if (remember { controller.appPrefs.developerTools.state }.value) {
           val clipboard = LocalClipboardManager.current
           Spacer(Modifier.height(DEFAULT_PADDING_HALF))
-          SectionItemView({ clipboard.shareText(invitation) }) {
+          SectionItemView({ clipboard.shareText(invitation) }, uiKey = Ui.Remote.ShareLink) {
             Text(generalGetString(MR.strings.share_link), color = MaterialTheme.colors.primary)
           }
         }
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/Appearance.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/Appearance.kt
index a661568a0d..b3ddb75d1c 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/Appearance.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/Appearance.kt
@@ -31,6 +31,8 @@ import dev.icerock.moko.resources.compose.painterResource
 import dev.icerock.moko.resources.compose.stringResource
 import chat.simplex.common.model.*
 import chat.simplex.common.model.ChatController.appPrefs
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.helpers.*
 import chat.simplex.common.model.ChatModel
@@ -231,6 +233,7 @@ object AppearanceScope {
         if (appPlatform.isAndroid) {
           Slider(
             localFontScale.value,
+            modifier = Modifier.ui(Ui.Appearance.FontScale),
             valueRange = 0.75f..1.25f,
             steps = 11,
             onValueChange = {
@@ -248,6 +251,7 @@ object AppearanceScope {
         } else {
           Slider(
             localFontScale.value,
+            modifier = Modifier.ui(Ui.Appearance.FontScale),
             valueRange = 0.7f..1.5f,
             steps = 9,
             onValueChange = {
@@ -1157,6 +1161,7 @@ object AppearanceScope {
       state,
       icon = null,
       enabled = remember { mutableStateOf(true) },
+      uiKey = Ui.Appearance.ColorMode,
       onSelected = onSelected
     )
   }
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/CallSettings.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/CallSettings.kt
index ca9c66df27..1c55d1ebff 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/CallSettings.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/CallSettings.kt
@@ -18,6 +18,8 @@ import chat.simplex.common.views.helpers.*
 import chat.simplex.common.model.*
 import chat.simplex.common.platform.ColumnWithScrollBar
 import chat.simplex.common.platform.appPlatform
+import chat.simplex.common.ui.UiKey
+import chat.simplex.common.ui.ui
 import chat.simplex.res.*
 
 @Composable
@@ -85,9 +87,11 @@ private fun LockscreenOpts(lockscreenOpts: State<CallOnLockScreen>, enabled: Sta
 fun SharedPreferenceToggle(
   preference: SharedPreference<Boolean>,
   enabled: Boolean = true,
+  uiKey: UiKey? = null,
   onChange: ((Boolean) -> Unit)? = null,
 ) {
   DefaultSwitch(
+    modifier = Modifier.ui(uiKey),
     enabled = enabled,
     checked = remember { preference.state }.value,
     onCheckedChange = {
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/SettingsView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/SettingsView.kt
index bd929bc2f7..9bdf240c1f 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/SettingsView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/SettingsView.kt
@@ -25,6 +25,8 @@ import androidx.compose.ui.unit.*
 import chat.simplex.common.model.*
 import chat.simplex.common.model.ChatController.appPrefs
 import chat.simplex.common.platform.*
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.UiKey
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.badges.BadgesView
 import chat.simplex.common.views.database.DatabaseView
@@ -99,9 +101,9 @@ fun SettingsLayout(
     AppBarTitle(stringResource(MR.strings.your_settings))
 
     SectionView {
-      SettingsActionItem(painterResource(MR.images.ic_light_mode), stringResource(MR.strings.appearance_settings), showSettingsModal { AppearanceView(it) })
+      SettingsActionItem(painterResource(MR.images.ic_light_mode), stringResource(MR.strings.appearance_settings), showSettingsModal { AppearanceView(it) }, uiKey = Ui.Settings.Appearance)
       SettingsActionItem(painterResource(MR.images.ic_lock), stringResource(MR.strings.your_privacy), showSettingsModal { PrivacySettingsView(it, showSettingsModal, setPerformLA) }, disabled = stopped)
-      SettingsActionItem(painterResource(MR.images.ic_help), stringResource(MR.strings.help_and_support), showSettingsModal { HelpAndSupportView(it, showModal, showCustomModal) })
+      SettingsActionItem(painterResource(MR.images.ic_help), stringResource(MR.strings.help_and_support), showSettingsModal { HelpAndSupportView(it, showModal, showCustomModal) }, uiKey = Ui.Settings.Help)
       DatabaseItem(encrypted, passphraseSaved, showSettingsModal { DatabaseView() }, stopped)
       SettingsActionItem(painterResource(MR.images.ic_ios_share), stringResource(MR.strings.migrate_from_device_to_another_device), { withAuth(generalGetString(MR.strings.auth_open_migration_to_another_device), generalGetString(MR.strings.auth_log_in_using_credential)) { ModalManager.fullscreen.showCustomModal { close -> MigrateFromDeviceView(close) } } }, disabled = stopped)
     }
@@ -157,7 +159,7 @@ fun HelpAndSupportView(
 
     SectionView(stringResource(MR.strings.settings_section_title_help)) {
       SettingsActionItem(painterResource(MR.images.ic_help), stringResource(MR.strings.how_to_use_simplex_chat), showModal { HelpView(userDisplayName) }, disabled = stopped)
-      SettingsActionItem(painterResource(MR.images.ic_add), stringResource(MR.strings.whats_new), showCustomModal { _, close -> WhatsNewView(viaSettings = true, close = close) }, disabled = stopped)
+      SettingsActionItem(painterResource(MR.images.ic_add), stringResource(MR.strings.whats_new), showCustomModal { _, close -> WhatsNewView(viaSettings = true, close = close) }, disabled = stopped, uiKey = Ui.Help.WhatsNew)
       SettingsActionItem(painterResource(MR.images.ic_info), stringResource(MR.strings.about_simplex_chat), showModal { SimpleXInfo(it, onboarding = false) })
     }
     SectionDividerSpaced()
@@ -381,8 +383,8 @@ fun AppVersionItem(showVersion: () -> Unit) {
 }
 
 @Composable
-fun SettingsActionItem(icon: Painter, text: String, click: (() -> Unit)? = null, textColor: Color = Color.Unspecified, iconColor: Color = MaterialTheme.colors.secondary, disabled: Boolean = false, extraPadding: Boolean = false) {
-  SectionItemView(click, disabled = disabled, extraPadding = extraPadding) {
+fun SettingsActionItem(icon: Painter, text: String, click: (() -> Unit)? = null, textColor: Color = Color.Unspecified, iconColor: Color = MaterialTheme.colors.secondary, disabled: Boolean = false, extraPadding: Boolean = false, uiKey: UiKey? = null) {
+  SectionItemView(click, disabled = disabled, extraPadding = extraPadding, uiKey = uiKey) {
     Icon(icon, text, tint = if (disabled) MaterialTheme.colors.secondary else iconColor)
     TextIconSpaced(extraPadding)
     Text(text, color = if (disabled) MaterialTheme.colors.secondary else textColor)
@@ -426,10 +428,11 @@ fun SettingsPreferenceItem(
   pref: SharedPreference<Boolean>,
   iconColor: Color = MaterialTheme.colors.secondary,
   enabled: Boolean = true,
+  uiKey: UiKey? = null,
   onChange: ((Boolean) -> Unit)? = null,
 ) {
   SettingsActionItemWithContent(icon, text, iconColor = iconColor,) {
-    SharedPreferenceToggle(pref, enabled, onChange)
+    SharedPreferenceToggle(pref, enabled, uiKey, onChange)
   }
 }
 
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/UserAddressView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/UserAddressView.kt
index 826648ddb8..b065f9c736 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/UserAddressView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/UserAddressView.kt
@@ -25,6 +25,7 @@ import dev.icerock.moko.resources.compose.painterResource
 import dev.icerock.moko.resources.compose.stringResource
 import androidx.compose.ui.unit.dp
 import chat.simplex.common.model.*
+import chat.simplex.common.ui.Ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.helpers.*
 import chat.simplex.common.model.ChatModel
@@ -433,6 +434,7 @@ private fun CreateAddressButton(onClick: () -> Unit) {
     onClick,
     iconColor = MaterialTheme.colors.primary,
     textColor = MaterialTheme.colors.primary,
+    uiKey = Ui.Address.Create,
   )
 }
 
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/UserProfileView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/UserProfileView.kt
index cc1149e44d..d7234ec04b 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/UserProfileView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/UserProfileView.kt
@@ -18,6 +18,8 @@ import androidx.compose.ui.text.style.TextAlign
 import androidx.compose.ui.unit.dp
 import androidx.compose.ui.unit.sp
 import chat.simplex.common.model.*
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.helpers.*
 import chat.simplex.common.views.onboarding.ReadableText
@@ -197,7 +199,7 @@ fun UserProfileLayout(
                 }
               }
             }
-            ProfileNameField(displayName, "", { isValidNewProfileName(it, profile) }, focusRequester)
+            ProfileNameField(displayName, "", { isValidNewProfileName(it, profile) }, focusRequester, uiKey = Ui.Profile.Name)
             if (showFullName(profile)) {
               Spacer(Modifier.height(DEFAULT_PADDING))
               Text(
@@ -236,7 +238,7 @@ fun UserProfileLayout(
 
             Spacer(Modifier.height(DEFAULT_PADDING))
             val enabled = !dataUnchanged() && canSaveProfile(displayName.value, shortDescr.value, profile)
-            val saveModifier: Modifier = Modifier.clickable(enabled) { saveProfile(displayName.value, fullName.value, shortDescr.value, description.value, profileImage.value) }
+            val saveModifier: Modifier = Modifier.ui(Ui.Profile.Save).clickable(enabled) { saveProfile(displayName.value, fullName.value, shortDescr.value, description.value, profileImage.value) }
             val saveColor: Color = if (enabled) MaterialTheme.colors.primary else MaterialTheme.colors.secondary
             Text(
               stringResource(MR.strings.save_and_notify_contacts),
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/UserProfilesView.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/UserProfilesView.kt
index e91d6c2ce0..eec6264a34 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/UserProfilesView.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/UserProfilesView.kt
@@ -22,6 +22,7 @@ import androidx.compose.ui.unit.dp
 import chat.simplex.common.model.*
 import chat.simplex.common.model.ChatModel.controller
 import chat.simplex.common.platform.*
+import chat.simplex.common.ui.Ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.chat.item.ItemAction
 import chat.simplex.common.views.chatlist.UserProfilePickerItem
@@ -179,7 +180,7 @@ private fun UserProfilesLayout(
         Divider(Modifier.padding(horizontal = 8.dp))
       }
       if (searchTextOrPassword.value.trim().isEmpty()) {
-        SectionItemView(addUser, minHeight = 68.dp) {
+        SectionItemView(addUser, minHeight = 68.dp, uiKey = Ui.Profiles.Add) {
           Icon(painterResource(MR.images.ic_add), stringResource(MR.strings.users_add), tint = MaterialTheme.colors.primary)
           Spacer(Modifier.padding(horizontal = 4.dp))
           Text(stringResource(MR.strings.users_add), color = MaterialTheme.colors.primary)
diff --git a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/networkAndServers/NetworkAndServers.kt b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/networkAndServers/NetworkAndServers.kt
index 92714b5910..8c9baf3fec 100644
--- a/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/networkAndServers/NetworkAndServers.kt
+++ b/apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/usersettings/networkAndServers/NetworkAndServers.kt
@@ -38,6 +38,8 @@ import chat.simplex.common.model.ChatController.getUserServers
 import chat.simplex.common.model.ChatController.setUserServers
 import chat.simplex.common.model.ChatModel.controller
 import chat.simplex.common.platform.*
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.helpers.*
 import chat.simplex.common.views.onboarding.OnboardingActionButton
@@ -839,7 +841,7 @@ fun SimpleConditionsView(
     }
     Column(Modifier.widthIn(max = if (appPlatform.isAndroid) 450.dp else 1000.dp).padding(bottom = DEFAULT_PADDING * 2).align(Alignment.CenterHorizontally), horizontalAlignment = Alignment.CenterHorizontally) {
       OnboardingActionButton(
-        modifier = if (appPlatform.isAndroid) Modifier.padding(horizontal = DEFAULT_ONBOARDING_HORIZONTAL_PADDING).fillMaxWidth() else Modifier.widthIn(min = 300.dp),
+        modifier = (if (appPlatform.isAndroid) Modifier.padding(horizontal = DEFAULT_ONBOARDING_HORIZONTAL_PADDING).fillMaxWidth() else Modifier.widthIn(min = 300.dp)).ui(Ui.Onboarding.ConditionsAccept),
         labelId = MR.strings.onboarding_conditions_accept,
         onboarding = null,
         onclick = onAccept
diff --git a/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/platform/PlatformTextField.desktop.kt b/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/platform/PlatformTextField.desktop.kt
index 3e048a93d5..b2e6fc9b21 100644
--- a/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/platform/PlatformTextField.desktop.kt
+++ b/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/platform/PlatformTextField.desktop.kt
@@ -20,6 +20,8 @@ import androidx.compose.ui.text.font.FontStyle
 import androidx.compose.ui.text.input.*
 import androidx.compose.ui.unit.LayoutDirection
 import androidx.compose.ui.unit.dp
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.ui
 import chat.simplex.common.views.chat.*
 import chat.simplex.common.views.helpers.*
 import chat.simplex.res.*
@@ -116,6 +118,7 @@ actual fun PlatformTextField(
       autoCorrectEnabled = true
     ),
     modifier = Modifier
+      .ui(Ui.Chat.Message)
       .padding(start = startPadding, end = endPadding)
       .offset(y = (-5).dp)
       .fillMaxWidth()
diff --git a/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/chatlist/ChatListNavLinkView.desktop.kt b/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/chatlist/ChatListNavLinkView.desktop.kt
index c875c0c9da..89fc1756db 100644
--- a/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/chatlist/ChatListNavLinkView.desktop.kt
+++ b/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/chatlist/ChatListNavLinkView.desktop.kt
@@ -12,6 +12,8 @@ import androidx.compose.ui.node.DelegatableNode
 import androidx.compose.ui.node.DrawModifierNode
 import androidx.compose.ui.unit.dp
 import chat.simplex.common.platform.onRightClick
+import chat.simplex.common.ui.UiKey
+import chat.simplex.common.ui.ui
 import chat.simplex.common.views.helpers.*
 
 object NoIndication : IndicationNodeFactory {
@@ -33,8 +35,9 @@ actual fun ChatListNavLinkLayout(
   disabled: Boolean,
   selectedChat: State<Boolean>,
   nextChatSelected: State<Boolean>,
+  uiKey: UiKey?,
 ) {
-  var modifier = Modifier.fillMaxWidth()
+  var modifier = Modifier.fillMaxWidth().ui(uiKey)
   if (!disabled) modifier = modifier
     .combinedClickable(onClick = click, onLongClick = { showMenu.value = true })
     .onRightClick { showMenu.value = true }
diff --git a/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/chatlist/TagListView.desktop.kt b/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/chatlist/TagListView.desktop.kt
index dba5ddb9e6..bfb3badbfb 100644
--- a/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/chatlist/TagListView.desktop.kt
+++ b/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/chatlist/TagListView.desktop.kt
@@ -13,6 +13,8 @@ import androidx.compose.ui.text.input.TextFieldValue
 import androidx.compose.ui.text.style.TextAlign
 import androidx.compose.ui.unit.dp
 import androidx.compose.ui.unit.sp
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.ui.theme.ThemeManager.colorFromReadableHex
 import chat.simplex.common.views.chat.item.isHeartEmoji
@@ -55,6 +57,7 @@ private fun SingleEmojiInput(
     },
     singleLine = true,
     modifier = Modifier
+      .ui(Ui.TagEditor.Emoji)
       .padding(4.dp)
       .size(width = TextFieldDefaults.MinHeight.value.sp.toDp(), height = TextFieldDefaults.MinHeight),
     textStyle = LocalTextStyle.current.copy(fontFamily = EmojiFont, textAlign = TextAlign.Center),
diff --git a/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/chatlist/UserPicker.desktop.kt b/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/chatlist/UserPicker.desktop.kt
index 43428bab72..d58d3b8742 100644
--- a/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/chatlist/UserPicker.desktop.kt
+++ b/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/chatlist/UserPicker.desktop.kt
@@ -19,6 +19,8 @@ import chat.simplex.common.model.ChatController.appPrefs
 import chat.simplex.common.model.User
 import chat.simplex.common.model.UserInfo
 import chat.simplex.common.platform.*
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.helpers.*
 import kotlinx.coroutines.flow.MutableStateFlow
@@ -51,6 +53,7 @@ actual fun UserPickerUsersSection(
           ) {
             row.forEach { u ->
               Column(modifier = Modifier
+                .ui(Ui.UserPicker.User(u.user.userId))
                 .clickable (
                   onClick = { onUserClicked(u.user) },
                   enabled = !stopped
@@ -96,6 +99,7 @@ actual fun PlatformUserPicker(modifier: Modifier, pickerState: MutableStateFlow<
     Box(
       Modifier
         .fillMaxSize()
+        .ui(Ui.UserPicker.Sheet)
         .clickable(interactionSource = remember { MutableInteractionSource() }, indication = null, onClick = { pickerState.value = AnimatedViewState.HIDING }),
       contentAlignment = Alignment.TopStart
     ) {
diff --git a/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/helpers/AppUpdater.kt b/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/helpers/AppUpdater.kt
index 306562e6ad..16d1c0428b 100644
--- a/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/helpers/AppUpdater.kt
+++ b/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/helpers/AppUpdater.kt
@@ -168,7 +168,7 @@ fun setupUpdateChecker() = withLongRunningApi {
 }
 
 private fun createUpdateJob() {
-  updateCheckerJob = withLongRunningApi {
+  updateCheckerJob = withLongRunningApi(idle = false) {
     delay(24 * 60 * 60 * 1000)
     checkForUpdate()
     createUpdateJob()
diff --git a/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/onboarding/SimpleXInfo.desktop.kt b/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/onboarding/SimpleXInfo.desktop.kt
index 30e1020d48..803e0669d8 100644
--- a/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/onboarding/SimpleXInfo.desktop.kt
+++ b/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/onboarding/SimpleXInfo.desktop.kt
@@ -8,6 +8,8 @@ import chat.simplex.common.model.ChatModel.controller
 import chat.simplex.common.model.SharedPreference
 import chat.simplex.common.model.User
 import chat.simplex.common.platform.chatModel
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.DEFAULT_PADDING
 import chat.simplex.res.*
 import dev.icerock.moko.resources.compose.painterResource
@@ -16,8 +18,8 @@ import dev.icerock.moko.resources.compose.painterResource
 actual fun OnboardingActionButton(user: User?, onboardingStage: SharedPreference<OnboardingStage>, onclick: (() -> Unit)?) {
   if (user == null) {
     Row(horizontalArrangement = Arrangement.spacedBy(DEFAULT_PADDING * 2.5f)) {
-      OnboardingActionButton(labelId = MR.strings.link_a_mobile, onboarding = if (controller.appPrefs.initialRandomDBPassphrase.get() && !chatModel.desktopOnboardingRandomPassword.value) OnboardingStage.Step2_5_SetupDatabasePassphrase else OnboardingStage.LinkAMobile, icon = painterResource(MR.images.ic_smartphone_300), onclick = onclick)
-      OnboardingActionButton(labelId = MR.strings.create_your_profile, onboarding = OnboardingStage.Step2_CreateProfile, icon = painterResource(MR.images.ic_desktop), onclick = onclick)
+      OnboardingActionButton(Modifier.ui(Ui.Onboarding.LinkAMobile), labelId = MR.strings.link_a_mobile, onboarding = if (controller.appPrefs.initialRandomDBPassphrase.get() && !chatModel.desktopOnboardingRandomPassword.value) OnboardingStage.Step2_5_SetupDatabasePassphrase else OnboardingStage.LinkAMobile, icon = painterResource(MR.images.ic_smartphone_300), onclick = onclick)
+      OnboardingActionButton(Modifier.ui(Ui.Onboarding.GetStarted), labelId = MR.strings.create_your_profile, onboarding = OnboardingStage.Step2_CreateProfile, icon = painterResource(MR.images.ic_desktop), onclick = onclick)
     }
   } else {
     OnboardingActionButton(Modifier.widthIn(min = 300.dp), labelId = MR.strings.make_private_connection, onboarding = OnboardingStage.OnboardingComplete, onclick = onclick)
diff --git a/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/usersettings/Appearance.desktop.kt b/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/usersettings/Appearance.desktop.kt
index 7a48f37271..aa70b3450f 100644
--- a/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/usersettings/Appearance.desktop.kt
+++ b/apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/usersettings/Appearance.desktop.kt
@@ -24,6 +24,8 @@ import chat.simplex.common.model.CloseBehavior
 import chat.simplex.common.model.SharedPreference
 import chat.simplex.common.trayIsAvailable
 import chat.simplex.common.platform.*
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.ui
 import chat.simplex.common.ui.theme.*
 import chat.simplex.common.views.helpers.*
 import chat.simplex.res.*
@@ -134,6 +136,7 @@ fun DensityScaleSection() {
       Spacer(Modifier.width(15.dp))
       Slider(
         localDensityScale.value,
+        modifier = Modifier.ui(Ui.Appearance.Zoom),
         valueRange = 1f..2f,
         steps = 11,
         onValueChange = {
diff --git a/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/desktop/ChatListFiltersListsDesktopTest.kt b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/desktop/ChatListFiltersListsDesktopTest.kt
new file mode 100644
index 0000000000..eeadc55124
--- /dev/null
+++ b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/desktop/ChatListFiltersListsDesktopTest.kt
@@ -0,0 +1,46 @@
+package chat.simplex.app.ui.desktop
+
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.app.ui.harness.lists
+import chat.simplex.common.platform.chatModel
+import chat.simplex.common.ui.Ui
+import org.junit.Test
+
+class ChatListFiltersListsDesktopTest : UiTest() {
+  @Test fun createListWithEmoji() = uiTest {
+    val alice = app("alice")
+    alice.chatList.row("Private notes")
+    val lists = lists()
+    lists.addList().apply {
+      typeInto(Ui.TagEditor.Emoji, "🚀")
+      typeName("work")
+      save()
+    }
+    val work = lists.tag("work")
+    check(work.chatTagEmoji == "🚀") { "list created with emoji ${work.chatTagEmoji}" }
+    poll(what = "the work chip with the emoji") { lists.chipTexts("work").containsAll(listOf("🚀", "work")) }
+  }
+
+  @Test fun editListNameAndEmoji() = uiTest {
+    val alice = app("alice")
+    alice.chatList.row("Private notes")
+    val lists = lists()
+    lists.addList().apply {
+      typeInto(Ui.TagEditor.Emoji, "🚀")
+      typeName("work")
+      save()
+    }
+    val id = lists.tag("work").chatTagId
+    lists.menu("work", "edit")
+    val editor = lists.editor()
+    poll(what = "the editor with the list's emoji and name") { editor.emojiText() == "🚀" && editor.nameText() == "work" && editor.saveLabel() == "Save list" }
+    editor.saveIgnored()
+    replaceText(Ui.TagEditor.Emoji, "🏠")
+    editor.replaceName("home")
+    editor.save()
+    poll(what = "the chip with the new emoji and name") {
+      chatModel.userTags.value.single { it.chatTagId == id }.let { it.chatTagText == "home" && it.chatTagEmoji == "🏠" } &&
+        textsOf(Ui.ChatList.UserTag(id)).containsAll(listOf("🏠", "home")) && "work" !in textsOf(Ui.ChatList.UserTag(id))
+    }
+  }
+}
diff --git a/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/desktop/OnboardingTest.kt b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/desktop/OnboardingTest.kt
new file mode 100644
index 0000000000..4653bdc5c0
--- /dev/null
+++ b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/desktop/OnboardingTest.kt
@@ -0,0 +1,302 @@
+package chat.simplex.app.ui.desktop
+
+import androidx.compose.ui.semantics.SemanticsProperties
+import androidx.compose.ui.test.performTextInput
+import chat.simplex.app.ui.harness.CONNECT_TIMEOUT_MS
+import chat.simplex.app.ui.harness.TestServers
+import chat.simplex.app.ui.harness.UiScope
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.app.ui.harness.onboarding
+import chat.simplex.app.ui.harness.quiesce
+import chat.simplex.common.model.ChatController.appPrefs
+import chat.simplex.common.model.ChatInfo
+import chat.simplex.common.platform.chatModel
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.UiKey
+import chat.simplex.common.views.helpers.AlertManager
+import chat.simplex.common.views.helpers.DBMigrationResult
+import chat.simplex.common.views.helpers.ModalManager
+import chat.simplex.common.views.migration.MigrationToState
+import chat.simplex.common.views.onboarding.OnboardingSharedState
+import chat.simplex.common.views.onboarding.OnboardingStage
+import org.junit.Test
+
+class OnboardingTest : UiTest() {
+  @Test fun onboardingWelcomeShowsDesktopActions() = uiTest {
+    app(null)
+    poll(what = "the welcome screen") { onboarding().stage == OnboardingStage.Step1_SimpleXInfo && exists(Ui.Onboarding.GetStarted) }
+    check(chatModel.currentUser.value == null) { "a user exists on the welcome screen" }
+    check("Link a mobile" in textsOf(Ui.Onboarding.LinkAMobile)) { "Link a mobile: ${textsOf(Ui.Onboarding.LinkAMobile)}" }
+    check("Create your profile" in textsOf(Ui.Onboarding.GetStarted)) { "Create your profile: ${textsOf(Ui.Onboarding.GetStarted)}" }
+    check("Why SimpleX is built." in textsOf(Ui.Onboarding.WhyBuilt)) { "Why SimpleX is built.: ${textsOf(Ui.Onboarding.WhyBuilt)}" }
+  }
+
+  @Test fun onboardingWhySimplexIsBuiltOpensHowItWorks() = uiTest {
+    app(null)
+    waitFor(Ui.Onboarding.WhyBuilt)
+    check(!seesText(WHY_BUILT_HEADING)) { "the welcome screen shows the HowItWorks heading" }
+    click(Ui.Onboarding.WhyBuilt)
+    poll(what = "HowItWorks over the welcome screen") { ModalManager.fullscreen.hasModalsOpen() && seesText(WHY_BUILT_HEADING) }
+  }
+
+  @Test fun onboardingCreateProfileValidName() = uiTest {
+    app(null)
+    onboarding().createProfile("alice")
+    poll(what = "the passphrase step") {
+      onboarding().stage == OnboardingStage.Step2_5_SetupDatabasePassphrase && seesText("Setup database passphrase") && exists(Ui.Onboarding.SetPassphrase)
+    }
+  }
+
+  @Test fun onboardingCreateProfileButtonDisabledForEmptyName() = uiTest {
+    app(null)
+    click(Ui.Onboarding.GetStarted)
+    waitFor(Ui.Onboarding.CreateProfile)
+    settle()
+    check(!isEnabled(Ui.Onboarding.CreateProfile)) { "Create profile is enabled with an empty name" }
+    typeInto(Ui.Onboarding.ProfileName, "   ")
+    settle()
+    check(!isEnabled(Ui.Onboarding.CreateProfile)) { "Create profile is enabled with a blank name" }
+    check(chatModel.currentUser.value == null) { "a profile was created" }
+  }
+
+  @Test fun onboardingCreateProfileInvalidNameShowsCorrectionAlert() = uiTest {
+    app(null)
+    click(Ui.Onboarding.GetStarted)
+    typeInto(Ui.Onboarding.ProfileName, "alice_1")
+    waitFor(Ui.Onboarding.ProfileName.part("invalid"))
+    waitFor(Ui.Onboarding.CreateProfile)
+    check(!isEnabled(Ui.Onboarding.CreateProfile)) { "Create profile is enabled for an invalid name" }
+    click(Ui.Onboarding.ProfileName.part("invalid"))
+    poll(what = "the correction alert") { seesText("Invalid name!") && seesText("Correct name to alice-1?") }
+    click(Ui.Alert.Confirm(Ui.AlertSource.Shared))
+    poll(what = "the corrected name") {
+      editableText(Ui.Onboarding.ProfileName) == "alice-1" && isEnabled(Ui.Onboarding.CreateProfile) && !exists(Ui.Onboarding.ProfileName.part("invalid"))
+    }
+  }
+
+  @Test fun onboardingCreateProfileBackReturnsToWelcome() = uiTest {
+    app(null)
+    click(Ui.Onboarding.GetStarted)
+    waitFor(Ui.Onboarding.ProfileName)
+    escape()
+    poll(what = "the welcome screen") {
+      onboarding().stage == OnboardingStage.Step1_SimpleXInfo && exists(Ui.Onboarding.LinkAMobile) && !exists(Ui.Onboarding.ProfileName)
+    }
+    check(chatModel.currentUser.value == null) { "a profile was created" }
+  }
+
+  @Test fun onboardingMigrateFromAnotherDeviceOpensMigrationScreen() = uiTest {
+    app(null)
+    click(Ui.Onboarding.GetStarted)
+    check("Migrate from another device" in textsOf(Ui.Onboarding.Migrate)) { "migrate button: ${textsOf(Ui.Onboarding.Migrate)}" }
+    click(Ui.Onboarding.Migrate)
+    poll(what = "Migrate here in the paste-link state") {
+      chatModel.migrationState.value is MigrationToState.PasteOrScanLink && seesText("Migrate here") && seesText("Paste archive link")
+    }
+  }
+
+  @Test fun onboardingSetDatabasePassphrase() = uiTest {
+    app(null)
+    onboarding().createProfile("alice")
+    typeSecret(Ui.Onboarding.NewPassphrase, PASSPHRASE)
+    typeSecret(Ui.Onboarding.ConfirmPassphrase, PASSPHRASE)
+    click(Ui.Onboarding.SetPassphrase)
+    poll(what = "the Encrypt database? alert") { seesText("Encrypt database?") && seesText("Database will be encrypted.", substring = true) }
+    check("Encrypt" in textsOf(Ui.Alert.Confirm(Ui.AlertSource.Shared))) { "confirm: ${textsOf(Ui.Alert.Confirm(Ui.AlertSource.Shared))}" }
+    click(Ui.Alert.Confirm(Ui.AlertSource.Shared))
+    poll(timeoutMs = 30_000, what = "Your network and the Database encrypted! alert") {
+      onboarding().stage == OnboardingStage.Step3_ChooseServerOperators && seesText("Database encrypted!")
+    }
+    click(Ui.Alert.Confirm(Ui.AlertSource.Shared))
+    poll(what = "Your network") { !AlertManager.shared.hasAlertsShown() && exists(Ui.Onboarding.Continue) }
+    check(storedSetting("StoreDBPassphrase") == "false") { "StoreDBPassphrase: ${storedSetting("StoreDBPassphrase")}" }
+  }
+
+  @Test fun onboardingSetPassphraseMismatchDisablesButton() = uiTest {
+    app(null)
+    onboarding().createProfile("alice")
+    typeSecret(Ui.Onboarding.NewPassphrase, PASSPHRASE)
+    typeSecret(Ui.Onboarding.ConfirmPassphrase, PASSPHRASE.dropLast(1))
+    settle()
+    waitFor(Ui.Onboarding.SetPassphrase)
+    check(!isEnabled(Ui.Onboarding.SetPassphrase)) { "Set database passphrase is enabled for mismatched passphrases" }
+    typeSecret(Ui.Onboarding.ConfirmPassphrase, PASSPHRASE.takeLast(1))
+    poll(what = "Set database passphrase to be enabled for matching passphrases") { isEnabled(Ui.Onboarding.SetPassphrase) }
+  }
+
+  @Test fun onboardingUseRandomPassphraseAlert() = uiTest {
+    app(null)
+    onboarding().createProfile("alice")
+    click(Ui.Onboarding.RandomPassphrase)
+    poll(what = "the Use random passphrase alert") {
+      AlertManager.shared.hasAlertsShown() && seesText("Random passphrase is stored in settings as plaintext.", substring = true)
+    }
+    check("OK" in textsOf(Ui.Alert.Confirm(Ui.AlertSource.Shared))) { "confirm: ${textsOf(Ui.Alert.Confirm(Ui.AlertSource.Shared))}" }
+    click(Ui.Alert.Confirm(Ui.AlertSource.Shared))
+    poll(timeoutMs = 30_000, what = "Your network") { onboarding().stage == OnboardingStage.Step3_ChooseServerOperators && exists(Ui.Onboarding.Continue) }
+    check(appPrefs.storeDBPassphrase.get() && storedSetting("EncryptedDBPassphrase") != null) { "the random passphrase is not stored in settings" }
+  }
+
+  @Test fun onboardingPassphrasePersistsAcrossRestart() = uiTest {
+    app(null)
+    onboarding().createProfile("alice")
+    typeSecret(Ui.Onboarding.NewPassphrase, PASSPHRASE)
+    typeSecret(Ui.Onboarding.ConfirmPassphrase, PASSPHRASE)
+    click(Ui.Onboarding.SetPassphrase)
+    click(Ui.Alert.Confirm(Ui.AlertSource.Shared))
+    poll(timeoutMs = 30_000, what = "the Database encrypted! alert") { seesText("Database encrypted!") }
+    click(Ui.Alert.Confirm(Ui.AlertSource.Shared))
+    check(storedSetting("StoreDBPassphrase") == "false" && storedSetting("EncryptedDBPassphrase") == null) { "a passphrase is stored in settings" }
+    restart()
+    poll(timeoutMs = 30_000, what = "the passphrase prompt") {
+      chatModel.chatDbStatus.value is DBMigrationResult.ErrorNotADatabase && seesText("Encrypted database") && seesText("Database passphrase is required to open chat.")
+    }
+  }
+
+  @Test fun onboardingYourNetworkShowsSetupRouters() = uiTest {
+    app(null)
+    onboarding().toYourNetwork("alice")
+    poll(what = "the Your network title and subtitle") { seesText("Your network") && seesText("Network routers cannot know", substring = true) }
+    check("Setup routers" in textsOf(Ui.Onboarding.SetupRouters)) { "routers button: ${textsOf(Ui.Onboarding.SetupRouters)}" }
+    onboarding().openOperators()
+    poll(what = "Server operators with a card per operator") {
+      seesText("Server operators") && chatModel.conditions.value.serverOperators.all { exists(Ui.Onboarding.Operator(it.operatorId)) }
+    }
+  }
+
+  @Test fun onboardingContinueGoesToConditions() = uiTest {
+    app(null)
+    onboarding().toYourNetwork("alice")
+    click(Ui.Onboarding.Continue)
+    poll(what = "Network commitments") {
+      onboarding().stage == OnboardingStage.Step4_NetworkCommitments && seesText("Network commitments") && exists(Ui.Onboarding.ConditionsLink) && isEnabled(Ui.Onboarding.Accept)
+    }
+  }
+
+  @Test fun onboardingChooseOperatorsToggle() = uiTest {
+    app(null)
+    val o = onboarding()
+    o.toYourNetwork("alice")
+    o.openOperators()
+    val id = chatModel.conditions.value.serverOperators.first().operatorId
+    val before = id in OnboardingSharedState.selectedOperatorIds
+    click(Ui.Onboarding.Operator(id))
+    poll(what = "operator $id to toggle") { (id in OnboardingSharedState.selectedOperatorIds) == !before }
+    click(Ui.Onboarding.Operator(id))
+    poll(what = "operator $id to toggle back") { (id in OnboardingSharedState.selectedOperatorIds) == before }
+  }
+
+  @Test fun onboardingChooseOperatorsCannotDeselectAll() = uiTest {
+    app(null)
+    val o = onboarding()
+    o.toYourNetwork("alice")
+    o.openOperators()
+    val enabled = o.enabledOperatorIds()
+    check(enabled.isNotEmpty()) { "no operator is enabled in a new database" }
+    for (id in enabled) click(Ui.Onboarding.Operator(id))
+    poll(what = "no operator selected and OK disabled") { OnboardingSharedState.selectedOperatorIds.isEmpty() && exists(Ui.Onboarding.OperatorsOk) && !isEnabled(Ui.Onboarding.OperatorsOk) }
+    escape()
+    settle()
+    check(exists(Ui.Onboarding.OperatorsOk) && ModalManager.fullscreen.hasModalsOpen()) { "Server operators closed with no operator selected" }
+    click(Ui.Onboarding.Operator(enabled.first()))
+    click(Ui.Onboarding.OperatorsOk)
+    poll(what = "Server operators to close") { !exists(Ui.Onboarding.OperatorsOk) && OnboardingSharedState.selectedOperatorIds == setOf(enabled.first()) }
+  }
+
+  @Test fun onboardingHowItHelpsPrivacyInfo() = uiTest {
+    app(null)
+    val o = onboarding()
+    o.toYourNetwork("alice")
+    o.openOperators()
+    check(!seesText("Network operators")) { "Network operators is shown before the info button" }
+    val modals = ModalManager.fullscreen.openModalCount()
+    click(Ui.Onboarding.HowItHelps)
+    poll(what = "the Network operators info screen") { ModalManager.fullscreen.openModalCount() == modals + 1 && seesText("Network operators") }
+  }
+
+  @Test fun onboardingAcceptConditionsCompletesOnboarding() = uiTest {
+    app(null)
+    val o = onboarding()
+    o.toConditions("alice")
+    val selected = OnboardingSharedState.selectedOperatorIds
+    click(Ui.Onboarding.Accept)
+    o.waitForChatList()
+    poll(what = "the connect onboarding view and the selected operators enabled") { seesText("Talk to someone") && o.enabledOperatorIds() == selected }
+  }
+
+  @Test fun onboardingConditionsLinkOpensConditionsText() = uiTest {
+    app(null)
+    val o = onboarding()
+    o.toConditions("alice")
+    click(Ui.Onboarding.ConditionsLink)
+    poll(what = "Conditions of use") { seesText("Conditions of use") && exists(Ui.Onboarding.ConditionsAccept) }
+    click(Ui.Onboarding.ConditionsAccept)
+    o.waitForChatList()
+    poll(what = "the connect onboarding view") { seesText("Talk to someone") }
+  }
+
+  @Test fun onboardingNoNotificationsStepOnDesktop() = uiTest {
+    app(null)
+    onboarding().toYourNetwork("alice")
+    waitFor(Ui.Onboarding.SetupRouters)
+    settle()
+    check(!exists(Ui.Onboarding.SetupNotifications) && !seesText("Setup notifications")) { "Setup notifications is shown on desktop" }
+  }
+
+  @Test fun onboardingThenConnectToCliPeerViaLocalServers() = uiTest {
+    val alice = app(null)
+    onboarding().complete("alice")
+    quiesce()
+    TestServers.configure()
+    val link = alice.newChat().createOneTimeLink()
+    val bob = cli("bob")
+    bob sends "/c $link"
+    bob expects "confirmation sent!"
+    bob.eventually("alice: contact is connected", CONNECT_TIMEOUT_MS)
+    poll(timeoutMs = CONNECT_TIMEOUT_MS, what = "contact bob ready in the model") {
+      chatModel.chats.value.any { (it.chatInfo as? ChatInfo.Direct)?.contact?.let { c -> c.displayName == "bob" && c.ready } == true }
+    }
+  }
+
+  @Test fun onboardingLinkAMobileShowsQrAndDeviceName() = uiTest {
+    app(null)
+    appPrefs.developerTools.set(true)
+    appPrefs.offerRemoteMulticast.set(false)
+    click(Ui.Onboarding.LinkAMobile)
+    onboarding().useRandomPassphrase()
+    poll(timeoutMs = 30_000, what = "the Link a mobile screen with a QR code") { onboarding().stage == OnboardingStage.LinkAMobile && seesDescription("QR Code") }
+    check(seesText("This device name") && seesText("Discoverable via local network")) { "device name section: ${texts().take(40)}" }
+    check(editableText(Ui.Remote.DeviceName) == appPrefs.deviceNameForRemoteAccess.get()) { "device name field: ${editableText(Ui.Remote.DeviceName)}" }
+    click(Ui.Remote.ShareLink)
+    poll(what = "the invitation on the clipboard") { clipboardText()?.startsWith("xrcp:/") == true }
+  }
+
+  @Test fun onboardingLinkAMobileBackReturnsToWelcome() = uiTest {
+    app(null)
+    appPrefs.offerRemoteMulticast.set(false)
+    click(Ui.Onboarding.LinkAMobile)
+    onboarding().useRandomPassphrase()
+    poll(timeoutMs = 30_000, what = "the Link a mobile screen") { onboarding().stage == OnboardingStage.LinkAMobile && exists(Ui.Remote.DeviceName) }
+    escape()
+    poll(what = "the welcome screen") {
+      onboarding().stage == OnboardingStage.Step1_SimpleXInfo && exists(Ui.Onboarding.LinkAMobile) && !exists(Ui.Remote.DeviceName)
+    }
+    check(chatModel.currentUser.value == null) { "a profile was created" }
+  }
+
+  private fun UiScope.typeSecret(key: UiKey, text: String) {
+    waitFor(key)
+    val before = secretLength(key)
+    val node = ui.onNode(matcher(key))
+    ui.runOnUiThread { node.performTextInput(text) }
+    poll(what = "field ${key.tag} to hold ${before + text.length} characters") { secretLength(key) == before + text.length }
+  }
+
+  private fun UiScope.secretLength(key: UiKey): Int =
+    ui.onNode(matcher(key)).fetchSemanticsNode().config.getOrElseNullable(SemanticsProperties.EditableText) { null }?.length ?: 0
+
+  private companion object {
+    const val WHY_BUILT_HEADING = "You were born without an account."
+    const val PASSPHRASE = "Uitest-passphrase-7"
+  }
+}
diff --git a/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/desktop/WhatsNewDesktopTest.kt b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/desktop/WhatsNewDesktopTest.kt
new file mode 100644
index 0000000000..92d067466e
--- /dev/null
+++ b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/desktop/WhatsNewDesktopTest.kt
@@ -0,0 +1,38 @@
+package chat.simplex.app.ui.desktop
+
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.app.ui.harness.UiScope
+import chat.simplex.app.ui.harness.WhatsNewScreen
+import chat.simplex.app.ui.harness.onboarding
+import chat.simplex.common.model.ChatController.appPrefs
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.views.onboarding.OnboardingStage
+import org.junit.Test
+
+class WhatsNewDesktopTest : UiTest() {
+  @Test fun whatsNewNotShownForNewUser() = uiTest {
+    app(null)
+    check(storedSetting("WhatsNewVersion") == null) { "a What's New version is stored before onboarding" }
+    click(Ui.Onboarding.GetStarted)
+    typeInto(Ui.Onboarding.ProfileName, "alice")
+    poll(what = "the stored What's New version to be the current one on the profile screen") { storedSetting("WhatsNewVersion") == WhatsNewScreen.VERSION }
+    finishOnboarding()
+    repeat(NO_MODAL_SETTLES) { settle() }
+    check(!WhatsNewScreen(this).shown() && !exists(Ui.WhatsNew.Ok)) { "What's New opened for a new user" }
+  }
+
+  private fun UiScope.finishOnboarding() {
+    poll(what = "Create profile to be enabled") { isEnabled(Ui.Onboarding.CreateProfile) }
+    click(Ui.Onboarding.CreateProfile)
+    onboarding().useRandomPassphrase()
+    click(Ui.Onboarding.Continue)
+    click(Ui.Onboarding.Accept)
+    poll(timeoutMs = 30_000, what = "the chat list after onboarding") {
+      appPrefs.onboardingStage.get() == OnboardingStage.OnboardingComplete && exists(Ui.ChatList.UserPicker)
+    }
+  }
+
+  private companion object {
+    const val NO_MODAL_SETTLES = 5
+  }
+}
diff --git a/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/CliPeer.kt b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/CliPeer.kt
new file mode 100644
index 0000000000..9c21119b94
--- /dev/null
+++ b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/CliPeer.kt
@@ -0,0 +1,133 @@
+package chat.simplex.app.ui.harness
+
+import com.pty4j.PtyProcess
+import com.pty4j.PtyProcessBuilder
+import java.io.File
+import java.io.InputStreamReader
+import java.util.concurrent.TimeUnit
+
+class CliPeer(name: String, private val dir: File, private val smpServer: String, private val flags: PeerFlags, waiter: Waiter) : PeerLines(name, waiter) {
+  private val transcript = File(dir, "transcript.log")
+  private lateinit var screen: VtScreen
+  private var proc: PtyProcess? = null
+  private var reader: Thread? = null
+
+  fun start() {
+    File(dir, "tmp").mkdirs()
+    if (!File(dir, "simplex_v1_chat.db").exists()) {
+      File(UiEnv.runDir, "peer-template").listFiles { f -> f.name.startsWith("simplex_v1_") }?.forEach { it.copyTo(File(dir, it.name)) }
+    }
+    val args = mutableListOf(UiEnv.cli, "-d", File(dir, "simplex_v1").absolutePath, "--user-display-name", name, "-s", smpServer)
+    if (flags.reactions) args += "--reactions"
+    if (flags.markRead) args += "--mark-read"
+    if (flags.fullLinks) args += "--show-full-links"
+    val cmd = arrayOf("setpriv", "--pdeathsig", "KILL", "sh", "-c", "stty -echo -icanon; exec \"\$0\" \"\$@\"") + args
+    val env = System.getenv().toMutableMap().apply {
+      put("HOME", dir.absolutePath); put("TMPDIR", File(dir, "tmp").absolutePath)
+      put("LC_ALL", "C.UTF-8"); put("TERM", "xterm-256color")
+    }
+    synchronized(lines) { lines.clear() }
+    screen = VtScreen(COLUMNS, ROWS) { line ->
+      transcript.appendText("${System.currentTimeMillis() % 100_000_000} $line\n")
+      synchronized(lines) { lines.add(line) }
+    }
+    val p = PtyProcessBuilder(cmd).setEnvironment(env).setDirectory(UiEnv.repoRoot.absolutePath)
+      .setInitialColumns(COLUMNS).setInitialRows(ROWS).setConsole(false).start()
+    proc = p
+    reader = Thread({
+      val r = InputStreamReader(p.inputStream, Charsets.UTF_8)
+      val buf = CharArray(8192)
+      try {
+        while (true) { val n = r.read(buf); if (n < 0) break; screen.feed(String(buf, 0, n)) }
+      } catch (_: Exception) {}
+    }, "cli-$name").apply { isDaemon = true; start() }
+    started = false
+    startDeadline = System.currentTimeMillis() + START_TIMEOUT_MS
+  }
+
+  private var started = true
+  private var startDeadline = 0L
+
+  fun awaitStart() = ensureStarted()
+
+  fun drainLines(): List<String> = synchronized(lines) { lines.toList().also { lines.clear() } }
+
+  private fun ensureStarted() {
+    if (started) return
+    waiter.waitUntil((startDeadline - System.currentTimeMillis()).coerceAtLeast(0), "$name to start") {
+      synchronized(lines) { lines.any { it.startsWith("Current user: ") } } && promptShown()
+    }
+    synchronized(lines) { lines.clear() }
+    started = true
+  }
+
+  fun stop() {
+    val p = proc ?: return
+    proc = null
+    p.destroy()
+    if (!p.waitFor(5, TimeUnit.SECONDS)) { p.destroyForcibly(); p.waitFor(5, TimeUnit.SECONDS) }
+    runCatching { p.inputStream.close() }; runCatching { p.outputStream.close() }; runCatching { p.errorStream.close() }
+    reader?.join(2000)
+  }
+
+  override fun fill() = ensureStarted()
+
+  override fun type(text: String) {
+    ensureStarted()
+    typeVerified(text)
+    enter(text)
+  }
+
+  private fun inputLine(): String = screen.cursorRowText().let { if (it.startsWith(PROMPT)) it.removePrefix(PROMPT) else it.removePrefix(">") }
+
+  private fun promptShown(): Boolean = screen.cursorRowText().startsWith(">")
+
+  private fun write(s: String) {
+    val out = proc!!.outputStream
+    out.write(s.toByteArray(Charsets.UTF_8)); out.flush()
+  }
+
+  private fun typeVerified(text: String) {
+    var seen = ""
+    repeat(TYPE_ATTEMPTS) {
+      write(text)
+      if (settles { inputLine() == text }) return
+      seen = inputLine()
+      write("\u007f".repeat(seen.length + 2))
+      settles { inputLine().isEmpty() }
+    }
+    throw AssertionError("$name: could not type `$text`; the input line held `$seen`")
+  }
+
+  private fun enter(text: String) {
+    write("\r")
+    val retryAt = System.currentTimeMillis() + ENTER_RETRY_MS
+    while (System.currentTimeMillis() < retryAt) {
+      if (inputLine() != text) return
+      Thread.sleep(10)
+    }
+    write("\r")
+  }
+
+  private fun settles(done: () -> Boolean): Boolean {
+    var last = inputLine()
+    var changedAt = System.currentTimeMillis()
+    while (true) {
+      if (done()) return true
+      Thread.sleep(10)
+      val now = inputLine()
+      if (now != last) { last = now; changedAt = System.currentTimeMillis() }
+      else if (System.currentTimeMillis() - changedAt > UNCHANGED_MS) return done()
+    }
+  }
+
+  companion object {
+    const val COLUMNS = 4000
+    const val ROWS = 50
+    private const val PROMPT = "> "
+    private const val START_TIMEOUT_MS = 60_000L
+    private const val TYPE_ATTEMPTS = 5
+    private const val UNCHANGED_MS = 1_500L
+    private const val ENTER_RETRY_MS = 500L
+  }
+}
diff --git a/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/DbTemplate.kt b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/DbTemplate.kt
new file mode 100644
index 0000000000..382a8b9231
--- /dev/null
+++ b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/DbTemplate.kt
@@ -0,0 +1,43 @@
+package chat.simplex.app.ui.harness
+
+import chat.simplex.common.model.ChatController.appPrefs
+import chat.simplex.common.platform.*
+import chat.simplex.common.views.helpers.DatabaseUtils.ksDatabasePassword
+import java.io.File
+import java.nio.file.AtomicMoveNotSupportedException
+import java.nio.file.Files
+import java.nio.file.StandardCopyOption
+
+object DbTemplate {
+  private val shared = File(UiEnv.runDir, "db-template")
+  private val keyFile = File(shared, "key")
+
+  val exists: Boolean get() = keyFile.isFile
+
+  fun installIfPresent() {
+    if (!exists) return
+    dbFiles(shared).forEach { it.copyTo(File(dataDir, it.name), overwrite = true) }
+    ksDatabasePassword.set(keyFile.readText())
+    appPrefs.storeDBPassphrase.set(true)
+    appPrefs.initialRandomDBPassphrase.set(true)
+  }
+
+  fun save() {
+    val staging = File(UiEnv.jvmDir, "db-template")
+    staging.deleteRecursively()
+    staging.mkdirs()
+    dbFiles(dataDir).forEach { it.copyTo(File(staging, it.name)) }
+    File(staging, "key").writeText(ksDatabasePassword.get() ?: error("no database key after initChatController"))
+    try {
+      Files.move(staging.toPath(), shared.toPath(), StandardCopyOption.ATOMIC_MOVE)
+    } catch (e: AtomicMoveNotSupportedException) {
+      throw IllegalStateException("run directory and JVM directory must be on one filesystem", e)
+    } catch (e: java.nio.file.FileSystemException) {
+      if (!exists) throw e
+      staging.deleteRecursively()
+    }
+  }
+
+  private fun dbFiles(dir: File): List<File> =
+    dir.listFiles { f -> f.isFile && (f.name.startsWith(chatDatabaseFileName) || f.name.startsWith(agentDatabaseFileName)) }.orEmpty().toList()
+}
diff --git a/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/HarnessBootTest.kt b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/HarnessBootTest.kt
new file mode 100644
index 0000000000..f423753f1a
--- /dev/null
+++ b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/HarnessBootTest.kt
@@ -0,0 +1,14 @@
+package chat.simplex.app.ui.harness
+
+import chat.simplex.common.model.ChatController.appPrefs
+import chat.simplex.common.ui.Ui
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class HarnessBootTest : UiTest() {
+  @Test fun bootShowsChatListForNewUser() = uiTest {
+    app("alice")
+    waitFor(Ui.ChatList.NewChat)
+    assertEquals(0, appPrefs.appearanceBarsBlurRadius.get())
+  }
+}
diff --git a/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/HarnessCliPeerTest.kt b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/HarnessCliPeerTest.kt
new file mode 100644
index 0000000000..918f01d2a9
--- /dev/null
+++ b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/HarnessCliPeerTest.kt
@@ -0,0 +1,17 @@
+package chat.simplex.app.ui.harness
+
+import chat.simplex.common.platform.chatController
+import kotlinx.coroutines.runBlocking
+import org.junit.Test
+
+class HarnessCliPeerTest : UiTest() {
+  @Test fun cliConnectsToGuiInvitation() = uiTest {
+    val alice = app("alice")
+    val bob = cli("bob")
+    val (link, _) = runBlocking { chatController.apiAddContact(null, incognito = false) }.first ?: error("apiAddContact failed")
+    bob sends "/c ${link.simplexChatUri(short = true)}"
+    bob expects "confirmation sent!"
+    bob.eventually("alice: contact is connected")
+    alice.chatList.row("bob")
+  }
+}
diff --git a/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/HarnessMeasureTest.kt b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/HarnessMeasureTest.kt
new file mode 100644
index 0000000000..5029fce4b6
--- /dev/null
+++ b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/HarnessMeasureTest.kt
@@ -0,0 +1,28 @@
+package chat.simplex.app.ui.harness
+
+import org.junit.Ignore
+import org.junit.Test
+
+@Ignore("benchmark of reset, frame and capture costs; run manually with --tests '*HarnessMeasureTest*' after removing this line")
+class HarnessMeasureTest : UiTest() {
+  @Test fun measureResetsFramesAndCapture() = uiTest {
+    val rt = Runtime.getRuntime()
+    fun usedMb(): Long { System.gc(); Thread.sleep(200); System.gc(); return (rt.totalMemory() - rt.freeMemory()) / 1_048_576 }
+    fun rssMb(): Long = java.io.File("/proc/self/status").readLines().first { it.startsWith("VmRSS:") }.split(Regex("\\s+"))[1].toLong() / 1024
+    val resetMs = mutableListOf<Long>()
+    for (i in 1..20) {
+      val t = System.nanoTime()
+      app("alice")
+      poll(what = "the chat list") { seesText("Private notes") }
+      resetMs += (System.nanoTime() - t) / 1_000_000
+      if (i == 1 || i % 5 == 0) println("UITEST reset#$i ms=${resetMs.last()} heapMb=${usedMb()} rssMb=${rssMb()} threads=${Thread.activeCount()}")
+    }
+    println("UITEST reset ms: first=${resetMs.first()} median=${resetMs.drop(1).sorted()[resetMs.size / 2 - 1]} max=${resetMs.drop(1).max()}")
+    val frames = 120
+    val t = System.nanoTime()
+    repeat(frames) { ui.mainClock.advanceTimeBy(16); ui.waitForIdle() }
+    println("UITEST frame ms avg=${(System.nanoTime() - t) / 1_000_000.0 / frames}")
+    val caps = (1..10).map { val c = System.nanoTime(); ui.captureToImage(); (System.nanoTime() - c) / 1_000_000 }
+    println("UITEST captureToImage ms=${caps}")
+  }
+}
diff --git a/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/HarnessResetTest.kt b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/HarnessResetTest.kt
new file mode 100644
index 0000000000..f59a0cefc2
--- /dev/null
+++ b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/HarnessResetTest.kt
@@ -0,0 +1,34 @@
+package chat.simplex.app.ui.harness
+
+import chat.simplex.common.model.ChatController.appPrefs
+import chat.simplex.common.platform.chatModel
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.views.helpers.ModalManager
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.FixMethodOrder
+import org.junit.Test
+import org.junit.runners.MethodSorters
+
+@FixMethodOrder(MethodSorters.NAME_ASCENDING)
+class HarnessResetTest : UiTest() {
+  @Test fun a_leavesStateBehind() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    alice.chatList.row("bob")
+    appPrefs.densityScale.set(1.7f)
+    click(Ui.ChatList.NewChat)
+    poll(what = "the new chat sheet") { ModalManager.start.hasModalsOpen() }
+  }
+
+  @Test fun b_startsClean() = uiTest {
+    app("alice")
+    assertEquals(1f, appPrefs.densityScale.get())
+    assertNull(storedSetting("DensityScale"))
+    assertFalse(ModalManager.start.hasModalsOpen())
+    assertFalse(chatModel.chats.value.any { it.chatInfo.chatViewName == "bob" })
+    poll(what = "the chat list") { seesText("Private notes") }
+    assertFalse(seesText("bob"))
+  }
+}
diff --git a/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/Reset.kt b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/Reset.kt
new file mode 100644
index 0000000000..0250372691
--- /dev/null
+++ b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/Reset.kt
@@ -0,0 +1,89 @@
+package chat.simplex.app.ui.harness
+
+import androidx.compose.runtime.MutableState
+import androidx.compose.ui.unit.DpSize
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.window.WindowState
+import chat.simplex.common.model.*
+import chat.simplex.common.platform.*
+import chat.simplex.common.simplexWindowState
+import chat.simplex.common.views.helpers.*
+import kotlinx.coroutines.CompletableDeferred
+import java.io.File
+import java.util.Properties
+import javax.swing.SwingUtilities
+
+object PrefStores {
+  private val resources = Class.forName("chat.simplex.common.platform.Resources_desktopKt")
+  private val settingsProps = staticField(resources, "settingsProps") as Properties
+  private val themesProps = staticField(resources, "settingsThemesProps") as Properties
+  private val settingsFile get() = File(desktopPlatform.configPath, "settings.properties")
+  private val themesFile get() = File(desktopPlatform.configPath, "themes.properties")
+  private val themesYaml get() = File(getPreferenceFilePath("themes.yaml"))
+
+  private lateinit var settingsCapture: Properties
+  private lateinit var themesCapture: Properties
+  private var yamlCapture: ByteArray? = null
+
+  fun capture() {
+    settingsCapture = settingsProps.clone() as Properties
+    themesCapture = themesProps.clone() as Properties
+    yamlCapture = themesYaml.takeIf { it.exists() }?.readBytes()
+  }
+
+  fun restore() {
+    restoreProps(settingsProps, settingsCapture, settingsFile)
+    restoreProps(themesProps, themesCapture, themesFile)
+    val yaml = yamlCapture
+    if (yaml == null) themesYaml.delete() else themesYaml.apply { parentFile.mkdirs() }.writeBytes(yaml)
+    CommonPrefs.reload()
+  }
+
+  private fun restoreProps(live: Properties, captured: Properties, file: File) {
+    synchronized(live) {
+      live.clear()
+      live.putAll(captured)
+      file.parentFile.mkdirs()
+      file.writer().use { live.store(it, "") }
+    }
+  }
+
+}
+
+object UiState {
+  fun clearUiState() {
+    CommonUiState.clear(::onEdt)
+    onEdt {
+      simplexWindowState.windowState = WindowState(size = DpSize(1600.dp, 900.dp))
+      simplexWindowState.windowFocused.value = true
+      simplexWindowState.windowVisible.value = true
+    }
+    clearTransientUi()
+  }
+
+  fun clearTransientUi() {
+    CommonUiState.clearTransient(::onEdt)
+    onEdt {
+      completePendingDialogs()
+      simplexWindowState.toasts.clear()
+    }
+  }
+
+  fun completePendingDialogs() {
+    val onResult = chat.simplex.common.DialogState::class.java.getDeclaredField("onResult\$delegate").apply { isAccessible = true }
+    with(simplexWindowState) {
+      for ((ds, empty) in listOf(openDialog to null, saveDialog to null, openMultipleDialog to emptyList<File>())) {
+        @Suppress("UNCHECKED_CAST")
+        val d = (onResult.get(ds) as MutableState<CompletableDeferred<Any?>?>).value
+        if (d != null && !d.isCompleted) d.complete(empty)
+      }
+    }
+  }
+}
+
+private fun staticField(cls: Class<*>, name: String): Any? = cls.getDeclaredField(name).apply { isAccessible = true }.get(null)
+
+internal fun onEdt(action: () -> Unit) {
+  if (SwingUtilities.isEventDispatchThread()) action() else SwingUtilities.invokeAndWait(action)
+}
+
diff --git a/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/TestRoot.kt b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/TestRoot.kt
new file mode 100644
index 0000000000..581ff945de
--- /dev/null
+++ b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/TestRoot.kt
@@ -0,0 +1,27 @@
+package chat.simplex.app.ui.harness
+
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.CompositionLocalProvider
+import androidx.compose.ui.platform.ClipboardManager
+import androidx.compose.ui.platform.LocalClipboardManager
+import androidx.compose.ui.platform.LocalUriHandler
+import androidx.compose.ui.platform.UriHandler
+import androidx.compose.ui.text.AnnotatedString
+
+class TestClipboard : ClipboardManager {
+  @Volatile var content: AnnotatedString? = null
+  override fun getText(): AnnotatedString? = content
+  override fun setText(annotatedString: AnnotatedString) { content = annotatedString }
+}
+
+class RecordingUriHandler : UriHandler {
+  val opened = mutableListOf<String>()
+  override fun openUri(uri: String) { synchronized(opened) { opened += uri } }
+}
+
+@Composable
+fun TestRoot(clipboard: TestClipboard, uriHandler: RecordingUriHandler, content: @Composable () -> Unit) {
+  CompositionLocalProvider(LocalClipboardManager provides clipboard, LocalUriHandler provides uriHandler) {
+    content()
+  }
+}
diff --git a/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/TestServers.kt b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/TestServers.kt
new file mode 100644
index 0000000000..39461d6685
--- /dev/null
+++ b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/TestServers.kt
@@ -0,0 +1,59 @@
+package chat.simplex.app.ui.harness
+
+import java.io.File
+import java.io.RandomAccessFile
+import java.nio.channels.FileChannel
+import java.nio.channels.FileLock
+import java.util.concurrent.LinkedBlockingQueue
+import java.util.concurrent.TimeUnit
+
+object TestServers {
+  private const val SLOTS = 120
+  private const val KEY_HASH = "LcJUMfVhwD8yxjAiSaDzzGF3-kLG4Uh0Fl_ZIjrRwjI="
+
+  private class SlotLock(val index: Int, val channel: FileChannel, val lock: FileLock)
+
+  private val slotLock: SlotLock by lazy {
+    UiEnv.runDir.mkdirs()
+    (0 until SLOTS).firstNotNullOfOrNull { k ->
+      val ch = RandomAccessFile(File(UiEnv.runDir, "slot-$k.lock"), "rw").channel
+      val lock = ch.tryLock()
+      if (lock != null) SlotLock(k, ch, lock) else { ch.close(); null }
+    } ?: error("no free port slot in ${UiEnv.runDir}")
+  }
+  val slot: Int get() = slotLock.index
+  val portBase: Int get() = 20000 + 100 * slot
+
+  private var proc: Process? = null
+  private val responses = LinkedBlockingQueue<String>()
+  lateinit var smp1: String
+    private set
+  val xftp1: String get() = "xftp://$KEY_HASH@localhost:${portBase + 2}"
+
+  fun start() {
+    if (proc != null) return
+    val dir = File(UiEnv.jvmDir, "servers").apply { mkdirs() }
+    val p = ProcessBuilder("setpriv", "--pdeathsig", "KILL", UiEnv.servers, dir.absolutePath, portBase.toString())
+      .directory(UiEnv.repoRoot).redirectErrorStream(true).start()
+    proc = p
+    val log = File(dir, "servers.log")
+    Thread({
+      p.inputStream.bufferedReader().forEachLine { line ->
+        log.appendText("$line\n")
+        if (line.startsWith("ready ") || line.startsWith("error ")) responses.add(line)
+      }
+    }, "uitest-servers").apply { isDaemon = true; start() }
+    val r = responses.poll(30, TimeUnit.SECONDS) ?: error("uitest-servers did not start; see $log")
+    check(r.startsWith("ready smp1 ")) { "uitest-servers: $r" }
+    smp1 = r.removePrefix("ready smp1 ")
+  }
+
+  fun configure() = configureServers(smp1, xftp1)
+
+  fun stop() {
+    val p = proc ?: return
+    proc = null
+    runCatching { p.outputStream.close() }
+    if (!p.waitFor(10, TimeUnit.SECONDS)) p.destroyForcibly()
+  }
+}
diff --git a/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/UiBridge.kt b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/UiBridge.kt
new file mode 100644
index 0000000000..058de1aa71
--- /dev/null
+++ b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/UiBridge.kt
@@ -0,0 +1,61 @@
+package chat.simplex.app.ui.harness
+
+import java.io.File
+import java.net.InetAddress
+import java.net.ServerSocket
+
+object UiBridge {
+  private val peers = HashMap<String, CliPeer>()
+  private val sleepWaiter = Waiter { timeoutMs, what, cond ->
+    val deadline = System.currentTimeMillis() + timeoutMs
+    while (!cond()) {
+      if (System.currentTimeMillis() > deadline) throw AssertionError("timed out after $timeoutMs ms waiting for $what")
+      Thread.sleep(20)
+    }
+  }
+
+  @JvmStatic fun main(args: Array<String>) {
+    val port = args.getOrNull(0)?.toInt() ?: 7777
+    UiJvm.setup()
+    TestServers.start()
+    val dir = File(UiEnv.jvmDir, "bridge-peers").apply { mkdirs() }
+    println("uitest-bridge: smp ${TestServers.smp1}, port base ${TestServers.portBase}, listening on 127.0.0.1:$port, pid ${ProcessHandle.current().pid()}")
+    ServerSocket(port, 1, InetAddress.getLoopbackAddress()).use { server ->
+      while (true) {
+        server.accept().use { socket ->
+          val input = socket.getInputStream().bufferedReader(Charsets.UTF_8)
+          val out = socket.getOutputStream().bufferedWriter(Charsets.UTF_8)
+          runCatching {
+            while (true) {
+              val line = input.readLine() ?: break
+              val reply = runCatching { handle(line, dir) }.getOrElse { listOf("err " + (it.message ?: it.toString()).replace("\n", " ")) }
+              reply.forEach { out.write(it); out.write("\n") }
+              out.flush()
+            }
+          }
+          Peers.stopAll()
+          peers.clear()
+        }
+      }
+    }
+  }
+
+  private fun handle(line: String, dir: File): List<String> {
+    val parts = line.split(" ", limit = 3)
+    return when (parts[0]) {
+      "servers" -> listOf("ok ${TestServers.smp1} ${TestServers.xftp1}")
+      "start" -> {
+        val name = parts[1]
+        val f = parts.getOrElse(2) { "" }.split(",").toSet()
+        val peer = CliPeer(name, File(dir, "${System.nanoTime()}-$name"), TestServers.smp1, PeerFlags("reactions" in f, "markRead" in f, "fullLinks" in f), sleepWaiter)
+        Peers.add(peer); peers[name] = peer
+        peer.start(); peer.awaitStart()
+        listOf("ok")
+      }
+      "type" -> { peers.getValue(parts[1]).types(parts.getOrElse(2) { "" }); listOf("ok") }
+      "drain" -> { val ls = peers.getValue(parts[1]).drainLines(); listOf("lines ${ls.size}") + ls }
+      "stop" -> { peers.remove(parts[1])?.stop(); listOf("ok") }
+      else -> listOf("err unknown command ${parts[0]}")
+    }
+  }
+}
diff --git a/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/UiEnv.kt b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/UiEnv.kt
new file mode 100644
index 0000000000..a6ff65cfc3
--- /dev/null
+++ b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/UiEnv.kt
@@ -0,0 +1,18 @@
+package chat.simplex.app.ui.harness
+
+import java.io.File
+import java.util.Properties
+
+object UiEnv {
+  private val props = Properties().also { p ->
+    System.getProperty("simplex.uitest.env")?.let(::File)?.takeIf { it.exists() }?.inputStream()?.use { p.load(it) }
+  }
+  private fun required(key: String): String = props.getProperty(key)?.takeIf { it.isNotBlank() } ?: error("env.properties has no $key")
+  val libAppLib: String = props.getProperty("libAppLib")
+    ?: File("src/commonMain/cpp/desktop/libs/linux-x86_64/libapp-lib.so").absolutePath
+  val runDir: File = File(props.getProperty("runDir")?.takeIf { it.isNotBlank() } ?: File("build/uitest/run-local").absolutePath)
+  val jvmDir: File by lazy { File(runDir, "jvm-${TestServers.slot}-${ProcessHandle.current().pid()}") }
+  val repoRoot: File get() = File(required("repoRoot"))
+  val cli: String get() = required("cli")
+  val servers: String get() = required("servers")
+}
diff --git a/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/UiJvm.kt b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/UiJvm.kt
new file mode 100644
index 0000000000..0e87e87083
--- /dev/null
+++ b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/UiJvm.kt
@@ -0,0 +1,24 @@
+package chat.simplex.app.ui.harness
+
+import java.io.File
+
+object UiJvm {
+  fun setup() {
+    val tmp = File(UiEnv.jvmDir, "tmp")
+    check(tmp.mkdirs() || tmp.isDirectory) { "cannot create ${tmp.absolutePath}" }
+    System.setProperty("user.home", UiEnv.jvmDir.absolutePath)
+    System.setProperty("java.io.tmpdir", tmp.absolutePath)
+    Runtime.getRuntime().addShutdownHook(Thread {
+      runCatching { UiTestApp.stopCore() }
+      Peers.stopAll()
+      TestServers.stop()
+      ProcessHandle.current().descendants().forEach { it.destroyForcibly() }
+    })
+  }
+}
+
+object Peers {
+  private val running = mutableListOf<CliPeer>()
+  @Synchronized fun add(p: CliPeer) { running += p }
+  @Synchronized fun stopAll() { running.forEach { runCatching { it.stop() } }; running.clear() }
+}
diff --git a/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/UiTest.kt b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/UiTest.kt
new file mode 100644
index 0000000000..62ece92f30
--- /dev/null
+++ b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/UiTest.kt
@@ -0,0 +1,358 @@
+package chat.simplex.app.ui.harness
+
+import androidx.compose.ui.semantics.SemanticsActions
+import androidx.compose.ui.graphics.toAwtImage
+import androidx.compose.ui.test.*
+import chat.simplex.common.AppScreen
+import chat.simplex.common.ui.UiIdle
+import chat.simplex.common.ui.UiKey
+import kotlinx.coroutines.test.StandardTestDispatcher
+import java.io.File
+
+abstract class UiTest {
+  companion object {
+    init { UiJvm.setup() }
+    private var testIndex = 0
+    private const val HARD_TIMEOUT_MS = 240_000L
+  }
+
+  fun uiTest(body: UiScope.() -> Unit) {
+    UiTestApp.bootJvm()
+    val dir = File(UiEnv.jvmDir, "t${++testIndex}")
+    var passed = false
+    val watchdog = java.util.Timer("uitest-watchdog", true).apply {
+      schedule(object : java.util.TimerTask() {
+        override fun run() {
+          println("UITEST hard timeout after ${HARD_TIMEOUT_MS / 1000} s in test ${dir.name}; thread dump follows")
+          Thread.getAllStackTraces().forEach { (t, st) -> println("--- ${t.name}\n" + st.joinToString("\n") { "    at $it" }) }
+          Runtime.getRuntime().halt(3)
+        }
+      }, HARD_TIMEOUT_MS)
+    }
+    try {
+      for (attempt in 1..KNOWN_ISSUE_ATTEMPTS) {
+        var bodyStarted = false
+        var bodyCompleted = false
+        try {
+          runInternalSkikoComposeUiTest(width = 1600, height = 900, coroutineDispatcher = StandardTestDispatcher()) {
+            mainClock.autoAdvance = false
+            bodyStarted = true
+            UiScope(this, dir).body()
+            bodyCompleted = true
+            UiTestApp.drain()
+          }
+          break
+        } catch (e: Throwable) {
+          val errors = (listOf(e) + e.suppressed).filter { it.javaClass.simpleName !in WRAPPERS }
+          val known = errors.isNotEmpty() && errors.all(::isKnownAppIssue)
+          if (!known || (bodyStarted && !bodyCompleted)) {
+            throw if (e.suppressed.isEmpty()) e else AssertionError("${e.message}; suppressed:\n" + e.suppressed.joinToString("\n") { it.stackTraceToString().lines().take(25).joinToString("\n") }, e)
+          }
+          println("UITEST known app issue, not failing the test: " + errors.joinToString { it.message.orEmpty() })
+          if (bodyCompleted) break
+          UiTestApp.drain()
+          if (attempt == KNOWN_ISSUE_ATTEMPTS) throw e
+        }
+      }
+      passed = true
+    } finally {
+      repeat(2) { javax.swing.SwingUtilities.invokeAndWait {} }
+      UiTestApp.drain()
+      if (chat.simplex.common.platform.chatController.getChatCtrl() == null) {
+        println("UITEST the test left no chat controller; initializing an empty core")
+        UiTestApp.resetForTest(null)
+      }
+      watchdog.cancel()
+      Peers.stopAll()
+      if (passed) dir.deleteRecursively()
+    }
+  }
+}
+
+private const val EXTENSION_MS = 60_000L
+private const val SCROLL_ATTEMPTS = 10
+private const val SCROLL_ANIMATION_FRAMES = 40
+private const val FOCUS_SETTLE_FRAMES = 3
+private const val SETTLE_FRAMES = 30
+private const val LIST_PAGES = 20
+private const val REPLACE_CHECK_MS = 2_000L
+private const val SCROLL_PAGE = 0.6f
+private const val SCROLL_MARGIN_DP = 48f
+
+class UiScope(val ui: SkikoComposeUiTest, private val dir: File) {
+  val clipboard = TestClipboard()
+  val uriHandler = RecordingUriHandler()
+
+  fun app(user: String?): App {
+    UiTestApp.resetForTest(user)
+    ui.setContent { TestRoot(clipboard, uriHandler) { AppScreen() } }
+    ui.waitForIdle()
+    return App(this)
+  }
+
+  fun restart(): App {
+    ui.setContent { }
+    ui.waitForIdle()
+    UiTestApp.restartCore()
+    ui.setContent { TestRoot(clipboard, uriHandler) { AppScreen() } }
+    poll(timeoutMs = 30_000, what = "the app to start again") {
+      chat.simplex.common.platform.chatModel.chatDbStatus.value != null && !chat.simplex.common.platform.chatModel.ctrlInitInProgress.value
+    }
+    return App(this)
+  }
+
+  fun textOf(key: UiKey): String? {
+    waitFor(key)
+    val textKey = androidx.compose.ui.semantics.SemanticsProperties.Text
+    val own = ui.onNode(matcher(key)).fetchSemanticsNode().config.getOrElseNullable(textKey) { null }?.firstOrNull()?.text
+    return own ?: ui.onAllNodes(hasAnyAncestor(matcher(key)) and SemanticsMatcher.keyIsDefined(textKey), useUnmergedTree = true)
+      .fetchSemanticsNodes().firstOrNull()?.config?.get(textKey)?.firstOrNull()?.text
+  }
+
+  fun storedSetting(key: String): String? =
+    java.util.Properties().apply { File(chat.simplex.common.platform.desktopPlatform.configPath, "settings.properties").inputStream().use { load(it) } }.getProperty(key)
+
+  fun sliderValue(key: UiKey): Float {
+    waitFor(key)
+    return ui.onNode(matcher(key)).fetchSemanticsNode().config[androidx.compose.ui.semantics.SemanticsProperties.ProgressBarRangeInfo].current
+  }
+
+  fun setSlider(key: UiKey, value: Float) {
+    waitFor(key)
+    scrollIntoView(key)
+    waitStable(key)
+    val node = ui.onNode(matcher(key))
+    ui.runOnUiThread { node.performSemanticsAction(androidx.compose.ui.semantics.SemanticsActions.SetProgress) { it(value) } }
+    ui.waitForIdle()
+  }
+
+  fun clipboardText(): String? = clipboard.content?.text
+
+  fun matcher(key: UiKey): SemanticsMatcher =
+    if (key.id == DESCRIBED) hasContentDescription(key.arg as String) and hasClickAction() else hasTestTag(key.tag)
+
+  fun exists(key: UiKey): Boolean = ui.onAllNodes(matcher(key)).fetchSemanticsNodes().isNotEmpty()
+
+  fun waitFor(key: UiKey, timeoutMs: Long = 10_000) = poll(timeoutMs, "node ${key.tag}") { exists(key) }
+
+  private fun waitPopupsClosedUnlessInside(key: UiKey) {
+    if (ui.onAllNodes(matcher(key) and hasAnyAncestor(isPopup())).fetchSemanticsNodes().isNotEmpty()) return
+    poll(what = "open popups to close before acting on ${key.tag}") { ui.onAllNodes(isPopup()).fetchSemanticsNodes().isEmpty() }
+  }
+
+
+  fun scrollTo(key: UiKey) {
+    poll(what = "a list to scroll to ${key.tag}") { exists(key) || pageListsTo(key) }
+  }
+
+  private fun pageListsTo(key: UiKey): Boolean {
+    val lists = ui.onAllNodes(SemanticsMatcher.keyIsDefined(SemanticsActions.ScrollToIndex) and SemanticsMatcher.keyIsDefined(SemanticsActions.ScrollBy))
+    for (i in lists.fetchSemanticsNodes().indices) {
+      for (page in 1..LIST_PAGES) {
+        val list = lists.fetchSemanticsNodes().getOrNull(i) ?: break
+        val before = list.children.map { it.id to it.boundsInRoot }
+        ui.runOnUiThread { list.config[SemanticsActions.ScrollBy].action?.invoke(0f, list.boundsInRoot.height * SCROLL_PAGE) }
+        repeat(SCROLL_ANIMATION_FRAMES) { ui.mainClock.advanceTimeBy(16, ignoreFrameDuration = true); ui.waitForIdle() }
+        if (exists(key)) return true
+        if (lists.fetchSemanticsNodes().getOrNull(i)?.children?.map { it.id to it.boundsInRoot } == before) break
+      }
+    }
+    return false
+  }
+
+
+
+  fun waitStable(key: UiKey) {
+    var last: androidx.compose.ui.geometry.Rect? = null
+    var count = 0
+    try {
+      poll(what = "node ${key.tag} to stop moving") {
+        val ns = ui.onAllNodes(matcher(key)).fetchSemanticsNodes()
+        count = ns.size
+        val b = ns.firstOrNull()?.boundsInRoot
+        (b != null && !b.isEmpty && b == last).also { last = b }
+      }
+    } catch (e: AssertionError) {
+      throw AssertionError("${e.message}; last bounds $last; matching nodes $count", e)
+    }
+  }
+
+  fun scrollIntoView(key: UiKey) {
+    repeat(SCROLL_ATTEMPTS) {
+      val node = ui.onAllNodes(matcher(key)).fetchSemanticsNodes().firstOrNull() ?: return
+      val rootBottom = generateSequence(node) { it.parent }.last().boundsInRoot.bottom
+      val b = node.boundsInRoot
+      val placed = b.width > 0f && b.height > 0f
+      if (placed && b.top >= 0f && b.bottom <= rootBottom) return
+      val scroller = generateSequence(node.parent) { it.parent }
+        .firstOrNull { it.config.contains(androidx.compose.ui.semantics.SemanticsActions.ScrollBy) } ?: return
+      val margin = node.layoutInfo.density.density * SCROLL_MARGIN_DP
+      val dy = when {
+        !placed -> rootBottom * SCROLL_PAGE
+        b.bottom > rootBottom -> b.bottom - rootBottom + margin
+        else -> b.top - margin
+      }
+      ui.runOnUiThread { scroller.config[androidx.compose.ui.semantics.SemanticsActions.ScrollBy].action?.invoke(0f, dy) }
+      repeat(SCROLL_ANIMATION_FRAMES) { ui.mainClock.advanceTimeBy(16, ignoreFrameDuration = true); ui.waitForIdle() }
+    }
+  }
+
+  fun escape() {
+    repeat(FOCUS_SETTLE_FRAMES) { ui.mainClock.advanceTimeBy(16, ignoreFrameDuration = true); ui.waitForIdle() }
+    ui.runOnUiThread { chat.simplex.common.simplexWindowState.backstack.lastOrNull()?.invoke() }
+    ui.waitForIdle()
+  }
+
+  fun click(key: UiKey) {
+    waitFor(key)
+    scrollIntoView(key)
+    waitStable(key)
+    poll(what = "node ${key.tag} to be enabled") { isEnabled(key) }
+    waitPopupsClosedUnlessInside(key)
+    focusBeforeTap(key)
+    val target = ui.onNode(matcher(key), useUnmergedTree = key.id != DESCRIBED).fetchSemanticsNode()
+    val point = tapPointInNode(target)
+    val node = ui.onNode(matcher(key))
+    ui.runOnUiThread { node.performTouchInput { click(point) } }
+    ui.waitForIdle()
+  }
+
+  fun settle() {
+    repeat(SETTLE_FRAMES) { ui.mainClock.advanceTimeBy(16, ignoreFrameDuration = true); ui.waitForIdle() }
+  }
+
+  private fun focusBeforeTap(key: UiKey) {
+    if (ui.onAllNodes(matcher(key) and hasAnyAncestor(isPopup())).fetchSemanticsNodes().isNotEmpty()) return
+    val node = ui.onNode(matcher(key))
+    if (!node.fetchSemanticsNode().config.contains(SemanticsActions.RequestFocus)) return
+    ui.runOnUiThread { node.performSemanticsAction(SemanticsActions.RequestFocus) }
+    repeat(FOCUS_SETTLE_FRAMES) { ui.mainClock.advanceTimeBy(16, ignoreFrameDuration = true); ui.waitForIdle() }
+  }
+
+  fun enterText(key: UiKey, text: String) {
+    waitFor(key)
+    val node = ui.onNode(matcher(key))
+    ui.runOnUiThread { node.performTextInput(text) }
+    ui.waitForIdle()
+  }
+
+  fun typeInto(key: UiKey, text: String) {
+    waitFor(key)
+    val node = ui.onNode(matcher(key))
+    val before = editableText(key).orEmpty()
+    ui.runOnUiThread { node.performTextInput(text) }
+    poll(what = "field ${key.tag} to hold `$text`") { editableText(key) == before + text }
+  }
+
+  fun replaceText(key: UiKey, text: String) {
+    waitFor(key)
+    val node = ui.onNode(matcher(key))
+    val current = editableText(key).orEmpty()
+    ui.runOnUiThread { node.performTextInputSelection(androidx.compose.ui.text.TextRange(0, current.length)) }
+    poll(what = "field ${key.tag} to select all") {
+      ui.onNode(matcher(key)).fetchSemanticsNode().config
+        .getOrElseNullable(androidx.compose.ui.semantics.SemanticsProperties.TextSelectionRange) { null } == androidx.compose.ui.text.TextRange(0, current.length)
+    }
+    ui.runOnUiThread { node.performTextInput(text) }
+    val replaced = runCatching { poll(timeoutMs = REPLACE_CHECK_MS, what = "field ${key.tag} to hold `$text`") { editableText(key) == text } }.isSuccess
+    if (!replaced) {
+      ui.runOnUiThread { node.performTextReplacement(text) }
+      poll(what = "field ${key.tag} to hold `$text` after replacement") { editableText(key) == text }
+    }
+  }
+
+  fun rightClick(key: UiKey) {
+    waitFor(key)
+    waitStable(key)
+    waitPopupsClosedUnlessInside(key)
+    val node = ui.onNode(matcher(key))
+    ui.runOnUiThread { node.performMouseInput { rightClick() } }
+    ui.waitForIdle()
+  }
+
+  fun textsOf(key: UiKey): List<String> {
+    waitFor(key)
+    val textKey = androidx.compose.ui.semantics.SemanticsProperties.Text
+    val own = ui.onNode(matcher(key)).fetchSemanticsNode().config.getOrElseNullable(textKey) { null }.orEmpty().map { it.text }
+    val inner = ui.onAllNodes(hasAnyAncestor(matcher(key)) and SemanticsMatcher.keyIsDefined(textKey), useUnmergedTree = true)
+      .fetchSemanticsNodes().flatMap { it.config[textKey].map { t -> t.text } }
+    return own + inner
+  }
+
+  fun descriptionsOf(key: UiKey): List<String> {
+    waitFor(key)
+    val descKey = androidx.compose.ui.semantics.SemanticsProperties.ContentDescription
+    return ui.onAllNodes((matcher(key) or hasAnyAncestor(matcher(key))) and SemanticsMatcher.keyIsDefined(descKey), useUnmergedTree = true)
+      .fetchSemanticsNodes().flatMap { it.config[descKey] }
+  }
+
+  fun isEnabled(key: UiKey): Boolean =
+    ui.onAllNodes(matcher(key)).fetchSemanticsNodes().firstOrNull()
+      ?.let { !it.config.contains(androidx.compose.ui.semantics.SemanticsProperties.Disabled) } ?: false
+
+  fun pressEnter(key: UiKey) {
+    waitPopupsClosedUnlessInside(key)
+    val node = ui.onNode(matcher(key))
+    ui.runOnUiThread { node.performKeyInput { pressKey(androidx.compose.ui.input.key.Key.Enter) } }
+    ui.waitForIdle()
+  }
+
+  fun editableText(key: UiKey): String? =
+    ui.onAllNodes((matcher(key) or hasAnyAncestor(matcher(key))) and SemanticsMatcher.keyIsDefined(androidx.compose.ui.semantics.SemanticsProperties.EditableText), useUnmergedTree = true)
+      .fetchSemanticsNodes().firstOrNull()?.config?.get(androidx.compose.ui.semantics.SemanticsProperties.EditableText)?.text
+
+  fun cli(name: String, flags: PeerFlags = PeerFlags()): CliPeer =
+    CliPeer(name, File(dir, "peers/$name"), TestServers.smp1, flags) { t, what, cond -> poll(t, what, cond = cond) }
+      .also { Peers.add(it); it.start() }
+
+  fun poll(timeoutMs: Long = 10_000, what: String, screenshot: Boolean = true, cond: () -> Boolean) {
+    val deadline = System.currentTimeMillis() + timeoutMs
+    var busyAtDeadline: Set<Long>? = null
+    var lastError: Throwable? = null
+    while (true) {
+      ui.mainClock.advanceTimeBy(16, ignoreFrameDuration = true)
+      ui.waitForIdle()
+      if (runCatching(cond).onFailure { lastError = it }.getOrDefault(false)) return
+      val now = System.currentTimeMillis()
+      if (now > deadline) {
+        val busy = busyAtDeadline ?: UiIdle.inFlight().map { it.id }.toSet().also { busyAtDeadline = it }
+        val stillBusy = UiIdle.inFlight().any { it.id in busy }
+        if (!stillBusy || now > deadline + EXTENSION_MS) {
+          val shot = if (screenshot) failureShot(what) else null
+          throw AssertionError("timed out after $timeoutMs ms waiting for $what; ${lastError?.let { "last condition error: $it; " } ?: ""}in flight: ${UiIdle.inFlight().joinToString { it.what }}; screenshot: $shot; visible texts: ${texts().take(60)}")
+        }
+      }
+      Thread.sleep(16)
+    }
+  }
+
+  private var shots = 0
+
+  private fun failureShot(what: String): String? = runCatching {
+    val dir = File(UiEnv.runDir, "failures").apply { mkdirs() }
+    val f = File(dir, "%s-%02d-%s.png".format(UiEnv.jvmDir.name, ++shots, what.replace(Regex("[^A-Za-z0-9]+"), "_").take(60)))
+    javax.imageio.ImageIO.write(ui.onRoot().captureToImage().toAwtImage(), "png", f)
+    f.path
+  }.getOrNull()
+
+  fun texts(): List<String> =
+    ui.onAllNodes(hasText("", substring = true), useUnmergedTree = true).fetchSemanticsNodes()
+      .flatMap { it.config.getOrElseNullable(androidx.compose.ui.semantics.SemanticsProperties.Text) { null }.orEmpty() }
+      .map { it.text }
+
+  fun assumeCamera() {}
+
+  fun seesDescription(text: String, substring: Boolean = false) =
+    ui.onAllNodes(hasContentDescription(text, substring = substring), useUnmergedTree = true).fetchSemanticsNodes().isNotEmpty()
+
+  fun seesText(text: String, substring: Boolean = false) =
+    ui.onAllNodes(hasText(text, substring = substring), useUnmergedTree = true).fetchSemanticsNodes().isNotEmpty()
+}
+
+private fun isKnownAppIssue(e: Throwable): Boolean =
+  e !is AssertionError && generateSequence(e) { it.cause }.any { c -> KNOWN_APP_ISSUES.any { c.message.orEmpty().contains(it) } }
+
+private val WRAPPERS = setOf("UncaughtExceptionsBeforeTest", "DiagnosticCoroutineContextException")
+
+private const val KNOWN_ISSUE_ATTEMPTS = 3
+private val KNOWN_APP_ISSUES = listOf("Controller is not initialized", "database closed")
diff --git a/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/UiTestApp.kt b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/UiTestApp.kt
new file mode 100644
index 0000000000..d15df7d5a4
--- /dev/null
+++ b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/UiTestApp.kt
@@ -0,0 +1,136 @@
+package chat.simplex.app.ui.harness
+
+import androidx.compose.ui.unit.DpSize
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.window.WindowState
+import chat.simplex.common.model.*
+import chat.simplex.common.model.ChatController.appPrefs
+import chat.simplex.common.platform.*
+import chat.simplex.common.platform.NtfManager
+import chat.simplex.common.simplexWindowState
+import chat.simplex.common.ui.theme.ThemeManager
+import chat.simplex.common.ui.UiIdle
+import chat.simplex.common.ui.uiTestHooksEnabled
+import chat.simplex.common.views.call.RcvCallInvitation
+import chat.simplex.common.views.database.deleteChatDatabaseFilesAndState
+import chat.simplex.common.views.database.stopChatAsync
+import chat.simplex.common.views.helpers.*
+import chat.simplex.common.views.onboarding.OnboardingStage
+import chat.simplex.common.views.onboarding.setLastVersionDefault
+import kotlinx.coroutines.runBlocking
+import java.io.File
+import java.util.Locale
+
+object UiTestApp {
+  private var booted = false
+
+  fun bootJvm() {
+    if (booted) return
+    booted = true
+    check(dataDir.startsWith(UiEnv.jvmDir) && File(desktopPlatform.configPath).startsWith(UiEnv.jvmDir)) {
+      "app paths outside the per-JVM directory: dataDir=$dataDir configPath=${desktopPlatform.configPath}"
+    }
+    System.load(UiEnv.libAppLib)
+    initHS()
+    Locale.setDefault(Locale.ENGLISH)
+    uiTestHooksEnabled = true
+    ntfManager = NoNtfManager
+    simplexWindowState.windowState = WindowState(size = DpSize(1600.dp, 900.dp))
+    tmpDir.mkdirs()
+    runMigrations()
+    ThemeManager.applyTheme(appPrefs.currentTheme.get()!!)
+    appPrefs.appearanceBarsBlurRadius.set(0)
+    PrefStores.capture()
+    ModelSnapshot.capture()
+  }
+
+  private var coreStarted = false
+
+  fun drain() {
+    val deadline = System.currentTimeMillis() + DRAIN_MS
+    while (UiIdle.inFlight().isNotEmpty() && System.currentTimeMillis() < deadline) Thread.sleep(20)
+    val stuck = UiIdle.inFlight()
+    if (stuck.isNotEmpty()) {
+      println("UITEST drain gave up after ${DRAIN_MS / 1000} s; abandoned: ${stuck.joinToString { it.what }}")
+      UiIdle.abandon(stuck)
+    }
+  }
+
+  fun resetForTest(user: String?) {
+    drain()
+    if (coreStarted) stopAndDeleteCore()
+    drain()
+    coreStarted = true
+    PrefStores.restore()
+    UiState.clearUiState()
+    TestServers.start()
+    DbTemplate.installIfPresent()
+    if (user != null) TestPrefs.preset()
+    initCore()
+    if (!DbTemplate.exists) {
+      stopCore()
+      DbTemplate.save()
+      initCore()
+    }
+    if (user == null) return UiState.clearTransientUi()
+    val u = runBlocking { chatController.apiCreateActiveUser(null, Profile(user, "", null)) }
+      ?: error("apiCreateActiveUser($user) failed; users ${runCatching { runBlocking { chatController.listUsers(null) }.map { it.user.displayName } }.getOrElse { it.message }}, database ${chatModel.chatDbStatus.value}")
+    chatModel.currentUser.value = u
+    chatModel.localUserCreated.value = true
+    appPrefs.onboardingStage.set(OnboardingStage.OnboardingComplete)
+    runBlocking { chatController.startChat(u) }
+    TestServers.configure()
+    setLastVersionDefault(chatModel)
+    UiState.clearTransientUi()
+  }
+
+  fun restartCore() {
+    runBlocking {
+      val ctrl = chatController.getChatCtrl()
+      if (ctrl != null && ctrl != -1L && chatModel.chatRunning.value != false) chatController.apiStopChat()
+    }
+    chatModel.chatRunning.value = null
+    val ctrl = chatController.getChatCtrl()
+    if (ctrl != null && ctrl != -1L) chatCloseStore(ctrl).let { check(it.isEmpty()) { "chatCloseStore failed: $it" } }
+    chatController.setChatCtrl(null)
+    drain()
+    UiState.clearUiState()
+    initChatControllerOnStart()
+  }
+
+  private fun initCore() {
+    runBlocking { initChatController() }
+    check(chatModel.chatDbStatus.value == DBMigrationResult.OK) { "database: ${chatModel.chatDbStatus.value}" }
+  }
+
+  fun stopCore() {
+    val deadline = System.currentTimeMillis() + 10_000
+    while (chatModel.ctrlInitInProgress.value) {
+      check(System.currentTimeMillis() < deadline) { "ctrlInitInProgress still set after 10 s" }
+      Thread.sleep(50)
+    }
+    runBlocking { if (chatModel.chatRunning.value == true) stopChatAsync(chatModel) }
+    val ctrl = chatController.getChatCtrl()
+    if (ctrl != null && ctrl != -1L) chatCloseStore(ctrl).let { check(it.isEmpty()) { "chatCloseStore failed: $it" } }
+    chatController.setChatCtrl(null)
+  }
+
+  private fun stopAndDeleteCore() {
+    stopCore()
+    deleteChatDatabaseFilesAndState()
+  }
+
+  private const val DRAIN_MS = 30_000L
+
+  private object NoNtfManager : NtfManager() {
+    override fun notifyCallInvitation(invitation: RcvCallInvitation): Boolean = false
+    override fun hasNotificationsForChat(chatId: String): Boolean = false
+    override fun cancelNotificationsForChat(chatId: String) {}
+    override fun cancelNotificationsForUser(userId: Long) {}
+    override fun displayNotification(user: UserLike, chatId: String, displayName: String, msgText: String, image: String?, actions: List<Pair<NotificationAction, () -> Unit>>) {}
+    override fun androidCreateNtfChannelsMaybeShowAlert() {}
+    override fun cancelCallNotification() {}
+    override fun cancelAllNotifications() {}
+    override fun showMessage(title: String, text: String) {}
+  }
+}
diff --git a/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/VtScreen.kt b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/VtScreen.kt
new file mode 100644
index 0000000000..cff01b3bbf
--- /dev/null
+++ b/apps/multiplatform/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/VtScreen.kt
@@ -0,0 +1,103 @@
+package chat.simplex.app.ui.harness
+
+class VtScreen(private val width: Int, private val height: Int, private val onLine: (String) -> Unit) {
+  private val rows = Array(height) { IntArray(width) { ' '.code } }
+  private val continued = BooleanArray(height)
+  private var row = 0
+  private var col = 0
+  private var wrapPending = false
+
+  private enum class State { TEXT, ESC, CSI, OSC, OSC_ESC }
+  private var state = State.TEXT
+  private val csi = StringBuilder()
+  private var highSurrogate: Char? = null
+
+  @Synchronized fun feed(text: String) {
+    for (ch in text) {
+      when (state) {
+        State.TEXT -> text(ch)
+        State.ESC -> state = when (ch) {
+          '[' -> { csi.setLength(0); State.CSI }
+          ']' -> State.OSC
+          else -> State.TEXT
+        }
+        State.CSI -> if (ch.code in 0x40..0x7e) { csi(csi.toString(), ch); state = State.TEXT } else csi.append(ch)
+        State.OSC -> state = when (ch) { '\u0007' -> State.TEXT; '\u001b' -> State.OSC_ESC; else -> State.OSC }
+        State.OSC_ESC -> state = State.TEXT
+      }
+    }
+  }
+
+  @Synchronized fun cursorRowText(): String = rowText(row)
+
+  private fun text(ch: Char) {
+    when {
+      ch == '\u001b' -> state = State.ESC
+      ch == '\r' -> { col = 0; wrapPending = false }
+      ch == '\n' -> { onLine(logicalLine(row)); lineFeed() }
+      ch == '\b' -> { if (col > 0) col--; wrapPending = false }
+      ch.isHighSurrogate() -> highSurrogate = ch
+      ch.isLowSurrogate() -> { highSurrogate?.let { put(Character.toCodePoint(it, ch)) }; highSurrogate = null }
+      ch.code < 0x20 || ch.code == 0x7f -> {}
+      else -> put(ch.code)
+    }
+  }
+
+  private fun put(cp: Int) {
+    if (wrapPending) {
+      lineFeed()
+      continued[row] = true
+      col = 0
+      wrapPending = false
+    }
+    rows[row][col] = cp
+    if (col == width - 1) wrapPending = true else col++
+  }
+
+  private fun lineFeed() {
+    wrapPending = false
+    if (row == height - 1) {
+      for (r in 0 until height - 1) { rows[r] = rows[r + 1]; continued[r] = continued[r + 1] }
+      rows[height - 1] = IntArray(width) { ' '.code }
+      continued[height - 1] = false
+    } else row++
+  }
+
+  private fun csi(params: String, final: Char) {
+    if (params.startsWith("?")) return
+    val p = params.split(';').map { it.toIntOrNull() }
+    fun arg(i: Int, def: Int) = p.getOrNull(i)?.takeIf { it != 0 } ?: def
+    wrapPending = false
+    when (final) {
+      'H', 'f' -> { row = (arg(0, 1) - 1).coerceIn(0, height - 1); col = (arg(1, 1) - 1).coerceIn(0, width - 1); continued[row] = false }
+      'A' -> row = (row - arg(0, 1)).coerceAtLeast(0)
+      'B' -> row = (row + arg(0, 1)).coerceAtMost(height - 1)
+      'C' -> col = (col + arg(0, 1)).coerceAtMost(width - 1)
+      'D' -> col = (col - arg(0, 1)).coerceAtLeast(0)
+      'G' -> col = (arg(0, 1) - 1).coerceIn(0, width - 1)
+      'K' -> when (p.getOrNull(0) ?: 0) {
+        0 -> rows[row].fill(' '.code, col, width)
+        1 -> rows[row].fill(' '.code, 0, col + 1)
+        2 -> rows[row].fill(' '.code)
+      }
+      'J' -> when (p.getOrNull(0) ?: 0) {
+        0 -> { rows[row].fill(' '.code, col, width); for (r in row + 1 until height) { rows[r].fill(' '.code); continued[r] = false } }
+        1 -> { for (r in 0 until row) { rows[r].fill(' '.code); continued[r] = false }; rows[row].fill(' '.code, 0, col + 1) }
+        2, 3 -> for (r in 0 until height) { rows[r].fill(' '.code); continued[r] = false }
+      }
+    }
+  }
+
+  private fun rowText(r: Int): String {
+    val cps = rows[r]
+    var end = width
+    while (end > 0 && cps[end - 1] == ' '.code) end--
+    return String(cps, 0, end)
+  }
+
+  private fun logicalLine(r: Int): String {
+    var start = r
+    while (start > 0 && continued[start]) start--
+    return (start..r).joinToString("") { i -> if (i < r) String(rows[i], 0, width) else rowText(i) }.trimEnd()
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/chat/ChatSearchTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/chat/ChatSearchTest.kt
new file mode 100644
index 0000000000..77cd9b83c8
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/chat/ChatSearchTest.kt
@@ -0,0 +1,25 @@
+package chat.simplex.app.ui.chat
+
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.app.ui.harness.connect
+import chat.simplex.common.ui.Ui
+import org.junit.Test
+
+class ChatSearchTest : UiTest() {
+  @Test fun search_direct_filtersResults() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    val chat = alice.chatList.open("bob")
+    chat.send("hello there 🙂")
+    bob expectsMessage "alice> hello there 🙂"
+    bob sends "@alice hello there"
+    bob sends "@alice how are you?"
+    val matches = listOf(chat.itemId("hello there 🙂"), chat.itemId("hello there"))
+    val other = chat.itemId("how are you?")
+    chat.search("ello ther")
+    poll(what = "only the two matching items") {
+      chat.itemTexts().toSet() == setOf("hello there 🙂", "hello there") &&
+        matches.all { exists(Ui.Chat.Item(it)) } && !exists(Ui.Chat.Item(other))
+    }
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/chat/DeleteMessageTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/chat/DeleteMessageTest.kt
new file mode 100644
index 0000000000..e8eb361e8b
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/chat/DeleteMessageTest.kt
@@ -0,0 +1,24 @@
+package chat.simplex.app.ui.chat
+
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.app.ui.harness.connect
+import chat.simplex.common.ui.Ui
+import org.junit.Assert.assertFalse
+import org.junit.Test
+
+class DeleteMessageTest : UiTest() {
+  @Test fun delete_received_onlyForMe() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    bob sends "@alice hello"
+    val chat = alice.chatList.open("bob")
+    val id = chat.itemId("hello")
+    chat.menu("hello", "delete")
+    waitFor(Ui.Alert.Option(Ui.AlertSource.Shared, "forMe"))
+    assertFalse(exists(Ui.Alert.Option(Ui.AlertSource.Shared, "forEveryone")))
+    click(Ui.Alert.Option(Ui.AlertSource.Shared, "forMe"))
+    poll(what = "the item removed") { chat.item(id) == null && !exists(Ui.Chat.Item(id)) }
+    chat.send("ping")
+    bob expectsMessage "alice> ping"
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/chat/EditMessageTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/chat/EditMessageTest.kt
new file mode 100644
index 0000000000..1f9ba1971d
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/chat/EditMessageTest.kt
@@ -0,0 +1,20 @@
+package chat.simplex.app.ui.chat
+
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.app.ui.harness.connect
+import chat.simplex.common.ui.Ui
+import org.junit.Test
+
+class EditMessageTest : UiTest() {
+  @Test fun edit_received_updatesBubble() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    bob sends "@alice hello"
+    val chat = alice.chatList.open("bob")
+    val id = chat.itemId("hello")
+    bob sends "!@alice hey"
+    poll(what = "the edited bubble") {
+      chat.item(id)?.let { it.content.text == "hey" && it.meta.itemEdited } == true && textsOf(Ui.Chat.Item(id)).any { "hey" in it }
+    }
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/chat/ForwardTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/chat/ForwardTest.kt
new file mode 100644
index 0000000000..b315efce43
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/chat/ForwardTest.kt
@@ -0,0 +1,33 @@
+package chat.simplex.app.ui.chat
+
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.app.ui.harness.connect
+import chat.simplex.common.model.CIForwardedFrom
+import chat.simplex.common.platform.chatModel
+import chat.simplex.common.ui.Ui
+import org.junit.Test
+
+class ForwardTest : UiTest() {
+  @Test fun forward_contactToContact_peerSeesForwarded() = uiTest {
+    val alice = app("alice"); val bob = cli("bob"); val cath = cli("cath")
+    connect(bob); connect(cath)
+    bob sends "@alice hey"
+    alice.chatList.open("bob").forwardTo("hey", "cath")
+    cath.eventuallyMessage("alice> -> forwarded")
+    cath expects "      hey"
+  }
+
+  @Test fun forward_toNotes_showsSavedFrom() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    bob sends "@alice hey"
+    val chat = alice.chatList.open("bob")
+    chat.forwardTo("hey", "Private notes")
+    val notes = alice.chatList.chatId("Private notes")
+    poll(what = "the note saved from bob") {
+      chatModel.chatId.value == notes && chatModel.chatsContext.chatItems.value.any { (it.meta.itemForwarded as? CIForwardedFrom.Contact)?.chatName == "bob" }
+    }
+    val id = chat.itemId("hey")
+    poll(what = "the `saved from` / `bob` header") { textsOf(Ui.Chat.Item(id)).let { t -> t.any { "saved from" in it } && "bob" in t } }
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/chat/MessagingTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/chat/MessagingTest.kt
new file mode 100644
index 0000000000..2237cfba6b
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/chat/MessagingTest.kt
@@ -0,0 +1,75 @@
+package chat.simplex.app.ui.chat
+
+import chat.simplex.app.ui.harness.connect
+import chat.simplex.app.ui.harness.PeerFlags
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.common.ui.Ui
+import org.junit.Test
+
+class MessagingTest : UiTest() {
+  @Test fun unreadCounterIncrementsAndClears() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    bob sends "@alice one"
+    poll(what = "unread badge 1") { "1" in alice.chatList.rowTexts("bob") }
+    bob sends "@alice two"
+    poll(what = "unread badge 2") { "2" in alice.chatList.rowTexts("bob") }
+    alice.chatList.open("bob")
+    poll(what = "unread badge gone") { alice.chatList.rowTexts("bob").none { it == "1" || it == "2" } }
+  }
+
+  @Test fun reply_menu_sendQuoted_peerSeesQuote() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    bob sends "@alice hello! how are you?"
+    val chat = alice.chatList.open("bob")
+    chat.menu("hello! how are you?", "reply")
+    chat.send("all good - you?")
+    bob expectsMessage "alice> > hello! how are you?"
+    bob expects "      all good - you?"
+  }
+
+  @Test fun edit_menu_updatesPeer() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    val chat = alice.chatList.open("bob")
+    chat.send("hello")
+    bob expectsMessage "alice> hello"
+    chat.menu("hello", "edit")
+    chat.replaceAndSend("hey 👋")
+    bob expectsMessage "alice> [edited] hey 👋"
+  }
+
+  @Test fun delete_ownForEveryone_peerSeesMarkedDeleted() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    val chat = alice.chatList.open("bob")
+    chat.send("hello")
+    bob expectsMessage "alice> hello"
+    chat.menu("hello", "delete")
+    click(Ui.Alert.Option(Ui.AlertSource.Shared, "forEveryone"))
+    bob expectsMessage "alice> [marked deleted] hello"
+  }
+
+  @Test fun reaction_add_peerSeesAdded() = uiTest {
+    val alice = app("alice"); val bob = cli("bob", PeerFlags(reactions = true))
+    connect(bob)
+    bob sends "@alice hi"
+    alice.chatList.open("bob").react("hi", "👍")
+    bob expectsMessage "alice> >> hi"
+    bob expects "    + 👍"
+  }
+
+  @Test fun reaction_received_chipCount() = uiTest {
+    val alice = app("alice"); val bob = cli("bob", PeerFlags(reactions = true))
+    connect(bob)
+    val chat = alice.chatList.open("bob")
+    chat.send("hi")
+    bob expectsMessage "alice> hi"
+    chat.react("hi", "👍")
+    bob expectsMessage "alice> > hi"
+    bob expects "    + 👍"
+    bob types "+1 alice hi"
+    poll(what = "reaction chip count 2") { chat.reactionCount("hi", "👍") == "2" }
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/chat/NotesTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/chat/NotesTest.kt
new file mode 100644
index 0000000000..f6bd29708f
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/chat/NotesTest.kt
@@ -0,0 +1,15 @@
+package chat.simplex.app.ui.chat
+
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.common.model.CIDirection
+import org.junit.Test
+
+class NotesTest : UiTest() {
+  @Test fun notes_sendText_saved() = uiTest {
+    val alice = app("alice")
+    val notes = alice.chatList.open("Private notes")
+    notes.send("keep in mind")
+    val id = notes.itemId("keep in mind")
+    poll(what = "a local note") { notes.item(id)?.chatDir is CIDirection.LocalSnd }
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/chat/SendCompatTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/chat/SendCompatTest.kt
new file mode 100644
index 0000000000..51d51b332d
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/chat/SendCompatTest.kt
@@ -0,0 +1,14 @@
+package chat.simplex.app.ui.chat
+
+import chat.simplex.app.ui.harness.connect
+import chat.simplex.app.ui.harness.UiTest
+import org.junit.Test
+
+class SendCompatTest : UiTest() {
+  @Test fun sendText_enter_peerReceives() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    alice.chatList.open("bob").send("hello there 🙂")
+    bob expectsMessage "alice> hello there 🙂"
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/groups/GroupsTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/groups/GroupsTest.kt
new file mode 100644
index 0000000000..489fec1aa9
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/groups/GroupsTest.kt
@@ -0,0 +1,45 @@
+package chat.simplex.app.ui.groups
+
+import chat.simplex.app.ui.harness.CONNECT_TIMEOUT_MS
+import chat.simplex.app.ui.harness.connect
+import chat.simplex.app.ui.harness.connectPeers
+import chat.simplex.app.ui.harness.hostGroup
+import chat.simplex.app.ui.harness.joinGroupFromList
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.common.platform.chatModel
+import chat.simplex.common.ui.Ui
+import org.junit.Test
+
+class GroupsTest : UiTest() {
+  @Test fun createGroup_opensChatAndInviteSheet() = uiTest {
+    val alice = app("alice")
+    alice.newChat().createGroup("team")
+    val id = alice.chatList.chatId("team")
+    poll(what = "the group chat open with the invite members sheet") { chatModel.chatId.value == id && seesText("Invite members") }
+  }
+
+  @Test fun groupSend_allMembersReceive() = uiTest {
+    val alice = app("alice"); val bob = cli("bob"); val cath = cli("cath")
+    connect(bob)
+    connectPeers(bob, cath)
+    hostGroup(bob, "team", "alice", "cath")
+    joinGroupFromList(alice, bob, "team")
+    cath sends "/j team"
+    cath.eventually("#team: you joined the group")
+    bob.eventually("#team: cath joined the group")
+    cath.eventually("#team: member alice is connected", CONNECT_TIMEOUT_MS)
+    alice.chatList.open("team").send("hello")
+    bob.eventuallyMessage("#team alice> hello", CONNECT_TIMEOUT_MS)
+    cath.eventuallyMessage("#team alice> hello", CONNECT_TIMEOUT_MS)
+  }
+
+  @Test fun leaveGroup_fromChatListMenu() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    hostGroup(bob, "team", "alice")
+    joinGroupFromList(alice, bob, "team")
+    alice.chatList.rowMenu("team", "leave")
+    click(Ui.Alert.Confirm(Ui.AlertSource.Shared))
+    bob.eventually("#team: alice left the group (signed)")
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/groups/JoiningCompatTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/groups/JoiningCompatTest.kt
new file mode 100644
index 0000000000..19bdf998b3
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/groups/JoiningCompatTest.kt
@@ -0,0 +1,16 @@
+package chat.simplex.app.ui.groups
+
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.app.ui.harness.connect
+import chat.simplex.app.ui.harness.hostGroup
+import chat.simplex.app.ui.harness.joinGroupFromList
+import org.junit.Test
+
+class JoiningCompatTest : UiTest() {
+  @Test fun groupInvitation_tapRowShowsJoinAlert() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    hostGroup(bob, "team", "alice")
+    joinGroupFromList(alice, bob, "team")
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/groups/MemberInfoTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/groups/MemberInfoTest.kt
new file mode 100644
index 0000000000..2c7cf3c7ef
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/groups/MemberInfoTest.kt
@@ -0,0 +1,28 @@
+package chat.simplex.app.ui.groups
+
+import chat.simplex.app.ui.harness.CONNECT_TIMEOUT_MS
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.app.ui.harness.connect
+import chat.simplex.app.ui.harness.ownGroup
+import chat.simplex.common.model.GroupMemberRole
+import chat.simplex.common.platform.chatModel
+import org.junit.Test
+
+class MemberInfoTest : UiTest() {
+  @Test fun memberInfo_changeRoleToAdmin() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    ownGroup(alice, "team", bob).groupInfo().member("bob").changeRole(GroupMemberRole.Admin)
+    bob.eventually("#team: alice changed your role from member to admin (signed)", CONNECT_TIMEOUT_MS)
+    poll(what = "bob is admin") { chatModel.groupMembers.value.any { it.memberProfile.displayName == "bob" && it.memberRole == GroupMemberRole.Admin } }
+  }
+
+  @Test fun memberInfo_removeMember() = uiTest {
+    val alice = app("alice"); val bob = cli("bob"); val cath = cli("cath")
+    connect(bob); connect(cath)
+    ownGroup(alice, "team", bob, cath).groupInfo().member("bob").remove()
+    bob.eventually("#team: alice removed you from the group (signed)", CONNECT_TIMEOUT_MS)
+    cath.eventually("#team: alice removed bob from the group (signed)", CONNECT_TIMEOUT_MS)
+    poll(what = "bob no longer a current member") { chatModel.groupMembers.value.none { it.memberProfile.displayName == "bob" && it.memberCurrent } }
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/ChatListFilterScreens.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/ChatListFilterScreens.kt
new file mode 100644
index 0000000000..8f56a2445c
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/ChatListFilterScreens.kt
@@ -0,0 +1,104 @@
+package chat.simplex.app.ui.harness
+
+import androidx.compose.runtime.mutableStateOf
+import chat.simplex.common.model.BusinessChatType
+import chat.simplex.common.model.ChatInfo
+import chat.simplex.common.platform.appPlatform
+import chat.simplex.common.platform.chatController
+import chat.simplex.common.platform.chatModel
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.views.chatlist.ActiveFilter
+import chat.simplex.common.views.chatlist.PresetTagKind
+import kotlinx.coroutines.runBlocking
+
+fun UiScope.presetFilter(kind: PresetTagKind, label: String) {
+  quiesce()
+  val chip = Ui.ChatList.PresetTag(kind.name)
+  if (exists(chip)) {
+    poll(what = "the `$label` filter chip") { label in textsOf(chip) }
+    click(chip)
+  } else {
+    click(Ui.ChatList.PresetMenu)
+    val item = Ui.ChatList.PresetMenuItem(kind.name)
+    poll(what = "the `$label` item in the filter menu") { exists(item) && label in textsOf(item) }
+    click(item)
+  }
+  poll(what = "the `$label` filter to be active") { chatModel.activeChatTagFilter.value == ActiveFilter.PresetTag(kind) }
+}
+
+fun UiScope.keepOneTimeLink(app: App): String {
+  val link = app.newChat().createOneTimeLink()
+  goBack()
+  poll(what = "the `Keep unused invitation?` alert") { seesText("Keep unused invitation?") }
+  click(Ui.Alert.Dismiss(Ui.AlertSource.Shared))
+  if (exists(Ui.NewChat.CreateLink)) goBack()
+  poll(what = "the New chat sheet to close with the pending connection kept") {
+    !exists(Ui.NewChat.CreateLink) && chatModel.chats.value.any { it.chatInfo is ChatInfo.ContactConnection }
+  }
+  return link
+}
+
+fun UiScope.namePendingConnection(alias: String) {
+  var id: String? = null
+  poll(what = "a pending connection in the model") {
+    id = chatModel.chats.value.firstOrNull { it.chatInfo is ChatInfo.ContactConnection }?.id
+    id != null
+  }
+  openContextMenu(Ui.ChatList.Row(id!!))
+  click(Ui.ChatList.RowMenu(id!!, "setName"))
+  typeInto(Ui.Info.Alias, alias)
+  poll(what = "the pending connection alias `$alias` in the model") {
+    (chatModel.chats.value.firstOrNull { it.id == id }?.chatInfo as? ChatInfo.ContactConnection)?.contactConnection?.localAlias == alias
+  }
+  closePendingConnectionInfo()
+}
+
+fun UiScope.closePendingConnectionInfo() {
+  if (!appPlatform.isAndroid) return
+  click(described("Back"))
+  poll(what = "the pending connection info to close") { !exists(Ui.Info.Alias) }
+}
+
+fun UiScope.joinLink(link: String) {
+  val plan = runBlocking { chatController.apiConnectPlan(null, link, inProgress = mutableStateOf(true)) }
+    ?: error("apiConnectPlan failed for $link")
+  runBlocking { chatController.apiConnect(null, incognito = false, connLink = plan.connLink) }
+    ?: error("apiConnect failed for $link")
+}
+
+fun UiScope.businessChat(biz: CliPeer) {
+  joinLink(biz.createAddress(business = true))
+  biz.eventuallyMatching(Regex("#\\S+: \\S+ joined the group"), CONNECT_TIMEOUT_MS)
+  poll(timeoutMs = CONNECT_TIMEOUT_MS, what = "the business chat `${biz.name}`") {
+    chatModel.chats.value.any { c ->
+      c.chatInfo.chatViewName == biz.name && (c.chatInfo as? ChatInfo.Group)?.groupInfo?.businessChat?.chatType == BusinessChatType.Business
+    }
+  }
+  quiesce()
+}
+
+fun CliPeer.createAddress(business: Boolean = false): String {
+  this sends "/ad"
+  this expects "Your new chat address is created!"
+  this expects ""
+  val link = nextLine()
+  this sends (if (business) "/auto_accept on business" else "/auto_accept on")
+  eventually(if (business) "auto_accept on, business" else "auto_accept on")
+  return link
+}
+
+fun CliPeer.createGroupLink(group: String): String {
+  createGroup(group)
+  this sends "/create link #$group"
+  this expects "Group link is created!"
+  this expects ""
+  return nextLine()
+}
+
+val planConfirm = Ui.Alert.Confirm(Ui.AlertSource.PrivacySensitive)
+
+fun UiScope.enterLinkInSearch(link: String) = enterText(Ui.ChatList.Search, link)
+
+fun UiScope.searchShowsLink(description: String): Boolean =
+  !isEnabled(Ui.ChatList.Search) && editableText(Ui.ChatList.Search).orEmpty().startsWith("$description (via ")
+
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/ChatListListsScreens.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/ChatListListsScreens.kt
new file mode 100644
index 0000000000..5e4b285e16
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/ChatListListsScreens.kt
@@ -0,0 +1,84 @@
+package chat.simplex.app.ui.harness
+
+import chat.simplex.common.model.ChatTag
+import chat.simplex.common.platform.chatModel
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.views.chatlist.ActiveFilter
+
+class UserListsScreen(private val s: UiScope) {
+  fun tag(name: String): ChatTag {
+    var t: ChatTag? = null
+    s.poll(what = "list `$name` in the model") {
+      t = chatModel.userTags.value.firstOrNull { it.chatTagText == name }
+      t != null
+    }
+    return t!!
+  }
+
+  fun chip(name: String) = Ui.ChatList.UserTag(tag(name).chatTagId)
+
+  fun chipTexts(name: String): List<String> = s.textsOf(chip(name))
+
+  fun activeTagId(): Long? = (chatModel.activeChatTagFilter.value as? ActiveFilter.UserTag)?.tag?.chatTagId
+
+  fun tagsOf(chat: String): List<Long> = ChatListScreen(s).chat(chat).chatInfo.chatTags.orEmpty()
+
+  fun editor() = ListEditorScreen(s)
+
+  fun addList(): ListEditorScreen {
+    s.click(Ui.ChatList.AddList)
+    return editor()
+  }
+
+  fun create(name: String): ChatTag {
+    addList().apply { typeName(name); save() }
+    return tag(name)
+  }
+
+  fun menu(name: String, action: String) {
+    val id = tag(name).chatTagId
+    s.openContextMenu(Ui.ChatList.UserTag(id))
+    s.click(Ui.ChatList.UserTagMenu(id, action))
+  }
+
+  fun filter(name: String) {
+    val id = tag(name).chatTagId
+    s.click(Ui.ChatList.UserTag(id))
+    s.poll(what = "the `$name` list filter to be active") { activeTagId() == id }
+  }
+
+  fun assign(chat: String, list: String) {
+    val id = tag(list).chatTagId
+    ChatListScreen(s).rowMenu(chat, "tagList")
+    s.click(Ui.TagList.Tag(id))
+    s.poll(what = "`$chat` in list `$list` and the list sheet closed") { tagsOf(chat) == listOf(id) && !s.exists(Ui.TagList.Tag(id)) }
+  }
+}
+
+fun UiScope.lists() = UserListsScreen(this)
+
+class ListEditorScreen(private val s: UiScope) {
+  fun shown(): Boolean = s.exists(Ui.TagEditor.Name)
+
+  fun typeName(text: String) = s.typeInto(Ui.TagEditor.Name, text)
+
+  fun replaceName(text: String) = s.replaceText(Ui.TagEditor.Name, text)
+
+  fun nameText(): String? = s.editableText(Ui.TagEditor.Name)
+
+  fun emojiText(): String? = s.editableText(Ui.TagEditor.Emoji) ?: s.textsOf(Ui.TagEditor.Emoji).firstOrNull()
+
+  fun saveLabel(): String? = s.textOf(Ui.TagEditor.Save)
+
+  fun save() {
+    s.click(Ui.TagEditor.Save)
+    s.poll(what = "the list editor to close") { !shown() }
+  }
+
+  fun saveIgnored() {
+    s.click(Ui.TagEditor.Save)
+    s.settle()
+    s.quiesce()
+    check(shown()) { "the list editor closed although its save button is disabled" }
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/ChatListMenusScreens.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/ChatListMenusScreens.kt
new file mode 100644
index 0000000000..9a8a781147
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/ChatListMenusScreens.kt
@@ -0,0 +1,10 @@
+package chat.simplex.app.ui.harness
+
+import chat.simplex.common.ui.Ui
+
+fun UiScope.openRowMenu(name: String): String {
+  val id = ChatListScreen(this).chatId(name)
+  openContextMenu(Ui.ChatList.Row(id))
+  return id
+}
+
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/ChatListRowsScreens.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/ChatListRowsScreens.kt
new file mode 100644
index 0000000000..55bff9a8e8
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/ChatListRowsScreens.kt
@@ -0,0 +1,25 @@
+package chat.simplex.app.ui.harness
+
+import chat.simplex.common.platform.chatController
+import chat.simplex.common.platform.chatModel
+import kotlinx.coroutines.runBlocking
+
+fun UiScope.switchAwayFromChat(app: App) {
+  backToChatList()
+  app.chatList.open("Private notes")
+  poll(what = "the notes folder to open") { chatModel.chatId.value == app.chatList.chatId("Private notes") }
+  backToChatList()
+}
+
+fun UiScope.closeInfoToChatList() {
+  escape()
+  backToChatList()
+}
+
+
+fun UiScope.connectIncognito(peer: CliPeer): String {
+  val (link, _) = runBlocking { chatController.apiAddContact(null, incognito = true) }.first ?: error("apiAddContact failed")
+  peer sends "/c ${link.simplexChatUri(short = true)}"
+  peer expects "confirmation sent!"
+  return peer.eventuallyMatching(Regex("(\\S+): contact is connected"), CONNECT_TIMEOUT_MS).groupValues[1]
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/ChatListToolbarScreens.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/ChatListToolbarScreens.kt
new file mode 100644
index 0000000000..f33ae1841d
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/ChatListToolbarScreens.kt
@@ -0,0 +1,73 @@
+package chat.simplex.app.ui.harness
+
+import chat.simplex.common.model.OperatorTag
+import chat.simplex.common.platform.appPlatform
+import chat.simplex.common.platform.chatController
+import chat.simplex.common.platform.chatModel
+import chat.simplex.common.ui.Ui
+import kotlinx.coroutines.runBlocking
+
+class ChatListToolbar(private val s: UiScope) {
+  private val title = Ui.ChatList.Bar.part("title")
+
+  fun titleTexts(): List<String> = s.textsOf(title)
+
+  fun canScrollToTop(): Boolean {
+    s.waitFor(title)
+    return s.isEnabled(title)
+  }
+
+  fun scrollToTop() = s.click(title)
+
+  fun profileBadge(): Boolean = s.textsOf(Ui.ChatList.UserPicker).isNotEmpty()
+
+  fun percentage(): String? = s.textsOf(Ui.ChatList.Subscriptions).firstOrNull { it.endsWith("%") }
+
+  fun toggleShowPercentage() {
+    s.click(Ui.ChatList.Subscriptions)
+    s.click(Ui.ServersSummary.ShowPercentage)
+    s.escape()
+    s.poll(what = "the servers info screen to close") { !s.exists(Ui.ServersSummary.ShowPercentage) }
+  }
+}
+
+fun UiScope.chatListToolbar() = ChatListToolbar(this)
+
+class WhatsNewScreen(private val s: UiScope) {
+  fun shown(): Boolean = s.seesText(TITLE)
+
+  fun ok() {
+    s.click(Ui.WhatsNew.Ok)
+    s.poll(what = "What's New to close") { !s.exists(Ui.WhatsNew.Ok) && !shown() }
+  }
+
+  companion object {
+    val VERSION: String by lazy {
+      Class.forName("chat.simplex.common.views.onboarding.WhatsNewViewKt").getDeclaredField("lastVersion").apply { isAccessible = true }.get(null) as String
+    }
+    val TITLE: String get() = "New in $VERSION"
+    const val OLDER_VERSION = "v6.5"
+  }
+}
+
+fun UiScope.whatsNewFromSettings(app: App): WhatsNewScreen {
+  app.settings()
+  click(Ui.Settings.Help)
+  click(Ui.Help.WhatsNew)
+  return WhatsNewScreen(this)
+}
+
+fun UiScope.backToChatList() {
+  if (appPlatform.isAndroid && chatModel.chatId.value != null) {
+    escape()
+    poll(what = "the chat to close") { chatModel.chatId.value == null }
+  }
+  waitFor(Ui.ChatList.Search)
+}
+
+fun enableOperator(tag: OperatorTag) {
+  val groups = runBlocking { chatController.getUserServers(null) } ?: error("getUserServers failed")
+  val updated = groups.map { g -> g.operator?.takeIf { it.operatorTag == tag }?.let { g.copy(operator = it.copy(enabled = true)) } ?: g }
+  check(updated != groups) { "no operator $tag to enable" }
+  check(runBlocking { chatController.setUserServers(null, updated) }) { "setUserServers failed" }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/CommonReset.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/CommonReset.kt
new file mode 100644
index 0000000000..b7c6dd2412
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/CommonReset.kt
@@ -0,0 +1,110 @@
+package chat.simplex.app.ui.harness
+
+import androidx.compose.runtime.MutableState
+import chat.simplex.common.AppLock
+import chat.simplex.common.model.*
+import chat.simplex.common.views.helpers.*
+import chat.simplex.common.platform.VideoPlayerHolder
+import kotlinx.coroutines.flow.MutableStateFlow
+import java.lang.reflect.Modifier
+import java.util.IdentityHashMap
+
+object ModelSnapshot {
+  private val restores = mutableListOf<() -> Unit>()
+  private val excludedTypes = setOf(ChatController::class.java, AppPreferences::class.java)
+
+  fun capture() {
+    restores.clear()
+    val seen = IdentityHashMap<Any, Unit>()
+    listOf<Any>(ChatModel, AppLock, ConnectProgressManager, ChannelRelaysModel, BadgeModel, VideoPlayerHolder).forEach { walk(it, seen) }
+  }
+
+  fun restore(onMain: (() -> Unit) -> Unit) = onMain { restores.forEach { it() } }
+
+  private fun walk(obj: Any, seen: IdentityHashMap<Any, Unit>) {
+    if (seen.put(obj, Unit) != null) return
+    val cls = obj.javaClass
+    val isObject = runCatching { cls.getDeclaredField("INSTANCE").apply { isAccessible = true }.get(null) === obj }.getOrDefault(false)
+    for (f in cls.declaredFields) {
+      val static = Modifier.isStatic(f.modifiers)
+      if (static != isObject || f.isSynthetic || f.name == "INSTANCE" || f.name.startsWith("$")) continue
+      if (f.type in excludedTypes) continue
+      f.isAccessible = true
+      val target = if (static) null else obj
+      val value = f.get(target)
+      if (!Modifier.isFinal(f.modifiers)) restores += { f.set(target, value) }
+      val content = if (value is Lazy<*>) value.value else value
+      if (content != null) captureValue(content)
+      if (content != null && Modifier.isFinal(f.modifiers) && isAppObject(content)) walk(content, seen)
+    }
+  }
+
+  @Suppress("UNCHECKED_CAST")
+  private fun captureValue(value: Any) {
+    when {
+      value is MutableStateFlow<*> -> { val v = value.value; restores += { (value as MutableStateFlow<Any?>).value = v } }
+      value is MutableState<*> -> { val v = value.value; restores += { (value as MutableState<Any?>).value = v } }
+      value is MutableList<*> -> { val c = value.toList(); restores += { (value as MutableList<Any?>).apply { clear(); addAll(c) } } }
+      value is MutableCollection<*> -> { val c = value.toList(); restores += { (value as MutableCollection<Any?>).apply { clear(); addAll(c) } } }
+      value is MutableMap<*, *> -> { val c = value.toMap(); restores += { (value as MutableMap<Any?, Any?>).apply { clear(); putAll(c) } } }
+    }
+  }
+
+  private fun isAppObject(v: Any): Boolean =
+    v.javaClass.name.startsWith("chat.simplex.") && !v.javaClass.isEnum && v.javaClass !in excludedTypes
+}
+
+object CommonUiState {
+  fun clear(onMain: (() -> Unit) -> Unit) {
+    ModelSnapshot.restore(onMain)
+    onMain {
+      CIFile.cachedRemoteFileRequests.clear()
+      clearImageCaches()
+      WallpaperType.cachedImages.clear()
+      setStatic("chat.simplex.common.views.chatlist.ChatListViewKt", "lazyListState", 0 to 0)
+      setStatic("chat.simplex.common.views.chat.ChatViewKt", "reportsListState", null)
+      AppLock.clearAuthState()
+    }
+    clearTransient(onMain)
+  }
+
+  fun clearTransient(onMain: (() -> Unit) -> Unit) = onMain {
+    ModalManager.closeAllModalsEverywhere()
+    listOf(ModalManager.start, ModalManager.center, ModalManager.end, ModalManager.fullscreen).distinct().forEach { m ->
+      for (name in listOf("passcodeView", "onTimePasscodeView")) {
+        @Suppress("UNCHECKED_CAST")
+        (ModalManager::class.java.getDeclaredField(name).apply { isAccessible = true }.get(m) as MutableStateFlow<Any?>).value = null
+      }
+    }
+    AlertManager.shared.hideAllAlerts()
+    AlertManager.privacySensitive.hideAllAlerts()
+  }
+
+  private fun setStatic(cls: String, name: String, value: Any?) {
+    Class.forName(cls).getDeclaredField(name).apply { isAccessible = true }.set(null, value)
+  }
+}
+
+object CommonPrefs {
+  fun reload() {
+    AppPreferences::class.java.getDeclaredField("themeOverridesStore").apply { isAccessible = true }.set(null, null)
+    val stateField = SharedPreference::class.java.getDeclaredField("_state").apply { isAccessible = true }
+    for (f in AppPreferences::class.java.declaredFields) {
+      if (!SharedPreference::class.java.isAssignableFrom(f.type)) continue
+      f.isAccessible = true
+      val pref = f.get(ChatController.appPrefs) as SharedPreference<*>
+      @Suppress("UNCHECKED_CAST")
+      (stateField.get(pref) as MutableState<Any?>).value = pref.get()
+    }
+    val appPrefs = ChatController.appPrefs
+    chat.simplex.common.ui.theme.ThemeManager.applyTheme(appPrefs.currentTheme.get()!!)
+    java.util.Locale.setDefault(java.util.Locale.ENGLISH)
+    val chatModel = ChatModel
+    chatModel.notificationPreviewMode.value =
+      runCatching { NotificationPreviewMode.valueOf(appPrefs.notificationPreviewMode.get()!!) }.getOrDefault(NotificationPreviewMode.default)
+    chatModel.showAuthScreen.value = appPrefs.performLA.get()
+    chatModel.showChatPreviews.value = appPrefs.privacyShowChatPreviews.get()
+    chatModel.simplexLinkMode.value = appPrefs.simplexLinkMode.get()
+  }
+}
+
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/Helpers.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/Helpers.kt
new file mode 100644
index 0000000000..804bc3b906
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/Helpers.kt
@@ -0,0 +1,77 @@
+package chat.simplex.app.ui.harness
+
+import chat.simplex.common.model.ChatInfo
+import chat.simplex.common.model.GroupMemberStatus
+import chat.simplex.common.platform.chatModel
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.ui.UiIdle
+import chat.simplex.common.ui.UiKey
+
+const val CONNECT_TIMEOUT_MS = 60_000L
+const val QUIET_MS = 1_000L
+const val DESCRIBED = "@described"
+
+fun described(contentDescription: String) = chat.simplex.common.ui.UiKey(DESCRIBED, contentDescription)
+
+fun UiScope.goBack() {
+  if (chat.simplex.common.platform.appPlatform.isDesktop) click(described("Back")) else escape()
+}
+
+fun UiScope.quiesce() {
+  poll(timeoutMs = 30_000, what = "no API calls in flight and no app events for $QUIET_MS ms") {
+    chat.simplex.common.ui.UiIdle.inFlight().isEmpty() && System.currentTimeMillis() - chat.simplex.common.ui.UiIdle.lastEventAt >= QUIET_MS
+  }
+}
+
+fun UiScope.connect(peer: CliPeer) {
+  val (link, _) = kotlinx.coroutines.runBlocking { chat.simplex.common.platform.chatController.apiAddContact(null, incognito = false) }.first
+    ?: error("apiAddContact failed")
+  peer sends "/c ${link.simplexChatUri(short = true)}"
+  peer expects "confirmation sent!"
+  peer.eventually("${chat.simplex.common.platform.chatModel.currentUser.value!!.displayName}: contact is connected", CONNECT_TIMEOUT_MS)
+}
+
+fun UiScope.connectPeers(a: CliPeer, b: CliPeer) {
+  val link = a.createOneTimeLink()
+  b sends "/c $link"
+  b expects "confirmation sent!"
+  a.eventually("${b.name}: contact is connected", CONNECT_TIMEOUT_MS)
+  b.eventually("${a.name}: contact is connected", CONNECT_TIMEOUT_MS)
+}
+
+fun UiScope.hostGroup(host: CliPeer, group: String, vararg members: String) {
+  host.createGroup(group)
+  for (m in members) {
+    host sends "/a $group $m"
+    host.eventually("invitation to join the group #$group sent to $m")
+  }
+}
+
+fun CliPeer.createGroup(group: String) {
+  this sends "/g $group"
+  this expects "group #$group is created"
+  this expects "to add members use /a $group <name> or /create link #$group"
+}
+
+fun CliPeer.createOneTimeLink(): String {
+  this types "/c"
+  var link: String? = null
+  while (link == null) link = Regex("(https://\\S+|simplex:/\\S+)").find(nextLine())?.value
+  return link
+}
+
+fun UiScope.openContextMenu(key: UiKey) {
+  poll(what = "API calls to finish before opening the menu of ${key.tag}") { UiIdle.inFlight().isEmpty() }
+  settle()
+  rightClick(key)
+}
+
+fun UiScope.joinGroupFromList(app: App, host: CliPeer, group: String) {
+  app.chatList.open(group)
+  click(Ui.Alert.Confirm(Ui.AlertSource.Shared))
+  host.eventually("#$group: ${chatModel.currentUser.value!!.displayName} joined the group", CONNECT_TIMEOUT_MS)
+  poll(timeoutMs = CONNECT_TIMEOUT_MS, what = "membership of #$group to be connected") {
+    (app.chatList.chat(group).chatInfo as ChatInfo.Group).groupInfo.membership.memberStatus == GroupMemberStatus.MemConnected
+  }
+  quiesce()
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/OnboardingScreens.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/OnboardingScreens.kt
new file mode 100644
index 0000000000..d9e3c5fd8e
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/OnboardingScreens.kt
@@ -0,0 +1,59 @@
+package chat.simplex.app.ui.harness
+
+import chat.simplex.common.model.ChatController.appPrefs
+import chat.simplex.common.platform.chatModel
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.views.onboarding.OnboardingStage
+
+class OnboardingScreen(private val s: UiScope) {
+  val stage: OnboardingStage get() = appPrefs.onboardingStage.get()
+
+  fun createProfile(name: String) {
+    s.click(Ui.Onboarding.GetStarted)
+    s.typeInto(Ui.Onboarding.ProfileName, name)
+    s.click(Ui.Onboarding.CreateProfile)
+    s.poll(timeoutMs = 30_000, what = "profile `$name` to be created and the profile step to close") {
+      chatModel.currentUser.value?.displayName == name && stage != OnboardingStage.Step2_CreateProfile
+    }
+  }
+
+  fun useRandomPassphrase() {
+    s.click(Ui.Onboarding.RandomPassphrase)
+    s.click(Ui.Alert.Confirm(Ui.AlertSource.Shared))
+    s.poll(what = "the passphrase step to close") { stage != OnboardingStage.Step2_5_SetupDatabasePassphrase }
+  }
+
+  fun toYourNetwork(name: String) {
+    createProfile(name)
+    if (stage == OnboardingStage.Step2_5_SetupDatabasePassphrase) useRandomPassphrase()
+    s.poll(timeoutMs = 30_000, what = "the Your network step") { stage == OnboardingStage.Step3_ChooseServerOperators && s.exists(Ui.Onboarding.Continue) }
+  }
+
+  fun openOperators() {
+    s.click(Ui.Onboarding.SetupRouters)
+    s.waitFor(Ui.Onboarding.OperatorsOk)
+  }
+
+  fun enabledOperatorIds(): Set<Long> =
+    chatModel.conditions.value.serverOperators.filter { it.enabled }.map { it.operatorId }.toSet()
+
+  fun toConditions(name: String) {
+    toYourNetwork(name)
+    s.click(Ui.Onboarding.Continue)
+    s.poll(what = "the Network commitments step") { stage == OnboardingStage.Step4_NetworkCommitments && s.exists(Ui.Onboarding.Accept) }
+  }
+
+  fun waitForChatList() {
+    s.poll(timeoutMs = 30_000, what = "onboarding to complete and the chat list to show") {
+      stage == OnboardingStage.OnboardingComplete && s.exists(Ui.ChatList.NewChat)
+    }
+  }
+
+  fun complete(name: String) {
+    toConditions(name)
+    s.click(Ui.Onboarding.Accept)
+    waitForChatList()
+  }
+}
+
+fun UiScope.onboarding() = OnboardingScreen(this)
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/PeerLines.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/PeerLines.kt
new file mode 100644
index 0000000000..76d1957672
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/PeerLines.kt
@@ -0,0 +1,93 @@
+package chat.simplex.app.ui.harness
+
+fun interface Waiter {
+  fun waitUntil(timeoutMs: Long, what: String, cond: () -> Boolean)
+}
+
+data class PeerFlags(val reactions: Boolean = false, val markRead: Boolean = false, val fullLinks: Boolean = false)
+
+abstract class PeerLines(val name: String, protected val waiter: Waiter) {
+  protected val lines = ArrayList<String>()
+
+  protected abstract fun fill()
+
+  protected abstract fun type(text: String)
+
+  infix fun sends(cmd: String) {
+    type(cmd)
+    await(LINE_TIMEOUT_MS, "$name: echo of `$cmd`") { takeFirst { it == cmd || stripTime(it) == cmd } != null }
+  }
+
+  infix fun types(text: String) = type(text)
+
+  infix fun expects(line: String) {
+    val got = nextLine()
+    if (got != line) throw AssertionError("$name: expected `$line`, got `$got`; next: ${pending()}")
+  }
+
+  infix fun expectsMessage(line: String) {
+    val got = nextLine()
+    if (stripTime(got) != line) throw AssertionError("$name: expected message `$line`, got `$got`; next: ${pending()}")
+  }
+
+  fun eventually(line: String, timeoutMs: Long = LINE_TIMEOUT_MS) {
+    await(timeoutMs, "$name: `$line`") { synchronized(lines) { lines.contains(line) } }
+    synchronized(lines) { val i = lines.indexOf(line); repeat(i + 1) { lines.removeAt(0) } }
+  }
+
+  fun eventuallyMessage(line: String, timeoutMs: Long = LINE_TIMEOUT_MS) {
+    await(timeoutMs, "$name: message `$line`") { synchronized(lines) { lines.any { stripTime(it) == line } } }
+    synchronized(lines) { val i = lines.indexOfFirst { stripTime(it) == line }; repeat(i + 1) { lines.removeAt(0) } }
+  }
+
+  fun eventuallyMatching(regex: Regex, timeoutMs: Long = LINE_TIMEOUT_MS): MatchResult {
+    await(timeoutMs, "$name: a line matching `$regex`") { synchronized(lines) { lines.any { regex.matches(it) } } }
+    return synchronized(lines) {
+      val i = lines.indexOfFirst { regex.matches(it) }
+      regex.matchEntire(lines[i])!!.also { repeat(i + 1) { lines.removeAt(0) } }
+    }
+  }
+
+  fun nextLine(timeoutMs: Long = LINE_TIMEOUT_MS): String {
+    await(timeoutMs, "$name: next output line") { synchronized(lines) { lines.isNotEmpty() } }
+    return synchronized(lines) { lines.removeAt(0) }
+  }
+
+  fun contactId(contact: String): Long {
+    sends("/i @$contact")
+    var id: Long? = null
+    await(LINE_TIMEOUT_MS, "$name: contact ID of $contact") {
+      synchronized(lines) {
+        val i = lines.indexOfFirst { it.startsWith("contact ID: ") }
+        if (i >= 0) {
+          id = lines[i].removePrefix("contact ID: ").trim().toLong()
+          val end = (i until lines.size).firstOrNull { lines[it].startsWith("peer chat protocol version range") } ?: (lines.size - 1)
+          repeat(end - i + 1) { lines.removeAt(i) }
+          true
+        } else false
+      }
+    }
+    return id!!
+  }
+
+  fun pending(): List<String> = synchronized(lines) { lines.take(10) }
+
+  protected fun await(timeoutMs: Long, what: String, cond: () -> Boolean) =
+    try {
+      waiter.waitUntil(timeoutMs, what) { fill(); cond() }
+    } catch (e: AssertionError) {
+      throw AssertionError("${e.message}; $name output: ${pending()}", e)
+    }
+
+  protected fun stripTime(line: String): String = TIME_PREFIX.replaceFirst(line, "")
+
+  private fun takeFirst(pred: (String) -> Boolean): String? = synchronized(lines) {
+    val i = lines.indexOfFirst(pred)
+    if (i >= 0) lines.removeAt(i) else null
+  }
+
+  companion object {
+    const val LINE_TIMEOUT_MS = 15_000L
+    private val TIME_PREFIX = Regex("^\\d{2}:\\d{2} ")
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/Screens.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/Screens.kt
new file mode 100644
index 0000000000..76fd78ad86
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/Screens.kt
@@ -0,0 +1,341 @@
+package chat.simplex.app.ui.harness
+
+import chat.simplex.common.model.ChatInfo
+import chat.simplex.common.model.ChatItem
+import chat.simplex.common.model.GroupMemberRole
+import chat.simplex.common.platform.chatModel
+import chat.simplex.common.ui.Ui
+
+class App(private val s: UiScope) {
+  val chatList = ChatListScreen(s)
+
+  fun userPicker(): UserPickerScreen {
+    s.click(Ui.ChatList.UserPicker)
+    return UserPickerScreen(s)
+  }
+
+  fun profile(): ProfileScreen {
+    s.click(Ui.ChatList.UserPicker)
+    s.click(Ui.UserPicker.User(chatModel.currentUser.value!!.userId))
+    return ProfileScreen(s)
+  }
+
+  fun appearance(): AppearanceScreen {
+    s.click(Ui.ChatList.UserPicker)
+    s.click(Ui.UserPicker.Settings)
+    s.click(Ui.Settings.Appearance)
+    return AppearanceScreen(s)
+  }
+
+  fun settings() {
+    s.click(Ui.ChatList.UserPicker)
+    s.click(Ui.UserPicker.Settings)
+  }
+
+  fun newChat(): NewChatScreen {
+    s.click(Ui.ChatList.NewChat)
+    return NewChatScreen(s)
+  }
+}
+
+class ChatListScreen(private val s: UiScope) {
+  fun chatId(name: String): String {
+    var id: String? = null
+    s.poll(what = "chat `$name` in the model") {
+      id = chatModel.chats.value.firstOrNull { it.chatInfo.chatViewName == name }?.id
+      id != null
+    }
+    return id!!
+  }
+
+  fun row(name: String): ChatListScreen {
+    s.waitFor(Ui.ChatList.Row(chatId(name)))
+    return this
+  }
+
+  fun request(name: String): ChatListScreen {
+    row(name)
+    s.poll(what = "the `Open to accept` request row for `$name`") { s.seesText("Open to accept", substring = true) }
+    return this
+  }
+
+  fun rowMenu(name: String, action: String, label: String? = null) {
+    val id = chatId(name)
+    val item = Ui.ChatList.RowMenu(id, action)
+    s.openContextMenu(Ui.ChatList.Row(id))
+    s.poll(what = "row menu item `$action`" + (label?.let { " labelled `$it`" } ?: "") + " (model settings ${chatModel.chats.value.firstOrNull { it.id == id }?.chatInfo?.chatSettings})") {
+      s.exists(item) && (label == null || label in s.textsOf(item))
+    }
+    s.click(item)
+  }
+
+  fun gone(name: String) {
+    s.poll(what = "chat `$name` to disappear") { chatModel.chats.value.none { it.chatInfo.chatViewName == name } }
+  }
+
+  fun open(name: String): ChatScreen {
+    s.click(Ui.ChatList.Row(chatId(name)))
+    return ChatScreen(s)
+  }
+
+  fun search(text: String) = s.typeInto(Ui.ChatList.Search, text)
+
+  fun shown(name: String): Boolean = s.exists(Ui.ChatList.Row(chatId(name)))
+
+  fun shareTo(name: String) = s.click(Ui.Share.Row(chatId(name)))
+
+  fun rowTexts(name: String): List<String> = s.textsOf(Ui.ChatList.Row(chatId(name)))
+
+  fun rowDescriptions(name: String): List<String> = s.descriptionsOf(Ui.ChatList.Row(chatId(name)))
+
+  fun chat(name: String) = chatModel.chats.value.first { it.chatInfo.chatViewName == name }
+}
+
+class NewChatScreen(private val s: UiScope) {
+  fun createGroup(name: String) {
+    s.click(Ui.NewChat.CreateGroup)
+    s.typeInto(Ui.NewGroup.Name, name)
+    s.click(Ui.NewGroup.Create)
+  }
+
+  fun invite(vararg names: String) {
+    for (name in names) s.click(Ui.InviteMembers.Contact(contactId(name)))
+    s.click(Ui.InviteMembers.Invite)
+    s.poll(what = "the invite sheet to close") { !s.exists(Ui.InviteMembers.Invite) }
+  }
+
+  fun createOneTimeLink(): String {
+    s.click(Ui.NewChat.CreateLink)
+    var link: String? = null
+    s.poll(timeoutMs = 20_000, what = "the one-time link") {
+      link = s.editableText(Ui.Link.Text)?.takeIf { it.isNotBlank() }
+      link != null
+    }
+    return link!!
+  }
+
+  private fun contactId(name: String): Long =
+    chatModel.chats.value.firstNotNullOf { (it.chatInfo as? ChatInfo.Direct)?.contact?.takeIf { c -> c.displayName == name }?.contactId }
+}
+
+class UserPickerScreen(private val s: UiScope) {
+  fun createAddress(): String {
+    val a = address()
+    return a.create().also { a.close() }
+  }
+
+  fun address(): AddressScreen {
+    s.click(Ui.UserPicker.Address)
+    return AddressScreen(s)
+  }
+
+  fun profiles(): ProfilesScreen {
+    s.click(Ui.UserPicker.Profiles)
+    return ProfilesScreen(s)
+  }
+
+  fun switchTo(name: String) {
+    s.click(Ui.UserPicker.User(chatModel.users.first { it.user.displayName == name }.user.userId))
+    s.poll(what = "`$name` to become the active user") { chatModel.currentUser.value?.displayName == name && !chatModel.switchingUsersAndHosts.value }
+    s.quiesce()
+  }
+}
+
+class ProfilesScreen(private val s: UiScope) {
+  fun add(name: String) {
+    s.click(Ui.Profiles.Add)
+    s.typeInto(Ui.NewProfile.Name, name)
+    s.click(Ui.NewProfile.Create)
+    s.poll(what = "`$name` to become the active user and the new profile screen to close") {
+      chatModel.currentUser.value?.displayName == name && !s.exists(Ui.NewProfile.Create)
+    }
+  }
+
+  fun close() {
+    s.escape()
+    s.poll(what = "the profiles screen to close") { !s.exists(Ui.Profiles.Add) }
+  }
+}
+
+class AddressScreen(private val s: UiScope) {
+  fun create(): String {
+    s.click(Ui.Address.Create)
+    s.click(Ui.Address.Share)
+    var link: String? = null
+    s.poll(what = "the address on the clipboard") { link = s.clipboardText(); link != null }
+    return link!!
+  }
+
+  fun close() {
+    s.escape()
+    s.poll(what = "the address screen to close") { !s.exists(Ui.Address.Share) }
+  }
+}
+
+class AppearanceScreen(private val s: UiScope) {
+  fun colorMode(mode: String) {
+    s.click(Ui.Appearance.ColorMode)
+    s.click(Ui.Appearance.ColorMode.option(mode))
+  }
+
+  fun colorModeText(): String? = s.textOf(Ui.Appearance.ColorMode)
+
+  var fontScale: Float
+    get() = s.sliderValue(Ui.Appearance.FontScale)
+    set(v) = s.setSlider(Ui.Appearance.FontScale, v)
+
+  var zoom: Float
+    get() = s.sliderValue(Ui.Appearance.Zoom)
+    set(v) = s.setSlider(Ui.Appearance.Zoom, v)
+}
+
+class ProfileScreen(private val s: UiScope) {
+  fun rename(name: String) {
+    s.replaceText(Ui.Profile.Name, name)
+    s.poll(what = "save to be enabled") { s.isEnabled(Ui.Profile.Save) }
+    s.click(Ui.Profile.Save)
+  }
+}
+
+class ChatScreen(private val s: UiScope) {
+  fun info() {
+    s.click(Ui.Chat.Bar.part("title"))
+  }
+
+  fun contactInfo(): ContactInfoScreen {
+    info()
+    return ContactInfoScreen(s)
+  }
+
+  fun groupInfo(): GroupInfoScreen {
+    info()
+    return GroupInfoScreen(s)
+  }
+
+  fun itemId(text: String): Long {
+    var id: Long? = null
+    s.poll(what = "chat item `$text`") {
+      id = chatModel.chatsContext.chatItems.value.lastOrNull { it.content.text == text }?.id
+      id != null && s.exists(Ui.Chat.Item(id!!))
+    }
+    return id!!
+  }
+
+  fun item(id: Long): ChatItem? = chatModel.chatsContext.chatItems.value.firstOrNull { it.id == id }
+
+  fun itemTexts(): List<String> = chatModel.chatsContext.chatItems.value.map { it.content.text }
+
+  fun menu(text: String, action: String) {
+    val id = itemId(text)
+    s.rightClick(Ui.Chat.Item(id))
+    s.click(Ui.Chat.ItemMenu(id, action))
+  }
+
+  fun react(text: String, emoji: String) {
+    val id = itemId(text)
+    s.rightClick(Ui.Chat.Item(id))
+    s.click(Ui.Chat.ItemReaction(id, emoji))
+  }
+
+  fun reactionCount(text: String, emoji: String): String? =
+    s.textsOf(Ui.Chat.ReactionChip(itemId(text), emoji)).firstOrNull { it.all(Char::isDigit) }
+
+  fun forwardTo(text: String, chatName: String) {
+    menu(text, "forward")
+    ChatListScreen(s).shareTo(chatName)
+    s.poll(what = "the send button to be enabled for forwarding") { s.isEnabled(Ui.Chat.Send) }
+    s.click(Ui.Chat.Send)
+  }
+
+  fun openSearch() {
+    s.click(Ui.Chat.BarMenu)
+    s.click(Ui.Chat.BarMenuItem("search"))
+  }
+
+  fun search(text: String) {
+    openSearch()
+    s.typeInto(Ui.Chat.Bar.part("search"), text)
+  }
+
+  fun send(text: String) {
+    s.typeInto(Ui.Chat.Message, text)
+    enterWhenSendable()
+  }
+
+  fun replaceAndSend(text: String) {
+    s.replaceText(Ui.Chat.Message, text)
+    enterWhenSendable()
+  }
+
+  private fun enterWhenSendable() {
+    s.poll(what = "the send button to be enabled") { s.isEnabled(Ui.Chat.Send) }
+    s.pressEnter(Ui.Chat.Message)
+    if (fieldClears(ENTER_RETRY_MS)) return
+    if (!s.editableText(Ui.Chat.Message).isNullOrEmpty() && s.isEnabled(Ui.Chat.Send)) runCatching { s.pressEnter(Ui.Chat.Message) }
+    s.poll(what = "the message field to clear after the second Enter") { s.editableText(Ui.Chat.Message).isNullOrEmpty() }
+  }
+
+  private fun fieldClears(timeoutMs: Long): Boolean =
+    runCatching { s.poll(timeoutMs = timeoutMs, what = "the message field to clear", screenshot = false) { s.editableText(Ui.Chat.Message).isNullOrEmpty() } }.isSuccess
+
+  private companion object {
+    const val ENTER_RETRY_MS = 5_000L
+  }
+}
+
+class ContactInfoScreen(private val s: UiScope) {
+  fun securityCode(): String {
+    s.click(Ui.Info.VerifyCode)
+    return s.textOf(Ui.VerifyCode.Code)!!.filterNot(Char::isWhitespace)
+  }
+
+  fun markVerified() {
+    s.click(Ui.Info.VerifyCode)
+    s.click(Ui.VerifyCode.Mark)
+    s.poll(what = "the security code screen to close") { !s.exists(Ui.VerifyCode.Mark) }
+  }
+
+  fun verifyRowText(): String? = s.textOf(Ui.Info.VerifyCode)
+}
+
+class GroupInfoScreen(private val s: UiScope) {
+  fun member(name: String): MemberInfoScreen {
+    var id: Long? = null
+    s.poll(what = "member `$name` in the model") {
+      id = chatModel.groupMembers.value.firstOrNull { it.memberProfile.displayName == name }?.groupMemberId
+      id != null
+    }
+    s.scrollTo(Ui.GroupInfo.Member(id!!))
+    s.click(Ui.GroupInfo.Member(id!!))
+    return MemberInfoScreen(s)
+  }
+}
+
+class MemberInfoScreen(private val s: UiScope) {
+  fun changeRole(role: GroupMemberRole) {
+    s.click(Ui.MemberInfo.Role)
+    s.click(Ui.MemberInfo.Role.option(role))
+    s.click(Ui.Alert.Confirm(Ui.AlertSource.Shared))
+  }
+
+  fun remove() {
+    s.click(Ui.MemberInfo.Remove)
+    s.click(Ui.Alert.Option(Ui.AlertSource.Shared, "remove"))
+  }
+}
+
+fun UiScope.ownGroup(app: App, group: String, vararg members: CliPeer): ChatScreen {
+  val me = chatModel.currentUser.value!!.displayName
+  app.newChat().apply {
+    createGroup(group)
+    invite(*members.map { it.name }.toTypedArray())
+  }
+  for (m in members) {
+    m.eventually("#$group: $me invites you to join the group as member")
+    m.eventually("use /j $group to accept")
+    m sends "/j $group"
+    m.eventually("#$group: you joined the group", CONNECT_TIMEOUT_MS)
+  }
+  quiesce()
+  return ChatScreen(this)
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/ServersConfig.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/ServersConfig.kt
new file mode 100644
index 0000000000..f8af563602
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/ServersConfig.kt
@@ -0,0 +1,18 @@
+package chat.simplex.app.ui.harness
+
+import chat.simplex.common.model.UserServer
+import chat.simplex.common.platform.chatController
+import chat.simplex.common.platform.chatModel
+import kotlinx.coroutines.runBlocking
+
+fun configureServers(smp: String, xftp: String) {
+  val groups = runBlocking { chatController.getUserServers(null) } ?: error("getUserServers failed")
+  fun custom(server: String) = UserServer(remoteHostId = null, serverId = null, server = server, preset = false, enabled = true, deleted = false)
+  val updated = groups.map { g ->
+    val op = g.operator
+    if (op != null) g.copy(operator = op.copy(enabled = false))
+    else g.copy(smpServers = g.smpServers.map { it.copy(enabled = false) } + custom(smp), xftpServers = g.xftpServers.map { it.copy(enabled = false) } + custom(xftp))
+  }.let { if (it.any { g -> g.operator == null }) it else it + groups.first().copy(operator = null, smpServers = listOf(custom(smp)), xftpServers = listOf(custom(xftp)), chatRelays = emptyList()) }
+  check(runBlocking { chatController.setUserServers(null, updated) }) { "setUserServers failed" }
+  chatModel.conditions.value = runBlocking { chatController.getServerOperators(null) } ?: error("getServerOperators failed")
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/TapPoint.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/TapPoint.kt
new file mode 100644
index 0000000000..c279a9f302
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/TapPoint.kt
@@ -0,0 +1,37 @@
+package chat.simplex.app.ui.harness
+
+import androidx.compose.ui.geometry.Offset
+import androidx.compose.ui.geometry.Rect
+import androidx.compose.ui.semantics.SemanticsActions
+import androidx.compose.ui.semantics.SemanticsNode
+
+fun tapPointInNode(node: SemanticsNode): Offset {
+  val bounds = node.boundsInRoot
+  val minTarget = node.layoutInfo.density.density * MIN_TOUCH_TARGET_DP
+  val nested = clickableDescendants(node).map { touchTarget(it.boundsInRoot, minTarget) }
+  val c = bounds.center
+  if (nested.none { it.contains(c) }) return c - bounds.topLeft
+  val x = widestFreeMidpoint(bounds.left, bounds.right, nested.filter { c.y >= it.top && c.y < it.bottom }.map { it.left to it.right })
+  if (x != null) return Offset(x, c.y) - bounds.topLeft
+  val y = widestFreeMidpoint(bounds.top, bounds.bottom, nested.filter { c.x >= it.left && c.x < it.right }.map { it.top to it.bottom })
+  return Offset(c.x, y ?: c.y) - bounds.topLeft
+}
+
+private fun clickableDescendants(node: SemanticsNode): List<SemanticsNode> =
+  node.children.flatMap { if (it.config.contains(SemanticsActions.OnClick)) listOf(it) else clickableDescendants(it) }
+
+private fun widestFreeMidpoint(start: Float, end: Float, covered: List<Pair<Float, Float>>): Float? {
+  var free = listOf(start to end)
+  for ((a, b) in covered) {
+    free = free.flatMap { (s, e) -> listOf(s to minOf(e, a), maxOf(s, b) to e).filter { it.second > it.first } }
+  }
+  return free.maxByOrNull { it.second - it.first }?.let { (it.first + it.second) / 2 }
+}
+
+private fun touchTarget(r: Rect, min: Float): Rect {
+  val dx = ((min - r.width) / 2).coerceAtLeast(0f)
+  val dy = ((min - r.height) / 2).coerceAtLeast(0f)
+  return Rect(r.left - dx, r.top - dy, r.right + dx, r.bottom + dy)
+}
+
+private const val MIN_TOUCH_TARGET_DP = 48f
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/TestPrefs.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/TestPrefs.kt
new file mode 100644
index 0000000000..773f0e217d
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/TestPrefs.kt
@@ -0,0 +1,22 @@
+package chat.simplex.app.ui.harness
+
+import chat.simplex.common.model.ChatController.appPrefs
+
+object TestPrefs {
+  fun preset() {
+    with(appPrefs) {
+      laNoticeShown.set(true)
+      appUpdateNoticeShown.set(true)
+      oneHandUICardShown.set(true)
+      addressCreationCardShown.set(true)
+      getStakeBannerDismissed.set(true)
+      supporterBannerShown.set(true)
+      showHiddenProfilesNotice.set(false)
+      showMuteProfileAlert.set(false)
+      showDeleteConversationNotice.set(false)
+      showDeleteContactNotice.set(false)
+      privacyDeliveryReceiptsSet.set(true)
+      privacyLinkPreviewsShowAlert.set(false)
+    }
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/AddressCompatTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/AddressCompatTest.kt
new file mode 100644
index 0000000000..4589b6afce
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/AddressCompatTest.kt
@@ -0,0 +1,13 @@
+package chat.simplex.app.ui.main
+
+import chat.simplex.app.ui.harness.UiTest
+import org.junit.Test
+
+class AddressCompatTest : UiTest() {
+  @Test fun addressCliConnectsAndRequestAppears() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    val address = alice.userPicker().address().create()
+    bob sends "/c $address"; bob expects "connection request sent!"
+    alice.chatList.request("bob")
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ChatListFiltersListsTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ChatListFiltersListsTest.kt
new file mode 100644
index 0000000000..dc5e4b8948
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ChatListFiltersListsTest.kt
@@ -0,0 +1,339 @@
+package chat.simplex.app.ui.main
+
+import chat.simplex.app.ui.harness.CONNECT_TIMEOUT_MS
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.app.ui.harness.backToChatList
+import chat.simplex.app.ui.harness.businessChat
+import chat.simplex.app.ui.harness.connect
+import chat.simplex.app.ui.harness.hostGroup
+import chat.simplex.app.ui.harness.lists
+import chat.simplex.app.ui.harness.ownGroup
+import chat.simplex.app.ui.harness.presetFilter
+import chat.simplex.app.ui.harness.quiesce
+import chat.simplex.common.model.MsgFilter
+import chat.simplex.common.platform.chatModel
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.views.chatlist.ActiveFilter
+import chat.simplex.common.views.chatlist.PresetTagKind
+import org.junit.Test
+
+class ChatListFiltersListsTest : UiTest() {
+  @Test fun unreadFilterToggle() = uiTest {
+    val alice = app("alice"); val bob = cli("bob"); val cath = cli("cath")
+    connect(bob); connect(cath)
+    alice.chatList.row("bob").row("cath").row("Private notes")
+    alice.chatList.rowMenu("cath", "ntfs.None")
+    poll(what = "cath muted") { alice.chatList.chat("cath").chatInfo.chatSettings?.enableNtfs == MsgFilter.None }
+    cath sends "@alice muted hello"
+    bob sends "@alice hello"
+    poll(what = "unread count 1 on bob and on muted cath") { "1" in alice.chatList.rowTexts("bob") && "1" in alice.chatList.rowTexts("cath") }
+    click(Ui.ChatList.UnreadFilter)
+    poll(what = "only bob listed") {
+      chatModel.activeChatTagFilter.value == ActiveFilter.Unread &&
+        alice.chatList.shown("bob") && !alice.chatList.shown("cath") && !alice.chatList.shown("Private notes")
+    }
+    click(Ui.ChatList.UnreadFilter)
+    poll(what = "all chats listed again") {
+      chatModel.activeChatTagFilter.value == null && alice.chatList.shown("bob") && alice.chatList.shown("cath") && alice.chatList.shown("Private notes")
+    }
+  }
+
+  @Test fun unreadFilterEmptyState() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    alice.chatList.row("bob").row("Private notes")
+    quiesce()
+    click(Ui.ChatList.UnreadFilter)
+    poll(what = "`No unread chats` and no rows") {
+      seesText("No unread chats") && exists(Ui.ChatList.NoUnreadChats) && !alice.chatList.shown("bob") && !alice.chatList.shown("Private notes")
+    }
+    click(Ui.ChatList.NoUnreadChats)
+    poll(what = "the filter cleared and the chats back") {
+      chatModel.activeChatTagFilter.value == null && alice.chatList.shown("bob") && alice.chatList.shown("Private notes")
+    }
+  }
+
+  @Test fun presetFilterFavorites() = uiTest {
+    val alice = app("alice"); val bob = cli("bob"); val cath = cli("cath")
+    connect(bob); connect(cath)
+    alice.chatList.row("bob").row("cath").row("Private notes")
+    alice.chatList.rowMenu("bob", "favorite")
+    poll(what = "bob a favorite") { alice.chatList.chat("bob").chatInfo.chatSettings?.favorite == true }
+    presetFilter(PresetTagKind.FAVORITES, "Favorites")
+    poll(what = "only bob listed") { alice.chatList.shown("bob") && !alice.chatList.shown("cath") && !alice.chatList.shown("Private notes") }
+  }
+
+  @Test fun presetFilterContacts() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    hostGroup(bob, "team", "alice")
+    alice.chatList.row("bob").row("team").row("Private notes")
+    presetFilter(PresetTagKind.CONTACTS, "Contacts")
+    poll(what = "only bob listed") { alice.chatList.shown("bob") && !alice.chatList.shown("team") && !alice.chatList.shown("Private notes") }
+  }
+
+  @Test fun presetFilterGroups() = uiTest {
+    val alice = app("alice"); val bob = cli("bob"); val biz = cli("biz")
+    connect(bob)
+    hostGroup(bob, "team", "alice")
+    businessChat(biz)
+    alice.chatList.row("bob").row("team").row("biz").row("Private notes")
+    presetFilter(PresetTagKind.GROUPS, "Groups")
+    poll(what = "only team listed") {
+      alice.chatList.shown("team") && !alice.chatList.shown("biz") && !alice.chatList.shown("bob") && !alice.chatList.shown("Private notes")
+    }
+  }
+
+  @Test fun presetFilterBusinesses() = uiTest {
+    val alice = app("alice"); val biz = cli("biz")
+    businessChat(biz)
+    alice.chatList.row("biz").row("Private notes")
+    presetFilter(PresetTagKind.BUSINESS, "Businesses")
+    poll(what = "only biz listed") { alice.chatList.shown("biz") && !alice.chatList.shown("Private notes") }
+  }
+
+  @Test fun presetFilterNotes() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    alice.chatList.row("bob").row("Private notes")
+    presetFilter(PresetTagKind.NOTES, "Notes")
+    poll(what = "only Private notes listed") { alice.chatList.shown("Private notes") && !alice.chatList.shown("bob") }
+  }
+
+  @Test fun presetFilterReports() = uiTest {
+    val alice = app("alice"); val bob = cli("bob"); val cath = cli("cath")
+    connect(bob); connect(cath)
+    ownGroup(alice, "team", bob, cath)
+    bob.eventually("#team: new member cath is connected", CONNECT_TIMEOUT_MS)
+    cath.eventually("#team: member bob is connected", CONNECT_TIMEOUT_MS)
+    cath sends "#team bad joke"
+    bob.eventuallyMessage("#team cath> bad joke", CONNECT_TIMEOUT_MS)
+    bob sends "/report #team content bad joke"
+    bob.eventuallyMessage("#team (support) > cath bad joke")
+    poll(timeoutMs = CONNECT_TIMEOUT_MS, what = "the report counted on team") {
+      chatModel.chats.value.any { it.chatInfo.chatViewName == "team" && it.chatStats.reportsCount > 0 }
+    }
+    backToChatList()
+    alice.chatList.row("bob").row("cath").row("team").row("Private notes")
+    presetFilter(PresetTagKind.GROUP_REPORTS, "Reports")
+    poll(what = "only team listed") {
+      alice.chatList.shown("team") && !alice.chatList.shown("bob") && !alice.chatList.shown("cath") && !alice.chatList.shown("Private notes")
+    }
+  }
+
+  @Test fun presetFiltersCollapsedMenuWhenMany() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    hostGroup(bob, "team", "alice")
+    alice.chatList.row("bob").row("team").row("Private notes")
+    quiesce()
+    poll(what = "Contacts, Groups and Notes as chips and no preset menu") {
+      listOf(PresetTagKind.CONTACTS, PresetTagKind.GROUPS, PresetTagKind.NOTES).all { exists(Ui.ChatList.PresetTag(it.name)) } && !exists(Ui.ChatList.PresetMenu)
+    }
+    alice.chatList.rowMenu("bob", "favorite")
+    poll(what = "the presets collapsed into the `All` menu") {
+      exists(Ui.ChatList.PresetMenu) && "All" in descriptionsOf(Ui.ChatList.PresetMenu) && PresetTagKind.entries.none { exists(Ui.ChatList.PresetTag(it.name)) }
+    }
+    click(Ui.ChatList.PresetMenu)
+    val labels = mapOf(PresetTagKind.FAVORITES to "Favorites", PresetTagKind.CONTACTS to "Contacts", PresetTagKind.GROUPS to "Groups", PresetTagKind.NOTES to "Notes")
+    poll(what = "Favorites, Contacts, Groups and Notes in the menu and no `All` item") {
+      labels.all { (kind, label) -> exists(Ui.ChatList.PresetMenuItem(kind.name)) && label in textsOf(Ui.ChatList.PresetMenuItem(kind.name)) } &&
+        !exists(Ui.ChatList.PresetMenuItem(PresetTagKind.CHANNELS.name)) && !exists(Ui.ChatList.PresetMenuAll)
+    }
+    click(Ui.ChatList.PresetMenuItem(PresetTagKind.GROUPS.name))
+    poll(what = "the Groups filter active and shown as the menu icon") {
+      chatModel.activeChatTagFilter.value == ActiveFilter.PresetTag(PresetTagKind.GROUPS) && "Groups" in descriptionsOf(Ui.ChatList.PresetMenu) &&
+        alice.chatList.shown("team") && !alice.chatList.shown("bob")
+    }
+  }
+
+  @Test fun presetFilterAllResets() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    hostGroup(bob, "team", "alice")
+    alice.chatList.row("bob").row("team").row("Private notes")
+    alice.chatList.rowMenu("bob", "favorite")
+    poll(what = "the preset menu") { exists(Ui.ChatList.PresetMenu) }
+    alice.chatList.search("bob")
+    poll(what = "only bob found") { alice.chatList.shown("bob") && !alice.chatList.shown("team") }
+    click(Ui.ChatList.PresetMenu)
+    click(Ui.ChatList.PresetMenuAll)
+    poll(what = "the search cleared and all chats listed") {
+      editableText(Ui.ChatList.Search).isNullOrEmpty() && alice.chatList.shown("bob") && alice.chatList.shown("team") && alice.chatList.shown("Private notes")
+    }
+    presetFilter(PresetTagKind.CONTACTS, "Contacts")
+    poll(what = "only bob listed") { alice.chatList.shown("bob") && !alice.chatList.shown("team") && !alice.chatList.shown("Private notes") }
+    click(Ui.ChatList.PresetMenu)
+    click(Ui.ChatList.PresetMenuAll)
+    poll(what = "the filter cleared and all chats listed") {
+      chatModel.activeChatTagFilter.value == null && "All" in descriptionsOf(Ui.ChatList.PresetMenu) &&
+        alice.chatList.shown("bob") && alice.chatList.shown("team") && alice.chatList.shown("Private notes")
+    }
+  }
+
+  @Test fun presetTagsHiddenWhenOnlyOneKind() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    alice.chatList.row("Private notes")
+    quiesce()
+    poll(what = "only the Notes kind, the tags row shown, and no preset chips or menu") {
+      chatModel.presetTags.filterValues { it > 0 }.keys == setOf(PresetTagKind.NOTES) && exists(Ui.ChatList.AddList) &&
+        PresetTagKind.entries.none { exists(Ui.ChatList.PresetTag(it.name)) } && !exists(Ui.ChatList.PresetMenu)
+    }
+    connect(bob)
+    alice.chatList.row("bob")
+    poll(what = "Contacts and Notes chips once there are two kinds") {
+      exists(Ui.ChatList.PresetTag(PresetTagKind.CONTACTS.name)) && exists(Ui.ChatList.PresetTag(PresetTagKind.NOTES.name)) && !exists(Ui.ChatList.PresetMenu)
+    }
+  }
+
+  @Test fun createListFromAddList() = uiTest {
+    val alice = app("alice")
+    alice.chatList.row("Private notes")
+    val lists = lists()
+    poll(what = "the `Add list` button") { "Add list" in textsOf(Ui.ChatList.AddList) }
+    val editor = lists.addList()
+    poll(what = "an empty list editor with `Save list`") { editor.nameText().isNullOrEmpty() && seesText("List name...") && editor.saveLabel() == "Save list" }
+    editor.typeName("work")
+    editor.save()
+    val work = lists.tag("work")
+    poll(what = "the `work` chip and the `Add list` button turned into +") {
+      "work" in textsOf(Ui.ChatList.UserTag(work.chatTagId)) && "Add list" !in textsOf(Ui.ChatList.AddList) && "Add list" in descriptionsOf(Ui.ChatList.AddList)
+    }
+    check(work.chatTagEmoji == null) { "list created with emoji ${work.chatTagEmoji}" }
+  }
+
+  @Test fun createListDuplicateNameError() = uiTest {
+    val alice = app("alice")
+    alice.chatList.row("Private notes")
+    val lists = lists()
+    lists.create("work")
+    val editor = lists.addList()
+    poll(what = "the list editor") { editor.shown() }
+    editor.typeName("work")
+    editor.saveIgnored()
+    check(chatModel.userTags.value.map { it.chatTagText } == listOf("work")) { "lists: ${chatModel.userTags.value}" }
+    editor.replaceName("work2")
+    editor.save()
+    poll(what = "lists work and work2") { chatModel.userTags.value.map { it.chatTagText }.toSet() == setOf("work", "work2") }
+  }
+
+  @Test fun addChatToListFromContextMenu() = uiTest {
+    val alice = app("alice"); val bob = cli("bob"); val cath = cli("cath")
+    connect(bob); connect(cath)
+    alice.chatList.row("bob").row("cath")
+    val lists = lists()
+    alice.chatList.rowMenu("bob", "tagList", "Add to list")
+    val editor = lists.editor()
+    poll(what = "the list editor with `Add to list`") { editor.shown() && editor.saveLabel() == "Add to list" }
+    editor.typeName("work")
+    editor.save()
+    val work = lists.tag("work").chatTagId
+    poll(what = "bob in work") { lists.tagsOf("bob") == listOf(work) }
+    alice.chatList.rowMenu("cath", "tagList", "Add to list")
+    poll(what = "the list sheet with work") { exists(Ui.TagList.Tag(work)) && "work" in textsOf(Ui.TagList.Tag(work)) && !editor.shown() }
+    click(Ui.TagList.Tag(work))
+    poll(what = "cath in work and the sheet closed") { lists.tagsOf("cath") == listOf(work) && !exists(Ui.TagList.Tag(work)) }
+  }
+
+  @Test fun changeChatListFromContextMenu() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    alice.chatList.row("bob")
+    val lists = lists()
+    val work = lists.create("work").chatTagId
+    val family = lists.create("family").chatTagId
+    lists.assign("bob", "work")
+    alice.chatList.rowMenu("bob", "tagList", "Change list")
+    poll(what = "the list sheet with work and family") { exists(Ui.TagList.Tag(work)) && exists(Ui.TagList.Tag(family)) }
+    click(Ui.TagList.Tag(family))
+    poll(what = "bob moved from work to family and the sheet closed") { lists.tagsOf("bob") == listOf(family) && !exists(Ui.TagList.Tag(family)) }
+  }
+
+  @Test fun removeChatFromList() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    alice.chatList.row("bob")
+    val lists = lists()
+    val work = lists.create("work").chatTagId
+    lists.assign("bob", "work")
+    alice.chatList.rowMenu("bob", "tagList", "Change list")
+    click(Ui.TagList.Tag(work))
+    poll(what = "bob out of work and the sheet closed") { lists.tagsOf("bob").isEmpty() && !exists(Ui.TagList.Tag(work)) }
+    alice.chatList.rowMenu("bob", "tagList", "Add to list")
+    waitFor(Ui.TagList.Tag(work))
+    escape()
+    poll(what = "the list sheet closed with the work list kept") { !exists(Ui.TagList.Tag(work)) && exists(Ui.ChatList.UserTag(work)) }
+  }
+
+  @Test fun filterByUserList() = uiTest {
+    val alice = app("alice"); val bob = cli("bob"); val cath = cli("cath")
+    connect(bob); connect(cath)
+    alice.chatList.row("bob").row("cath").row("Private notes")
+    val lists = lists()
+    lists.create("work")
+    lists.assign("bob", "work")
+    lists.filter("work")
+    poll(what = "only bob listed") { alice.chatList.shown("bob") && !alice.chatList.shown("cath") && !alice.chatList.shown("Private notes") }
+    click(lists.chip("work"))
+    poll(what = "the filter off and all chats listed") {
+      lists.activeTagId() == null && alice.chatList.shown("bob") && alice.chatList.shown("cath") && alice.chatList.shown("Private notes")
+    }
+  }
+
+  @Test fun emptyListShowsNoChatsInList() = uiTest {
+    val alice = app("alice")
+    alice.chatList.row("Private notes")
+    val lists = lists()
+    lists.create("work")
+    lists.filter("work")
+    poll(what = "`No chats in list work.` and no rows") { seesText("No chats in list work.") && !alice.chatList.shown("Private notes") }
+  }
+
+  @Test fun listUnreadDot() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    alice.chatList.row("bob")
+    val lists = lists()
+    lists.create("work")
+    lists.assign("bob", "work")
+    quiesce()
+    poll(what = "the work chip without the unread dot") { "work" in lists.chipTexts("work") && "work ●" !in lists.chipTexts("work") }
+    bob sends "@alice hi"
+    poll(timeoutMs = CONNECT_TIMEOUT_MS, what = "the unread dot on the work chip") { "work ●" in lists.chipTexts("work") }
+    alice.chatList.open("bob")
+    poll(what = "bob's message read") { alice.chatList.chat("bob").chatStats.unreadCount == 0 }
+    backToChatList()
+    poll(what = "the unread dot gone") { "work" in lists.chipTexts("work") && "work ●" !in lists.chipTexts("work") }
+  }
+
+  @Test fun deleteListConfirm() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    alice.chatList.row("bob")
+    val lists = lists()
+    val work = lists.create("work").chatTagId
+    lists.assign("bob", "work")
+    lists.menu("work", "delete")
+    poll(what = "the `Delete list?` alert") { seesText("Delete list?") && seesText("All chats will be removed from the list work, and the list deleted") }
+    click(Ui.Alert.Confirm(Ui.AlertSource.Shared))
+    poll(what = "the work chip gone and bob still listed without a list") {
+      chatModel.userTags.value.none { it.chatTagId == work } && !exists(Ui.ChatList.UserTag(work)) && alice.chatList.shown("bob") && lists.tagsOf("bob").isEmpty()
+    }
+  }
+
+  @Test fun listsArePerUser() = uiTest {
+    val alice = app("alice")
+    alice.chatList.row("Private notes")
+    val lists = lists()
+    val work = lists.create("work").chatTagId
+    alice.userPicker().profiles().apply { add("alice2"); close() }
+    poll(what = "no lists for alice2") {
+      chatModel.userTags.value.isEmpty() && !exists(Ui.ChatList.UserTag(work)) && exists(Ui.ChatList.AddList) && "Add list" in textsOf(Ui.ChatList.AddList)
+    }
+    val home = lists.create("home").chatTagId
+    alice.userPicker().switchTo("alice")
+    poll(what = "alice's work list back without alice2's home list") {
+      chatModel.userTags.value.map { it.chatTagText } == listOf("work") && exists(Ui.ChatList.UserTag(work)) && !exists(Ui.ChatList.UserTag(home))
+    }
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ChatListMenuTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ChatListMenuTest.kt
new file mode 100644
index 0000000000..f9a5a6fa55
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ChatListMenuTest.kt
@@ -0,0 +1,49 @@
+package chat.simplex.app.ui.main
+
+import chat.simplex.app.ui.harness.connect
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.common.ui.Ui
+import org.junit.Test
+
+class ChatListMenuTest : UiTest() {
+  @Test fun contactMenuMarkReadAndUnread() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    bob sends "@alice one"
+    poll(what = "unread badge 1") { "1" in alice.chatList.rowTexts("bob") }
+    alice.chatList.rowMenu("bob", "markRead")
+    poll(what = "unread badge gone") { "1" !in alice.chatList.rowTexts("bob") && alice.chatList.chat("bob").chatStats.unreadCount == 0 }
+    alice.chatList.rowMenu("bob", "markUnread")
+    poll(what = "the chat marked unread") { alice.chatList.chat("bob").chatStats.unreadChat }
+    alice.chatList.rowMenu("bob", "markRead")
+    poll(what = "the unread mark cleared") { !alice.chatList.chat("bob").chatStats.unreadChat }
+  }
+
+  @Test fun contactMenuFavoriteUnfavorite() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    alice.chatList.rowMenu("bob", "favorite")
+    poll(what = "the favorite star on the row") { "Favorite" in alice.chatList.rowDescriptions("bob") }
+    alice.chatList.rowMenu("bob", "unfavorite")
+    poll(what = "the favorite star gone") { "Favorite" !in alice.chatList.rowDescriptions("bob") }
+  }
+
+  @Test fun contactMenuMuteUnmute() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    alice.chatList.rowMenu("bob", "ntfs.None")
+    poll(what = "the muted icon on the row") { "Notifications" in alice.chatList.rowDescriptions("bob") }
+    alice.chatList.rowMenu("bob", "ntfs.All")
+    poll(what = "the muted icon gone") { "Notifications" !in alice.chatList.rowDescriptions("bob") }
+  }
+
+  @Test fun contactMenuClearChat() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    bob sends "@alice to be cleared"
+    poll(what = "the message preview on the row") { "to be cleared" in alice.chatList.rowTexts("bob") }
+    alice.chatList.rowMenu("bob", "clear")
+    click(Ui.Alert.Confirm(Ui.AlertSource.Shared))
+    poll(what = "the preview gone") { "to be cleared" !in alice.chatList.rowTexts("bob") }
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ChatListMenusPendingTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ChatListMenusPendingTest.kt
new file mode 100644
index 0000000000..fc9614d686
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ChatListMenusPendingTest.kt
@@ -0,0 +1,168 @@
+package chat.simplex.app.ui.main
+
+import chat.simplex.app.ui.harness.CONNECT_TIMEOUT_MS
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.app.ui.harness.backToChatList
+import chat.simplex.app.ui.harness.closePendingConnectionInfo
+import chat.simplex.app.ui.harness.connect
+import chat.simplex.app.ui.harness.createOneTimeLink
+import chat.simplex.app.ui.harness.enterLinkInSearch
+import chat.simplex.app.ui.harness.hostGroup
+import chat.simplex.app.ui.harness.joinGroupFromList
+import chat.simplex.app.ui.harness.keepOneTimeLink
+import chat.simplex.app.ui.harness.openRowMenu
+import chat.simplex.app.ui.harness.planConfirm
+import chat.simplex.app.ui.harness.quiesce
+import chat.simplex.common.model.ChatInfo
+import chat.simplex.common.model.MsgFilter
+import chat.simplex.common.platform.chatModel
+import chat.simplex.common.ui.Ui
+import org.junit.Test
+
+private const val PENDING = "invited to connect"
+private val PLAN_RESULT = Regex("invitation link: ok to connect|error: connection authorization failed.*")
+private val AUTH_FAILED = Regex("error: connection authorization failed - .*")
+private val notOffered = listOf("markRead", "markUnread", "favorite", "unfavorite", "ntfs.None", "ntfs.All", "clear")
+
+class ChatListMenusPendingTest : UiTest() {
+  @Test fun contactMenuMarkRead() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    bob sends "@alice one"
+    poll(what = "unread badge 1") { "1" in alice.chatList.rowTexts("bob") }
+    alice.chatList.rowMenu("bob", "markRead")
+    poll(what = "the unread badge gone") { "1" !in alice.chatList.rowTexts("bob") && alice.chatList.chat("bob").chatStats.unreadCount == 0 }
+  }
+
+  @Test fun contactMenuMarkUnread() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    quiesce()
+    val emptyTexts = alice.chatList.rowTexts("bob").count { it.isEmpty() }
+    alice.chatList.rowMenu("bob", "markUnread")
+    poll(what = "the unread mark and its empty badge on the row") {
+      alice.chatList.chat("bob").chatStats.unreadChat && alice.chatList.rowTexts("bob").count { it.isEmpty() } > emptyTexts
+    }
+    val id = openRowMenu("bob")
+    poll(what = "`Mark read` offered instead of `Mark unread`") {
+      exists(Ui.ChatList.RowMenu(id, "markRead")) && !exists(Ui.ChatList.RowMenu(id, "markUnread"))
+    }
+    click(Ui.ChatList.RowMenu(id, "markRead"))
+    poll(what = "the unread mark cleared") { !alice.chatList.chat("bob").chatStats.unreadChat }
+  }
+
+  @Test fun contactMenuRightClickOpens() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    val id = openRowMenu("bob")
+    poll(what = "the contact menu") {
+      listOf("markUnread", "favorite", "ntfs.None", "clear", "delete").all { exists(Ui.ChatList.RowMenu(id, it)) } &&
+        listOf("Mark unread", "Favorite", "Mute", "Add to list", "Clear", "Delete").all { seesText(it) }
+    }
+  }
+
+  @Test fun groupMenuMuteModesAllMentionsNone() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    hostGroup(bob, "team", "alice")
+    joinGroupFromList(alice, bob, "team")
+    fun team() = (alice.chatList.chat("team").chatInfo as ChatInfo.Group).groupInfo
+    alice.chatList.rowMenu("team", "ntfs.Mentions", "Mute")
+    poll(what = "mentions-only notifications") { team().chatSettings.enableNtfs == MsgFilter.Mentions }
+    alice.chatList.rowMenu("team", "ntfs.None", "Mute all")
+    poll(what = "notifications off") { team().chatSettings.enableNtfs == MsgFilter.None }
+    alice.chatList.rowMenu("team", "ntfs.All", "Unmute")
+    poll(what = "all notifications") { team().chatSettings.enableNtfs == MsgFilter.All }
+  }
+
+  @Test fun notesMenuMarkUnreadAndClear() = uiTest {
+    val alice = app("alice")
+    alice.chatList.open("Private notes").send("keep in mind")
+    backToChatList()
+    poll(what = "the note in the row preview") { "keep in mind" in alice.chatList.rowTexts("Private notes") }
+    alice.chatList.rowMenu("Private notes", "markUnread")
+    poll(what = "the notes marked unread") { alice.chatList.chat("Private notes").chatStats.unreadChat }
+    alice.chatList.rowMenu("Private notes", "clear")
+    poll(what = "the `Clear private notes?` alert") {
+      seesText("Clear private notes?") && seesText("All messages will be deleted - this cannot be undone!")
+    }
+    click(Ui.Alert.Confirm(Ui.AlertSource.Shared))
+    poll(what = "the notes cleared and the unread mark reset") {
+      alice.chatList.chat("Private notes").let { it.chatItems.isEmpty() && !it.chatStats.unreadChat } &&
+        "keep in mind" !in alice.chatList.rowTexts("Private notes")
+    }
+  }
+
+  @Test fun pendingInvitationRowIconAndName() = uiTest {
+    val alice = app("alice")
+    keepOneTimeLink(alice)
+    poll(what = "the pending row with its name, description and icon") {
+      alice.chatList.rowTexts(PENDING).containsAll(listOf(PENDING, "you shared one-time link")) &&
+        "profile image placeholder" in alice.chatList.rowDescriptions(PENDING) &&
+        (alice.chatList.chat(PENDING).chatInfo as ChatInfo.ContactConnection).contactConnection.initiated
+    }
+  }
+
+  @Test fun pendingConnectionMenuSetName() = uiTest {
+    val alice = app("alice")
+    keepOneTimeLink(alice)
+    poll(what = "no pending connection info before the menu") { !seesText("You invited a contact") }
+    alice.chatList.rowMenu(PENDING, "setName")
+    poll(what = "`You invited a contact` with the name field") { seesText("You invited a contact") && exists(Ui.Info.Alias) }
+    typeInto(Ui.Info.Alias, "friend")
+    poll(what = "the pending connection named `friend` in the model") {
+      chatModel.chats.value.any { it.chatInfo is ChatInfo.ContactConnection && it.chatInfo.chatViewName == "friend" }
+    }
+    closePendingConnectionInfo()
+    poll(what = "the row named `friend`") { "friend" in alice.chatList.rowTexts("friend") }
+  }
+
+  @Test fun pendingConnectionClickOpensInfo() = uiTest {
+    val alice = app("alice")
+    keepOneTimeLink(alice)
+    poll(what = "no pending connection info before the click") { !seesText("You invited a contact") }
+    val id = alice.chatList.chatId(PENDING)
+    alice.chatList.open(PENDING)
+    poll(what = "`You invited a contact` with the one-time link and the name field") {
+      chatModel.chatId.value == id && seesText("You invited a contact") && seesText("One-time invitation link") && exists(Ui.Info.Alias)
+    }
+  }
+
+  @Test fun pendingConnectionMenuDeleteInitiated() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    val link = keepOneTimeLink(alice)
+    alice.chatList.rowMenu(PENDING, "delete")
+    poll(what = "the `Delete pending connection?` alert") {
+      seesText("Delete pending connection?") && seesText("The contact you shared this link with will NOT be able to connect!", substring = true)
+    }
+    click(Ui.Alert.Confirm(Ui.AlertSource.Shared))
+    alice.chatList.gone(PENDING)
+    poll(timeoutMs = CONNECT_TIMEOUT_MS, what = "the deleted link to fail its plan on the server") {
+      bob sends "/_connect plan 1 $link"
+      bob.eventuallyMatching(PLAN_RESULT).value.startsWith("error")
+    }
+    bob sends "/c $link"
+    bob.eventuallyMatching(AUTH_FAILED)
+  }
+
+  @Test fun contactMenuForNotReadyContactOnlyDelete() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    val link = bob.createOneTimeLink()
+    alice.chatList.row("Private notes")
+    enterLinkInSearch(link)
+    poll(timeoutMs = CONNECT_TIMEOUT_MS, what = "the `Open new chat` alert for bob") {
+      exists(planConfirm) && "Open new chat" in textsOf(planConfirm) && seesText("bob")
+    }
+    click(planConfirm)
+    poll(what = "the prepared contact bob without a connection") {
+      (alice.chatList.chat("bob").chatInfo as? ChatInfo.Direct)?.contact?.let { it.nextConnectPrepared && it.activeConn == null } == true
+    }
+    backToChatList()
+    val id = openRowMenu("bob")
+    poll(what = "a row menu with only `Delete`") {
+      exists(Ui.ChatList.RowMenu(id, "delete")) && notOffered.none { exists(Ui.ChatList.RowMenu(id, it)) } && !seesText("Add to list")
+    }
+    click(Ui.ChatList.RowMenu(id, "delete"))
+    poll(what = "the `Confirm contact deletion?` alert") { seesText("Confirm contact deletion?") }
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ChatListRequestsCardsCompatTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ChatListRequestsCardsCompatTest.kt
new file mode 100644
index 0000000000..a0f6cb1131
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ChatListRequestsCardsCompatTest.kt
@@ -0,0 +1,22 @@
+package chat.simplex.app.ui.main
+
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.app.ui.harness.openRowMenu
+import chat.simplex.common.platform.chatModel
+import chat.simplex.common.ui.Ui
+import org.junit.Test
+
+class ChatListRequestsCardsCompatTest : UiTest() {
+  @Test fun contactRequestIncognitoHiddenWithShortLinkData() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    val address = alice.userPicker().createAddress()
+    poll(what = "alice's address with short-link data") { chatModel.userAddress.value?.shortLinkDataSet == true }
+    bob sends "/c $address"; bob expects "connection request sent!"
+    alice.chatList.request("bob")
+    val id = openRowMenu("bob")
+    poll(what = "the request menu with `Accept` and `Reject` but no `Accept incognito`") {
+      exists(Ui.ChatList.RowMenu(id, "accept")) && exists(Ui.ChatList.RowMenu(id, "reject")) &&
+        !exists(Ui.ChatList.RowMenu(id, "acceptIncognito")) && !seesText("Accept incognito")
+    }
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ChatListRequestsCardsTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ChatListRequestsCardsTest.kt
new file mode 100644
index 0000000000..f3beda6aa7
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ChatListRequestsCardsTest.kt
@@ -0,0 +1,133 @@
+package chat.simplex.app.ui.main
+
+import chat.simplex.app.ui.harness.CONNECT_TIMEOUT_MS
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.app.ui.harness.connect
+import chat.simplex.app.ui.harness.quiesce
+import chat.simplex.common.model.ChatController.appPrefs
+import chat.simplex.common.model.ChatInfo
+import chat.simplex.common.platform.appPlatform
+import chat.simplex.common.platform.chatModel
+import chat.simplex.common.ui.Ui
+import org.junit.Test
+
+class ChatListRequestsCardsTest : UiTest() {
+  @Test fun contactWithRequestOpenToAccept() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    val address = alice.userPicker().createAddress()
+    bob sends "/c $address"; bob expects "connection request sent!"
+    alice.chatList.request("bob").open("bob")
+    poll(what = "bob's chat with the `Reject` / `Accept` bar instead of the message field") {
+      chatModel.chatId.value == alice.chatList.chatId("bob") &&
+        exists(Ui.Chat.RequestReject) && "Reject" in textsOf(Ui.Chat.RequestReject) &&
+        exists(Ui.Chat.RequestAccept) && "Accept" in textsOf(Ui.Chat.RequestAccept) &&
+        !exists(Ui.Chat.Message)
+    }
+  }
+
+  @Test fun contactWithRequestComposeAccept() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    val address = alice.userPicker().createAddress()
+    bob sends "/c $address"; bob expects "connection request sent!"
+    alice.chatList.request("bob").open("bob")
+    click(Ui.Chat.RequestAccept)
+    bob.eventually("alice: contact is connected", CONNECT_TIMEOUT_MS)
+    poll(what = "the accept bar replaced by the message field") {
+      !(alice.chatList.chat("bob").chatInfo as ChatInfo.Direct).contact.nextAcceptContactRequest &&
+        !exists(Ui.Chat.RequestAccept) && exists(Ui.Chat.Message) && !seesText("Accept contact request")
+    }
+  }
+
+  @Test fun contactWithRequestComposeReject() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    val address = alice.userPicker().createAddress()
+    bob sends "/c $address"; bob expects "connection request sent!"
+    alice.chatList.request("bob").open("bob")
+    click(Ui.Chat.RequestReject)
+    poll(what = "the `Reject contact request` alert") { seesText("Reject contact request") && seesText("The sender will NOT be notified.") }
+    poll(what = "the alert's `Reject` button") { "Reject" in textsOf(Ui.Alert.Confirm(Ui.AlertSource.Shared)) }
+    click(Ui.Alert.Confirm(Ui.AlertSource.Shared))
+    alice.chatList.gone("bob")
+    poll(what = "back on the chat list with no chat open") { chatModel.chatId.value == null && exists(Ui.ChatList.Search) }
+  }
+
+  @Test fun oneHandToolbarCardSelectBottomBar() = uiTest {
+    app("alice")
+    appPrefs.oneHandUICardShown.set(false)
+    poll(what = "the `Bottom bar` / `Top bar` card") {
+      exists(Ui.ChatList.OneHandCard) && "Bottom bar" in textsOf(Ui.ChatList.OneHandCard) && "Top bar" in textsOf(Ui.ChatList.OneHandCard)
+    }
+    click(Ui.ChatList.OneHandCard.part("top"))
+    poll(what = "top toolbars: the floating new-chat button and no toolbar button") {
+      !appPrefs.oneHandUI.get() && storedSetting("OneHandUI") == "false" && exists(Ui.ChatList.NewChatFab) && !exists(Ui.ChatList.NewChat)
+    }
+    click(Ui.ChatList.OneHandCard.part("bottom"))
+    poll(what = "bottom toolbars: the toolbar new-chat button and no floating button") {
+      appPrefs.oneHandUI.get() && storedSetting("OneHandUI") == "true" && exists(Ui.ChatList.NewChat) && !exists(Ui.ChatList.NewChatFab)
+    }
+    poll(what = "the card still shown") { exists(Ui.ChatList.OneHandCard) && !appPrefs.oneHandUICardShown.get() }
+  }
+
+  @Test fun oneHandToolbarCardDismissShowsAlert() = uiTest {
+    app("alice")
+    appPrefs.oneHandUICardShown.set(false)
+    click(Ui.ChatList.OneHandCard.part("close"))
+    poll(what = "the `Reachable app toolbars` alert") { seesText("Reachable app toolbars") && seesText("You can change it in Appearance settings.") }
+    poll(what = "the card gone and OneHandUICardShown stored") { !exists(Ui.ChatList.OneHandCard) && storedSetting("OneHandUICardShown") == "true" }
+    click(Ui.Alert.Confirm(Ui.AlertSource.Shared))
+    poll(what = "the alert to close") { !seesText("You can change it in Appearance settings.") }
+  }
+
+  @Test fun oneHandCardAutoHiddenAfterThreeChats() = uiTest {
+    val alice = app("alice"); val bob = cli("bob"); val cath = cli("cath")
+    connect(bob)
+    alice.chatList.row("bob").row("Private notes")
+    quiesce()
+    poll(what = "two listed chats: bob and the notes folder") { chatModel.chats.value.count { !it.chatInfo.contactCard && !it.chatInfo.chatDeleted } == 2 }
+    appPrefs.oneHandUICardShown.set(false)
+    poll(what = "the card shown with two chats") { exists(Ui.ChatList.OneHandCard) }
+    settle()
+    poll(what = "the card still shown") { exists(Ui.ChatList.OneHandCard) && !appPrefs.oneHandUICardShown.get() }
+    connect(cath)
+    alice.chatList.row("cath")
+    poll(what = "the card gone with three chats and OneHandUICardShown stored") {
+      !exists(Ui.ChatList.OneHandCard) && storedSetting("OneHandUICardShown") == "true"
+    }
+    poll(what = "no `Reachable app toolbars` alert") { !seesText("You can change it in Appearance settings.") }
+  }
+
+  @Test fun connectBannerCardOpensNewLink() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    alice.chatList.row("bob")
+    quiesce()
+    appPrefs.addressCreationCardShown.set(false)
+    val newLink = Ui.ChatList.ConnectBanner.part("newLink")
+    scrollTo(newLink)
+    poll(what = "the banner half `New 1-time link`") { "New 1-time link" in textsOf(newLink) }
+    click(newLink)
+    poll(what = "New chat on the `1-time link` tab with the link created") {
+      seesText("New chat") && seesText("1-time link") && seesText("Share this 1-time invite link") && !seesText("Paste the link you received") &&
+        chatModel.showingInvitation.value != null && !editableText(Ui.Link.Text).isNullOrBlank()
+    }
+  }
+
+  @Test fun connectBannerCardOpensPasteLink() = uiTest {
+    assumeCamera()
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    alice.chatList.row("bob")
+    quiesce()
+    appPrefs.addressCreationCardShown.set(false)
+    val pasteLink = Ui.ChatList.ConnectBanner.part("pasteLink")
+    val label = if (appPlatform.isAndroid) "Paste link / Scan" else "Paste link"
+    scrollTo(pasteLink)
+    poll(what = "the banner half `$label`") { label in textsOf(pasteLink) }
+    click(pasteLink)
+    poll(what = "New chat on the `Connect via link` tab") {
+      seesText("New chat") && seesText("Connect via link") && seesText("Paste the link you received") && seesText("Tap to paste link") &&
+        !seesText("Share this 1-time invite link") && chatModel.showingInvitation.value == null &&
+        seesText("Or scan QR code") == appPlatform.isAndroid
+    }
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ChatListRowsTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ChatListRowsTest.kt
new file mode 100644
index 0000000000..3329f83dd3
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ChatListRowsTest.kt
@@ -0,0 +1,231 @@
+package chat.simplex.app.ui.main
+
+import chat.simplex.app.ui.harness.CONNECT_TIMEOUT_MS
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.app.ui.harness.backToChatList
+import chat.simplex.app.ui.harness.closeInfoToChatList
+import chat.simplex.app.ui.harness.connect
+import chat.simplex.app.ui.harness.connectIncognito
+import chat.simplex.app.ui.harness.createAddress
+import chat.simplex.app.ui.harness.hostGroup
+import chat.simplex.app.ui.harness.joinGroupFromList
+import chat.simplex.app.ui.harness.switchAwayFromChat
+import chat.simplex.common.model.ChatInfo
+import chat.simplex.common.model.MsgContent
+import chat.simplex.common.model.MsgFilter
+import chat.simplex.common.model.getTimestampText
+import chat.simplex.common.platform.chatModel
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.views.newchat.planAndConnect
+import kotlinx.coroutines.runBlocking
+import org.junit.Assert.assertFalse
+import org.junit.Test
+
+private const val PNG_1PX = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg=="
+
+class ChatListRowsTest : UiTest() {
+  @Test fun previewShowsLastTextMessage() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    bob sends "@alice first message"
+    poll(what = "the first message on the row") { "first message" in alice.chatList.rowTexts("bob") }
+    bob sends "@alice second message"
+    poll(what = "the second message in place of the first") {
+      alice.chatList.rowTexts("bob").let { "second message" in it && "first message" !in it }
+    }
+    alice.chatList.open("bob").send("my reply")
+    bob.eventuallyMessage("alice> my reply")
+    backToChatList()
+    poll(what = "alice's own reply on the row") {
+      alice.chatList.rowTexts("bob").let { "my reply" in it && "second message" !in it }
+    }
+  }
+
+  @Test fun previewShowsDraft() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    bob sends "@alice hello"
+    poll(what = "bob's message on the row") { "hello" in alice.chatList.rowTexts("bob") }
+    alice.chatList.open("bob")
+    typeInto(Ui.Chat.Message, "unsent draft")
+    switchAwayFromChat(alice)
+    poll(what = "the draft with the edit icon in place of the message") {
+      chatModel.draftChatId.value == alice.chatList.chatId("bob") &&
+        alice.chatList.rowTexts("bob").let { t -> t.any { it.endsWith(" unsent draft") } && "hello" !in t }
+    }
+  }
+
+  @Test fun previewLink() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    val id = bob.contactId("alice")
+    bob sends """/_send @$id json [{"msgContent":{"type":"link","text":"https://simplex.chat","preview":{"uri":"https://simplex.chat","title":"SimpleX Chat","description":"Private messenger","image":"$PNG_1PX"}}}]"""
+    bob.eventuallyMessage("@alice https://simplex.chat")
+    poll(what = "the link text and the link image on the row") {
+      "https://simplex.chat" in alice.chatList.rowTexts("bob") && alice.chatList.chat("bob").chatItems.lastOrNull()?.content?.msgContent is MsgContent.MCLink
+    }
+  }
+
+  @Test fun previewDeletedMessage() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    bob sends "@alice to be deleted"
+    poll(what = "the message on the row") { "to be deleted" in alice.chatList.rowTexts("bob") }
+    bob sends "\\@alice to be deleted"
+    bob.eventually("message marked deleted")
+    poll(what = "`marked deleted` in place of the text") {
+      alice.chatList.rowTexts("bob").let { "marked deleted" in it && "to be deleted" !in it }
+    }
+  }
+
+  @Test fun previewContactCardMessage() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    bob sends "/p bob Coffee lover"
+    bob.eventually("user bio changed to Coffee lover (your 0 contacts are notified)")
+    bob.createAddress()
+    connect(bob)
+    bob sends "/share address @alice"
+    bob.eventuallyMatching(Regex(".*@alice contact address of @bob.*:"))
+    poll(what = "the card's name and bio on the row") { "bob\nCoffee lover" in alice.chatList.rowTexts("bob") }
+  }
+
+  @Test fun previewGroupSenderPrefix() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    hostGroup(bob, "team", "alice")
+    joinGroupFromList(alice, bob, "team")
+    alice.chatList.open("team").send("mine")
+    bob.eventuallyMessage("#team alice> mine", CONNECT_TIMEOUT_MS)
+    backToChatList()
+    poll(what = "alice's own message without a sender prefix") {
+      alice.chatList.rowTexts("team").let { t -> "mine" in t && t.none { it.endsWith(": mine") } }
+    }
+    bob sends "#team hello all"
+    poll(what = "bob's message with the `bob: ` prefix") { "bob: hello all" in alice.chatList.rowTexts("team") }
+  }
+
+  @Test fun unreadCounterGrayWhenMuted() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    alice.chatList.rowMenu("bob", "ntfs.None")
+    poll(what = "bob muted") { alice.chatList.chat("bob").chatInfo.chatSettings?.enableNtfs == MsgFilter.None }
+    bob sends "@alice one"
+    poll(what = "unread badge 1") { "1" in alice.chatList.rowTexts("bob") }
+    bob sends "@alice two"
+    poll(what = "unread badge 2 in place of the mute icon") {
+      "2" in alice.chatList.rowTexts("bob") && "Notifications" !in alice.chatList.rowDescriptions("bob") &&
+        alice.chatList.chat("bob").chatInfo.chatSettings?.enableNtfs == MsgFilter.None
+    }
+  }
+
+  @Test fun mentionBadgeSingleUnread() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    hostGroup(bob, "team", "alice")
+    joinGroupFromList(alice, bob, "team")
+    poll(what = "no @ badge before the mention") { "Notifications" !in alice.chatList.rowDescriptions("team") }
+    bob sends "#team hello @alice"
+    poll(what = "the round @ badge without a count") {
+      alice.chatList.chat("team").chatStats.let { it.unreadCount == 1 && it.unreadMentions == 1 } &&
+        "Notifications" in alice.chatList.rowDescriptions("team") && "1" !in alice.chatList.rowTexts("team")
+    }
+  }
+
+  @Test fun mentionIconWithMultipleUnread() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    hostGroup(bob, "team", "alice")
+    joinGroupFromList(alice, bob, "team")
+    bob sends "#team hello @alice"
+    poll(what = "the round @ badge") { "Notifications" in alice.chatList.rowDescriptions("team") }
+    bob sends "#team and one more"
+    poll(what = "the @ icon next to the badge 2") {
+      alice.chatList.chat("team").chatStats.let { it.unreadCount == 2 && it.unreadMentions == 1 } &&
+        "Notifications" in alice.chatList.rowDescriptions("team") && "2" in alice.chatList.rowTexts("team")
+    }
+  }
+
+  @Test fun mutedIconWhenNoUnread() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    alice.chatList.rowMenu("bob", "ntfs.None")
+    poll(what = "the mute icon on the row") { "Notifications" in alice.chatList.rowDescriptions("bob") }
+    bob sends "@alice hi"
+    poll(what = "the unread badge in place of the mute icon") {
+      "1" in alice.chatList.rowTexts("bob") && "Notifications" !in alice.chatList.rowDescriptions("bob")
+    }
+    alice.chatList.rowMenu("bob", "markRead")
+    poll(what = "the mute icon back once read") {
+      "Notifications" in alice.chatList.rowDescriptions("bob") && "1" !in alice.chatList.rowTexts("bob")
+    }
+  }
+
+  @Test fun favoriteStarWhenNoUnread() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    alice.chatList.rowMenu("bob", "favorite")
+    poll(what = "the star on the row") { "Favorite" in alice.chatList.rowDescriptions("bob") }
+    bob sends "@alice hi"
+    poll(what = "the unread badge in place of the star") {
+      "1" in alice.chatList.rowTexts("bob") && "Favorite" !in alice.chatList.rowDescriptions("bob")
+    }
+    alice.chatList.rowMenu("bob", "markRead")
+    poll(what = "the star back once read") {
+      "Favorite" in alice.chatList.rowDescriptions("bob") && "1" !in alice.chatList.rowTexts("bob")
+    }
+  }
+
+  @Test fun incognitoIconOnRow() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connectIncognito(bob)
+    poll(what = "bob connected incognito") {
+      (alice.chatList.chat("bob").chatInfo as? ChatInfo.Direct)?.contact?.contactConnIncognito == true
+    }
+    assertFalse(alice.chatList.chat("Private notes").chatInfo.incognito)
+  }
+
+  @Test fun verifiedIconOnRow() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    alice.chatList.row("bob")
+    assertFalse((alice.chatList.chat("bob").chatInfo as ChatInfo.Direct).contact.verified)
+    alice.chatList.open("bob").contactInfo().markVerified()
+    poll(what = "bob verified in the model") { (alice.chatList.chat("bob").chatInfo as ChatInfo.Direct).contact.verified }
+    closeInfoToChatList()
+  }
+
+  @Test fun timestampShown() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    bob sends "@alice what time is it"
+    poll(what = "the message time on the row") {
+      val item = alice.chatList.chat("bob").chatItems.lastOrNull()?.takeIf { it.content.text == "what time is it" }
+      item != null && getTimestampText(item.meta.itemTs) in alice.chatList.rowTexts("bob")
+    }
+  }
+
+  @Test fun previewContactShouldAcceptForAddress() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    bob sends "/ad"
+    bob expects "Your new chat address is created!"
+    bob expects ""
+    val address = bob.nextLine()
+    runBlocking { planAndConnect(null, address, close = null) }
+    click(Ui.Alert.Confirm(Ui.AlertSource.PrivacySensitive))
+    click(Ui.Chat.Connect)
+    click(Ui.Alert.Confirm(Ui.AlertSource.Shared))
+    bob.eventually("alice wants to connect to you!", CONNECT_TIMEOUT_MS)
+    backToChatList()
+    poll(what = "`contact should accept…` on bob's row") { "contact should accept…" in alice.chatList.rowTexts("bob") }
+  }
+
+  @Test fun previewGroupInvitationJoinAs() = uiTest {
+    val alice = app("alice"); val bob = cli("bob"); val cath = cli("cath")
+    connect(bob)
+    hostGroup(bob, "team", "alice")
+    poll(what = "`You are invited to group` on the team row") { "You are invited to group" in alice.chatList.rowTexts("team") }
+    val incognito = connectIncognito(cath)
+    hostGroup(cath, "club", incognito)
+    poll(what = "`Join as $incognito` on the club row") { "Join as $incognito" in alice.chatList.rowTexts("club") }
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ChatListToolbarSearchTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ChatListToolbarSearchTest.kt
new file mode 100644
index 0000000000..895c26786c
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ChatListToolbarSearchTest.kt
@@ -0,0 +1,242 @@
+package chat.simplex.app.ui.main
+
+import chat.simplex.app.ui.harness.CONNECT_TIMEOUT_MS
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.app.ui.harness.backToChatList
+import chat.simplex.app.ui.harness.chatListToolbar
+import chat.simplex.app.ui.harness.connect
+import chat.simplex.app.ui.harness.createAddress
+import chat.simplex.app.ui.harness.createGroupLink
+import chat.simplex.app.ui.harness.enterLinkInSearch
+import chat.simplex.app.ui.harness.goBack
+import chat.simplex.app.ui.harness.joinLink
+import chat.simplex.app.ui.harness.keepOneTimeLink
+import chat.simplex.app.ui.harness.namePendingConnection
+import chat.simplex.app.ui.harness.planConfirm
+import chat.simplex.app.ui.harness.presetFilter
+import chat.simplex.app.ui.harness.quiesce
+import chat.simplex.app.ui.harness.searchShowsLink
+import chat.simplex.common.model.ChatController.appPrefs
+import chat.simplex.common.model.ChatInfo
+import chat.simplex.common.model.GroupProfile
+import chat.simplex.common.platform.chatController
+import chat.simplex.common.platform.chatModel
+import chat.simplex.common.ui.Ui
+import chat.simplex.common.views.chatlist.PresetTagKind
+import chat.simplex.common.views.database.stopChatAsync
+import kotlinx.coroutines.runBlocking
+import org.junit.Test
+
+class ChatListToolbarSearchTest : UiTest() {
+  @Test fun searchFiltersByDisplayName() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    alice.chatList.row("bob").row("Private notes")
+    alice.chatList.search("bo")
+    poll(what = "only bob listed") { alice.chatList.shown("bob") && !alice.chatList.shown("Private notes") }
+  }
+
+  @Test fun chatListTitleAndProfileButton() = uiTest {
+    val alice = app("alice")
+    poll(what = "the title `Chats`") { "Chats" in chatListToolbar().titleTexts() }
+    check(!exists(Ui.UserPicker.Sheet)) { "the user picker is open before the profile button is clicked" }
+    alice.userPicker()
+    poll(what = "the user picker with `Create SimpleX address`") { exists(Ui.UserPicker.Sheet) && textOf(Ui.UserPicker.Address) == "Create SimpleX address" }
+  }
+
+  @Test fun chatListScrollToTopOnTitleClick() = uiTest {
+    app("alice")
+    repeat(GROUPS) { i ->
+      runBlocking { chatController.apiNewGroup(null, incognito = false, GroupProfile("group$i", "", null)) } ?: error("apiNewGroup failed")
+    }
+    restart()
+    var ids = emptyList<String>()
+    poll(what = "all chats in the model") { ids = chatModel.chats.value.map { it.id }; ids.size > GROUPS }
+    val bar = chatListToolbar()
+    waitFor(Ui.ChatList.Row(ids.first()))
+    check(!bar.canScrollToTop()) { "the title is clickable while the list is at the top" }
+    scrollTo(Ui.ChatList.Row(ids.last()))
+    poll(what = "the title to become clickable with the list scrolled") { bar.canScrollToTop() }
+    bar.scrollToTop()
+    poll(what = "the list back at the top with the first chat shown") { !bar.canScrollToTop() && exists(Ui.ChatList.Row(ids.first())) }
+  }
+
+  @Test fun chatListUnreadDotOnProfileButtonForOtherUsers() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    alice.userPicker().profiles().apply { add("work"); close() }
+    connect(bob)
+    alice.userPicker().switchTo("alice")
+    val bar = chatListToolbar()
+    quiesce()
+    check(!bar.profileBadge()) { "the profile button has a badge before bob writes" }
+    bob sends "@work hello"
+    poll(timeoutMs = CONNECT_TIMEOUT_MS, what = "the badge on the profile button") { bar.profileBadge() }
+    alice.userPicker().switchTo("work")
+    alice.chatList.open("bob")
+    poll(what = "bob's chat to be read") { alice.chatList.chat("bob").chatStats.unreadCount == 0 }
+    backToChatList()
+    alice.userPicker().switchTo("alice")
+    poll(what = "the badge gone") { !bar.profileBadge() }
+  }
+
+  @Test fun chatListStoppedChatIndicator() = uiTest {
+    app("alice")
+    check(!exists(Ui.ChatList.Stopped)) { "the stopped indicator is shown while chat runs" }
+    runBlocking { stopChatAsync(chatModel) }
+    poll(what = "the `Chat is stopped` indicator") { exists(Ui.ChatList.Stopped) && "Chat is stopped" in descriptionsOf(Ui.ChatList.Stopped) }
+    click(Ui.ChatList.Stopped)
+    poll(what = "the chat stopped alert") { seesText("Chat is stopped") && seesText(STOPPED_ALERT_TEXT) }
+    click(Ui.Alert.Confirm(Ui.AlertSource.Shared))
+    poll(what = "the alert to close") { !seesText(STOPPED_ALERT_TEXT) }
+  }
+
+  @Test fun subscriptionIndicatorConnected() = uiTest {
+    app("alice")
+    appPrefs.networkShowSubscriptionPercentage.set(true)
+    val bar = chatListToolbar()
+    poll(what = "`%` with no subscriptions") { bar.percentage() == "%" }
+    runBlocking { chatController.apiAddContact(null, incognito = false) }.first ?: error("apiAddContact failed")
+    poll(what = "`100%` with the invitation queue subscribed") { bar.percentage() == "100%" }
+  }
+
+  @Test fun subscriptionIndicatorPercentageToggle() = uiTest {
+    app("alice")
+    val bar = chatListToolbar()
+    check(bar.percentage() == null) { "the percentage is shown by default" }
+    bar.toggleShowPercentage()
+    poll(what = "the percentage next to the indicator") { bar.percentage() == "%" && storedSetting("ShowSubscriptionPercentage") == "true" }
+    bar.toggleShowPercentage()
+    poll(what = "the percentage hidden") { bar.percentage() == null && storedSetting("ShowSubscriptionPercentage") == "false" }
+  }
+
+  private companion object {
+    const val GROUPS = 30
+    const val STOPPED_ALERT_TEXT = "You can start chat via app Settings / Database or by restarting the app."
+  }
+
+  @Test fun newChatButtonOpensNewChatSheet() = uiTest {
+    app("alice")
+    poll(what = "the toolbar button `Start new chat` and no floating button") {
+      exists(Ui.ChatList.NewChat) && !exists(Ui.ChatList.NewChatFab) && "Start new chat" in descriptionsOf(Ui.ChatList.NewChat)
+    }
+    click(Ui.ChatList.NewChat)
+    poll(what = "the New chat sheet") { chatModel.newChatSheetVisible.value && exists(Ui.NewChat.CreateLink) && seesText("New chat") }
+    goBack()
+    poll(what = "the New chat sheet to close") { !chatModel.newChatSheetVisible.value && !exists(Ui.NewChat.CreateLink) }
+    appPrefs.oneHandUI.set(false)
+    poll(what = "the floating button `Start new chat` and no toolbar button") {
+      exists(Ui.ChatList.NewChatFab) && !exists(Ui.ChatList.NewChat) && "Start new chat" in descriptionsOf(Ui.ChatList.NewChatFab)
+    }
+    click(Ui.ChatList.NewChatFab)
+    poll(what = "the New chat sheet from the floating button") { chatModel.newChatSheetVisible.value && exists(Ui.NewChat.CreateLink) }
+  }
+
+  @Test fun searchFiltersByAlias() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    val link = keepOneTimeLink(alice)
+    namePendingConnection("friend")
+    bob sends "/c $link"; bob expects "confirmation sent!"
+    bob.eventually("alice: contact is connected", CONNECT_TIMEOUT_MS)
+    poll(what = "the contact bob listed under the alias `friend`") {
+      chatModel.chats.value.any { it.chatInfo is ChatInfo.Direct && it.chatInfo.chatViewName == "friend" } &&
+        chatModel.chats.value.none { it.chatInfo is ChatInfo.ContactConnection }
+    }
+    alice.chatList.row("friend").row("Private notes")
+    alice.chatList.search("frie")
+    poll(what = "only `friend` listed") { alice.chatList.shown("friend") && !alice.chatList.shown("Private notes") }
+    val friend = alice.chatList.chatId("friend")
+    replaceText(Ui.ChatList.Search, "frix")
+    poll(what = "`friend` listed for text it does not contain only while it is the open chat") {
+      alice.chatList.shown("friend") == (chatModel.chatId.value == friend)
+    }
+  }
+
+  @Test fun searchMatchesPendingConnectionAlias() = uiTest {
+    val alice = app("alice")
+    keepOneTimeLink(alice)
+    namePendingConnection("dentist")
+    alice.chatList.row("dentist").row("Private notes")
+    alice.chatList.search("dent")
+    poll(what = "only the pending connection listed") { alice.chatList.shown("dentist") && !alice.chatList.shown("Private notes") }
+  }
+
+  @Test fun searchNoChatsFound() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    alice.chatList.row("bob").row("Private notes")
+    alice.chatList.search("qq")
+    poll(what = "`No chats found` and no rows") {
+      seesText("No chats found") && !alice.chatList.shown("bob") && !alice.chatList.shown("Private notes")
+    }
+  }
+
+  @Test fun searchClearsWhenFilterChanges() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    alice.chatList.row("bob").row("Private notes")
+    alice.chatList.search("bo")
+    poll(what = "only bob listed") { alice.chatList.shown("bob") && !alice.chatList.shown("Private notes") }
+    presetFilter(PresetTagKind.CONTACTS, "Contacts")
+    poll(what = "the search text cleared") { editableText(Ui.ChatList.Search).isNullOrEmpty() }
+  }
+
+  @Test fun searchNameShowsConnectToNameRow() = uiTest {
+    val alice = app("alice")
+    alice.chatList.search("bobby")
+    poll(what = "the row `Connect to bobby.testing`") {
+      exists(Ui.ChatList.ConnectByName) && "Connect to bobby.testing" in textsOf(Ui.ChatList.ConnectByName)
+    }
+    replaceText(Ui.ChatList.Search, "@bob.simplex")
+    poll(what = "the row `Connect to @bob.simplex`") {
+      exists(Ui.ChatList.ConnectByName) && "Connect to @bob.simplex" in textsOf(Ui.ChatList.ConnectByName)
+    }
+    replaceText(Ui.ChatList.Search, "bob")
+    poll(what = "no connect row for `bob`") { !exists(Ui.ChatList.ConnectByName) }
+  }
+
+  @Test fun searchPasteLinkTriggersConnectPlan() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    val address = bob.createAddress()
+    alice.chatList.row("Private notes")
+    enterLinkInSearch(address)
+    poll(what = "the address description in the read-only search field") { searchShowsLink("SimpleX contact address") }
+    poll(timeoutMs = CONNECT_TIMEOUT_MS, what = "the plan alert for bob with `Open new chat`") {
+      exists(planConfirm) && "Open new chat" in textsOf(planConfirm) && seesText("bob")
+    }
+    click(Ui.Alert.Dismiss(Ui.AlertSource.PrivacySensitive))
+    poll(what = "the search field cleared and editable") { editableText(Ui.ChatList.Search).isNullOrEmpty() && isEnabled(Ui.ChatList.Search) }
+  }
+
+  @Test fun searchPasteKnownContactLinkFiltersToContact() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    val address = bob.createAddress()
+    joinLink(address)
+    bob.eventually("alice: contact is connected", CONNECT_TIMEOUT_MS)
+    alice.chatList.row("bob").row("Private notes")
+    quiesce()
+    enterLinkInSearch(address)
+    poll(timeoutMs = CONNECT_TIMEOUT_MS, what = "only bob listed for his address") {
+      searchShowsLink("SimpleX contact address") && alice.chatList.shown("bob") && !alice.chatList.shown("Private notes")
+    }
+    settle()
+    poll(what = "no plan alert for a known contact") { !exists(planConfirm) }
+  }
+
+  @Test fun searchPasteKnownGroupLinkFiltersToGroup() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    val link = bob.createGroupLink("team")
+    joinLink(link)
+    bob.eventually("#team: alice joined the group", CONNECT_TIMEOUT_MS)
+    poll(timeoutMs = CONNECT_TIMEOUT_MS, what = "alice an active member of team") {
+      chatModel.chats.value.any { (it.chatInfo as? ChatInfo.Group)?.takeIf { g -> g.chatViewName == "team" }?.groupInfo?.membership?.memberActive == true }
+    }
+    alice.chatList.row("team").row("Private notes")
+    quiesce()
+    enterLinkInSearch(link)
+    poll(timeoutMs = CONNECT_TIMEOUT_MS, what = "only team listed for its link") {
+      searchShowsLink("SimpleX group link") && alice.chatList.shown("team") && !alice.chatList.shown("Private notes")
+    }
+    settle()
+    poll(what = "no plan alert for a known group") { !exists(planConfirm) }
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ChatProfilesTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ChatProfilesTest.kt
new file mode 100644
index 0000000000..b1f43bdfb9
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ChatProfilesTest.kt
@@ -0,0 +1,13 @@
+package chat.simplex.app.ui.main
+
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.common.platform.chatModel
+import org.junit.Test
+
+class ChatProfilesTest : UiTest() {
+  @Test fun profilesAddProfile() = uiTest {
+    val alice = app("alice")
+    alice.userPicker().profiles().add("work")
+    poll(what = "alice and work listed") { chatModel.users.map { it.user.displayName }.containsAll(listOf("alice", "work")) }
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ContactInfoTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ContactInfoTest.kt
new file mode 100644
index 0000000000..47ff9f34ca
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ContactInfoTest.kt
@@ -0,0 +1,30 @@
+package chat.simplex.app.ui.main
+
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.app.ui.harness.connect
+import chat.simplex.common.model.ChatInfo
+import chat.simplex.common.ui.Ui
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class ContactInfoTest : UiTest() {
+  @Test fun contactInfoVerifyCodeMatchesCli() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    val shown = alice.chatList.open("bob").contactInfo().securityCode()
+    bob sends "/code alice"
+    bob.eventually("alice security code:")
+    assertEquals(bob.nextLine().filterNot(Char::isWhitespace), shown)
+  }
+
+  @Test fun contactInfoMarkVerified() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    val info = alice.chatList.open("bob").contactInfo()
+    info.markVerified()
+    poll(what = "bob verified in the model") { (alice.chatList.chat("bob").chatInfo as ChatInfo.Direct).contact.verified }
+    poll(what = "the row `View security code`") { info.verifyRowText() == "View security code" }
+    click(Ui.Info.VerifyCode)
+    poll(what = "`bob is verified`") { seesText("bob is verified") }
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ContactsTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ContactsTest.kt
new file mode 100644
index 0000000000..904be9f642
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/ContactsTest.kt
@@ -0,0 +1,55 @@
+package chat.simplex.app.ui.main
+
+import chat.simplex.app.ui.harness.CONNECT_TIMEOUT_MS
+import chat.simplex.app.ui.harness.connect
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.common.platform.chatModel
+import chat.simplex.common.ui.Ui
+import org.junit.Test
+
+class ContactsTest : UiTest() {
+  @Test fun contactRequestMenuAccept() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    val address = alice.userPicker().createAddress()
+    bob sends "/c $address"; bob expects "connection request sent!"
+    alice.chatList.request("bob")
+    alice.chatList.rowMenu("bob", "accept")
+    bob.eventually("alice: contact is connected", CONNECT_TIMEOUT_MS)
+  }
+
+  @Test fun contactRequestMenuReject() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    val address = alice.userPicker().createAddress()
+    bob sends "/c $address"; bob expects "connection request sent!"
+    alice.chatList.request("bob")
+    alice.chatList.rowMenu("bob", "reject")
+    alice.chatList.gone("bob")
+  }
+
+  @Test fun deleteContactAndNotify() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    alice.chatList.open("bob").info()
+    click(Ui.Info.DeleteContact)
+    click(Ui.Alert.Option(Ui.AlertSource.Shared, "deleteContact"))
+    click(Ui.Alert.Option(Ui.AlertSource.Shared, "deleteAndNotify"))
+    bob.eventually("alice deleted contact with you")
+    alice.chatList.gone("bob")
+  }
+
+  @Test fun contactInfoSetLocalAlias() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    alice.chatList.open("bob").info()
+    typeInto(Ui.Info.Alias, "friend")
+    poll(what = "the row to read `friend`") { chatModel.chats.value.any { it.chatInfo.chatViewName == "friend" } }
+    poll(what = "the row text `friend`") { "friend" in alice.chatList.rowTexts("friend") }
+  }
+
+  @Test fun editProfileDisplayName() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    connect(bob)
+    alice.profile().rename("alice2")
+    bob.eventually("contact alice changed to alice2")
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/OneTimeLinkCompatTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/OneTimeLinkCompatTest.kt
new file mode 100644
index 0000000000..64a53a284d
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/OneTimeLinkCompatTest.kt
@@ -0,0 +1,14 @@
+package chat.simplex.app.ui.main
+
+import chat.simplex.app.ui.harness.UiTest
+import org.junit.Test
+
+class OneTimeLinkCompatTest : UiTest() {
+  @Test fun oneTimeLinkCliConnectsViaShortLink() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    val link = alice.newChat().createOneTimeLink()
+    bob sends "/c $link"; bob expects "confirmation sent!"
+    bob expects "alice: contact is connected"
+    alice.chatList.row("bob")
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/OneTimeLinkTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/OneTimeLinkTest.kt
new file mode 100644
index 0000000000..2900cbab3a
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/OneTimeLinkTest.kt
@@ -0,0 +1,25 @@
+package chat.simplex.app.ui.main
+
+import chat.simplex.app.ui.harness.CONNECT_TIMEOUT_MS
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.common.model.ChatInfo
+import chat.simplex.common.platform.chatModel
+import chat.simplex.common.ui.Ui
+import org.junit.Assert.assertNotEquals
+import org.junit.Test
+
+class OneTimeLinkTest : UiTest() {
+  @Test fun oneTimeLinkSwitchToIncognito() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    val link = alice.newChat().createOneTimeLink()
+    click(Ui.Link.ShareProfile)
+    click(Ui.Link.ProfileIncognito)
+    poll(what = "the incognito footer") { seesText("A new random profile will be shared.") }
+    bob sends "/c $link"; bob expects "confirmation sent!"
+    val shared = bob.eventuallyMatching(Regex("(\\S+): contact is connected"), CONNECT_TIMEOUT_MS).groupValues[1]
+    assertNotEquals("alice", shared)
+    poll(what = "an incognito contact bob") {
+      chatModel.chats.value.any { (it.chatInfo as? ChatInfo.Direct)?.contact?.let { c -> c.displayName == "bob" && c.contactConnIncognito } == true }
+    }
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/UserPickerTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/UserPickerTest.kt
new file mode 100644
index 0000000000..00dadc0cc2
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/UserPickerTest.kt
@@ -0,0 +1,17 @@
+package chat.simplex.app.ui.main
+
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.common.model.GroupProfile
+import chat.simplex.common.platform.chatController
+import kotlinx.coroutines.runBlocking
+import org.junit.Test
+
+class UserPickerTest : UiTest() {
+  @Test fun userPickerSwitchProfile() = uiTest {
+    val alice = app("alice")
+    runBlocking { chatController.apiNewGroup(null, incognito = false, GroupProfile("team", "", null)) } ?: error("apiNewGroup failed")
+    alice.userPicker().profiles().apply { add("work"); close() }
+    alice.userPicker().switchTo("alice")
+    alice.chatList.row("team")
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/WhatsNewTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/WhatsNewTest.kt
new file mode 100644
index 0000000000..c187fe31bf
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/main/WhatsNewTest.kt
@@ -0,0 +1,55 @@
+package chat.simplex.app.ui.main
+
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.app.ui.harness.WhatsNewScreen
+import chat.simplex.app.ui.harness.enableOperator
+import chat.simplex.app.ui.harness.whatsNewFromSettings
+import chat.simplex.common.model.ChatController.appPrefs
+import chat.simplex.common.model.OperatorTag
+import chat.simplex.common.platform.chatController
+import chat.simplex.common.ui.Ui
+import kotlinx.coroutines.runBlocking
+import org.junit.Test
+
+class WhatsNewTest : UiTest() {
+  @Test fun whatsNewFromSettings() = uiTest {
+    val alice = app("alice")
+    val whatsNew = whatsNewFromSettings(alice)
+    poll(what = "What's New from Help & support, without an OK button") { whatsNew.shown() && !exists(Ui.WhatsNew.Ok) }
+    escape()
+    poll(what = "Help & support again") { !whatsNew.shown() && exists(Ui.Help.WhatsNew) }
+  }
+
+  @Test fun whatsNewShownAfterVersionUpgrade() = uiTest {
+    app("alice")
+    appPrefs.whatsNewVersion.set(WhatsNewScreen.OLDER_VERSION)
+    restart()
+    val whatsNew = WhatsNewScreen(this)
+    poll(what = "What's New to open by itself") { whatsNew.shown() && exists(Ui.WhatsNew.Ok) }
+    poll(what = "the stored What's New version to be the current one") { storedSetting("WhatsNewVersion") == WhatsNewScreen.VERSION }
+  }
+
+  @Test fun whatsNewOkCloses() = uiTest {
+    app("alice")
+    appPrefs.whatsNewVersion.set(WhatsNewScreen.OLDER_VERSION)
+    restart()
+    val whatsNew = WhatsNewScreen(this)
+    poll(what = "What's New to open by itself") { whatsNew.shown() && exists(Ui.WhatsNew.Ok) }
+    whatsNew.ok()
+  }
+
+  @Test fun whatsNewShowsViewUpdatedConditions() = uiTest {
+    app("alice")
+    enableOperator(OperatorTag.SimpleX)
+    restart()
+    val whatsNew = WhatsNewScreen(this)
+    poll(what = "What's New with `View updated conditions`") {
+      whatsNew.shown() && exists(Ui.WhatsNew.ViewConditions) && textOf(Ui.WhatsNew.ViewConditions) == "View updated conditions"
+    }
+    click(Ui.WhatsNew.ViewConditions)
+    poll(what = "the `Updated conditions` screen") { seesText("Updated conditions") && seesText("Accept conditions") }
+    poll(what = "the conditions to be marked as notified in the core") {
+      runBlocking { chatController.getServerOperators(null) }?.currentConditions?.notifiedAt != null
+    }
+  }
+}
diff --git a/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/settings/AppearanceTest.kt b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/settings/AppearanceTest.kt
new file mode 100644
index 0000000000..b1c0a77753
--- /dev/null
+++ b/apps/multiplatform/common/src/uiTestShared/kotlin/chat/simplex/app/ui/settings/AppearanceTest.kt
@@ -0,0 +1,22 @@
+package chat.simplex.app.ui.settings
+
+import chat.simplex.app.ui.harness.UiTest
+import chat.simplex.common.platform.appPlatform
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class AppearanceTest : UiTest() {
+  @Test fun appearance_settingsPersistAcrossRestart() = uiTest {
+    val before = app("alice").appearance()
+    before.colorMode("DARK")
+    before.fontScale = 1.2f
+    if (appPlatform.isDesktop) before.zoom = 1.5f
+    poll(what = "theme, font scale and zoom to be stored") {
+      storedSetting("CurrentTheme") == "DARK" && storedSetting("FontScale") == "1.2" && (!appPlatform.isDesktop || storedSetting("DensityScale") == "1.5")
+    }
+    val after = restart().appearance()
+    assertEquals("Dark", after.colorModeText())
+    assertEquals(1.2f, after.fontScale, 0.001f)
+    if (appPlatform.isDesktop) assertEquals(1.5f, after.zoom, 0.001f)
+  }
+}
diff --git a/apps/multiplatform/scripts/uitest-android.sh b/apps/multiplatform/scripts/uitest-android.sh
new file mode 100755
index 0000000000..7510947111
--- /dev/null
+++ b/apps/multiplatform/scripts/uitest-android.sh
@@ -0,0 +1,131 @@
+#!/bin/sh
+# Usage: scripts/uitest-android.sh <app.apk> <androidTest.apk> [am instrument -e args...]
+# Needs scripts/uitest.sh to have run once (it builds the CLI and test servers and writes build/uitest/env.properties).
+# Env:
+#   UITEST_SERIAL  adb serial of the device or emulator to use; when unset, a Waydroid instance is claimed with wd.sh from PATH
+#   WD_INSTANCE    Waydroid instance (default 2), WD_OWNER claim owner (default uitest-$USER)
+#   UITEST_APP_ID  application id of the app APK (default chat.simplex.app.debug)
+#   ADB, JAVA_HOME tool locations (default: adb from ANDROID_HOME, ANDROID_SDK_ROOT or PATH; java from JAVA_HOME or PATH)
+set -eu
+sdk="${ANDROID_HOME:-${ANDROID_SDK_ROOT:-}}"
+ADB="${ADB:-$( [ -n "$sdk" ] && [ -x "$sdk/platform-tools/adb" ] && echo "$sdk/platform-tools/adb" || echo adb )}"
+adb() { "$ADB" "$@"; }
+app_apk=$1; test_apk=$2; shift 2
+export WD_INSTANCE="${WD_INSTANCE:-2}" WD_OWNER="${WD_OWNER:-uitest-$(id -un)}"
+pkg="${UITEST_APP_ID:-chat.simplex.app.debug}"
+runner=$pkg.test/androidx.test.runner.AndroidJUnitRunner
+out="$(dirname "$(readlink -f "$0")")/../build/uitest-android/run-$(date +%Y%m%d-%H%M%S)"
+mkdir -p "$out"
+t0=$(date +%s)
+step() { echo "uitest-android: [$(( $(date +%s) - t0 )) s] $*"; }
+
+mp="$(dirname "$(readlink -f "$0")")/.."
+bridge_log="$out/bridge.log"
+avail_mb=$(awk '/^MemAvailable:/ {print int($2 / 1024)}' /proc/meminfo)
+[ "$avail_mb" -ge 4500 ] || { echo "uitest-android: only $avail_mb MB available, need 4500 (bridge + Waydroid); free memory first" >&2; exit 1; }
+java="${JAVA_HOME:+$JAVA_HOME/bin/}java"
+[ -s "$mp/build/uitest/env.properties" ] || { echo "uitest-android: run scripts/uitest.sh once first; it builds the CLI and test servers and writes build/uitest/env.properties" >&2; exit 1; }
+cp_file="$mp/build/uitest/bridge.classpath"
+h="$mp/common/src/desktopTest/kotlin/chat/simplex/app/ui/harness"
+bridge_srcs="$h/UiBridge.kt $h/CliPeer.kt $h/VtScreen.kt $h/TestServers.kt $h/UiEnv.kt $h/UiJvm.kt $mp/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/ServersConfig.kt $mp/common/src/uiTestShared/kotlin/chat/simplex/app/ui/harness/PeerLines.kt"
+wd_pid=
+cleanup() {
+  [ -z "${bridge_pid:-}" ] || kill -TERM "$bridge_pid" 2>/dev/null || true
+  [ -z "$wd_pid" ] || wait "$wd_pid" 2>/dev/null || true
+  [ -n "${UITEST_SERIAL:-}" ] || wd.sh release >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+if [ ! -s "$cp_file" ] || [ -n "$(find $bridge_srcs -newer "$cp_file" 2>/dev/null)" ]; then
+  step "compiling the bridge"
+  (cd "$mp" && ./gradlew -g "$mp/.gradle/uitest-home" --no-daemon -q -Pkotlin.compiler.execution.strategy=in-process :common:uitestBridgeClasspath) > "$out/bridge-build.log" 2>&1 \
+    || { echo "uitest-android: bridge build failed; see $out/bridge-build.log" >&2; exit 1; }
+fi
+if [ -z "${UITEST_SERIAL:-}" ]; then
+  wd.sh claim "$WD_OWNER"
+  if ! wd.sh status | grep -q "Session:.*RUNNING"; then
+    wd.sh up > "$out/waydroid-up.log" 2>&1 &
+    wd_pid=$!
+  fi
+fi
+setsid "$java" -Djava.awt.headless=true -Dsimplex.uitest.env="$mp/build/uitest/env.properties" -cp "$(cat "$cp_file")" chat.simplex.app.ui.harness.UiBridge 7777 > "$bridge_log" 2>&1 &
+bridge_pid=$!
+i=0
+until grep -q "^uitest-bridge: smp" "$bridge_log" 2>/dev/null; do
+  i=$((i + 1)); [ "$i" -lt 1200 ] || { echo "uitest-android: bridge did not start; see $bridge_log" >&2; exit 1; }
+  kill -0 "$bridge_pid" 2>/dev/null || { echo "uitest-android: bridge exited; see $bridge_log" >&2; exit 1; }
+  sleep 0.1
+done
+base=$(sed -n 's/^uitest-bridge: .*port base \([0-9]*\),.*/\1/p' "$bridge_log")
+step "bridge up, server port base $base"
+
+if [ -n "$wd_pid" ]; then
+  wait "$wd_pid" || { echo "uitest-android: wd.sh up failed; see $out/waydroid-up.log" >&2; wd_pid=; exit 1; }
+  wd_pid=
+fi
+serial="${UITEST_SERIAL:-$(wd.sh serial)}"
+step "device $serial ready"
+echo "uitest-android: note: pm clear removes the app's data on $serial"
+app_sum=$(sha256sum "$app_apk" | cut -c1-16)
+stamp="$mp/build/uitest-android/installed-app-$(printf %s "$serial" | tr -c "A-Za-z0-9" _)"
+installed_ver=$(adb -s "$serial" shell dumpsys package "$pkg" 2>/dev/null | tr -d '\r' | sed -n 's/^ *lastUpdateTime=//p' | head -1)
+if [ -n "$installed_ver" ] && [ "$(cat "$stamp" 2>/dev/null)" = "$app_sum $installed_ver" ]; then
+  echo "uitest-android: app APK unchanged on $serial, skipping its install"
+else
+  if [ -n "${UITEST_SERIAL:-}" ]; then adb -s "$serial" install -r -g "$app_apk" >/dev/null; else wd.sh install "$app_apk"; fi
+  installed_ver=$(adb -s "$serial" shell dumpsys package "$pkg" | tr -d '\r' | sed -n 's/^ *lastUpdateTime=//p' | head -1)
+  echo "$app_sum $installed_ver" > "$stamp"
+fi
+adb -s "$serial" install -r -t "$test_apk"
+step "APKs installed"
+for p in 7777 $((base + 1)) $((base + 2)); do adb -s "$serial" reverse "tcp:$p" "tcp:$p" >/dev/null; done
+prepare_app() {
+  adb -s "$serial" shell pm clear "$pkg" >/dev/null
+  for perm in android.permission.POST_NOTIFICATIONS android.permission.CAMERA android.permission.RECORD_AUDIO; do
+    adb -s "$serial" shell pm grant "$pkg" "$perm" 2>/dev/null || true
+  done
+}
+# Prints one line per test in an `am instrument -r` output: "<class>#<test> <code>" for finished tests (0 pass, -2 fail, -3/-4 skipped)
+# and "<class>#<test> crashed" for a test that started without finishing.
+results() {
+  tr -d '\r' < "$1" | awk '
+    /^INSTRUMENTATION_STATUS: class=/ { c = substr($0, 31) }
+    /^INSTRUMENTATION_STATUS: test=/ { t = substr($0, 30) }
+    /^INSTRUMENTATION_STATUS_CODE: / { code = $2; if (code == 1) { running = c "#" t } else { print c "#" t, code; running = "" } }
+    END { if (running != "") print running, "crashed" }'
+}
+shots=/sdcard/Android/data/$pkg/files/failures
+adb -s "$serial" shell rm -rf "$shots" || true
+adb -s "$serial" logcat -G 16M >/dev/null 2>&1 || true
+adb -s "$serial" logcat -c || true
+: > "$out/results.txt"
+pass=1
+gave_up=
+while :; do
+  prepare_app
+  skip=$(cut -d' ' -f1 "$out/results.txt" | paste -sd, -)
+  set +e
+  if [ -n "$skip" ]; then
+    adb -s "$serial" shell am instrument -w -r "$@" -e notClass "$skip" "$runner" > "$out/instrument-$pass.txt" 2>&1
+  else
+    adb -s "$serial" shell am instrument -w -r "$@" "$runner" > "$out/instrument-$pass.txt" 2>&1
+  fi
+  rc=$?
+  set -e
+  results "$out/instrument-$pass.txt" >> "$out/results.txt"
+  adb -s "$serial" pull "$shots" "$out/" >/dev/null 2>&1 || true
+  step "instrumentation pass $pass finished (am instrument exit $rc)"
+  tr -d '\r' < "$out/instrument-$pass.txt" | grep -q "shortMsg=Process crashed" || break
+  [ "$pass" -lt 4 ] || { echo "uitest-android: process crashed in 4 passes, giving up" >&2; gave_up=1; break; }
+  pass=$((pass + 1))
+  echo "uitest-android: the app process crashed; resuming with the remaining tests (pass $pass)"
+done
+cat "$out"/instrument-*.txt > "$out/instrument.txt"
+adb -s "$serial" logcat -d > "$out/logcat.txt" 2>&1 || true
+grep -E "INSTRUMENTATION_STATUS: stack=" "$out/instrument.txt" | cut -c1-1500 || true
+grep -E "UITEST|TestRunner: (started|finished|failed)" "$out/logcat.txt" | sed "s/^[0-9-]* //" > "$out/timings.txt" || true
+echo "uitest-android: results ($out/results.txt; 0 pass, -2 fail, -3/-4 skipped):"
+sed 's/^chat\.simplex\.app\.ui\.//' "$out/results.txt"
+echo "uitest-android: $(grep -c ' 0$' "$out/results.txt") passed, $(grep -c ' -2$' "$out/results.txt") failed, $(grep -c ' crashed$' "$out/results.txt") crashed; results in $out"
+[ -z "$gave_up" ] && ! grep -qE ' (-2|crashed)$' "$out/results.txt" && [ -s "$out/results.txt" ]
diff --git a/apps/multiplatform/scripts/uitest.sh b/apps/multiplatform/scripts/uitest.sh
new file mode 100755
index 0000000000..33d2615975
--- /dev/null
+++ b/apps/multiplatform/scripts/uitest.sh
@@ -0,0 +1,85 @@
+#!/bin/sh
+set -eu
+self=$(readlink -f "$0")
+cd "$(dirname "$self")/.."
+home="$PWD/.gradle/uitest-home"
+kotlin_in_process="-Pkotlin.compiler.execution.strategy=in-process"
+
+if [ "${1:-}" = "--inside" ]; then
+  shift
+  run="$1"; shift
+  [ "$$" -eq 1 ] || { echo "uitest: --inside runs only as PID 1 of the runner's PID namespace" >&2; exit 1; }
+  trap 'kill -TERM -1 2>/dev/null; exit 143' TERM
+  SIMPLEX_UITEST_RUNNER=1 ./gradlew -g "$home" --offline --no-daemon "$kotlin_in_process" :common:desktopUiTest -PuiRunDir="$run" -PuiPass=1 "$@"
+  exit $?
+fi
+
+avail_mb=$(awk '/^MemAvailable:/ {print int($2 / 1024)}' /proc/meminfo)
+[ "$avail_mb" -ge 3000 ] || { echo "uitest: only $avail_mb MB available, need 3000; free memory first" >&2; exit 1; }
+mkdir -p build/uitest
+exec 9>build/uitest/runner.lock
+flock -n 9 || { echo "another uitest run holds build/uitest/runner.lock" >&2; exit 1; }
+run="$PWD/build/uitest/run-$(date +%Y%m%d-%H%M%S)"
+mkdir -p "$run/jvmtmp" "$run/cache"
+ls -1dt build/uitest/run-* 2>/dev/null | tail -n +7 | xargs -r rm -rf
+
+repo=$(cd ../.. && pwd)
+(cd "$repo" && cabal build -O0 -f uitest --builddir=dist-uitest exe:simplex-chat exe:uitest-servers)
+cli=$(cd "$repo" && cabal list-bin -O0 -f uitest --builddir=dist-uitest exe:simplex-chat)
+servers=$(cd "$repo" && cabal list-bin -O0 -f uitest --builddir=dist-uitest exe:uitest-servers)
+
+peer_template() {
+  t="$run/peer-template.tmp"
+  mkdir -p "$t/tmp"
+  (cd "$repo" && HOME="$t" TMPDIR="$t/tmp" "$cli" -d "$t/simplex_v1" --maintenance -e /v -t 0 >"$t/out.txt" 2>&1) || true
+  if [ -f "$t/simplex_v1_chat.db" ] && grep -q "no active user in maintenance mode" "$t/out.txt"; then
+    rm -rf "$t/tmp" "$t/out.txt" && mv "$t" "$run/peer-template"
+  else
+    echo "peer template not created; peers create their databases on first start" >&2
+  fi
+}
+peer_template &
+template_pid=$!
+
+[ -d common/src/commonMain/cpp/desktop/libs/linux-x86_64 ] || { echo "uitest: native libs missing in common/src/commonMain/cpp/desktop/libs/linux-x86_64; build the desktop app once (./gradlew :desktop:cmakeBuildAndCopy)" >&2; exit 1; }
+prepare_key=$({
+  find . -path ./build -prune -o -path ./.gradle -prune -o -path '*/build' -prune -o \( -name '*.gradle.kts' -o -name gradle.properties -o -name '*.versions.toml' \) -type f -print
+  find common/src/commonMain/cpp -path '*/libs' -prune -o -type f -print
+} | LC_ALL=C sort | xargs sha256sum | sha256sum; ls -l --time-style=full-iso common/src/commonMain/cpp/desktop/libs/linux-x86_64 | grep -v libapp-lib.so)
+prepare_key=$(printf '%s' "$prepare_key" | sha256sum | cut -d' ' -f1)
+lib=common/src/commonMain/cpp/desktop/libs/linux-x86_64/libapp-lib.so
+if [ "$prepare_key" = "$(cat build/uitest/prepare.key 2>/dev/null)" ] && [ -f "$lib" ]; then
+  echo "uitest: build files and native libs unchanged, skipping the outside Gradle step"
+else
+  rm -f build/uitest/prepare.key
+  ./gradlew -g "$home" --no-daemon "$kotlin_in_process" :desktop:cmakeBuildAndCopy :common:desktopTestClasses :common:uitestPrepare
+  ./gradlew -g "$home" --stop >/dev/null 2>&1 || true
+  echo "$prepare_key" > build/uitest/prepare.key
+fi
+
+cat > build/uitest/env.properties <<ENV
+libAppLib=$PWD/$lib
+runDir=$run
+repoRoot=$repo
+cli=$cli
+servers=$servers
+ENV
+wait "$template_pid"
+
+case " $* " in
+  *" -PuiForks="*) ;;
+  *)
+    forks=$(( (avail_mb - 2500) / 1000 ))
+    [ "$forks" -ge 1 ] || forks=1
+    [ "$forks" -le 4 ] || forks=4
+    echo "uitest: $avail_mb MB available, running $forks test JVMs in parallel (override with -PuiForks=N)"
+    set -- "$@" -PuiForks=$forks ;;
+esac
+
+inside_pid=
+trap '[ -z "$inside_pid" ] || kill -KILL "$inside_pid"' INT TERM
+unshare -rn --pid --fork --kill-child --mount-proc sh -c '
+  ip link set lo up && ip link set lo multicast on && ip route add 224.0.0.0/4 dev lo src 127.0.0.1 &&
+  exec "$0" --inside "$@"' "$self" "$run" "$@" &
+inside_pid=$!
+wait "$inside_pid"
diff --git a/plans/ui-tests/2026-10-10-desktop-ui-test-dsl-plan.md b/plans/ui-tests/2026-10-10-desktop-ui-test-dsl-plan.md
new file mode 100644
index 0000000000..b7723d161a
--- /dev/null
+++ b/plans/ui-tests/2026-10-10-desktop-ui-test-dsl-plan.md
@@ -0,0 +1,1596 @@
+# Desktop UI tests: typed component keys, a headless driver and a test DSL
+
+**Date:** 2026-10-10 (revised 2026-10-13 after adversarial review rounds 1–49; review stopped on a time box; revised 2026-10-14: what is built is in 0.5, status in section 15)
+**Base:** master at `d72f68e6d` (`~/wt-uitest-ref`)
+**Files:** this plan and its companions are in `plans/ui-tests/`: the Android plan (`2026-10-12-android-ui-test-automation.md`), the Android research log (`2026-10-12-android-research-progress.md`), the P1a start page (`2026-10-13-p1a-start-here.md`), and the test catalogue (`catalogue/`: chapters `00`–`05`, review and progress notes in `catalogue/verify/`, count and status scripts in `catalogue/tools/`). Paths starting with `~/` refer to the author's machine (reference worktree, build scripts, Waydroid tooling).
+**Start here (implementers):** `plans/ui-tests/2026-10-13-p1a-start-here.md`. It covers the reading order, build order and exit check for P1a (section 12). P1a is complete, so that page is historical; the current harness is described in 0.5.
+
+## Summary
+
+The desktop app has no UI tests and no names for its components: `testTag` and `Modifier.semantics` appear zero times. Manual GUI testing (the PR #7573 matrix) had to drive the app by screen coordinates and read its database to check what it showed. Clicks went to the wrong row whenever the chat list reordered, and reading the live database froze the app once.
+
+This plan adds four layers:
+
+1. **Keys.** Every interactive or inspectable component gets a typed key from one `Ui` object, applied with `Modifier.ui(key)`. Rows, items and members carry their entity id in the key.
+2. **Typed semantics.** The state a test asserts on (unread count, item status and metadata, sender, verification, incognito, muted) is published as typed semantics properties, not judged from pixels.
+3. **Driver.** A headless in-process driver renders the real `AppScreen()` with the real core in a test JVM, using Compose's skiko test scene (`runInternalSkikoComposeUiTest` with a `StandardTestDispatcher`, 7.2, 14; `runDesktopComposeUiTest` as the fallback). Other users are CLI processes of the current build or a stable release downloaded by tag. Servers are local, and the whole test run is cut off from the real network.
+4. **DSL.** Screen objects and a test DSL that reads like `tests/ChatTests`: `bob sends "/c $link"`, `bob expects "confirmation sent!"`, `alice.chatList.row("bob") shouldHave unread(1)`.
+
+Decisions (2026-10-10):
+- Thorough coverage: every screen and every user-facing feature of the desktop app. The catalogue (section 10) lists 1,177 test cases (28 of them `IGNORE` with a reason) in four files plus a legend under `plans/ui-tests/catalogue/`.
+- In-process driver only; no remote automation server. Tests run locally.
+- Typed keys on every component.
+- DSL in Kotlin, in the `desktopTest` source set, run by a separate `desktopUiTest` task. (As built: test bodies and screens are in `common/src/uiTestShared`, compiled into `desktopTest` and Android `androidTest`, 0.5.1.)
+- No badge-display tests for now: no badge semantics property, no test issuer key. Keys on the badge screens are still added, and the supporter-perks screens are tested without badge display.
+- The stable CLI peer is the release binary downloaded by tag.
+- Screenshots (added 2026-10-12): every passing catalogue test (except the `REALTIME` ones and runs with `-PuiShots=off`, 7.7) saves committed PNG screenshots, rewritten only when the screen changes outside masked volatile regions, to show UI changes as image diffs, give evidence that the tests ran (new and changed images, plus each run's summary), and document every screen (7.7).
+
+Changed since (13, 2026-10-13/14): Android is in scope through shared test bodies (`uiTestShared`); the minimal-app-code rule of 2026-10-14 supersedes items 1–2 above and "typed keys on every component" for now; the shared bodies live in `common/src/uiTestShared`, compiled into `desktopTest` and Android `androidTest`. What is built is in 0.5.
+
+## 0.5 As built (2026-10-14)
+
+Sections 3–11 remain the design. This section describes what is implemented in `~/wt-uitest` (branch `nd/desktop-ui-tests`, base `eda94a505`, nothing committed), checked against the code on 2026-10-14 at about 20:05 UTC. Paths are relative to `apps/multiplatform`. Each design subsection that differs starts with a one-line "As built" note pointing here.
+
+### 0.5.1 Layout and test counts
+
+| Source set | Path | Compiled into | `@Test` |
+|---|---|---|---|
+| Shared harness and tests | `common/src/uiTestShared/kotlin/chat/simplex/app/ui/{harness,main,chat,groups,settings}` | `desktopTest` (`common/build.gradle.kts`, `kotlin.srcDir`) and `:android` `androidTest` (`android/build.gradle.kts`, `sourceSets["androidTest"].java.srcDir`) | 112 |
+| Desktop-only catalogue tests | `common/src/desktopTest/kotlin/chat/simplex/app/ui/desktop` | `desktopTest` | 25 |
+| Desktop harness and its tests | `common/src/desktopTest/kotlin/chat/simplex/app/ui/harness` | `desktopTest` | 5 (`HarnessMeasureTest` is `@Ignore`d, a manual benchmark) |
+| Android harness and Android-only tests | `android/src/androidTest/java/chat/simplex/app/ui/{harness,back}`, `ui/SmokeTest.kt` | `androidTest` | 15 |
+| **Desktop run** | | | **142** (141 run, 1 ignored) |
+| **Android run** | | | **127** (112 + 15) |
+
+- Shared (112): ChatListFiltersListsTest 21, ChatListRowsTest 16, ChatListToolbarSearchTest 16, ChatListMenusPendingTest 10, ChatListRequestsCardsTest 8, MessagingTest 6, ContactsTest 5, ChatListMenuTest 4, WhatsNewTest 4, GroupsTest 3, ContactInfoTest 2, ForwardTest 2, MemberInfoTest 2, and 1 each in AddressCompatTest, AppearanceTest, ChatListRequestsCardsCompatTest, ChatProfilesTest, ChatSearchTest, DeleteMessageTest, EditMessageTest, JoiningCompatTest, NotesTest, OneTimeLinkCompatTest, OneTimeLinkTest, SendCompatTest, UserPickerTest.
+- Desktop-only, package `chat.simplex.app.ui.desktop` (names end in `DesktopTest`, except `OnboardingTest`, so none repeats a shared class name): OnboardingTest 22, ChatListFiltersListsDesktopTest 2, WhatsNewDesktopTest 1.
+- Desktop harness: HarnessResetTest 2, HarnessBootTest 1, HarnessCliPeerTest 1, HarnessMeasureTest 1.
+- Android-only: `back/BackKeyTest` 14 (helpers in `back/BackKeyHelpers.kt`), `SmokeTest` 1.
+- Shared harness files: `Screens.kt` (`App`, `ChatListScreen`, `NewChatScreen`, `UserPickerScreen`, `ProfilesScreen`, `AddressScreen`, `AppearanceScreen`, `ProfileScreen`, `ChatScreen`, `ContactInfoScreen`, `GroupInfoScreen`, `MemberInfoScreen`, `ownGroup`), `ChatList{Filter,Lists,Menus,Rows,Toolbar}Screens.kt`, `OnboardingScreens.kt`, `Helpers.kt`, `PeerLines.kt`, `TapPoint.kt`, `TestPrefs.kt`, `ServersConfig.kt`, `CommonReset.kt` (`ModelSnapshot`, `CommonUiState`, `CommonPrefs`).
+- Each platform has its own `UiScope` class with the same method names, and the shared code compiles against either. There is no `UiDriver` interface (7.4).
+
+### 0.5.2 App code
+
+- `common/src/commonMain/kotlin/chat/simplex/common/ui/Ui.kt`: `UiKey`, `Modifier.ui(key)`, `object Ui` and the flag `uiTestHooksEnabled` (renamed from `uiTagsEnabled`). `Modifier.ui` and `UiIdle` do nothing unless the flag is set. The desktop harness sets it in `bootJvm`. On Android, `initUiTags(context)` (`common/src/androidMain/kotlin/chat/simplex/common/ui/UiTags.android.kt`, called from `SimplexApp`) sets it when the app is debuggable. Release builds never set it.
+- **Keys rule** (user, 2026-10-14; decision in 13): keys go only on elements a test acts on or must read, and there are no observation-only helpers. `Ui.UserPicker.Sheet` is the one presence-only key, because the Android user picker stays composed off screen. States without a key are read through the model (`contact.verified`, `chatInfo.incognito`, `draftChatId`, chat items), visible texts or existing content descriptions. Not built: typed semantics (4), `UiSemantics.kt`, `uiVolatile()`, the key lint (9.4).
+- **Pseudo-key `described(text)`** (`Helpers.kt`, id `@described`): matches a node with that content description and a click action, on both platforms. It replaces the planned `Ui.Modal.Back`.
+- **`ui/UiIdle.kt`**: in-flight items (id, label), `abandon`, `lastEventAt`; no counters. The hooks are thin wrappers:
+  - `sendCmd` runs as `UiIdle.track { withContext(Dispatchers.IO) { … } }`; the status polls `GetAgentSubsTotal` and `GetAgentServersSummary` are not tracked;
+  - the receiver wraps event processing in `UiIdle.trackEvent`;
+  - `withApi`/`withBGApi`/`withLongRunningApi` jobs are tracked until they complete, except those launched with `idle = false`: `PopChatCollector` (ChatModel.kt:827), `ProcessedErrors` (ProcessedErrors.kt:19), `createUpdateJob` (AppUpdater.kt:171).
+- Size: 56 modified app files (`commonMain`, `desktopMain`, `androidMain`, `SimplexApp.kt`; +380/−169 lines), plus the new `Ui.kt`, `UiIdle.kt` and `UiTags.android.kt`.
+
+### 0.5.3 Desktop harness (`common/src/desktopTest/kotlin/chat/simplex/app/ui/harness`)
+
+- **Per JVM** (`UiJvm`, `UiEnv`, `UiTestApp.bootJvm`):
+  - directory `<run>/jvm-<slot>-<pid>`, with `user.home` and `java.io.tmpdir` inside it;
+  - `bootJvm`: path check, `System.load(libapp-lib)` and `initHS`, English locale, `uiTestHooksEnabled = true`, a no-op `NtfManager` (records nothing), window state 1600 × 900, `runMigrations`, theme applied, toolbar blur 0, `PrefStores.capture`, `ModelSnapshot.capture`;
+  - the shutdown hook stops the core, the peers and `uitest-servers`, then destroys the remaining descendant processes.
+- **`uiTest { }`** (no parameters):
+  - runs `runInternalSkikoComposeUiTest(1600, 900, StandardTestDispatcher())` with `autoAdvance = false`, then the body, then `drain()` inside the scene;
+  - `finally`: two EDT flushes, `drain()`, `resetForTest(null)` if the test left no controller, peers stopped, and `<jvm>/t<n>` deleted after a pass only;
+  - the known-issue policy is in 0.5.8.
+- **`app(user)`** (`null` = onboarding boot) runs `resetForTest(user)` and composes `TestRoot { AppScreen() }`. `resetForTest`, in order:
+  1. `drain`;
+  2. stop the core (wait at most 10 s for `ctrlInitInProgress`, `stopChatAsync`, `chatCloseStore`, `setChatCtrl(null)`) and `deleteChatDatabaseFilesAndState()`;
+  3. `drain`, `PrefStores.restore`, `clearUiState`, `TestServers.start()` (once per JVM), `DbTemplate.installIfPresent`, `TestPrefs.preset()` (onboarded boots only);
+  4. `initChatController`; the first JVM without a template stops the core, publishes the template with an atomic rename and initialises again;
+  5. with a user: `apiCreateActiveUser`, model and onboarding stage set, `startChat`, `configureServers`, `setLastVersionDefault`, `clearTransientUi`.
+- **`restart()`**: empty composition; `restartCore` (`apiStopChat` if running, `chatRunning = null`, `chatCloseStore`, `setChatCtrl(null)`, `drain`, `clearUiState`, `initChatControllerOnStart`); compose again; poll (30 s) until `chatDbStatus != null` and init has finished.
+- **`TestRoot`**: an in-memory `LocalClipboardManager` and a recording `LocalUriHandler`.
+- **`poll(timeout = 10 s, what) { cond }`**:
+  - each iteration: `advanceTimeBy(16)`, `waitForIdle`, the condition, `Thread.sleep(16)`; a condition that throws counts as "not yet", and its last error goes into the timeout message;
+  - past the deadline it keeps waiting while any `UiIdle` item that was in flight at the deadline still is, up to 60 s more;
+  - a timeout writes `<run>/failures/<jvm>-NN-<what>.png` and reports the in-flight list and the first 60 visible texts;
+  - `settle()` advances 30 frames of 16 ms.
+- **Actions:**
+  - `click`: wait for the node; `scrollIntoView` (at most 10 `ScrollBy` steps: by the overflow plus 50 px, or 0.6 of a page for an unplaced node, then 40 frames); non-empty stable bounds; enabled; no open popup unless the target is inside one; `RequestFocus` and 3 frames; then a touch tap at `tapPointInNode` (`TapPoint.kt`: the centre, or the middle of the widest span no nested clickable covers, nested targets widened to 48 dp);
+  - `rightClick`: a mouse right click;
+  - `typeInto`: `performTextInput`, verified through `EditableText`; `enterText`: the same without verification;
+  - `replaceText`: select all, input, and `performTextReplacement` if the field doesn't hold the text after 2 s;
+  - `pressEnter`: the Enter key; `escape()`: 3 frames, then the window back stack;
+  - `scrollTo(key)`: pages each lazy list (`ScrollBy` 0.6 page, 40 frames, at most 20 pages) until the key appears; `performScrollTo*` is never used (15.4 item 20);
+  - `setSlider`: `SetProgress`.
+- **Reads:** `exists` (any match), `waitFor`, `textOf`, `textsOf`, `descriptionsOf`, `editableText`, `isEnabled`, `seesText`, `seesDescription`, `texts`, `sliderValue`, `storedSetting` (`settings.properties`), `clipboardText`. Lookups use keys or literal English text, not `MR.strings`.
+
+### 0.5.4 Android harness (`android/src/androidTest/java/chat/simplex/app/ui/harness`)
+
+- **`uiTest { }`** under `createEmptyComposeRule()`: a 300 s watchdog (thread dump to logcat, then `Process.killProcess`; the runner resumes), `bootOnce`, the body, then `finish()` (peers stopped, `Intents.release()` before `ActivityScenario.close()`, `drain`).
+- **`bootOnce`:**
+  - waits at most 180 s for the app's own startup, and rebuilds a fresh database if it has users (15.4 item 10a);
+  - decrypts it: `apiStopChat`, then `apiStorageEncryption(key → "")`; on failure it keeps the encrypted template and logs the error. decryption succeeds (verified in the final run, 15.4 item 25);
+  - saves the template to `dataDir/uitest-db-template` (an empty key file means decrypted);
+  - presets blur 0, `notificationsMode = OFF`, both background-service notices shown, `canAskToEnableNotifications = false`, `privacyProtectScreen = false`;
+  - `PrefStores.capture` (the two SharedPreferences stores and `themes.yaml`), `ModelSnapshot.capture`.
+- **`app(user)`**: `resetForTest` (stop, delete, `PrefStores.restore`, `CommonUiState.clear`, `TestPrefs`, template, init, user, `startChat`, servers from the bridge, `setLastVersionDefault`), then `ActivityScenario.launch(MainActivity)` with Espresso-Intents stubbing external intents.
+- **`restart()`**: `restartCore` first, then a poll (60 s) until chat runs with the user loaded, then close and relaunch the activity (15.4 item 10).
+- **`poll`**: `advanceTimeBy(48)`, `waitForIdle`, the condition, `sleep(50)`; the deadline extension, last error and message are as on desktop. Failure screenshots go through `UiAutomation` into the app's external files directory, and the runner pulls them. `settle()` is one 500 ms advance.
+- **Differences from desktop:**
+  - `click` uses `performScrollTo`, then centres the node in its `ScrollBy` parent;
+  - `rightClick` is a long press; `escape()` and `goBack()` press system Back (`Espresso.pressBack`);
+  - the message field (an `EditText`) is set with Espresso `replaceText`, retried every 2 s for up to 10 s, and read with a `ViewAssertion`; `pressEnter` on it clicks Send, elsewhere it sends the IME action;
+  - `scrollTo` uses `performScrollToNode`;
+  - `clipboardText` reads the last recorded intent's `EXTRA_TEXT` (inside `ACTION_CHOOSER` too), then the system clipboard;
+  - `Timing` logs `UITEST phase N ms: …` and `UITEST wait N ms: …` (waits of 500 ms or more) to logcat;
+  - there is no known-issue allowlist.
+
+### 0.5.5 Peers and the bridge
+
+- **`PeerLines`** (shared) holds the line buffer and all matching. The platform `CliPeer`s implement only `fill()` and `type()`.
+  - `sends` types the command, then consumes the first matching echo anywhere in the buffer (the command, or the sent item without its `HH:MM ` prefix);
+  - also `types`, `expects`, `expectsMessage`, `eventually`, `eventuallyMessage`, `eventuallyMatching`, `nextLine`, `contactId`, `pending`;
+  - line waits default to `LINE_TIMEOUT_MS` = 15 s; a timeout appends the next 10 buffered lines.
+- **Desktop `CliPeer`:**
+  - pty4j, 4000 × 50; `setpriv --pdeathsig KILL sh -c 'stty -echo -icanon; exec <cli> …'`;
+  - args `-d`, `--user-display-name`, `-s <smp1>`, plus `--reactions`, `--mark-read`, `--show-full-links` from `PeerFlags`;
+  - `HOME` = the peer directory `<jvm>/t<n>/peers/<name>`, `TMPDIR` inside it, `LC_ALL=C.UTF-8`, `TERM=xterm-256color`, working directory the repo root;
+  - the database is copied from `<run>/peer-template` on first start; `cli()` returns at once, and the first use waits at most 60 s for `Current user:` and the prompt;
+  - typing: write, wait until the input line equals the text (1.5 s unchanged window), else erase with DEL and retype (5 attempts); Enter, and Enter once more if the line still holds the text after 500 ms;
+  - `VtScreen` is the terminal model.
+- **Android `CliPeer`** talks to the host through `Bridge`: TCP `127.0.0.1:7777` (fixed, through `adb reverse`), a 60 s read timeout, one connection per instrumentation process.
+- **The bridge** (`UiBridge.kt`, in the desktop harness; the Android runner starts it as a host JVM) owns `TestServers` and desktop `CliPeer`s, serves one client at a time, and stops all peers when the client disconnects. Protocol, one line per command:
+  - `servers` → `ok <smp1> <xftp1>`;
+  - `start <name> <flags, comma-separated>` → `ok` once the peer has started;
+  - `type <name> <text>` → `ok`;
+  - `drain <name>` → `lines N`, then N lines;
+  - `stop <name>` → `ok`;
+  - any failure → `err <message>`.
+
+  Matching runs device-side in `PeerLines`. Bridge peer directories (`<bridge jvm>/bridge-peers/<nanoTime>-<name>`) are not deleted.
+
+### 0.5.6 Servers
+
+- `tests/UITestServers.hs` (cabal flag `uitest`, `exe:uitest-servers`) takes `<dir> <portBase>`, runs **`smp1` only** (persistent store, port base + 1), prints `ready smp1 smp://…@localhost:<port>` and exits on stdin EOF. It has no control protocol.
+- `TestServers`: 120 slots (`slot-<k>.lock` in the run directory), base 20000 + 100 k. It is spawned under `setpriv --pdeathsig KILL` from the test thread during the first reset (in the bridge, from its main thread).
+- `configureServers(smp, xftp)` disables the operator groups and adds a custom group with `smp1` and an `xftp1` address on base + 2 that **nothing serves**. Any XFTP test fails until P1b.
+
+### 0.5.7 Helpers and timeouts
+
+`Helpers.kt`:
+- `described`; `goBack()` (desktop clicks `described("Back")`, Android presses system Back);
+- `quiesce()`: no API in flight and no event for 1 s, bounded by 30 s;
+- `connect(peer)`: a GUI link from `apiAddContact`, joined by the peer; `connectPeers`, `hostGroup`, `CliPeer.createGroup`, `CliPeer.createOneTimeLink`;
+- `openContextMenu`: waits for no API in flight, settles, then right-clicks (Android: long press);
+- `joinGroupFromList`: opens the row, confirms, waits for the host's "joined" line and for `MemConnected`, then `quiesce`.
+
+`WhatsNewScreen.VERSION` reads the app's `lastVersion` by reflection.
+
+| Wait | Desktop | Android |
+|---|---|---|
+| `poll` default | 10 s, plus up to 60 s while the same API calls stay in flight | same |
+| Connections (`CONNECT_TIMEOUT_MS`) | 60 s | 60 s |
+| Peer line / peer start | 15 s / 60 s | 15 s / 60 s (in the bridge); bridge socket read 60 s |
+| `quiesce` / `drain` | 30 s / 30 s, then stuck items are abandoned | same |
+| `restart()` | 30 s | 60 s |
+| App startup in `bootOnce` | — | 180 s |
+| Hard timeout per test | 240 s: thread dump, `Runtime.halt(3)`; the JVM's remaining tests are lost (15.4 item 20) | 300 s: thread dump, process killed; the runner resumes |
+| Gradle task | 12 h | — |
+
+### 0.5.8 Known-issue policy (desktop)
+
+`KNOWN_APP_ISSUES` lists "Controller is not initialized" and "database closed" (15.5 item 3). When the scene runner throws:
+1. the coroutines-test wrappers (`UncaughtExceptionsBeforeTest`, `DiagnosticCoroutineContextException`) are dropped;
+2. if every remaining error matches somewhere in its cause chain and none is an `AssertionError`:
+   - a test whose body completed passes, logged as `UITEST known app issue, not failing the test`;
+   - a test whose body never started is retried (at most 3 attempts);
+   - a test whose body started but did not complete fails;
+3. any other error fails the test, with the suppressed errors listed.
+
+Android has no allowlist.
+
+### 0.5.9 Runners and Gradle
+
+**Desktop: `scripts/uitest.sh [gradle args]`.**
+- Refuses to start with less than 3000 MB `MemAvailable`. Takes `flock -n build/uitest/runner.lock`. Creates `build/uitest/run-<timestamp>` (with `jvmtmp` and `cache`) and keeps the newest 6 run directories.
+- Outside the namespace:
+  - `cabal build -O0 -f uitest --builddir=dist-uitest exe:simplex-chat exe:uitest-servers`, paths from `cabal list-bin`;
+  - in the background, the peer database template (`--maintenance -e /v -t 0`, accepted when the output says "no active user in maintenance mode");
+  - checks that the native libs are staged;
+  - `./gradlew -g .gradle/uitest-home --no-daemon :desktop:cmakeBuildAndCopy :common:desktopTestClasses :common:uitestPrepare`, then `--stop`; skipped when a fingerprint (build files, the cpp sources outside `libs`, `ls -l` of the staged libs except `libapp-lib.so`) matches `build/uitest/prepare.key`;
+  - writes `build/uitest/env.properties` (`libAppLib`, `runDir`, `repoRoot`, `cli`, `servers`).
+- Adds `-PuiForks=N`, N = (MemAvailable MB − 2500) / 1000 clamped to 1..4, unless `-PuiForks` is given.
+- Inside `unshare -rn --pid --fork --kill-child --mount-proc` (loopback up, multicast route): `./gradlew -g … --offline --no-daemon :common:desktopUiTest -PuiRunDir=<run> -PuiPass=1 <args>`. One pass. Every Gradle call uses `-Pkotlin.compiler.execution.strategy=in-process`.
+
+**`desktopUiTest`** (`common/build.gradle.kts`; a `KotlinJvmTest` that runs only with `SIMPLEX_UITEST_RUNNER=1`):
+- includes `chat/simplex/app/ui/**`, which `desktopTest` excludes;
+- `forkEvery` = `-PuiForkEvery`, default **0** (one JVM per fork runs many classes); `maxParallelForks` = `-PuiForks`; 2 GB heap; 12 h timeout; `-PuiAllowEmpty`;
+- environment: `XDG_DATA_HOME`, `XDG_CONFIG_HOME` and `FREETYPE_PROPERTIES` removed, `GSETTINGS_BACKEND=memory`, `XDG_CACHE_HOME=<run>/cache`;
+- JVM: `en_US`, UTC, `java.io.tmpdir=<run>/jvmtmp`, heap dump on OOM and `-XX:ErrorFile` crash logs into the run directory; headless, skiko, env and IO-parallelism properties;
+- `testLogging` with full exceptions and standard streams; results under `common/build/{test-results,reports/tests}/desktopUiTest/pass1`.
+
+`uitestPrepare` only resolves `desktopTestRuntimeClasspath`. `uitestBridgeClasspath` copies the harness classes to `build/uitest/bridge-classes` and writes `build/uitest/bridge.classpath`.
+
+**Android: `scripts/uitest-android.sh <app.apk> <androidTest.apk> [am instrument -e …]`.**
+- Requires a previous `scripts/uitest.sh` run (for `env.properties`, the CLI and `uitest-servers`) and 4500 MB `MemAvailable`.
+- Environment:
+  - `UITEST_SERIAL`: any adb device; Waydroid is then not used;
+  - `WD_INSTANCE` (default 2), `WD_OWNER` (default `uitest-$USER`);
+  - `UITEST_APP_ID` (default `chat.simplex.app.debug`);
+  - `ADB`, `JAVA_HOME` (defaults: `adb` from `ANDROID_HOME`/`ANDROID_SDK_ROOT` or `PATH`, `java` from `JAVA_HOME` or `PATH`).
+- Setup:
+  - rebuilds the bridge classpath only when one of its 7 sources is newer;
+  - claims the Waydroid instance and starts it in the background if needed;
+  - starts the bridge (`setsid java -cp … UiBridge 7777`) and kills it by `$!` on exit;
+  - installs the app APK unless its sha256 and `lastUpdateTime` match the stamp, and always the test APK;
+  - `adb reverse` for 7777, base + 1 and base + 2.
+- Each pass: `pm clear`, grants POST_NOTIFICATIONS, CAMERA and RECORD_AUDIO, then `am instrument -w -r`. After "Process crashed" it resumes with `-e notClass <finished tests>` (at most 4 passes).
+- Output in `build/uitest-android/run-<timestamp>/`:
+  - `results.txt`, one line per test, `<class>#<test> <code>`: 0 pass, −2 fail, −3/−4 skipped, or `crashed`;
+  - `instrument-<n>.txt`, `instrument.txt`, `logcat.txt` (`logcat -G 16M`), `timings.txt`, `failures/`, `bridge.log`.
+- The exit status is non-zero on any −2 or `crashed`, or when there are no results.
+- It does **not** run `wd.sh net isolate` (open item). The container keeps internet access during a run, and isolation rests on the local server configuration and on onboarding opening no connection.
+
+APKs: `ANDROID_TEST=1 bash ~/build/android.sh` (run in the worktree) builds the app APK and publishes the test APK next to it.
+
+### 0.5.10 How to run
+
+```sh
+cd apps/multiplatform
+scripts/uitest.sh                                   # all desktop tests
+scripts/uitest.sh --tests '*ChatListRowsTest*'      # one class (any Gradle test filter)
+scripts/uitest.sh -PuiForks=1 -PuiForkEvery=1       # serial, one JVM per class
+ANDROID_TEST=1 bash ~/build/android.sh              # app APK + androidTest APK
+scripts/uitest-android.sh <app.apk> <test.apk>      # all Android tests on Waydroid instance 2
+scripts/uitest-android.sh <app.apk> <test.apk> -e class chat.simplex.app.ui.main.ChatListRowsTest
+UITEST_SERIAL=<serial> scripts/uitest-android.sh <app.apk> <test.apk>   # another adb device
+```
+
+### 0.5.11 Design items not built yet (P1b+)
+
+| Design | Not built |
+|---|---|
+| 4, 5, 9.4 | typed semantics, keys everywhere, key lint: superseded for now by the minimal-app-code rule (13) |
+| 6 | the real-time clock target and input-lead correction (the loop advances a fixed 16 ms, Android 48 ms, so composition delays fire late in real time); the end-of-test dialog drain; closing alerts with Escape or by reflection (alerts are only dropped with `hideAllAlerts` at the next reset); the end-of-test `ctrlInitInProgress` wait; `setCatchNonTestRelatedExceptions(false)`, `UiUncaught`, `allowUncaught` and composition-error bookkeeping; JVM poisoning, the `Slow` category, the EDT probe and per-shot allowances (the hard timeout halts the JVM instead) |
+| 7.1, 7.1.1 | JUnit categories (`-PuiTags`, `-PuiExcludeTags`, `Smoke`, …); pinned fonts (`FONTCONFIG_FILE`); the `shots`, `shotTolerance`, `pass` and `strict` system properties; Kover and `uitestCoverageMerge`; `uitestPrepare` steps 2–4 (stable and fixture CLI downloads, migration lists) and the migration check; the second (`Multicast`) pass, the empty-run check, screenshot cleanup and coverage merge |
+| 7.2, 7.3 | fixtures (`app(…, fixture)`, `restart(fixture)`); `RecordingNtfManager`, `UiTestPlatform` and the seams of 11.2; deleting `dataDir/tmp`; the `CC.ShowVersion` check; the lock-screen restart path and the alert exit of the restart poll; the `changingActiveUserMutex` check, manual `migrationState` handling, and the `OnboardingSharedState`/`BadgeStore` roots |
+| 7.4, 7.5 | `UiDriver`/`UiNode`/`InProcessDriver`; `MR.strings` lookups and exactly-one matching; `hold`, `dragTo`, `hover`, `clickAtTextRange`, `press(key, modifiers)`, `wait(d)`, `composeField()` (placeholder); the report directory with semantics dump, peer tails and command log (only the failure PNG and the message exist) |
+| 7.6, 7.7, 7.8 | `UiFiles` dialog responders (pending dialogs are only completed empty at reset); `LocalClipboard`; a throwing URI handler; toast and notification recording; screenshots; coverage |
+| 8.1 | the Stable CLI and `CliVersion`; `--mute` (the D-Bus notification concern of 8.3 stands); `--xftp-server`; `$HOME/Downloads`; the start–stop–start cycle; the `! `/`> `/`\ ` typing rule; `PeerFlags.key`, `PeerServers`; `expectsAny`, `repeatUntil`; `stop`/`start`/`snapshot`/`restore` inside a test; `RelayPeer`; mobile hosts |
+| 8.2 | `xftp1` (configured but not served), `smp2`, `xftp2`, the names resolver, the control protocol, `restoreBaseline` |
+| 9.1–9.3 | `GuiUser`, `ChatRow` and the typed row classes; `uiTest(realTimes)`, `app(name, onboarded, fixture)`, `connect(gui, peer)`, `relay`, `mobileHost`, `servers`, `allowUncaught`, `screenshot`, `shouldHave`; the one-`app()`-per-test rule; `…CompatStableTest` subclasses |
+| 10.1 | `CatalogueTraceabilityTest`, stub generation, the catalogue in the repo; a traceability rule for the desktop-only (`chat.simplex.app.ui.desktop`) and Android-only (`chat.simplex.app.ui`, `chat.simplex.app.ui.back`) packages |
+| 11 | local HTTP and SOCKS stubs, committed media fixtures, multicast tests, server control, SQL fixtures |
+| Android | notification tests; the 10-run exit check; `wd.sh net isolate` in the runner; `testTagsAsResourceId` and `ui-test-manifest` (not needed by the instrumented layer); the debug network-security-config (approved, 13) |
+
+## Terms
+
+Paths are repo-relative. **C** = `apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common`, **D** = `apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common`, **A** = `apps/multiplatform/common/src/androidMain/kotlin/chat/simplex/common`, **Hs** = `src/Simplex/Chat`. Every `file:line` reference in the plan and the catalogue is to master at `d72f68e6d` (2026-10-10), checked out at `~/wt-uitest-ref`.
+
+- **Key** — a value of type `UiKey`: a dotted id plus an optional entity argument, e.g. `chatList.row` + `@12`. Rendered as one `testTag` string, `chatList.row[@12]`.
+- **Semantics node** — the unit Compose tests find and act on. `clickable`, `Button`, `IconButton`, `Switch`, `Tab`, `DropdownMenuItem` merge their children into one node.
+- **Driver** — the object that finds nodes and performs actions, backed by `SkikoComposeUiTest` (the scene runner's receiver, 7.2) in the test JVM.
+- **Screen object** — a Kotlin class for one screen whose methods are user actions and whose properties are what the screen shows.
+- **Peer** — a non-GUI user in a test: a CLI process driven by its terminal text, as in the Haskell tests (`CliPeer`, also used for remote-desktop mobile hosts).
+- **Relay** — a chat relay CLI process in headless mode (`RelayPeer`, 8.1); it has no terminal, only a log, and takes commands only through `run(cmd)`.
+- **Sub-area** — one `###` section of a catalogue file (e.g. 01 §7 "1-time link"); the `Area` column inside a section is finer and only labels rows.
+
+## 1. Goals and non-goals
+
+Goals:
+- Tests that read like the CLI tests and name what the user sees.
+- Stable lookups: by key or by `MR.strings` key, never by position or pixel.
+- Assertions on typed state (unread count, delivery status, item metadata, sender, verification, incognito, muted). (Deferred by the 2026-10-14 minimal-app-code rule, 13: states are read through the model, visible texts or content descriptions, 0.5.2.)
+- Version matrices: the GUI on the current build, peers on the current CLI or a stable release CLI.
+- Local runs: headless, no Xvfb, no display, no real network, deterministic waits, failure output with a semantics dump and a screenshot (no test assertion reads pixels; committed screenshots are compared outside the test logic, 7.7).
+
+Non-goals for this plan:
+- Badge display (see the decisions above).
+- A remote automation server, tests against real AppImages, and tests with two GUIs.
+- CI integration (tests run locally; a CI job can call the same runner script later).
+- Android-only UI (catalogue `05-android-only.md`) is a separate effort. The catalogue tests themselves run on Android too: since 2026-10-13 the Android harness shares screens, helpers and test bodies through `common/src/uiTestShared` (13, 0.5.4).
+- Pixel assertions inside tests: a test's own checks read semantics only; committed screenshots (7.7) are compared outside the test logic and fail a test only with `-PuiShots=verify`.
+
+The parts of the app that leave the process are tested up to their boundary: calls up to the browser launch (a `LocalUriHandler` stub records the call link), VLC playback and voice recording behind approved seams (11.2), OS notifications (recorded), file choosers (completed by the test). Tray and window chrome are not rendered. Sections 7.6 and 11 list each surface.
+
+## 2. Architecture
+
+(As built: see 0.5. Differs: no `UiDriver` layer, each platform has a `UiScope` with the same methods; no typed semantics; `uitest-servers` runs `smp1` only; no `RelayPeer`.)
+
+```
+runner script          uitest.sh: build + fetch outside, then Gradle inside a loopback-only network namespace
+  │
+tests (DSL)            uiTest { val alice = app("alice"); val bob = cli("bob") ... }   // peer version from peerVersion (10.1)
+  │
+screen objects         ChatListScreen, ChatRow, ChatScreen, NewChatSheet, ConnectPlanAlert, UserPickerScreen, ...
+  │
+UiDriver               node(key) / node(text) / nodes(matcher) → UiNode; input; poll; dump
+  │                    skiko test scene (manual clock) + real core over JNI, one GUI per test JVM
+app code               Modifier.ui(Ui.X.Y), semantics { unread = ... }    (keys + typed semantics)
+peers                  CliPeer: CLI binary under a pty, sends/expects on terminal lines (mobile hosts too); RelayPeer: headless relay
+servers                uitest-servers (SMP, second SMP, XFTP, second XFTP, names resolver), once per test JVM
+```
+
+## 3. Keys
+
+### 3.1 Type and modifier
+
+(As built: see 0.5.2. Differs: the flag is `uiTestHooksEnabled` and also gates `UiIdle`; Android sets it through `initUiTags(context)` in `A/ui/UiTags.android.kt`, called from `SimplexApp`; `Ui` holds only the keys tests use, with no `Ui.Alert.Title`, `Ui.Modal.Back` or `ModalPlacement` local; `described("Back")` replaces `Ui.Modal.Back`.)
+
+New file `C/ui/Ui.kt` (commonMain). The key code compiles into every build, but tags are emitted only in test and debug builds (decided 2026-10-12: test tags are for testing only): `Modifier.ui` is a no-op unless `uiTagsEnabled` is set, which the desktop harness does in `bootJvm` (the `desktopTest` source set sees `internal` members of `:common`) and, on Android, a new public common function called from `SimplexApp.initMultiplatform()` sets it when the app is debuggable (`ApplicationInfo.FLAG_DEBUGGABLE`, true for the `debug` build type unless `local.properties` sets `debuggable=false`, android/build.gradle.kts:56; `BuildConfig` belongs to the `:android` module, which can't set an `internal` var, and no existing common init has a `Context`); desktop release packages and Android release builds never set it.
+
+```kotlin
+@Immutable
+class UiKey(val id: String, val arg: Any? = null) {
+  val tag: String get() = if (arg == null) id else "$id[$arg]"
+  fun option(value: Any) = UiKey("$id.option", value)
+  fun part(name: String) = UiKey("$id.$name", arg)
+}
+
+@Volatile internal var uiTagsEnabled = false                     // set by the test harness (desktop) or a debug build (Android)
+fun Modifier.ui(key: UiKey?): Modifier = if (key == null || !uiTagsEnabled) this else testTag(key.tag)
+
+object Ui {
+  object ChatList {
+    val Bar = UiKey("chatList.bar")                                   // DefaultAppBar: title = Bar.part("title")
+    val List = UiKey("chatList.list"); val Search = UiKey("chatList.search"); val NewChat = UiKey("chatList.newChat")
+    val UserPicker = UiKey("chatList.userPicker")
+    fun Row(chatId: String, remoteHostId: Long? = null) = UiKey("chatList.row", rowArg(chatId, remoteHostId))
+    fun RowMenu(chatId: String, action: String, remoteHostId: Long? = null) = UiKey("chatList.row.menu.$action", rowArg(chatId, remoteHostId))
+    fun Tag(tag: Any) = UiKey("chatList.tag", tag)
+    private fun rowArg(chatId: String, rh: Long?) = if (rh == null) chatId else "$rh:$chatId"
+  }
+  object Chat {
+    val Items = UiKey("chat.items")
+    val Bar = UiKey("chat.bar"); val Info = UiKey("chat.info"); val Banner = UiKey("chat.banner")   // title (opens info) = Bar.part("title")
+    val Message = UiKey("chat.compose"); val Send = UiKey("chat.send"); val Attach = UiKey("chat.attach")
+    fun Item(itemId: Long) = UiKey("chat.item", itemId)
+    fun ItemMenu(itemId: Long, action: String) = UiKey("chat.item.menu.$action", itemId)
+    fun MemberAvatar(groupMemberId: Long) = UiKey("chat.memberAvatar", groupMemberId)
+  }
+  enum class AlertSource { Shared, PrivacySensitive }
+  object Alert {
+    fun Title(src: AlertSource) = UiKey("alert.title", src)
+    fun Confirm(src: AlertSource) = UiKey("alert.confirm", src)
+    fun Dismiss(src: AlertSource) = UiKey("alert.dismiss", src)
+    fun Option(src: AlertSource, name: String) = UiKey("alert.option.$name", src)
+  }
+  object Modal { fun Back(placement: ModalPlacement?) = UiKey("modal.back", placement) }
+  // ... one nested object per UI area (Search, Screen, NewChat, Share, UserPicker, Settings, Group, …)
+}
+```
+
+- **Typed, hierarchical, compile-checked.** A renamed key breaks the build of the test that uses it.
+- **Why not composable function names:** references to `@Composable` functions (`::SendMsgView`) don't compile, and the composable names in `sourceInformation` are stripped or unreliable after inlining.
+- **Release cost:** one volatile read per keyed modifier and no semantics property, because release builds never set `uiTagsEnabled` (above); in test and debug builds, one semantics property per keyed node (`testTag` isn't announced by screen readers).
+- **Naming rule:** `area.component[.part]` in camelCase. Entity keys always take the core id (`chat.id`, `cItem.id`, `groupMemberId`, `userId`), never a list index, except where no id exists (section 3.4). Lazy lists get a list key too (`Ui.ChatList.List`, `Ui.Chat.Items`), used by `scrollTo` (7.4).
+- **Two alert managers.** `AlertManager.shared` and `AlertManager.privacySensitive` both render (`privacySensitive` at C/App.kt:242, only when the user is authorized; `shared` at :255), each showing its last alert (C/views/helpers/AlertManager.kt:432). Alert keys therefore carry the manager.
+- **Modal placement.** `ModalManager(placement: ModalPlacement? = null)` (C/views/helpers/ModalView.kt:97): on Android every manager has placement `null`, and the floating terminal renders `ModalView` with no manager (D/DesktopApp.kt:219). The placement is provided as a CompositionLocal (default `null`) in `ModalManager.showInView()` (:201/:217, already composable and already wrapping each modal in a `CompositionLocalProvider`).
+
+### 3.2 Placement rule
+
+`Modifier.ui(key)` goes **on the same modifier chain as the `clickable`/`combinedClickable`/`toggleable`** (or on the component that owns the click, such as `ExposedDropdownMenuBox`), before it. A tag on a child of a merged node is hidden from the default (merged) tree, because testTag's merge policy keeps the parent's value (verified in ui 1.8.2). Examples: `SectionItemView` Row (C/views/helpers/Section.kt:213), `SimpleButtonFrame` (C/views/helpers/SimpleButton.kt:90), the bubble in `ChatItemView` (C/views/chat/item/ChatItemView.kt:327).
+
+### 3.3 Helper parameters (one edit keys many screens)
+
+Add `uiKey: UiKey? = null` (named `uiKey` because some helpers already have a parameter called `key`, e.g. `PassphraseField(key: MutableState<String>, …)`, C/views/database/DatabaseEncryptionView.kt:317) or a fixed internal key to these shared helpers. Site counts are approximate.
+
+| Helper | file:line | Sites | Key |
+|---|---|---|---|
+| `SectionItemView` (+ `WithoutMinPadding`, `LongClickable`, `SpaceBetween`) | C/views/helpers/Section.kt:198/221/236/264 | 274 / 7 / 5 / 28 | param |
+| `SectionItemWithValue`, `SectionViewSelectable(Cards)` | Section.kt:287/155/178 | 4 / 3 / 2 | param; options `key.option(value)` |
+| `SectionTextFooter` (AnnotatedString overload; the String overload at :314 delegates) | Section.kt:319-328 | ~100 | new `uiKey` param on its `Text`, so link spans in footers (SetSimplexNameView.kt:217) have a keyed ancestor (3.5, 9.4) |
+| `InfoRow` (read-only) / `InfoRowEllipsis` (clickable, via `SectionItemViewSpaceBetween`) | Section.kt:370/437 | 64 / 1 | param |
+| `SettingsActionItem`, `SettingsActionItemWithContent` | C/views/usersettings/SettingsView.kt:384/393 | 98 / 37 | param |
+| `SettingsPreferenceItem`, `PreferenceToggle(WithIcon)` | SettingsView.kt:423/437/453 | 23 / 11 / 6 | param, applied to the Switch (the row has no click) |
+| `SharedPreferenceToggle`, `SharedPreferenceToggleWithIcon` (2 overloads) | C/views/usersettings/CallSettings.kt:85/101/131 | 1 / 2 | param on both overloads (`SharedPreferenceRadioButton` :155 has no call sites) |
+| `DefaultSwitch` | C/views/helpers/DefaultSwitch.kt:14 | 24 | already has `modifier` |
+| `ExposedDropDownSettingRow` → `ExposedDropDownSetting`; `ExposedDropDownSettingWithIcon` | C/views/helpers/ExposedDropDownSettingRow.kt:156 → 25; :89 | 30 + 1 (Android only, CallView.android.kt:361) | key on `ExposedDropdownMenuBox` (:37-38, owns `onExpandedChange`); `DropdownMenuItem` :68 (and :133 in `…WithIcon`) = `key.option(value)` |
+| `IntSettingRow`, `TimeoutSettingRow` | C/views/usersettings/networkAndServers/AdvancedNetworkSettings.kt:436/495 | 5 / 6 | param + options |
+| `DropdownCustomTimePickerSettingRow` | C/views/helpers/CustomTimePicker.kt:83 | 2 | param |
+| `ItemAction` (5 overloads; all context menus) | ChatItemView.kt:1096/1116/1142/1170/1190 | 92 | param (no modifier today) |
+| `SimpleButton*` → `SimpleButtonFrame` | SimpleButton.kt:26/54/39/70 → 88 | 23 | param in the frame |
+| `NavigationButtonBack/Close/Menu`, `ShareButton` | C/views/helpers/DefaultTopAppBar.kt:128/137/155/146 | ~20 | fixed keys |
+| `ModalView` back button | C/views/helpers/ModalView.kt:59-61 | 60 + ~115 `showModal`/`showModalCloseable` | fixed `Ui.Modal.Back(placement)` from the CompositionLocal of 3.1 |
+| `DefaultAppBar` title / search | DefaultTopAppBar.kt:24 (:39, :84) | 10 | param `uiKey` (the screen's bar, e.g. `Ui.ChatList.Bar`, `Ui.Chat.Bar`; the chat list and the chat are shown side by side, ChatListView.kt:612, ChatView.kt:1443), title and search = `uiKey.part("title"/"search")`; trailing `buttons` keyed at call sites |
+| `AppBarTitle` | C/views/helpers/AppBarTitle.kt:20 | 111 | `Ui.Screen.X` screen-root key, param |
+| AlertManager built-in buttons | C/views/helpers/AlertManager.kt:155/159, 196/200, 239/244, 400/408/415, title 441 | ~440 alert calls | fixed `Ui.Alert.*(source)` from the rendering manager (3.1) |
+| `TextEditor` / `PlainTextEditor` | C/views/helpers/TextEditor.kt:29/108 | 8 / 2 | `TextEditor` has `modifier`; `PlainTextEditor` gets the param |
+| `DefaultBasicTextField`, `DefaultConfigurableTextField`, `PassphraseField` | C/views/helpers/DefaultBasicTextField.kt:30/115 (+ reveal button :189); DatabaseEncryptionView.kt:317 | 9 / 11 | through their `modifier` (applied to the text field; PassphraseField's at :357); reveal = `key.part("reveal")` |
+| `PlatformTextField` (compose message field) | C/platform/PlatformTextField.kt:12; desktop actual D/platform/PlatformTextField.desktop.kt:44-58 | 1 | the expect/actual signature gets the param (the desktop actual has no `modifier`); fixed `Ui.Chat.Message` |
+| `SearchTextField` | C/views/helpers/SearchTextField.kt:32 (clear :122) | 5 | param `uiKey`, clear = `uiKey.part("clear")`: the chat list passes `Ui.ChatList.Search` (ChatListView.kt:799), the other direct callers their screen's key (GroupChatInfoView.kt:1390, AddGroupMembersView.kt:217, NewChatSheet.kt:494), `DefaultAppBar` its own `uiKey.part("search")`; a fixed key would match twice while the chat list and an end-pane screen are both shown |
+| `ProfileNameField` | C/views/WelcomeView.kt:415 | 13 | param |
+| `OnboardingActionButton` (expect :187 + 2 actuals, and :190), `TextButtonBelowOnboardingButton` | C/views/onboarding/SimpleXInfo.kt:187/190/223 | 25 / 11 | :190 already has `modifier`; the expect overload and :223 get the param |
+| `InfoViewActionButton` | C/views/chat/ChatInfoView.kt:1061 | 13 | param |
+| `ActionButton` (2) | C/views/newchat/NewChatSheet.kt:785/828 | 10 | param |
+| `OpenChatButton` | C/views/chat/group/GroupMemberInfoView.kt:879 | 3 | param |
+| `UserPickerOptionRow`, `UserProfilePickerItem`, `DevicePickerRow` | C/views/chatlist/UserPicker.kt:483/399/493 | few | param (entity: userId / remoteHostId) |
+| `ChatListNavLinkLayout` (expect + 2 actuals) | C/views/chatlist/ChatListNavLinkView.kt:1027; android actual :14 (combinedClickable :26); desktop actual :28 (combinedClickable :39) | 8 | param, passed `Ui.ChatList.Row(chat.id, chat.remoteHostId)` |
+| `ChatItemView` bubble | ChatItemView.kt:69 (:327) | 4 | `Ui.Chat.Item(cItem.id)` |
+| `SendMsgButton` | C/views/chat/SendMsgView.kt:452 (:466) | 3 (:136/:246/:256) | fixed `Ui.Chat.Send` |
+| `SelectableCard` | C/views/onboarding/SetNotificationsMode.kt:68/73 | 5 | `key.option(value)` |
+
+Exception: `showAlertDialogButtons(Column)` takes caller-built buttons (44 calls in 25 files, built from `SectionItemView`, `TextButton` and small helper buttons; e.g. C/views/newchat/ConnectPlan.kt:463, :567, :599). Those are keyed at the call site with `Ui.Alert.Option(source, name)`.
+
+### 3.4 Entity keys
+
+| Key | Emitted at | Id |
+|---|---|---|
+| `ChatList.Row(chatId, remoteHostId)` + row menu | C/views/chatlist/ChatListView.kt:1099 → ChatListNavLinkView.kt:67-164; menu :278-640 | `chat.id` (`@12`, `#5`) and `chat.remoteHostId` |
+| `NewChat.Contact(chatId)` | NewChatSheet.kt:341/430/752 → C/views/contacts/ContactListNavView.kt:47/107 | `chat.id` (also add LazyList keys there) |
+| `Share.Row(chatId)` | C/views/chatlist/ShareListView.kt:213 | `chat.id` (add LazyList key) |
+| `ChatList.Tag(id)` | ChatListView.kt:1295-1318; C/views/chatlist/TagListView.kt:100/115 | `PresetTagKind` / `chatTagId` |
+| `Chat.Item(itemId)` (+ reactions, select) | C/views/chat/ChatView.kt:2398 → :1922 → ChatItemView.kt:327; reactions :143/195/363; select overlay ChatView.kt:2236 | `cItem.id`; merged groups `merged.newest().item.id` |
+| `Chat.MemberAvatar(groupMemberId)` | ChatView.kt:2086 | `groupMemberId` |
+| Members (info list, channel members, support, mentions, relays, delivery) | C/views/chat/group/GroupChatInfoView.kt:778/1099; ChannelMembersView.kt:115; MemberSupportView.kt:131; C/views/chat/group/GroupMentions.kt:226; ChannelRelaysView.kt:79; C/views/chat/ChatItemInfoView.kt:430 | `groupMemberId` |
+| Add-members contacts | C/views/chat/group/AddGroupMembersView.kt:310/321 | `contact.apiId` |
+| Relays | C/views/newchat/AddChannelView.kt:452/545; AddGroupRelayView.kt:138; C/views/chat/ComposeView.kt:1961/2070; chat-relay lists ProtocolServersView.kt:92, OperatorView.kt:247 | `groupRelayId` (AddChannelView), `relayId` (AddGroupRelayView), `groupMemberId` (ComposeView :2070 iterates `GroupMember`), relay id or address (settings lists) |
+| User profiles | UserPicker.kt:399 (android :55/81, desktop :47-54); C/views/usersettings/UserProfilesView.kt:177; ComposeContextProfilePickerView.kt:260; C/views/newchat/NewChatView.kt:443/452 | `userId` (add LazyList keys at NewChatView.kt:443/452) |
+| Remote hosts / controllers | UserPicker.kt:533/493; C/views/remote/ConnectDesktopView.kt:420 | `remoteHostId` / `remoteCtrlId` |
+| Operators | C/views/usersettings/networkAndServers/NetworkAndServers.kt:215/674; onboarding ChooseServerOperators.kt:211 | `operatorId` |
+| Servers | ProtocolServersView.kt:105/139; OperatorView.kt:335-452 | server address (ids are null for unsaved servers) |
+| Commands, versions, wallpapers, tabs, image previews | CommandsMenuView.kt:231; ChatItemInfoView.kt:327; Appearance.kt:398; NewChatView.kt:136; ComposeImageView.kt:35 | command label (menus have no keyword) / version index / enum / index (add LazyList keys at Appearance.kt:398 and ComposeImageView.kt:35) |
+| Badges ledger, pay, level | C/views/badges/BadgesLedgerView.kt:83, BadgesPayView.kt:148, BadgesYourLevelView.kt:125 (pay and level are unreachable today, 9.4) | `entryId` / period / level |
+
+### 3.5 Controls that need more than a click on a keyed node
+
+- **Links inside messages.** `ClickableText` (C/views/chat/item/TextItemView.kt:426) handles clicks with `pointerInput`, so links have no click semantics. `UiNode.clickAtTextRange(range)` reads the text node's `GetTextLayoutResult` (in the unmerged tree), computes the bounding box of the link's characters and clicks there. No app change. Texts built with `withLink(LinkAnnotation.Url…)` (e.g. the Wefunder link, WhatsNewView.kt:1210; SetSimplexNameView.kt:217) are different: Compose 1.8.2 gives each link span its own child node with `OnClick` and `LinkTestMarker`, which no `Modifier.ui` reaches, so tests click it as the `LinkTestMarker` child of the keyed `Text` with `performClick`; the Wefunder `Text` gets its key at its call site, and footer links get theirs through `SectionTextFooter`'s `uiKey` (3.3).
+- **Voice record press-and-hold** (SendMsgView.kt:418): hold-versus-tap is decided by wall-clock time (`firstTapTime + 1000L < System.currentTimeMillis()`, GestureDetector.kt:265-267), so `UiNode.hold(1.2.seconds)` presses on the node (`performMouseInput { moveTo(center); press() }`; a new injection otherwise presses where the previous one left the pointer, InputDispatcher.kt:145-153), waits 1.2 s of real time through the polling loop of section 6 (so the Compose clock advances and the press interaction progresses; a plain `Thread.sleep` would freeze composition), and releases (with the recorder seam of 11.2).
+- **Long-press and right-click menus:** `longClick()` / `rightClick()` on the keyed row.
+- **Keyboard:** `press(key, modifiers)` sends key events to the focused node (Enter, Shift+Enter, Up, Escape, Ctrl+C/V, digits, Backspace).
+- **Drag and hover:** `dragTo(other)` (text selection between items, list reordering) and `hover()` (hover-only buttons) use `performMouseInput`.
+- The selection toolbars (C/views/chat/group/GroupMembersToolbar.kt, C/views/chat/SelectableChatItemToolbars.kt) use plain `IconButton`s (GroupMembersToolbar.kt:62/71/80, SelectableChatItemToolbars.kt:95/104/113); the `pointerInput` at :54/:87 only swallows background gestures. They are keyed like any button.
+
+## 4. Typed semantics
+
+(As built: not built. Superseded for now by the 2026-10-14 minimal-app-code rule (13); tests read these states through the model, visible texts or content descriptions, 0.5.2.)
+
+New file `C/ui/UiSemantics.kt` (its properties are set only when `uiTagsEnabled`, like the tags of 3.1):
+
+```kotlin
+val UnreadKey = SemanticsPropertyKey<UiUnread>("SimplexUnread")
+var SemanticsPropertyReceiver.unread by UnreadKey
+data class UiUnread(val count: Int, val mentions: Int, val unreadChat: Boolean)
+
+val ItemMetaKey = SemanticsPropertyKey<UiItemMeta>("SimplexItemMeta")
+data class UiItemMeta(val status: String, val sentViaProxy: Boolean?, val encrypted: Boolean?, val signed: Boolean?, val timedTtl: Int?, val edited: Boolean, val live: Boolean)
+
+val SenderKey = SemanticsPropertyKey<String>("SimplexSender")   // display name of a group item's sender, on every item, not only the first of a run
+// likewise: VerifiedKey, IncognitoKey, MutedKey(ntfsMode), FavoriteKey, SelectedKey, FileStatusKey(CIFileStatus kind), SubStatusKey
+
+val VolatileKey = SemanticsPropertyKey<Boolean>("SimplexVolatile", mergePolicy = { parent, _ -> parent })   // content that changes every run (durations, QR codes, links, codes; displayed times come from the display clock); masked in screenshot comparison (7.7); set on the volatile child and not merged into its row or item
+fun Modifier.uiVolatile() = if (!uiTagsEnabled) this else semantics { set(VolatileKey, true) }
+```
+
+Each property is set on the **merged node that carries the key**, not on the child icon, so one lookup returns the row or item with all its state:
+
+| State | Rendered at | Set on |
+|---|---|---|
+| Unread / mentions / unread mark | C/views/chatlist/ChatPreviewView.kt:461-500, `UnreadBadge` :591; UserPicker.kt:639 | `ChatList.Row`, user rows |
+| Muted, favorite | ChatPreviewView.kt:502-521 | `ChatList.Row` |
+| Incognito | ChatPreviewView.kt:557, ChatInfoImage.kt:59, ContactPreviewView.kt:145 | rows, info headers |
+| Verified | ChatPreviewView.kt:97; ChatView.kt:1742; ChatInfoView.kt:737; GroupMemberInfoView.kt:775; VerifyCodeView.kt:67-69 (in the `Row` at :66) | rows, title, info headers, the security code screen's status `Row` (VerifyCodeView.kt:66-72; it has no click, so it gets its own read-only key `Ui.VerifyCode.status` with `mergeDescendants`, area K3) |
+| Item status, sent via proxy, encrypted, signed, timed, edited | C/views/chat/item/CIMetaView.kt:69-125 | `Chat.Item` (`ItemMetaKey`) |
+| Live message | C/views/chat/item/FramedItemView.kt:287, TextItemView.kt:176-183 | `Chat.Item` (`ItemMetaKey.live`) |
+| Group sender | ChatView.kt:2039/2097 (drawn outside the bubble, only on the first item of a run) | `Chat.Item` (`SenderKey`) |
+| File status | CIFileView.kt:139-177, CIImageView.kt:73-98, CIVideoView.kt:498-561 | `Chat.Item` |
+| Subscription status | C/views/helpers/SubscriptionStatusIcon.kt:12, ChatView.kt:1635 | indicator node |
+| Selected / current | `ChatListNavLinkLayout(selectedChat)`, UserPicker.kt:425, TagListView.kt:153 | row |
+
+Matchers in the test library are `SemanticsMatcher`s over these properties: `unread(n)`, `itemStatus("sent")` (the `UiItemMeta.status` string; e.g. `sent`, `delivered`, `error`), `edited()`, `sender(name)`, `verified()`, `incognito()`, `hasTagPrefix(prefix)`, ...
+
+## 5. Rollout of keys ("everywhere")
+
+(As built: not followed. Superseded for now by the 2026-10-14 minimal-app-code rule (13): keys only on elements tests act on or must read, 0.5.2.)
+
+### 5.1 Size
+
+The helpers of 3.3 have about 1,000 call sites (the inventory counted 776 interactive ones, excluding `InfoRow` and `AppBarTitle`). Ad-hoc `clickable`/`IconButton`/`TextButton`/`Button` sites: about 300 in about 100 files of commonMain and desktopMain. In total about 190 files are touched. Keying the helpers reaches about 70% of interaction sites.
+
+### 5.2 Key areas
+
+This is a map of where keys go, not a PR sequence; PRs follow the phases of section 12 (one PR per catalogue sub-area, carrying the keys that sub-area's tests need). The file counts are rough and overlap.
+
+| Area | Scope | Files (approx.) |
+|---|---|---|
+| K0 | `Ui.kt`, `UiSemantics.kt`, `Modifier.ui`, `UiIdle.kt` and its hooks (6; pending confirmation, 13); every helper parameter of 3.3; fixed keys in AlertManager, ModalView (+ placement local), the DefaultTopAppBar navigation and share buttons, PlatformTextField, `SendMsgButton` (`Ui.Chat.Send`); `uiKey` parameters on DefaultAppBar and SearchTextField; `uiVolatile()` (7.7) on QRCode, the invitation/address link and security-code texts, ServersSummaryView statistics, call and voice durations, server addresses with ports, link-preview URLs, multi-relay lists, incognito profile names, the remote pairing port field and session codes (desktop and Android), the pasted desktop invitation (Android), the chat console's line list, the "Message queue info" alert (a volatile-text parameter on `showAlertMsg`), the chat-relay address editor, the live-message send-button pulse, the typing indicator and animated images; the display-clock seam (11.2) in ChatModel.kt's time formatters, `FloatingDate`, the grouping check and the SimpleX-name sale countdown | ~30 |
+| K1 | Chat list, user picker, new chat sheet, paste link, connect plan alerts; unread/muted/incognito semantics on rows | ~15 |
+| K2 | Chat view: toolbar (ChatView.kt:1194-1433), items + item menus, compose/send/attach (ComposeView, SendMsgView, Compose*View, ContextItemView, CommandsMenuView, GroupMentions, SelectableChatItemToolbars), item info; item meta, sender and file semantics | ~30 |
+| K3 | Chat/contact/group/member info, member lists, add members, preferences, verify code, group/channel creation and links, relays | ~25 |
+| K4 | Address screens, settings tree (SettingsView, profiles, privacy, appearance, network and servers, operators, calls, developer, database, migration), badges screens | ~60 |
+| K5 | Onboarding (SimpleXInfo, WelcomeView, ChooseServerOperators, YourNetwork, WhatsNewView), remote desktop link, misc | ~20 |
+
+Ad-hoc sites with many raw clickables to key directly (from the inventory): ChatListView.kt (20: FAB 480, toolbar 531/547/586/706/750, tag chips 1212-1474), ChatView.kt toolbar and FABs (1242-1433, 2850/3266/3284), ChatItemView.kt (195/270/363), item views (CIVoiceView 267/305/351, CIVideoView 322-465, CIImageView 112-147, CIFileView 193, FramedItemView 126/294/405), SendMsgView.kt (316, 376-418, 439, 466, 504), ComposeView.kt (1285, 1319, 1562, 2119/2144), WhatsNewView.kt (13 sites), Appearance.kt (9), UserProfileView.kt (6), NewChatView.kt (136, 218-253, 589/612, 719, 751/758), OperatorView.kt (528-858), YourNetwork.kt (`ConfigureRoutersButton`, :172-177).
+
+## 6. Synchronization (no sleeps, no hangs)
+
+(As built: see 0.5.2–0.5.4, 0.5.7, 0.5.8. Differs: each poll iteration advances a fixed 16 ms (Android 48 ms) with no real-time target or input-lead correction, so composition delays fire late in real time; the `sendCmd` item wraps the `withContext(Dispatchers.IO)` block instead of sitting inside it; no end-of-test dialog drain, no Escape or reflection closing of alerts (they are dropped by `hideAllAlerts` at the next reset), no change to the coroutines-test collector and no `UiUncaught`; known app errors follow 0.5.8; the hard timeout is 240 s then `Runtime.halt(3)` (Android 300 s, process killed, runner resumes), with no poisoning, `Slow` category or EDT probe.)
+
+**Manual clock, one polling loop.** Each test runs with `mainClock.autoAdvance = false`. The driver has one loop, `poll(what, timeout) { condition }`: sleep about 16 ms of real time, advance the Compose clock towards real time, evaluate the condition; repeat until it holds or the deadline passes. Every lookup, assertion and peer `expects` goes through it, and so does every wait inside an input action (`hold`, 3.5). The only fixed wait is `wait(d)` (7.4), the same loop running for `d` of real time with no condition, used only where a catalogue row names the interval (for example "retry more than 3 s after the failure").
+
+- **Clock target.** `advanceTimeBy` rounds up to whole 16 ms frames (AbstractMainTestClock.kt:44) and input injection advances the clock as well, so advancing by each iteration's elapsed time would run the clock ahead of real time (up to about 2×). The loop instead keeps `target = clockAtTestStart + realTimeSinceTestStart` and advances by `target - mainClock.currentTime` when that is positive and otherwise by 0, with `ignoreFrameDuration = true` (an advance by 0 still runs the test scheduler's current tasks, which with the `StandardTestDispatcher`, 14, run inside `advanceScheduler` — a render runs the scene's own flush queue — and the closing `runTest`; the advance renders no frame); input injection advances the clock by each event's time (InputDispatcher.skiko.kt:246-259; a `longClick` advances the long-press timeout + 100 ms, MouseInjectionScope.kt:395), so after each input action the driver adds the clock's lead over the loop's target (`mainClock.currentTime - target`, which excludes what settle loops already added) to `clockAtTestStart`, as screenshot settle loops do for what they advance (7.7) — otherwise no frame renders until real time catches up (measured: state written after a `longClick` appeared after about 0.6 s instead of 17–21 ms); virtual time may lag the target but never leads it after these corrections (input leads: about 60–76 ms per click, 50 ms per key press, 600 ms per `longClick`; `performTextInput` doesn't move the clock): a settle loop advances the clock by whole seconds and then adds what it advanced to `clockAtTestStart`, so the loop continues from there instead of freezing until real time catches up, and from then on runs that far (up to about 11 s per shot) ahead of real time, as it does by the input leads added after each action; composition delays pending at a shot therefore fire early. Each advance is capped (e.g. 100 ms per iteration), so if rendering a frame costs more than real time the clock lags instead of starving the EDT (P1 measures the render cost, 14).
+
+- The app's work outside Compose (core threads, receiver loop, EDT jobs, `withBGApi` executor) runs in real time anyway; advancing the clock by the real elapsed time keeps composition-scoped delays and animations (the live-message update loop `delay(3000)`, SendMsgView.kt:545-550; toast timers; the 1 s status polls) in step with it.
+- With `autoAdvance = false`, Compose's own `waitForIdle` returns as soon as layout is done (it ignores idling resources and infinite animations), so no animation loop can block a test — neither indeterminate spinners nor the finite animations restarted in a loop (SendMsgView.kt:534-544), nor the `delay` loops (TextItemView.kt:176-183, the call timer ChatView.kt:1264-1268). Progress screens can be asserted while their command runs.
+- The EDT (`withApi`, `withContext(Dispatchers.Main)`; on desktop `Dispatchers.Main` is kotlinx-coroutines-swing, which posts with `invokeLater`) is not part of the Compose clock; the polling loop simply waits for the condition.
+
+**`UiIdle` (busy tracking).** A commonMain object, always on, records each in-flight item with its start time:
+- core commands in `ChatController.sendCmd` (C/model/SimpleXAPI.kt:936-958), added before and removed in `finally`, both inside its `withContext(Dispatchers.IO)` block (:939-957): a composition coroutine's continuation dispatched after the scene's closing `runTest` never runs with the `StandardTestDispatcher` (14), so a `finally` outside that block could leave the item in flight; the periodic status polls (`GetAgentSubsTotal`, ChatListView.kt:683-692; `GetAgentServersSummary`, ServersSummaryView.kt:706-722) are excluded by command type, not by the `log` flag (user commands such as badge redemption also use `log = false`, SimpleXAPI.kt:580);
+- events in `startReceiver` (SimpleXAPI.kt:782-831): added when `recvMsg` returns an event (:805), removed in `finally` after `processReceivedMsg` and `trySend` (which run inside `withTimeoutOrNull`, :808-811, with exceptions caught at :823-828); processed events are also counted, with the time of the last one, and items started and finished are counted, for the screenshot quiet wait and settle check (7.7);
+- jobs started by `withBGApi`/`withLongRunningApi`/`withApi` (C/views/helpers/Utils.kt:34-49), added on launch and removed on completion. `withLongRunningApi` gets a parameter `idle: Boolean = true`; jobs that never end, or that wait long and are cancelled by the reset, pass `idle = false`: `PopChatCollector.init` (C/model/ChatModel.kt:827; one collector per `ChatsContext`) and the app-update checker `createUpdateJob` (D/views/helpers/AppUpdater.kt:170-176, which re-launches itself after `delay(24 h)`; its `withLongRunningApi` call at :171 is the one site to mark; reached only through `setupUpdateChecker()`, which desktop `main` calls and `bootJvm` doesn't, so the mark only guards a test that starts it), and the agent-error alert timer of `ProcessedErrors` (C/views/helpers/ProcessedErrors.kt:19, which can wait up to 60 s and is cancelled by the reset, 7.3).
+
+Coroutines launched outside these helpers are not tracked (e.g. the 1 s delayed secondary-chat close, SimpleXAPI.kt:3271-3277, attachment processing, ComposeView.kt:299/310/457, and the file dialogs awaited in composition-scoped coroutines: the attach pickers, ComposeView.desktop.kt:24-38, and the QR save's first dialog, QRCode.kt:91-94); waits on their effects are ordinary polled assertions.
+
+It is used in four ways:
+- an assertion's deadline (default 10 s) is extended while any item that was already in flight at the original deadline is still in flight, up to the original deadline + 60 s, so legitimately long commands (export of a 1 GB file, a 30 s SOCKS timeout) don't make waits expire while a stream of short receiver events can't keep a failing wait alive; tests that wait longer pass an explicit timeout;
+- `drain()` waits until nothing is in flight (at most 30 s) before a reset; items still in flight when it gives up are listed in the log and marked abandoned, and abandoned items are ignored from then on by every use of "in flight" (later drains, the deadline extension, the end-of-test dialog poll, the screenshot quiet wait and settle check, 7.7), so a stuck job costs one reset, not every reset or shot in the JVM;
+- the failure report lists what was in flight;
+- screenshots wait for it to be quiet (nothing in flight, no event processed for 1 s) before settling, and the settle check requires nothing in flight at the second of two equal captures and nothing started, finished or processed between them (7.7).
+
+**End of each test.** After a passing body of a catalogue test, `uiTest` first drains file dialogs in passes of at most 5: each pass runs `waitForIdle`, then polls (at most 10 s, like the quiet wait of 7.7) until some `DialogState` is pending or UiIdle has nothing in flight, then completes every pending `DialogState` with an empty result (as below); it stops after a pass that completed none (measured with the QR flow ending after `respondSave(<dir>)`: passes completed 1 then 0, and the end-of-test shot was quiet and settled, 10 of 10; without the poll the first pass completed none, the second dialog opened afterwards, and the shot was `unquiet` and `unsettled`, 10 of 10). The poll is needed because a dialog the body answered last can open the next one only after a `waitForIdle` resumes its waiter, and then from a `Dispatchers.Default` job (e.g. `respondSave(<dir>)` on the QR save's folder dialog, 7.6: `shareFile` runs in `withLongRunningApi`, Utils.kt:46-49, Share.desktop.kt:26); the drain's own empty results open no further dialog (`saveTempImageUncompressed` returns null, Utils.desktop.kt:240-241, and QRCode.kt:95-96 shares only a file). A dialog awaited from a tracked job keeps that job in flight (`withLongRunningApi`, e.g. CIFileView.kt:109-117), so 7.7's quiet wait and settle check could never succeed while it is open; the attach pickers (ComposeView.desktop.kt:24-38) and the QR save's first dialog (QRCode.kt:91-94) wait in composition-scoped coroutines, which aren't tracked. File choosers are native windows that the shot doesn't show either way. Then the end-of-test screenshot is captured (7.7; not in `REALTIME` tests or with `-PuiShots=off`), and written only once the test has passed. Then, while the scene still exists, `uiTest` (in `finally`, so also after a failing body) closes what would otherwise leave coroutines waiting forever: it completes every pending `DialogState` with an empty result (completing the captured deferred, so a dialog that completes in between causes no `NullPointerException`) (null, or an empty list for `openMultipleDialog`, DesktopApp.kt:274; file choosers, 7.6; `clearTransientUi`, 7.3), then sends Escape to each dialog root until the rendered alert managers show no alert (alerts in a manager that isn't rendered go to the reflection path below) (at most 10 tries), which runs each alert's `onDismissRequest` and so completes the deferreds and continuations behind it (e.g. "Start chat?", `showStartChatAfterRestartAlert`, Core.kt:226-235; the retry alert of `sendCmdWithRetry`, SimpleXAPI.kt:842-869). `hideAllAlerts` alone only drops the composables (AlertManager.kt:48-50) and would leave `initChatController` waiting with `ctrlInitInProgress` set. An alert that remains after the tries is reported and fails the test. After the alerts are closed (by Escape or by the reflection path below), a plain loop — not `poll` — waits at most 10 s, as the reset does (7.2), for `ctrlInitInProgress` to clear (closing "Start chat?" only completes its deferred; initialisation then still loads the user's data before clearing the flag, Core.kt:170-188); if it is still set then, the JVM is poisoned (below).
+
+**Uncaught errors in app coroutines.** The scene runner (`runInternalSkikoComposeUiTest`, 7.2, 14; `runDesktopComposeUiTest` goes through the same `withScene`) ends with `testScope.runTest { }` (`TestScope` at ComposeUiTest.skiko.kt:155, `runTest` at :201), and kotlinx-coroutines-test 1.8.0 (the version ui-test-desktop 1.8.2 brings) from the first `runTest` on keeps a JVM-wide exception collector enabled (`catchNonTestRelatedExceptions` is `true`): an unhandled error in any coroutine — the app's `withBGApi`/`withLongRunningApi`/`withApi` jobs catch nothing (C/views/helpers/Utils.kt:36-49), and about 36 API wrappers in SimpleXAPI.kt throw, as does `sendCmd` while the controller is null (:937) — is queued and thrown by the next `runTest`, from `withScene`'s `finally` — the same test's when it happens before its scene closes (body or end-of-test cleanup; as `UncaughtExceptionsBeforeTest`, replacing the test's own assertion error), the following test's when it happens after (reset). `bootJvm` therefore turns the collector off (`TestScopeKt.setCatchNonTestRelatedExceptions(false)`, public in the bytecode but internal in Kotlin, so called by reflection; it must run before any `runTest`, since once the collector is enabled it stays on and a later change makes every `runTest` fail its own check) and installs its own `Thread.setDefaultUncaughtExceptionHandler` (the desktop app installs none: `registerGlobalErrorHandler`, C/platform/UI.kt:20-22, is called only on Android, and window crashes go to `showApp`'s `WindowExceptionHandler`, D/DesktopApp.kt:42-43, which isn't rendered here). The handler records each error with its phase; where the `UiIdle` launch hook exists (6), an error from a job is attributed to the test and phase that launched it, so a job abandoned by `drain` can't fail a later test. An error during the test body fails that test at its end (its own assertion error, if any, stays the cause and the recorded errors are added as suppressed exceptions; a test that expects one wraps the step in `allowUncaught(T::class) { … }`, 9.2, which polls (6) until an error of type `T` is recorded, consumes it, and fails if none arrives — the error usually comes from a job on another thread after the click returns); an error during a reset, a restart or the end of a test is written to the run log (and to the failure report if the test fails) without failing any test.
+
+Errors in composition-scoped coroutines (`LaunchedEffect`, `rememberCoroutineScope().launch`, e.g. VersionInfoView.kt:29-31 calls `sendCmd`, which throws while the controller is null) don't reach that handler: they go to the scene's own handler and are rethrown by the next `waitForIdle` (ComposeUiTest.skiko.kt:270-279), behind every node lookup (`getRoots`, :378-380), and by `withScene`'s `finally` (:202). `throwUncaught` clears what it throws (UncaughtExceptionHandler.kt:72-79), so whoever catches one owns it. They always fail the test, whatever phase they surface in: each `poll` iteration first calls `waitForIdle()` on its own and treats any throwable from it, except `InterruptedException` (the watchdog's, rethrown), as a composition error (so one that happens to be an `AssertionError` is not mistaken for a matcher failure), fails at once if the test has a recorded composition error (a `restartCore` that kept one goes on with a scene that no longer recomposes), and only then evaluates the lookup through `onAllNodes(…).fetchSemanticsNodes()` with its own counting (so anything thrown out of the fetch's own wait for idle is likewise a composition error, not a matcher failure), retrying its own matcher failures and the documented transient states (`scrollTo` waits until the list's `IndexForKey(key) >= 0` before `performScrollToKey`, Actions.kt:197-200; `UiNode.get`/`assert`/`child` evaluate their matchers inside the lookup's transform on the EDT, not on the test thread, Assertions.kt:258-259); each end-of-test step and `restartCore`'s waits for idle (including the one inside `setContent`, ComposeUiTest.skiko.kt:338) catch a `Throwable` from it, rethrow `InterruptedException` (the watchdog's), keep anything else as a composition error and continue; after the scene runner returns, `uiTest` fails the test with the first composition error, or, if the body has its own throwable, keeps that as the cause and adds the composition errors (and a different throwable the scene runner ended with) as suppressed. A failed effect cancels the scene's recomposer job (the recomposer's effect job is a child of it, not a `SupervisorJob`), so after a composition error the dialogs no longer recompose and Escape would keep hitting the same stale dialog root: the end-of-test step then completes the remaining alerts by reflection instead of Escape: each entry of `AlertManager`'s `alertViews` (AlertManager.kt:37) is a `ComposableLambdaImpl` whose `_block` is the show function's lambda, and the harness invokes the dismiss callback that lambda captured — `$onDismissRequest` for `showAlertDialog` (which covers "Start chat?", Core.kt:226-235, and the retry alert, SimpleXAPI.kt:880-888), `showAlertDialogStacked` and `showAlertDialogButtonsColumn`, `$onDismiss` for `showOpenChatAlert`, none for `showAlertDialogButtons`, `showAlertMsg` and `showAlertMsgWithProgress`, whose dismissal only hides — and then drops the entries with `hideAllAlerts`. The field names are compiler-generated, so P1's harness tests check them. The same path is used for every alert in a manager that isn't rendered when the test ends, not only after a composition error: `AlertManager.privacySensitive` while the app is locked has no dialog root (App.kt:240-242). The wait for `ctrlInitInProgress` described under "End of each test" follows. The captured callbacks are invoked on the EDT, as `clearTransientUi` is, since they write Compose state.
+
+**Hard timeout and poisoning.** `uiTest` checks a poison flag on entry, before the scene runner (whose scene setup and teardown run on the EDT with `invokeAndWait`), and runs the scene runner on a dedicated daemon thread that the JUnit thread joins with a deadline: 2 min (10 min for tests in the `Slow` category), plus 28 s for each screenshot the test takes (10 s quiet wait plus 11 settle steps of about 1.4 s, the steps about 12% slower with the Kover agent attached, 7.8, measured on a toy project; P1 measures the step on the app and adjusts this), plus 10 s for each end-of-test drain pass that waits (6, "End of each test"; normally only the last pass waits, and it waits its full bound only while something stays in flight with no dialog opening, e.g. a long export) — the JUnit thread joins in slices and recomputes the deadline from a shot counter the body increments when each shot starts (a shot costs up to 10 s of quiet wait plus up to 11 settle steps — one before focus is cleared, then at most 10 — of about 1.4 s each on an animated scene, 7.7). When the deadline passes the JUnit thread first probes the EDT (`invokeLater` plus a 5 s latch), then writes the failure report while the scene is still as the test left it: the non-UI parts (peer tails, `UiIdle` list, command log) always; the semantics dump and screenshot only if the EDT probe succeeded, built on a helper thread with its own 20 s timeout, inside `runOnUiThread { … }` (the body thread can still be rendering on the EDT — input injection advances the clock itself, InputDispatcher.skiko.kt:246-259, and every node lookup renders a pending layout, ComposeUiTest.skiko.kt:273-279, 378-380 — while `captureToImage` snapshots on the calling thread, :356-358, so a capture off the EDT can catch a cleared surface; measured: 26 of 150 captures blank off the EDT, 0 of 150 inside `runOnUiThread`, which runs inline on the EDT without deadlock), which records a composition error that its `waitForIdle` surfaces instead of dropping it (`printToString` and `captureToImage` call `waitForIdle`, which renders through `invokeAndWait`, ComposeUiTest.skiko.kt:356-358/:378-380, and would hang the JUnit thread on a stuck EDT). Only then does it interrupt the body thread (the interrupt unwinds through the end-of-test cleanup and closes the scene, ComposeUiTest.skiko.kt:196-203). If the body thread is still alive 15 s after the interrupt, or the probe fails, or a reset's 10 s wait for `ctrlInitInProgress` expires (7.2), or `changingActiveUserMutex` is still held after `drain()` (7.3), or `ctrlInitInProgress` is still set 10 s after the end-of-test alert completion (above), or the staged core's migrations differ from the current CLI's (7.1), the JVM is *poisoned*: every later `uiTest` in it fails at entry with "JVM poisoned by <test>" without touching the EDT, so the rest of the class fails fast instead of hanging on a thread stuck in JNI or on the EDT. The Gradle task also has a `timeout` as a last backstop.
+
+## 7. In-process driver
+
+### 7.1 Gradle
+
+(As built: see 0.5.9. Differs: `forkEvery` defaults to 0; no categories, pinned fonts, `shots`/`shotTolerance`/`pass`/`strict` properties or Kover; `uitestPrepare` only resolves `desktopTestRuntimeClasspath`, and `env.properties` (5 keys) is written by the runner; no migration check. Added: `kotlin.srcDir("src/uiTestShared/kotlin")`, heap dumps and `-XX:ErrorFile` crash logs in the run directory, `testLogging` with standard streams, and the `uitestBridgeClasspath` task for the Android bridge.)
+
+In `apps/multiplatform/common/build.gradle.kts` the existing `val desktopTest by getting` (line 149) is replaced by:
+
+```kotlin
+val desktopTest by getting {
+  languageSettings.optIn("androidx.compose.ui.test.ExperimentalTestApi")   // error-level opt-ins of the scene runner (7.2)
+  languageSettings.optIn("androidx.compose.ui.test.InternalTestApi")       // runInternalSkikoComposeUiTest (14)
+  languageSettings.optIn("androidx.compose.ui.InternalComposeUiApi")       // its semanticsOwnerListener parameter type, PlatformContext (ComposeUiTest.skiko.kt:91); set module-wide so no test file needs its own @OptIn
+  dependencies {
+    implementation(compose.desktop.uiTestJUnit4)  // the skiko test scene runner (ui-test-desktop 1.8.2, downloaded into the dedicated Gradle home by the outside step, 7.1.1)
+    implementation(compose.desktop.currentOs)     // skiko native runtime
+    implementation("org.jetbrains.pty4j:pty4j:0.13.13")   // pinned: 0.14.x needs kotlin-stdlib 2.4; 0.13.13 brings jna 5.14.0, slf4j-api 2.0.13
+                                                          //   and raises kotlin-stdlib to 2.1.21 in the desktopTest classpath only (harmless)
+  }
+}
+```
+
+and the test tasks:
+
+```kotlin
+tasks.named<Test>("desktopTest") { exclude("chat/simplex/app/ui/**") }   // existing unit tests unchanged
+
+tasks.register("uitestCoverageMerge") { /* merges the <run directory>/coverage/pass<n>.ic files that exist (one or two) through Kover's reporter and writes the HTML/XML report and summary; run by the runner after both passes (7.8) */ }
+
+tasks.register("uitestPrepare") {                                         // run outside the namespace (7.1.1)
+  // 1. resolve desktopTestRuntimeClasspath, so the offline run inside the namespace finds every runtime-only artifact
+  // 2. download the stable CLI (-PuiStableTag) and fixture CLIs (-PuiFixtureTags), verify their published SHA-256 (mandatory) and set the executable bit
+  // 2b. resolve Kover's koverJvmAgent and koverJvmReporter configurations (7.8), so the offline run and the merge find them
+  // 3. run the current CLI (built before Gradle, 7.1.1) on a scratch database and record its chat and agent migration lists (7.1)
+  // 4. write <rootProject>/build/uitest/env.properties (apps/multiplatform/build/uitest), including the run directory (-PuiRunDir) and the two lists
+}
+
+tasks.register<KotlinJvmTest>("desktopUiTest") {                       // KotlinJvmTest with targetName, so Kover instruments it (7.8)
+  targetName = "desktop"
+  onlyIf { System.getenv("SIMPLEX_UITEST_RUNNER") == "1" }              // only from uitest.sh: Kover makes check/build/koverVerify depend on every instrumented desktop KotlinJvmTest (7.8)
+  val dt = tasks.named<Test>("desktopTest").get()
+  testClassesDirs = dt.testClassesDirs; classpath = dt.classpath
+  include("chat/simplex/app/ui/**")
+  forkEvery = (findProperty("uiForkEvery") as String?)?.toLong() ?: 0    // 0 = one JVM per fork runs many classes (15.4 item 24); -PuiForkEvery=1 = one JVM per class
+  maxParallelForks = (findProperty("uiForks") as String?)?.toInt() ?: 1
+  maxHeapSize = "2g"
+  timeout.set(Duration.ofHours(12))                                       // last backstop (6); `import java.time.Duration` at the top of the file: inside the script `java` resolves to the project's `java` extension, so `java.time.…` doesn't compile (found in P1a)
+  filter { isFailOnNoMatchingTests = findProperty("uiAllowEmpty") == null }   // the runner's passes may each match nothing (7.1.1)
+  useJUnit {
+    fun cats(p: String) = (findProperty(p) as String?)?.split(",")?.filter { it.isNotBlank() }?.map { "chat.simplex.app.ui.$it" }?.toTypedArray()
+    cats("uiTags")?.let { includeCategories(*it) }
+    cats("uiExcludeTags")?.let { excludeCategories(*it) }
+  }
+  environment.remove("XDG_DATA_HOME"); environment.remove("XDG_CONFIG_HOME")
+  environment("GSETTINGS_BACKEND", "memory")   // the system theme then resolves to light, whatever the host's GTK theme (7.7)
+  environment("XDG_CACHE_HOME", "${findProperty("uiRunDir")}/cache")   // fontconfig's cache for the pinned font directory and JNA's native-library extraction, instead of the real ~/.cache (measured)
+  environment("FONTCONFIG_FILE", file("src/desktopTest/uitest-fonts/fonts.conf").absolutePath)   // pinned fonts (7.7), committed beside fonts.conf, <dir prefix="relative">
+  environment.remove("FREETYPE_PROPERTIES")                               // hinting overrides would change every screenshot (7.7)
+  jvmArgs("-Duser.language=en", "-Duser.country=US", "-Duser.timezone=UTC", "-Djava.io.tmpdir=${findProperty("uiRunDir")}/jvmtmp")   // AppCommon.desktop.kt:19 captures defaultLocale at class init; UTC for screenshots (7.7)
+  systemProperty("simplex.uitest.shots", (findProperty("uiShots") as String?) ?: "update")           // update | verify | off (7.7)
+  systemProperty("simplex.uitest.shotTolerance", (findProperty("uiShotTolerance") as String?) ?: "0")
+  // Kover agent on this task unless -PuiCoverage=off; forks append to one per-task report, copied per pass by the runner (7.8)
+  systemProperty("java.awt.headless", "true")
+  systemProperty("skiko.data.path", rootProject.file("build/uitest/skiko").absolutePath)
+  systemProperty("simplex.uitest.env", rootProject.file("build/uitest/env.properties").absolutePath)
+  systemProperty("simplex.uitest.pass", (findProperty("uiPass") as String?) ?: "1")   // failure reports go to <run directory>/report/pass<n> (7.5)
+  systemProperty("simplex.uitest.strict", (findProperty("uiStrict") != null).toString())   // strict traceability (10.1, P7)
+  systemProperty("kotlinx.coroutines.io.parallelism", "256")   // old receivers block IO threads up to 300 s each (7.3)
+  outputs.upToDateWhen { false }                                          // the core, CLIs and servers are not task inputs; always run
+  val pass = (findProperty("uiPass") as String?) ?: "1"                   // each runner pass keeps its own results (7.1.1)
+  reports.junitXml.outputLocation.set(layout.buildDirectory.dir("test-results/desktopUiTest/pass$pass"))
+  reports.html.outputLocation.set(layout.buildDirectory.dir("reports/tests/desktopUiTest/pass$pass"))
+  binaryResultsDirectory.set(layout.buildDirectory.dir("test-results/desktopUiTest/pass$pass/binary"))
+}
+```
+
+- `env.properties` holds the absolute paths of `libapp-lib.so` and its library folder, the current CLI, the stable CLI and the tag it was downloaded for, each fixture CLI and its tag, `uitest-servers`, the repo root, the run directory (port slots, 8.2; per-JVM directories, 7.1; failure reports, 7.5), and the current CLI's chat and agent migration lists (7.1). The catalogue is read from the test classpath (10).
+- The JUnit category interfaces (`Smoke`, `StableCompat`, `NeedsRelay`, `NeedsNames`, `NeedsFixture`, `Multicast`, `Slow`) live in package `chat.simplex.app.ui`; Gradle loads every listed category up front.
+- **Per-JVM data directories.** The app's paths are read once at class initialisation: `dataDir` from `XDG_DATA_HOME` or `user.home` (D/platform/Platform.desktop.kt:6-8), `desktopPlatform.configPath` (:7, :12; settings file at D/platform/Resources.desktop.kt:39-40), `tmpDir` from `java.io.tmpdir` (D/platform/Files.desktop.kt:15). The task removes `XDG_DATA_HOME` and `XDG_CONFIG_HOME`; the `UiTest` base class's companion initialiser — which runs before any app class is initialised (JUnit and Gradle load classes without initialising them) — registers the harness's single shutdown hook of 8.2 (Kover's agent has its own) (it stops peers and relays, closes `uitest-servers`' stdin and waits for it, then destroys the remaining descendant processes with `destroyForcibly()`, `ProcessHandle.current().descendants()` — which also covers the `gsettings monitor` process the app's theme detector starts, Theme.desktop.kt:8-11, which never exits on its own under the memory backend, measured one orphan per JVM; it first sets a shutting-down flag, after which `UiUncaught` drops errors, since destroying the `gsettings monitor` process makes the detector's reader thread throw an uncaught `NullPointerException`), creates a fresh directory per JVM, `<run directory>/jvm-<slot>-<pid>` (slots are reused by later JVMs, and a reused directory would bring back the previous JVM's peer databases, server stores and settings) (on the same filesystem as the checkout, not `/tmp`, which may be a small root filesystem; one test picks a sparse file over 1 GB), and sets `user.home` and `java.io.tmpdir` inside it. `bootJvm()` asserts that `dataDir` and `configPath` are inside that directory, failing fast otherwise. Setting `java.io.tmpdir` at runtime covers the app's `tmpDir`, but not the JDK's NIO `Files.createTempFile`/`createTempDirectory`, nor `File.createTempFile` once it has been used (measured, JDK 17), so the task also passes `-Djava.io.tmpdir=<run directory>/jvmtmp` (created by the runner) and library and harness temp files stay off `/tmp`.
+- Native libs: `libsimplex.so` and GHC libs are staged into `apps/multiplatform/common/src/commonMain/cpp/desktop/libs/linux-x86_64` (gitignored; `bash ~/build/stage-libs.sh` in the worktree, or upstream `scripts/desktop/build-lib-linux.sh`). `libapp-lib.so` comes from `:desktop:cmakeBuildAndCopy` (it links against the staged `libsimplex.so`, cpp/desktop/CMakeLists.txt:57). The staged core and the current CLI must be the same version: fixture SQL edits run the CLI with `-y` on the GUI's database (11.1), so a newer CLI would apply migrations the GUI's core doesn't know, and "current" peers would differ from the GUI. The check compares the migrations applied to a fresh database. `uitestPrepare` runs the current CLI once on a scratch database with `--user-display-name uitest -e "/sql chat select name from migrations order by name" -t 0`, and again with `/sql agent …` (not `--maintenance`, which exits on a database with no user, Hs/Core.hs:89-91; the CLI's `/v` prints only the version, View.hs:216, :2711-2716), and writes both lists to `env.properties` (dropping the `Current user:` line, the `name` header row and the trailing blank line). The first `resetForTest` in the JVM whose init succeeds (a fixture with a startup database error defers it to the next) sends `CC.ShowVersion()` (SimpleXAPI.kt:4110) through `chatController.sendCmd(null, …, log = false)` — not `apiGetVersion()`, which returns only the version (SimpleXAPI.kt:2737-2742), and without logging, so the console of the JVM's first test shows no extra items — and reads `chatMigrations`/`agentMigrations` (`UpMigration.upName`, DatabaseUtils.kt:109-112) from the `CR.VersionInfo` result (:6901; the core reads the database's `migrations` table sorted by name, Hs/Library/Commands.hs:3671-3676, the same rows as the CLI's query), and fails the current test and poisons the JVM, with both lists in the report, when they differ.
+
+#### 7.1.1 Runner script
+
+(As built: see 0.5.9. Differs: one pass (`-PuiPass=1`), so no `Multicast` pass, empty-run check, screenshot cleanup or coverage merge, and `-PuiTags` has no effect; added: the 3000 MB `MemAvailable` guard, the `-O0` cabal build with `cabal list-bin`, the peer database template, the fingerprint skip of the outside Gradle step, automatic `-PuiForks`, in-process Kotlin compilation; `--stop` runs only after the outside step, when it runs.)
+
+Tests are run by `apps/multiplatform/scripts/uitest.sh [gradle args]`:
+
+1. **Outside the namespace** (network allowed; the script runs in `apps/multiplatform`, and relative paths below are from there): the script first runs `mkdir -p build/uitest` and takes `flock -n` on `build/uitest/runner.lock`, held through both passes (a second runner would rewrite `env.properties` and re-copy `libapp-lib.so` under the first run's JVMs, so it exits instead), then creates a fresh run directory `$PWD/build/uitest/run-<timestamp>` and its `jvmtmp` subdirectory (the test JVMs' launch-time `java.io.tmpdir`, 7.1) (absolute, since `uitestPrepare` and the test JVM resolve paths from `common/`; port-slot locks, 8.2) and removes older `run-*` directories except the last 5 (keeping 5 old ones plus the new one, since a run keeps each JVM's GUI data and server stores, the peer databases of failing tests, and its reports), then runs `./gradlew -g "$PWD/.gradle/uitest-home" --no-daemon :desktop:cmakeBuildAndCopy :common:desktopTestClasses :common:uitestPrepare` with `-PuiRunDir=<that directory>` (written into `env.properties`) and the user's `-PuiStableTag` and `-PuiFixtureTags` (they select the binaries `uitestPrepare` downloads), then `./gradlew -g "$PWD/.gradle/uitest-home" --stop`. Both steps use their own Gradle user home, `.gradle/uitest-home` in `apps/multiplatform` (git-ignored, and outside `build/`, which the root `clean` task deletes, build.gradle.kts:112-113; filled by this outside step, which has network; the first run downloads the wrapper distribution and dependencies once, an estimated 1–2.5 GB on disk): a Gradle process holds cache locks (`caches/journal-1`, shared across Gradle versions) that a Gradle process on the other side of the namespace can't ask it to release, so with a shared home an outside daemon makes the inside run fail with "Timeout waiting to lock journal cache", and a run of several hours makes every outside build on the same home fail the same way (the daily prebuild timer, `~/build/linux.sh`, IDE syncs; verified both ways, the outside build failed after 69 s). A build or IDE sync of the same checkout still conflicts during a run, on the project's own `.gradle/8.12/fileHashes` lock (verified: failed after 64 s), so other work during a run uses another worktree. Every invocation on that home uses `--no-daemon`, so its only daemon is the single-use one that exits with its build; the script still runs `./gradlew -g … --stop` before entering the namespace and before pass 2, as a guard against a process left by an interrupted run. Before the Gradle invocation, the outside step runs `cabal build -f uitest --builddir=dist-uitest exe:simplex-chat exe:uitest-servers`, because `uitestPrepare` runs the built CLI (a separate build directory, because the desktop library is built with `client_library` and sharing `dist-newstyle` would rebuild the package each time).
+2. **Inside the namespace** (8.3; the inner Gradle runs get `SIMPLEX_UITEST_RUNNER=1`, without which `desktopUiTest` is skipped, 7.1): the script re-executes itself under
+   ```sh
+   self=$(readlink -f "$0")   # set at the top of the script, so the re-exec still resolves whatever directory step 1 runs in
+   unshare -rn --pid --fork --kill-child --mount-proc sh -c '
+     ip link set lo up && ip link set lo multicast on && ip route add 224.0.0.0/4 dev lo src 127.0.0.1 &&
+     exec "$0" --inside "$@"' "$self" "$@" &
+   trap 'kill -KILL $!' INT TERM; wait $!
+   ```
+   The outer script doesn't `exec`: `unshare --fork` blocks SIGINT and SIGTERM while it waits, so the outer script kills it with SIGKILL on Ctrl+C or SIGTERM, and `--kill-child` tears the namespace down; it returns `wait`'s status (verified with util-linux 2.38.1: no leftover processes, status 130). Because `unshare` is started with `&` from a non-interactive shell, SIGINT is ignored for everything inside the namespace, and `dash` can't trap a signal ignored on entry; so Ctrl+C is handled only by the outer trap. In `--inside` mode the script is PID 1 of the pid namespace, which receives only signals it handles; it runs `trap 'kill -TERM -1 2>/dev/null; exit 143' TERM` (for a SIGTERM sent from inside), records each pass's exit code and exits non-zero if either failed.
+   and runs the Gradle passes there: `./gradlew -g "$PWD/.gradle/uitest-home" --offline --no-daemon :common:desktopUiTest …`. The whole Gradle process runs inside, because the test worker connects back to the Gradle process over loopback (a JVM alone in the namespace can't reach it; verified). `-g` is needed anyway, because inside the user namespace the uid is 0 and `user.home` resolves to `/root`. The pid namespace kills every leftover process (peers, relays, servers) when the run ends.
+3. **Two passes.** The script reads the user's `-PuiTags`, `-PuiExcludeTags`, `--tests`, `-PuiForks`, `-PuiShots` and `-PuiCoverage` arguments (the last two decide the whole-run screenshot and coverage steps, 7.7, 7.8). Pass 1 runs with the user's arguments and `Multicast` added to the exclusions. Pass 2 runs only if the user's `uiTags` is empty or contains `Multicast`: it runs the user's arguments (exclusions, `--tests`, `-PuiShots`, `-PuiCoverage`, `-PuiStrict`, `-PuiShotTolerance`) with `-PuiTags=Multicast` and `-PuiForks=1` (8.3) replacing the user's `-PuiTags` and `-PuiForks` rather than appending to them. Pass 1 is skipped when the user's `uiTags` is exactly `Multicast`. Both passes add `-PuiRunDir=<run directory>` (the task's `java.io.tmpdir` is its `jvmtmp`, 7.1), `-PuiAllowEmpty`, so a pass whose filters match nothing doesn't fail Gradle ("No tests found for given includes", verified), and `-PuiPass=1` or `-PuiPass=2`, so each pass writes its XML and HTML results to its own directory (a second Gradle invocation of the same test task deletes the first one's results, verified with Gradle 8.12). The script deletes both pass directories before pass 1, and fails the run if neither pass executed a test (it counts the XML results in `common/build/test-results/desktopUiTest/pass1` and `pass2`, the `:common` project's build directory). After both passes, when no test filter (`uiTags`, `uiExcludeTags`, `--tests`) was given and `uiShots` is `update`, it deletes committed screenshots whose test no longer exists or that a passing test no longer produced, and regenerates the screenshot docs index (7.7). After both passes it also merges the per-pass coverage reports and writes the coverage report and summary (7.8), unless `-PuiCoverage=off`.
+
+Usage: `scripts/uitest.sh` (full run), `scripts/uitest.sh -PuiTags=Smoke -PuiExcludeTags=StableCompat` (smoke run; P1b, no categories yet), `scripts/uitest.sh --tests '*OneTimeLink*Test'`, `scripts/uitest.sh -PuiForks=2` (default chosen from free memory: 10.2).
+
+### 7.2 Boot, reset and restart
+
+(As built: see 0.5.3 and 0.5.4. Differs: `bootJvm` has no collector change, uncaught handler, `platform` or seams, uses a no-op `NtfManager` and applies the theme; `resetForTest(user)` has no fixture, uses `deleteChatDatabaseFilesAndState()` (so `dataDir/tmp` is not deleted), and runs `PrefStores.restore` → `clearUiState` → `TestServers.start()` → `DbTemplate.installIfPresent` (so the template's key is installed after the prefs are restored, as 15.1 says; the code below has the opposite order); no `MigrationCheck`; `TestRoot` provides `LocalClipboardManager` and `LocalUriHandler` only, with no throwing option.)
+
+`initHaskell()` is private to the desktop module (desktop/src/jvmMain/kotlin/chat/simplex/desktop/Main.kt:50-91), so the harness repeats its essential steps. `acquireSingleInstance()` (D/SingleInstance.kt:33) is skipped. The reset adds no app code beyond `UiIdle` (6): it uses existing functions, public state and reflection from test code (private fields, and the model walk of 7.3).
+
+```kotlin
+object UiTestApp {
+  val dbPrefix: String get() = dbAbsolutePrefixPath             // C/platform/Files.kt:24, D/platform/Files.desktop.kt:20
+  fun bootJvm() {                                             // once per JVM, from the base class
+    TestScopeKt.setCatchNonTestRelatedExceptions(false)        // by reflection, before the first runTest (6)
+    Thread.setDefaultUncaughtExceptionHandler(UiUncaught)     // records uncaught app errors with the current phase (6)
+    check(dataDir.startsWith(UiEnv.jvmDir) && File(desktopPlatform.configPath).startsWith(UiEnv.jvmDir))   // 7.1 per-JVM data directories
+    System.load(UiEnv.libAppLib); initHS()                      // C/platform/Core.kt:18
+    Locale.setDefault(Locale.ENGLISH)
+    uiTagsEnabled = true                                      // test tags and typed semantics are emitted only in test/debug builds (3.1)
+    ntfManager = RecordingNtfManager                          // lateinit, C/platform/NtfManager.kt:18
+    platform = UiTestPlatform                                 // same PlatformInterface as desktop/Main.kt:65-90
+    simplexWindowState.windowState = WindowState(size = DpSize(1600.dp, 900.dp))  // lateinit, D/DesktopApp.kt:271
+    tmpDir.mkdirs()                                           // databaseExportDir; desktop main creates it
+    runMigrations()                                           // C/platform/AppCommon.kt:46; writes lastMigratedVersionCode
+    appPrefs.appearanceBarsBlurRadius.set(0)                  // toolbar blur off in every test, onboarding included, for performance (user decision 2026-10-13);
+                                                              //   set before the capture, so every reset restores it; tests about blur turn it on
+    PrefStores.capture()                                      // settings.properties, themes.properties, themes.yaml as they are now (7.3)
+    ModelSnapshot.capture()                                   // initial values of ChatModel, ChatsContext, AppLock fields (7.3)
+    UiSeams.installFakes()                                    // recorder, audio/video provider, Ctrl+V clipboard reader (11.2);
+                                                              //   the display clock is fixed or real per test, from uiTest(realTimes) (7.7)
+  }
+
+  fun resetForTest(user: String?, fixture: ((dbPrefix: String) -> Unit)?) {   // called by app() at the start of each test
+    UiIdle.drain()                                            // let the previous test's jobs finish (6)
+    stopAndCloseCore()                                        // as deleteStorageAndRestart does (C/views/localauth/LocalAuthView.kt:55-68):
+                                                              //   wait while ctrlInitInProgress (at most 10 s, else poison the JVM with a report);
+                                                              //   stopChatAsync only if chatRunning == true (it also sets chatRunning = false);
+                                                              //   chatCloseStore only if ctrl != null && ctrl != -1; then setChatCtrl(null)
+                                                              //   (DatabaseView.kt:581), which also stops the receiver on the old controller
+    UiIdle.drain()                                            // events in flight when the receiver stopped, before clearUiState (as restartCore, 7.3)
+    deleteDatabaseFiles()                                     // the files deleteChatDatabaseFilesAndState removes (C/views/database/DatabaseView.kt:556-599),
+                                                              //   plus dataDir/tmp (coreTmpDir, the core's temp folder and the agent's XFTP work folder; deleteChatDatabaseFilesAndState removes java.io.tmpdir/simplex and dataDir/migration_temp_files, not dataDir/tmp, DatabaseView.kt:572-574; a transfer still running when the core stops leaves its prepared copy there, a failed one is removed by the agent, FileTransfer/Agent.hs:513-517),
+                                                              //   without its asynchronous UI clearing (:585-596); clearUiState does that synchronously;
+                                                              //   then re-creates filesDir, tmpDir and wallpapersDir as it does (:570, :574, :576), since they are otherwise created once per JVM
+    DbTemplate.installIfPresent()                             // the run's pre-migrated empty database and its key (<run directory>/db-template),
+                                                              //   so initChatController opens instead of migrating (15.1: reset 7.2 s → 0.94 s);
+                                                              //   the JVM that finds none migrates once, closes the store, copies the files and key,
+                                                              //   publishes them with an atomic rename and re-opens; FIXTURE rows replace the files after this
+    PrefStores.restore()                                      // 7.3
+    clearUiState()                                            // 7.3, synchronously on the EDT: model, navigation, window state
+    TestServers.restoreBaseline()                             // 8.2
+    fixture?.invoke(dbPrefix)                                 // FIXTURE rows: prepare the database while the core is stopped (11.1)
+    if (user != null) TestPrefs.preset()                      // 11.1 "Pre-set prefs"; onboarding boots keep defaults
+    runBlocking { initChatController() }                      // C/platform/Core.kt:70; fresh DB → random key, no prompt; a fixture DB made
+                                                              //   without a key opens with the empty key (DatabaseUtils.kt:51-62)
+    if (!migrationsChecked && chatModel.chatDbStatus.value == DBMigrationResult.OK) MigrationCheck.compare()   // 7.1: CC.ShowVersion's chatMigrations/agentMigrations vs the CLI's lists; poison on mismatch
+    if (chatModel.chatDbStatus.value != DBMigrationResult.OK) return clearTransientUi()   // fixture with a startup DB error
+    val fixtureUser = chatModel.currentUser.value             // a fixture database may already have a user (initChatController started it)
+    if (fixtureUser == null && user == null) return clearTransientUi()   // onboarding: Core.kt:153-166 sets Step1 and starts without a user
+    val u = fixtureUser ?: runBlocking { chatController.apiCreateActiveUser(null, Profile(user!!, "", null)) }!!  // display name only
+    chatModel.localUserCreated.value = true
+    appPrefs.onboardingStage.set(OnboardingStage.OnboardingComplete)
+    chatModel.currentUser.value = u                           // getUserServers/setUserServers read the user id from the model (currentUserId)
+    if (fixtureUser == null) runBlocking { chatController.startChat(u) }   // SimpleXAPI.kt:663
+    runBlocking { TestServers.configure(u) }                  // 8.2: /_servers with the operator groups disabled and one custom group;
+                                                              //   assigns the fresh getServerOperators result to chatModel.conditions;
+                                                              //   after startChat: before it the core answers chatNotStarted (found in P1a)
+    setLastVersionDefault(chatModel)                          // WhatsNewView.kt:1024, so What's New doesn't open
+    clearTransientUi()                                        // 7.3: modals, passcode views, alerts and toasts stale jobs put back;
+                                                              //   keeps chatDbStatus, localUserCreated and the chats startChat loaded
+  }
+
+  fun restartCore(fixture: ((dbPrefix: String) -> Unit)?) { … }   // RESTART rows, 7.3
+}
+```
+
+- Each test gets a new composition from the scene runner: `runInternalSkikoComposeUiTest(width = 1600, height = 900, coroutineDispatcher = StandardTestDispatcher()) { setContent { TestRoot { AppScreen() } } }` (14; the fallback is `runDesktopComposeUiTest(width = 1600, height = 900)`; density 1, so 1600 px = 1600 dp). The size matches `windowState` and leaves room for the end pane: END modals expand the window to `388·√fontScale·2 + 590` dp (ModalView.kt:146-148, Resources.desktop.kt:106-108), 1366 dp at font scale 1 and about 1540 dp at the largest desktop font scale, 1.5 (Appearance.kt:251).
+- `TestRoot` provides the test stubs as composition locals: in-memory `LocalClipboardManager` **and** `LocalClipboard` (app code uses the former, ~40 sites; Compose text fields and `SelectionContainer` use the latter in 1.8.2), a recording `LocalUriHandler` (links, the browser launch for calls, D/views/call/CallView.desktop.kt:157-174). The stubs belong to the test (so a migration test can carry a link across a `restart()`).
+- Window-only features (tray, window-state persistence, the file-dialog windows, toasts' `LaunchedEffect`, floating terminal, close policy; D/DesktopApp.kt:40-257) are not rendered; 7.6 says how each is covered.
+
+### 7.3 Isolation between tests, and restart inside a test
+
+(As built: see 0.5.3, 0.5.4. Differs: `ModelSnapshot` unwraps and walks `Lazy` fields (15.4 item 26); its roots are `ChatModel`, `AppLock`, `ConnectProgressManager`, `ChannelRelaysModel`, `BadgeModel`, `VideoPlayerHolder`; no `changingActiveUserMutex` check, no manual `migrationState`, `ProcessedErrors` timers not cancelled explicitly; `restartCore` drains once and has no fixture, lock-screen path or alert exit (desktop polls 30 s for init; Android restarts the core before relaunching the activity, 15.4 item 10).)
+
+Every test calls `app(...)` first, which runs `resetForTest`: a fresh database, restored preference stores, cleared in-memory state, servers back to their baseline (8.2), then a fresh composition. Peers are started per test, each in a directory of its own test (8.1), and stopped at the end. `hs_init` runs once per JVM.
+
+**`PrefStores.capture()` / `restore()`.** Each `SharedPreference` copies its value into a private `_state` when created and stores no default (SimpleXAPI.kt:3903-3917), and `appPrefs` is a lazy singleton (:537), so rewriting the files is not enough. `capture()` (in `bootJvm`, after `runMigrations`) copies the raw `Properties` of `settings.properties` and `themes.properties` and the content of `themes.yaml`, as `runMigrations()` leaves them (it writes `lastMigratedVersionCode`, `currentThemeIds` and an empty theme-overrides list, AppCommon.kt:46-66, Files.kt:153-167). The restore: clear and refill the raw `Properties`, rewrite `settings.properties`, `themes.properties` and `themes.yaml` from the capture (otherwise the files would hold the previous test's values until the first pref write); null the private static `themeOverridesStore` cache (SimpleXAPI.kt:528, used by the preference at :388-391); refresh the cached state of every `SharedPreference` field of `AppPreferences` by reflection (`_state.value = get()`), never calling `set`: `set` would write every default into the file, and defaults computed from other prefs while the key is absent would stop following them (`mkTimeoutPreference`, SimpleXAPI.kt:320-327, picks the proxy defaults only while the timeout key is unset); apply the restored theme through `ThemeManager.applyTheme(appPrefs.currentTheme.get()!!)` (as Theme.kt:823 does; it writes `currentTheme` only when the value differs, ThemeManager.kt:105-108, so passing the stored value writes nothing); `Locale.setDefault(Locale.ENGLISH)` (switching language calls `Locale.setDefault`, D/views/usersettings/Appearance.desktop.kt:52-60); set `.value` of the `ChatModel` fields that are copied from prefs once (`val … by lazy { mutableStateOf(…) }`, ChatModel.kt:211/220/222/248) (`notificationPreviewMode`, `showAuthScreen`, `showChatPreviews`, `simplexLinkMode`).
+
+**`clearUiState()`** (before the core starts, in `resetForTest` and `restartCore`), on the EDT, waiting for completion:
+- everything `clearTransientUi()` clears (below);
+- `ChatModel`, its `ChatsContext` objects and `AppLock`, by reflection rather than by a hand-written list (reviews kept finding fields the list missed, e.g. `desktopOnboardingRandomPassword`, which would make later onboarding tests skip the passphrase step, WelcomeView.kt:400; `showCallView`, App.kt:226-237; `AppLock.laFailed`, App.kt:218): `ModelSnapshot.capture()` in `bootJvm`, before the first init, records the initial state of these objects by walking their declared fields (private ones included), and `clearUiState` restores it: `MutableState` and `MutableStateFlow` fields get their initial value; `SnapshotStateList`/`SnapshotStateMap` and plain mutable collections (tested with Kotlin `is MutableCollection<*>` / `is MutableMap<*, *>`, which excludes Kotlin's read-only collections such as the `EmptySet` in `terminalsVisible`, ChatModel.kt:183, so those are restored by reference only) are cleared and refilled with their initial contents; non-final fields get their initial reference back and then, like every field, the captured value inside it (a `var` holding a `MutableState`, such as `draft`/`draftChatId`, ChatModel.kt:240/242, is never reassigned but its `.value` changes), which covers plain `var`s the app sets outside any state (`chatListBanner`, ChatModel.kt:206; `centerPanelBackgroundClickHandler`, :274, set at UserAddressView.kt:549 in a `LaunchedEffect` with no `onDispose`); final fields holding an object of an app class are walked the same way, once per object, which reaches each context's `chatState` (`ActiveChatState`: six `MutableStateFlow`s and `@Volatile var selectionActive`, ChatItemsMerger.kt:196-206, whose six flows production resets through `clearAndNotify`, DatabaseView.kt:587; `selectionActive` is not reset there), `popChatCollector` (its pending map; stale chat ids would pop the wrong chats; `deleteChatDatabaseFilesAndState` also clears it, DatabaseView.kt:589/594) and `processedCriticalError`/`processedInternalError` (ChatModel.kt:270-271; their `timer` job is cancelled first, as a pending one waits up to 60 s and then calls `hideAllAlerts`, ProcessedErrors.kt:15-28; it is launched with `withLongRunningApi(idle = false)` so that `UiIdle.drain()` doesn't wait for it before the reset cancels it). The walk skips Kotlin `object`s (`controller`, managed by `resetForTest`), `MutableSharedFlow`s that aren't `MutableStateFlow`s (the check for `MutableStateFlow` comes first, as it is a subtype) and `lazy` delegates. Exceptions, handled by hand: `changingActiveUserMutex` (ChatModel.kt:257, a kotlinx `Mutex`, not an app class; a job abandoned by `drain` may hold it, and every later user switch would then hang) is checked instead: it is a `static final` field of the `ChatModel` object (ChatModel.kt:140), so reflection can't replace it, and its only holders are `currentUserId` and the active-user section (SimpleXAPI.kt:653, :749-753), so a lock still held after `drain()` means a job is stuck in the core and the JVM is poisoned with a report (6); `migrationState` (re-created as MigrateToDevice.kt:55 does), the four fields copied from prefs (restored by `PrefStores`), and `chatsContext`/`secondaryChatsContext` themselves (the existing objects are reset in place, `secondaryChatsContext` set to null). The fields that matter most for the next test — `chatId`, chats, items, `chatState` (each flow and `selectionActive`), `chatListBanner`, `users`, `draft`/`draftChatId` (ComposeView.kt:1447-1462 can save them on dispose; ids restart at 1 in a fresh database), `chatDbStatus`, `chatDbEncrypted`, `localUserCreated`, `chatRunning`, remote state, calls — are asserted in P1's harness tests to be back to their initial values after a reset;
+- other singletons: `BadgeModel`, `BadgeStore`'s load state, `ChannelRelaysModel`, `ConnectProgressManager`, `VideoPlayerHolder`, `OnboardingSharedState.selectedOperatorIds` (YourNetwork.kt:37-39), `CIFile.cachedRemoteFileRequests` (ChatModel.kt:4626, read by `fileReady` for every file, Files.kt:170-172, and cleared in production only on a chat switch, ComposeView.kt:1425, whose `KeyChangeEffect` skips the first composition), image caches: `clearImageCaches()` (D/views/helpers/Utils.desktop.kt:132-134) empties `loadedImageCache` (:128, a 30-entry cache keyed by the file's path, which the database deletion of 7.2 doesn't clear, so a later test's file with the same name would show the previous test's bitmap), and `WallpaperType.cachedImages` (ChatWallpaper.kt:342); the seam fakes' per-test state, `AudioPlayer.currentlyPlaying` and `RecorderInterface.stopRecording` (11.2);
+- file-level mutable state of UI files, reset by reflection on their `…Kt` classes: `ChatListViewKt.lazyListState` (ChatListView.kt:907, the chat list's scroll position saved in `onDispose`, :979, and used as the next composition's start, :240) back to `0 to 0`, and `ChatViewKt.reportsListState` (ChatView.kt:1747) to null; otherwise each test would start with the list where the previous one left it, rows above it uncomposed and unfindable, and `restartCore` would restore an offset a real restart doesn't. P1's harness tests assert the list is at index 0 after a reset, and the source-level check of 9.4 fails on top-level `var`s and mutable `val`s of UI files that are neither reset nor allow-listed (the allow-list starts with those found harmless: `chatViewScrollState`, cleared when its scroll collector completes, ChatView.kt:2481-2486, measured; the call WebSocket list, CallView.desktop.kt:28; the composable bookkeeping sets, Utils.kt:632-633; the lazily built icons, CustomIcons.kt:37/83/111/143; the update checker's job, AppUpdater.kt:160, whose job is `idle = false`; extension properties without a backing field, such as MigrateFromDevice.kt:102 and MigrateToDevice.kt:117, hold no state and are skipped);
+- window state: `simplexWindowState.windowState` re-created at 1600 × 900 dp (END modals widen it, ModalView.kt:146-148), `windowFocused` and `windowVisible` true (`NTF` tests set focus to false; left false it stops the 1 s status poll, ChatListView.kt:688), `AppLock.clearAuthState()`.
+
+**`clearTransientUi()`** (also the last step of `resetForTest` on every path, including the early returns for a startup DB error and for onboarding), on the EDT: `ModalManager` all placements (`closeAllModalsEverywhere`, ModalView.kt:260-266) and the private `passcodeView`/`onTimePasscodeView` (:112-113, via reflection); pending `DialogState`s completed with an empty result (as at the end of each test, 6); both alert managers (`hideAllAlerts`, AlertManager.kt:48; alerts a test left open were already dismissed at its end, 6); recorded toasts.
+
+**`restartCore(fixture)`** (RESTART rows) simulates a real app restart: end the composition first (its `onDispose` handlers start core jobs, e.g. ConnectMobileView.kt:339-342 stops the remote host, SetupDatabasePassphrase.kt:82-87 starts the chat), wait for idle, then `UiIdle.drain()`; if the controller is neither null nor -1 (a startup DB error leaves it null; -1 is the process-start value, SimpleXAPI.kt:535, which the lock-screen path keeps because init is skipped, AppCommon.desktop.kt:35; `sendCmd` would pass -1 to the core as a pointer) and `chatRunning` isn't false, raw `apiStopChat` (not `stopChatAsync`, which would set `chatStopped` and trigger the "Start chat?" alert on start, Core.kt:61-62; `apiStopChat` leaves `chatStopped` unchanged, SimpleXAPI.kt:1093-1097), then `chatModel.chatRunning.value = null` (the process-start value, ChatModel.kt:146; with `true` left in place, `startChatWithoutUser` returns at once, SimpleXAPI.kt:705, and a user-less app stays on the splash screen); `chatCloseStore` under the same controller check, then `setChatCtrl(null)` and a second `drain()` (events in flight when the receiver stopped); `fixture?.invoke(dbPrefix)` (FIXTURE rows that copy, restore or edit data the test produced); clear in-memory state as `clearUiState` does, including `chatDbStatus` (files and preference stores are kept); then start as desktop startup does — `initChatControllerOnStart()` (Core.kt:59-67), or, when a self-destruct passcode is set, the lock-screen path (`AppCommon.desktop.kt:35` skips init; the harness restores the process-start controller with `setChatCtrl(null)` then `setChatCtrl(-1L)`, which LocalAuthView.kt:36 requires before it initialises) — and compose again with `setContent { TestRoot { AppScreen() } }` at once (the same `TestRoot` stubs), as desktop `showApp` composes while initialisation runs (initialisation can wait on an alert inside `AppScreen`, e.g. "Start chat?": Core.kt:61-62 passes `showStartChatAfterRestartAlert`, :226-235, and :170 awaits it; and `initChatControllerOnStart` only launches a coroutine, Core.kt:59, so `ctrlInitInProgress` may still be false right after it returns). Then poll until `chatModel.chatDbStatus.value != null && !chatModel.ctrlInitInProgress.value`, or until an alert is shown (`AlertManager.shared.hasAlertsShown()`); on the lock-screen path, where `chatDbStatus` stays null until the passcode is entered (LocalAuthView.kt:36-37), poll instead until `AppLock.userAuthorized.value == false` and the passcode view is shown (`ModalManager.fullscreen.showPasscodeInView`, App.kt:222, in the block at :210-224). Persistence rows additionally assert the stored value in `settings.properties`.
+
+A class may therefore hold many tests, and the catalogue's class mapping (10.1) works with any `forkEvery`. Each reset leaves the previous Haskell controller and its agent threads behind (`chatCloseStore` only closes the stores, Mobile.hs:364-367), and old receiver threads may block up to 300 s in `chatRecvMsgWait` (SimpleXAPI.kt:532, :962); both are bounded by the number of tests one JVM runs. With `forkEvery = 0` (as built, 15.4 item 24) that is a share of the whole run, so RSS (about 4.6 MB per reset, 15.1) and one receiver thread per reset accumulate per fork; `-PuiForkEvery=1` bounds them by one class (at most 29 tests, legend class map).
+
+### 7.4 Driver
+
+(As built: see 0.5.3, 0.5.4. Differs: no `UiDriver`/`UiNode`/`InProcessDriver`; the API is methods on each platform's `UiScope`; lookups use keys, `described(text)` or literal English text, not `MR.strings`; `exists` means any match; clicks are touch input at `tapPointInNode`; alerts are not closed with `press(Key.Escape)`.)
+
+```kotlin
+interface UiDriver {
+  fun node(key: UiKey): UiNode
+  fun node(text: StringResource, within: SemanticsMatcher? = null): UiNode  // MR.strings, resolved with generalGetString
+  fun node(text: String, within: SemanticsMatcher? = null): UiNode          // literal text (message bodies, names)
+  fun nodes(matcher: SemanticsMatcher): List<UiNode>
+  fun scrollTo(list: UiKey, itemKey: Any)                                    // performScrollToKey on the keyed lazy list
+  fun poll(what: String, timeout: Duration = 10.seconds, cond: () -> Boolean) // the loop of section 6
+  fun wait(d: Duration)                                                      // the poll loop running for d of real time with no condition; only where a catalogue row names the interval (e.g. "retry more than 3 s after the failure")
+  fun escape()                                                               // simplexWindowState.backstack.lastOrNull()?.invoke(), as DesktopApp.kt:125-130
+  fun composeField(): Pair<String, String>                                   // the message field's text and placeholder: desktop from semantics (EditableText; the placeholder Text exists only while the field is empty), Android from the EditText (catalogue 05 setup item 5)
+  fun dump(): String; fun screenshot(): ImageBitmap
+}
+interface UiNode {
+  fun click(): UiNode; fun rightClick(): UiNode; fun longClick(): UiNode; fun hover(): UiNode
+  fun hold(duration: Duration): UiNode; fun dragTo(other: UiNode): UiNode; fun clickAtTextRange(range: IntRange): UiNode
+  fun type(text: String): UiNode; fun press(key: Key, vararg modifiers: Key): UiNode
+  fun <T> get(key: SemanticsPropertyKey<T>): T?; fun assert(m: SemanticsMatcher): UiNode
+  fun child(text: String): UiNode?
+  fun capture(): ImageBitmap                                               // captureToImage of this node (7.7)
+}
+class InProcessDriver(private val t: SkikoComposeUiTest) : UiDriver      // the supertype of DesktopComposeUiTest; also fits runInternalSkikoComposeUiTest (14)
+```
+
+- UI labels are looked up by `MR.strings` key, so tests are locale-independent. Message text is looked up with `within = hasTagPrefix("chat.item[")` (a node or ancestor whose tag starts with `chat.item[`), because the chat list preview (`ChatPreviewView`) shows the same text.
+- `node(...)` polls until exactly one node matches (a pending row and the contact row can briefly coexist); zero or several matches after the deadline fail with the semantics dump.
+- Lazy lists: `scrollTo` uses the list key and the list's own item keys: `Pair(chat.remoteHostId, chat.id)` for the chat list (ChatListView.kt:1099) and `ChatViewItemKey(item.id, createdAt ms)` for chat items (ChatView.kt:2398 via `keyForItem`, :3663, which becomes `internal`). An item hidden inside a merged group is reached through the group's newest item. Lists without keys get keys (3.4).
+- Input runs on the EDT: injected pointer and key events are dispatched on the thread that calls `performMouseInput`/`performKeyInput`/`performClick` (their `flush` calls `sendPointerEvent`/`sendKeyEvent` directly, InputDispatcher.skiko.kt:69-75, 130-138, 215-225, and the pre-event layout pass runs there too, BaseComposeScene.skiko.kt:60-65), which would run every click handler and the app code it calls off the EDT, racing the app's own EDT jobs. So the driver wraps each input injection in `runOnUiThread { … }`, which runs inline on the EDT (DesktopSynchronization.desktop.kt:28-40), keeping clock advances and lookups working; `hold` keeps its real-time wait between separate press and release injections. Semantics actions already run on the EDT (Actions.kt:581). The wrapper is per-platform: on Android the dispatcher already injects on the main thread and a wrap would throw (research doc §5.1).
+- Dialogs and menus render as extra roots: lookups use `onAllNodes(..., useUnmergedTree)` and `isDialog()`.
+- `escape()` covers modals; it invokes the back-stack lambda inside `runOnUiThread`, as the window key handler runs it on the EDT (D/DesktopApp.kt:125-128), since `closeModal` changes plain collections (ModalView.kt:105, 108, 168-179). Alerts register no back handler, so a test closes an alert with `press(Key.Escape)` on the dialog root (the Compose dialog dismisses on Escape).
+- `type(text)` uses `performTextInput`. On the compose field any typed text of two or more characters whose every line names an existing regular file (absolute, or relative to the JVM's working directory) is attached as files instead (PlatformTextField.desktop.kt:97-104, :222-236); tests type such text only to attach a file: as the feature itself (02 `paste_filePathText_attachesFile`) or as the attach step of file tests whose rows say so (01 `serversSummaryFilesTabShowsXftp`, 02 §G).
+
+### 7.5 Failure output
+
+(As built: only `<run>/failures/<jvm>-NN-<what>.png` (Android: pulled into `<run>/failures/`), and a message with the in-flight list and the first 60 visible texts; peer timeouts add the peer's next 10 lines. P1b for the rest.)
+
+On any failed assertion or timeout: the semantics tree of every root (`onAllNodes(isRoot(), useUnmergedTree = true).printToString(maxDepth = Int.MAX_VALUE)`; the collection overload defaults to depth 0, Output.kt:83-86), a PNG via `captureToImage()`, the last 50 terminal lines of each peer and the last 50 log lines of each relay, the recorded toasts and URIs, the `UiIdle` in-flight list, recorded uncaught errors with their phase (6), the screenshot diff image in `verify` mode (7.7), and the app's command log, written to `<run directory>/report/pass<n>/<TestClass>/<test>/` (the run directory comes from `env.properties` and the pass from the `simplex.uitest.pass` property, 7.1, so reports of earlier runs never mix with new ones; the test JVM's working directory is `common/`).
+
+### 7.6 Surfaces outside the scene
+
+(As built: in-memory `LocalClipboardManager` and recording `LocalUriHandler` (desktop); pending `DialogState`s are completed empty at reset only; notifications go to a no-op manager; no toast recording. Android uses Espresso-Intents, 0.5.4.)
+
+| Surface | Location | In tests |
+|---|---|---|
+| File choosers | D/views/helpers/DefaultDialog.desktop.kt:78-165; `simplexWindowState.openDialog/saveDialog/openMultipleDialog` (D/platform/Files.desktop.kt:68-101) | `UiFiles.respondOpen(path)`, `respondOpenMultiple(paths)`, `respondSave(path)` poll until the dialog's deferred is set and not completed (the `DialogState` field `onResult$delegate`, a `MutableState`, read by reflection; `isAwaiting` is not used, because it stays true until the waiting coroutine resumes, D/DesktopApp.kt:289-303, and a flow such as the QR save, QRCode.kt:90-97 → `shareFile` → a second `saveDialog.awaitResult`, Files.desktop.kt:78, opens the next dialog on the same `DialogState` within one poll step: polling for `isAwaiting` false failed 40 of 40 runs, measured), then complete that captured deferred, failing if `complete()` returns false (40 of 40 passed under load, measured); and `UiFiles.awaiting()` tells whether any `DialogState` has a non-completed deferred (for tests asserting that none opens; a waiter cancelled while it awaits, e.g. because its screen left composition, leaves its deferred set and not completed, since `awaitResult` clears it only after a normal resume, D/DesktopApp.kt:294-300, so `awaiting()` counts it until the end-of-test drain (6) or `clearTransientUi` completes it, and `respondX` only accepts a deferred that was not already pending at the test's previous UI action (the driver records the pending deferreds before each input action's input is injected, 7.4, and before each `respondX`, never after: flows that wait on a background dispatcher, such as the `CIFileView` save, `exportArchive` and `shareFile`, have already set their deferred when the click returns, and a record taken then made `respondSave` reject the right dialog in 12 of 24 runs, measured), so a stale one is never answered in place of the next dialog; a dialog must therefore be answered before the next input action, and when `respondX` times out while a recorded deferred is still pending it fails with "dialog opened before the previous action; answer it right after the action that opens it"); some save dialogs are directories-only (e.g. `saveTempImageUncompressed`, which waits on `saveDialog` with no file name, Utils.desktop.kt:239-240, DefaultDialog.desktop.kt:101-102), so `respondSave` takes a directory there |
+| Text clipboard | `ClipboardManager.shareText` (D/platform/Share.desktop.kt:20-23); Compose `LocalClipboardManager`, `LocalClipboard` | in-memory implementations from `TestRoot` (headless AWT has no clipboard and the Compose one silently drops calls) |
+| Ctrl+V in the compose field | D/platform/PlatformTextField.desktop.kt:141-152: if the (Compose) clipboard text is a list of existing files they are attached (:144-146, covered by the in-memory clipboard); otherwise — plain text or an image — it reads the AWT system clipboard (:150), which throws `HeadlessException` headless | file-list pastes need only `CB`; any other Ctrl+V in the compose field needs the approved clipboard seam (11.2) |
+| Links, browser, calls | `LocalUriHandler`; outgoing calls open the browser through it (D/views/call/CallView.desktop.kt:157-174) | recording `LocalUriHandler` from `TestRoot`, with a harness option that makes `openUri` throw an `Exception` (an `Error` would escape the app's catch; the "Error opening browser" alert that ends the call, CallView.desktop.kt:168-175). An outgoing call invitation is sent only after the browser page reports its capabilities (CallView.desktop.kt:41-43), so outgoing-call tests assert the recorded call link and the waiting state; incoming calls from a peer (`/_call invite`), call items and alerts are tested (the incoming-call alert plays its ringtone through `SoundPlayer` → `AudioPlayer`, IncomingCallAlertView.kt:30-33, RecAndPlay.desktop.kt:275-289, so those rows add `AV`); WebRTC is not |
+| Toasts | `simplexWindowState.toasts`, drained by the Window's `LaunchedEffect` (D/DesktopApp.kt:165-182), which isn't rendered | the harness drains and records them; tests assert on the record |
+| Notifications | D/model/NtfManager.desktop.kt:97-148 (`displayNotification` → `displayNotificationViaLib`, `Toast.builder()` :123) | `RecordingNtfManager` records each call; the notification-preview text is built inside the desktop manager (:100-102), so preview-mode tests assert the preference and the recorded call |
+| Esc | Window key handler (D/DesktopApp.kt:125-130) | `escape()` (7.4) for modals, `press(Key.Escape)` for alerts |
+| VLC audio/video, voice recording | D/platform/RecAndPlay.desktop.kt:25-90/92; D/platform/VideoPlayer.desktop.kt:217 | approved seams (11.2) |
+| OS folder opener | `desktopOpenDir`, D/platform/Files.desktop.kt:37-48 (no-op when `Desktop.isDesktopSupported()` is false), reached from the database-folder buttons via `desktopOpenDatabaseDir` (:33; DatabaseView.kt:243, DatabaseErrorView.kt:330) and from the app-update download (AppUpdater.kt:361-480, out of reach, 11.3); `openFile` (Share.desktop.kt:46) has no callers | not covered: rows are `IGNORE` until the seam of section 13 is approved |
+| Tray, floating console window, window size/position persistence, close policy, crash-restart loop | D/DesktopTray.kt:34-80; DesktopApp.kt:34-120, 194-257, 215 | not rendered; catalogue 04 has `IGNORE` rows for them (11.3) |
+| Single-instance dialog | D/SingleInstance.kt:104 | not rendered; not a user feature, no catalogue row |
+
+### 7.7 Screenshots (committed, rewritten only when they change)
+
+(As built: not built; P1b.)
+
+Tests save PNG screenshots that are committed to the repo. They serve three purposes: UI regressions and intended changes show up as image diffs in every PR at no extra cost; new and changed images prove that a real test rendered that screen (for unchanged screens the evidence is the run's `screenshots/summary.txt`, which lists every shot as unchanged, changed, new, unsettled, unquiet, orphaned or unverifiable); and together they document every screen and feature, indexed by the catalogue. Decided with the user: every passing catalogue test except the `REALTIME` ones (and none with `-PuiShots=off`) saves an end-of-test shot plus any named shots its author adds, and the PNGs are stored with Git LFS. A test's own assertions still read only semantics (1); screenshots are compared outside the test logic and fail a test only in `verify` mode (below).
+
+**What is captured.** After a passing body, once pending file dialogs are completed and before the rest of the end-of-test cleanup (6), the test captures `<test>.png` (written once the test has passed). A test adds named shots at intermediate steps with `screenshot("after-join")`, or `screenshot("profile", of = node)` for one element (`UiNode.capture()`, 7.4). Named shots are captured when called but written (or compared) only after the test has passed, including the end-of-test checks of 6 (recorded uncaught and composition errors), so a failing test saves none. Named shots are the test author's choice and are not listed in the catalogue; they are taken with no file dialog pending (a dialog awaited from a tracked job keeps it in flight, so the quiet wait could only end `unquiet`, 6). Capture uses `SkikoComposeUiTest.captureToImage()` (the whole surface, including open dialogs, which are separate roots) or the node's `captureToImage()`, so the image is what the semantics assertions saw, after composition-scoped delays up to the settle time have run (for example visible items get marked read after 600 ms, ChatView.kt:3090-3094, and "in progress" spinners appear after 1 s, ChatListNavLinkView.kt:52-59). Failure screenshots stay separate (7.5) and are never committed. The key lint and the harness's own tests save no screenshots.
+
+**Where.** `apps/multiplatform/common/src/desktopTest/uitest-screenshots/<catalogue file>/<TestClass>/<test>[-<name>].png`, next to a sidecar `….json` with the masks below and stable metadata (catalogue file, row feature, test name, step). The PNG also carries these fields as `tEXt` chunks. Nothing run-specific (dates, commit, run id) goes into the image or the sidecar, so an unchanged screen produces an unchanged file. A `…CompatStableTest` run saves its own copies under its class name.
+
+**Determinism.** A screenshot is only useful if an unchanged screen renders the same pixels on every run:
+- Rendering: the fixed 1600 × 900 dp scene at density 1 (7.2), headless Skiko software rasterisation, the app's bundled fonts (Inter in `apps/multiplatform/common/src/commonMain/moko-resources/fonts`; Noto Color Emoji in `…/desktopMain/moko-resources/fonts`, applied only to emoji-only messages, an emoji-only compose field (ComposeView.kt:1071-1072), reactions and tag emoji, EmojiItemView.kt:20-21, ChatItemView.desktop.kt:29, TagListView.desktop.kt:60), with the host fonts pinned for the rest — monospace text (`FontFamily.Monospace`: markdown snippets, the console, verification codes, server addresses; ChatModel.kt:5178/5186, TerminalView.kt:174, VerifyCodeView.kt:82) uses the pinned DejaVu Sans Mono, and emoji inside ordinary text, which is Inter (C/ui/theme/Type.kt), use Inter's own glyph where it has one (e.g. ❤ ♥ ☀ ⚠ ⬆ ⬜ ▶ ↩ ©) and otherwise fall back to the pinned fonts (in `FontFamily.Default` text, which is DejaVu Sans 2.37, the emoji it covers are its own monochrome glyphs — most of the emoticons block, 64 of 80, but not e.g. 🙂 U+1F642 or 🙏 U+1F64F; ❤; and many Miscellaneous Symbols and Dingbats such as ☀ ☕ ⚡ ✌ ✔ — and all other emoji fall back to Noto Color Emoji; all deterministic) — through `FONTCONFIG_FILE` (7.1) pointing at a fontconfig file that the harness ships with a fixed font directory (DejaVu Sans, DejaVu Sans Mono and Noto Color Emoji; Compose's default family on Linux is the first available of Noto Sans, DejaVu Sans and Arial, which in the pinned directory is DejaVu Sans, and the app has text styles without a family, e.g. unread badges, ChatPreviewView.kt:596-600, and quotes, FramedItemView.kt:67/93 — without a sans font, `FontFamily.Default` throws "Could not load font"), so a screenshot depends only on the checkout, not on the host's fonts (glyphs in none of these fonts render as empty boxes, the same on every run; Skiko bundles its own FreeType inside `libskiko-linux-x64.so` and binds its `FT_*` calls to that copy, so the host's `libfreetype` does not affect rasterisation, but the bundled FreeType reads `FREETYPE_PROPERTIES`, which changes hinting, so the task removes it), the light theme and default prefs restored by `PrefStores` (7.3) — the default theme is SYSTEM (SimpleXAPI.kt:233), which jSystemThemeDetector resolves through `gsettings get org.gnome.desktop.interface gtk-theme` on any Linux (D/ui/theme/Theme.desktop.kt:8-24; its GNOME check is always true), so the task sets `GSETTINGS_BACKEND=memory` (7.1) and the host user's dark GTK theme can't turn every screenshot dark — the locale `Locale.ENGLISH` set by `bootJvm` and `PrefStores` (7.2, 7.3) and `-Duser.timezone=UTC` (7.1; the app formats times in the system zone, `TimeZone.currentSystemDefault()`, ChatModel.kt:3945-3994).
+- Animation state: with the manual clock, `waitForIdle` does not finish animations (`isIdle` ignores them, ComposeUiTest.skiko.kt:254-266, and virtual time follows real time, 6; e.g. `FloatingDate` fades over 350 ms, ChatView.kt:2966-2970), so before each capture the driver first waits (at most 10 s) until `UiIdle` has nothing in flight and no core event has been processed for 1 s — content driven by core events keeps changing after the last assertion (a sent item's status, member joins, relays, transfer progress, chat-list order), and `UiIdle` counts processed receiver events for this — and then repeats: advance the clock by 1 s (`mainClock.advanceTimeBy(1000, ignoreFrameDuration = true)`; virtual time leads real time here, and the loop of 6 is shifted by the same amount afterwards), wait for idle, capture — until two consecutive captures are identical outside the masks with no core event processed between them, nothing in `UiIdle` in flight at the second one and nothing started or finished between them (settle steps run virtual time ahead, so a composition `delay` can start tracked work mid-shot) (at most 10 steps; a shot that never settles, or whose quiet wait hit its bound, is saved and marked `unsettled` or `unquiet` in the summary). A test whose last step leaves a known change pending (e.g. a sent message's delivery) waits for it before ending. Advancing is what renders a new frame: with `autoAdvance = false`, `captureToImage` only snapshots the last frame unless a layout is pending, so two captures without an advance would always be equal. Looped finite animations never settle — the live-message send-button pulse (SendMsgView.kt:533-544) and the typing indicator (TextItemView.kt:176-183) — so their composables are volatile too, and so are animated images (`rememberAnimatedImage`, D/views/chat/item/CIImageView.desktop.kt:25-26 and ImageFullScreenView.desktop.kt:25; the flag goes on a wrapper around `ImageView` in each platform's `SimpleAndAnimatedImageView` and on `FullScreenImageView`'s `modifier`, only when the image is animated (`looksAnimatable(data)`, AnimatedImage.desktop.kt:106, on desktop; on Android coil animates GIFs always, even under blur and modals, A/views/chat/item/CIImageView.android.kt:22-58, ImageFullScreenView.android.kt:32, and the check is a header check of the image bytes for GIF or animated WebP, since Android's `isAnimImage` needs a URI, Images.android.kt:127), so static images stay unmasked): their frames are decoded on `Dispatchers.Default` and wait in real time, so the test clock can't stop them (D/platform/AnimatedImage.desktop.kt:51-56, 131-148), and a GIF with loop count 0 plays forever. Indeterminate progress indicators (semantics `ProgressBarRangeInfo.Indeterminate`) are masked like `VolatileKey` nodes. A blinking caret blinks in step with the 1 s settle advances, so a focused field would look settled while differing between runs. The end-of-test shot therefore first advances the clock by one settle step (so delayed `requestFocus` calls in `LaunchedEffect`s fire — 17 call sites in 13 files request focus 100 ms–1 s after composition, e.g. WelcomeView.kt:175, AddGroupView.kt:181, and the confirm button of every two-button alert, AlertManager.kt:152), then clears focus, then settles; `screenshot(name)` follows the same sequence — one settle step, then it notes the focused text field (semantics `Focused`), clears focus, settles (at most 10 steps), captures — and then gives the field focus back with its `SemanticsActions.RequestFocus` action, so the next `press` still reaches it (3.5). The compose field keeps focus after sending (it clears focus only when sending becomes disabled, PlatformTextField.desktop.kt:71-73), and several screens focus a field soon after opening (above), so a named shot often has a focused field to handle.
+- Times are fixed by a display clock; other volatile content is masked. Times are not only text: message bubbles reserve width for the time (`reserveSpaceForMeta`, CIMetaView.kt:130-195, used at TextItemView.kt:158, FramedItemView.kt:359, CIFileView.kt:213), and item grouping depends on it (a new timestamp shows when 60 s pass between items or the minute text changes, ChatView.kt:3765-3768, :3784), so masking the time would not keep the rest of the screen stable. A display-clock seam (11.2, approved 2026-10-12) maps every timestamp and "now" used for display to one fixed instant in UI tests: `getTimestampText`, `getTimestampDateText`, `localTimestamp` and `localDate` (ChatModel.kt:3944-3998), `FloatingDate` (ChatView.kt:2894) and the 60 s grouping check (ChatView.kt:3765, :3784); and the SimpleX-name sale countdown, which ticks every second from `System.currentTimeMillis()` (SetSimplexNameView.kt:195-205); P1 audits the remaining display uses of `Clock.System.now()` and `System.currentTimeMillis()` (the chat console is volatile as a whole instead: its lines carry wall-clock times, `TerminalItem.date`, SimpleXAPI.kt:7524, TerminalView.kt:173, and include every core event in arrival order, SimpleXAPI.kt:2905). Times then render as one fixed time and date, and grouping depends only on sender and direction, on every run. The core keeps its real clock, so ordering, TTLs and timers are unaffected. Tests about real time display or time-based grouping (date separators, the floating date, grouping by time; catalogue code `REALTIME`) turn the seam off with `uiTest(realTimes = true)` and save no screenshots, since their screens can't be stable. What remains volatile is masked: QR codes and the link text of invitations and addresses (new keys on every run, QRCode.kt:23-64), security codes, server statistics (ServersSummaryView), call and voice durations, and the looped animations above. These composables get the semantics flag `VolatileKey` through `Modifier.uiVolatile()` (4; added in K0, 5.2), on the volatile child itself; `VolatileKey` does not merge into the parent row or item (4). Before comparing, the harness fills the bounds of every node of the **unmerged** tree with `VolatileKey` with a flat colour in both the old and the new image (union of the old sidecar's and the current masks); a change in the set of volatile nodes (their count or keys, recorded in the sidecar) also counts as a change, so a regression that drops a QR code isn't hidden by the old mask. Where P1 finds that a masked text's width moves its neighbours, the volatile node is widened to cover them. Run-dependent content outside the time display is volatile too: server addresses with their ports (ports come from the JVM's slot, 8.2; the custom servers' editor, ProtocolServerView.kt:181-184, and the server summaries, ServersSummaryView.kt:534, :562) and link-preview URLs (`http://127.0.0.1:<port>`), and the relay list of a channel with several relays, whose order is random (`chooseRandomRelays`, AddChannelView.kt:183-217; ChannelRelaysView.kt:62-79). Ports appear in more places than can be listed reliably (the contact and member "Receiving via"/"Sending via" rows, `SimplexServers`, ChatInfoView.kt:1156-1163, GroupMemberInfoView.kt:659-663; a link-preview test's message text `http://127.0.0.1:<port>/page`, FramedItemView.kt:396-400, and its chat-list preview), so in addition the harness masks, for every text node of the unmerged tree (`Text` or `EditableText`) whose text contains one of the run's own ports (the JVM's server and stub ports, 8.2), whether or not it is flagged, the bounds of its outermost ancestor that merges its descendants' semantics, searching up only to the nearest scroll container (a node with `VerticalScrollAxisRange`; walking to the root would reach full-screen clickable scrims such as the user picker's, UserPicker.desktop.kt:96-100); that is the chat bubble even for a port inside a quote, whose own quote column merges too (FramedItemView.kt:292-308) while the bubble's width follows it, and the whole row for list and info rows; the node itself when there is none (measured on a replica of the item layout: 0 pixels differ): ports change with the JVM's slot between runs and the app font's digits differ in width, so a port's text moves its neighbours (measured: 20001 against 20101 moved an icon after a left-aligned port and a right-aligned bubble's edge by 3 px; with the ancestor masked, 0 pixels differed). Also volatile: incognito profile names, which the core generates at random for each incognito connection (`generateRandomProfile`, Hs ProfileGenerator.hs:9-22) — "Your random profile" in chat info (ChatInfoView.kt:583-589), "Your random profile" in channel info (GroupChatInfoView.kt:628) and the incognito member's own row in group info (:772) and "Join as %s" in a group invitation preview (ChatPreviewView.kt:583-587); the remote-desktop pairing screen's port field, bound to a system-chosen port when none is set (ConnectMobileView.kt:476-485; simplexmq RemoteControl/Discovery.hs:83), and its session verification code (ConnectMobileView.kt:231-238), and on Android the "Use from desktop" session code and pasted invitation (`SessionCodeText`, ConnectDesktopView.kt:341-349, used at :157-160, :273, :326-329; the invitation field, :386-396); the chat console's line list, flagged on the list itself (`LazyColumnWithScrollBar`, TerminalView.kt:159-167, so the number of volatile nodes doesn't vary with the number of lines; each line, :168-174, carries a wall-clock time and core events arrive in their own order); the "Message queue info" alert (shown at ChatInfoView.kt:694-698 and GroupMemberInfoView.kt:717-721 through `showAlertMsg`, text built at ChatInfoView.kt:1399-1403; random queue and message ids and timestamps; `showAlertMsg` gets a volatile-text parameter in K0, AlertManager.kt:212-218); and the chat-relay address editor, whose link has new keys on every run (ChatRelayView.kt:231-241; a preset relay shows its fixed preset address instead). The committed PNG itself is left unmasked, so it reads naturally as documentation.
+
+**Write only on change.** After capture, if a committed PNG exists with the same size, every pixel outside the masks is identical and the set of volatile nodes matches the sidecar's (tolerance 0 by default; `-PuiShotTolerance=<n>` allows a per-channel delta for other hosts), the file is not touched. Otherwise the new PNG and sidecar are written (each to a temporary file renamed into place, so an interrupted write never leaves a truncated PNG; a committed PNG that can't be decoded (and isn't an LFS pointer) counts as changed) and a diff image (changed pixels in red over a grey copy) goes to `<run directory>/screenshots/diff/<TestClass>/<test>[-<name>].png`. Each JVM appends one line per shot to `<run directory>/screenshots/summary.txt` (new / changed / unchanged / unsettled / unquiet / orphaned / unverifiable (LFS pointer), with the share of changed pixels); appends are single `write` calls of one line, which do not interleave. Modes, `-PuiShots=`:
+- `update` (default): write new and changed screenshots; the test does not fail. `git diff` then shows exactly the screens that changed.
+- `verify`: a changed or missing screenshot fails the test, with the diff image in the failure report (7.5) (for PR checks).
+- `off`: no capture (quick local runs).
+Tests that are `@Ignore`d or skipped by an assumption produce no screenshot and keep their existing ones. Whole-run steps happen in the runner after both passes (7.1.1), only when no test filter was given and the mode is `update`: it deletes committed screenshots of tests that no longer exist (per the catalogue and the compiled classes, not the XML results, which lack entries for a crashed JVM) and those of tests that **passed** this run but didn't produce them (the summary lists every shot each test produced; failing tests save no shots and keep theirs), records them as `orphaned` in the summary, and regenerates the docs index. The traceability check (10.1) fails on screenshots without a catalogue test whenever it runs.
+
+**Docs index.** A generated `uitest-screenshots/README.md` lists, per catalogue file and sub-area, each row's feature with its screenshots; the runner rewrites it only when its content changes, like the images.
+
+**Size.** A flat 1600 × 900 UI screenshot compresses to roughly 40–120 KB. The 1,149 runnable tests run 1,185 times (the 36 `S` tests run again in their stable subclasses), so with one or two shots each there are roughly 1,200–2,366 images (the 2 `REALTIME` runs save none), about 50–280 MB in the working tree, and history grows with every changed image. The PNGs are written losslessly with maximum compression and stored with Git LFS (`.gitattributes`: `apps/multiplatform/common/src/desktopTest/uitest-screenshots/**/*.png filter=lfs diff=lfs merge=lfs -text`; sidecars and the index stay in plain git), so clones stay small while PR diffs still show the images. P1 adds the attribute and requires git-lfs (`git lfs install`, which also sets `filter.lfs.required`; it is not installed on this host yet, and without it git stores the PNGs in plain history silently, verified): the runner refuses `uiShots=update` unless `git config filter.lfs.clean` is set and `git check-attr filter` reports `lfs` for a screenshot path (`git lfs env` alone succeeds even without `git lfs install`); no LFS operation needs the network during the run. The compare step reads committed PNGs from the working tree; a checkout without `git lfs pull` has pointer files (they start with `version https://git-lfs`), which `update` never overwrites — such a shot is reported as `unverifiable (LFS pointer)` — and `verify` fails with the same hint.
+
+### 7.8 Coverage measurement
+
+(As built: not built; P1b.)
+
+Decided 2026-10-12: the UI test run measures real coverage, so catalogue completeness is checked against what actually ran rather than estimated.
+
+- **Tool.** Kover (the Kotlin coverage plugin with the IntelliJ agent) is applied to `:common`. Kover instruments only test tasks of type `KotlinJvmTest` bound to the JVM target, so `desktopUiTest` is registered as `tasks.register<KotlinJvmTest>("desktopUiTest") { targetName = "desktop"; … }` (7.1). All forks of a pass append to Kover's single per-task binary report (`common/build/kover/bin-reports/desktopUiTest.ic`; the agent appends, so parallel forks share it safely), which Kover deletes when the task starts, so the runner copies it, when present (a pass that is skipped or matches no test writes none), to `<run directory>/coverage/pass<n>.ic` after each pass and then deletes it (otherwise a later plain `koverHtmlReport`, with `desktopUiTest` skipped, would include stale UI-test coverage) and after both passes merges the pass files that exist (one or two) with a small Gradle task of the harness that reads them through Kover's reporter (resolved in `uitestPrepare`, so it works offline). Because Kover makes `check`, `build` and its own report and verify tasks depend on every instrumented `KotlinJvmTest` of the `desktop` target, `desktopUiTest` runs only when the runner sets `SIMPLEX_UITEST_RUNNER=1` (`onlyIf`, 7.1); a plain `./gradlew check` skips it and never starts the suite outside the namespace. Gradle resolves the plugin when it configures the build (step 1 of 7.1.1 runs outside the namespace), and `uitestPrepare` also resolves the `koverJvmAgent` and `koverJvmReporter` configurations, so the offline run and the merge find them; a run with `-PuiCoverage=off` skips the agent, whose overhead P1 measures.
+- **Scope.** The report covers the UI and model code the tests exercise: `chat.simplex.common.views.*`, `chat.simplex.common.ui.*`, `chat.simplex.common.model.*`, `chat.simplex.common.platform.*`, excluding the test harness. Line and branch coverage per package, file and composable function, as HTML and XML in `<run directory>/coverage/report/`, plus a short summary (per-package percentages and the files with zero covered lines) in `<run directory>/coverage/summary.txt`.
+- **Use.** Files and composables with no covered lines after a full run are the starting list for new catalogue rows: each is either given a row, or recorded in the legend as unreachable on desktop (Android-only, camera, WebRTC) with its reason, so the next full run's zero-coverage list contains only known exclusions. Coverage is reported, not enforced: no threshold fails the run, since screens that need a seam not yet approved (13) or an out-of-reach surface (11.3) can't be covered.
+- **Interaction with screenshots.** Coverage runs and screenshot runs are the same runs; coverage adds no files to the repo (reports stay in the run directory).
+
+## 8. Peers and servers
+
+### 8.1 CLI peers
+
+(As built: see 0.5.5. Differs: Current CLI only; args `-d`, `--user-display-name`, `-s <smp1>` and the three display flags, with no `--mute`, `--xftp-server` or `--key`; no `$HOME/Downloads`; `TERM=xterm-256color`; `stty -echo -icanon` before exec instead of the start–stop–start cycle; the database comes from the run's peer template (15.1); typing uses a 1.5 s unchanged window and 5 attempts, with no `! `/`> `/`\ ` rule; `sends` consumes the first matching echo anywhere in the buffer; line waits 15 s; no `expectsAny`, `repeatUntil`, `stop`/`start`/`snapshot`/`restore`, relays or mobile hosts; added `eventuallyMessage`, `eventuallyMatching`, `pending`. Matching is shared in `PeerLines`; on Android it runs device-side over the bridge.)
+
+```kotlin
+sealed interface CliVersion {
+  object Current : CliVersion                               // built from this checkout
+  data class Stable(val tag: String = UiEnv.defaultStableTag) : CliVersion
+}
+sealed interface TestUser { val name: String }
+class CliPeer(override val name: String, val version: CliVersion, val flags: PeerFlags, val servers: PeerServers) : TestUser {   // flags and servers apply on every start
+  infix fun sends(cmd: String)                 // like ##>; types the command with verified input (Typing, below), then waits for the command's echo (the command line itself; for message commands, which the CLI echoes only when they fail, Terminal/Input.hs:64/68/89-99: the sent-item line `HH:MM <cmd>`, timestamp stripped, View.hs:2427-2429, or, if the command fails, the plain line `<cmd>` before the error) and re-sends Enter once if the input line still holds it. Some message commands print a sent item that differs from the command, so they are sent with `types` and read with `expectsMessage`/`expects`: a quote reply `> @alice (hi) re` prints `HH:MM @alice > hi` then `      re` (View.hs:2400-2402); a forward `@carol <- @alice hi` prints `HH:MM @carol <- @alice` then `      hi`; text with bold, italic, strike or colour markdown loses those markers (`@alice *b* !1 r!` prints `HH:MM @alice b r`; code and secret keep theirs; View.hs:2461-2462, Styled.hs:38-47; received items the same, View.hs:2362); `/feed <text>` prints `/feed (<n>) HH:MM <text>`, read with `nextLine()` and a prefix check (measured)
+  infix fun types(text: String)                // like Haskell `send`: types the text with verified input (Typing, below) and Enter, waits for no echo; for `/live` (a successful one is not echoed and its item is hidden while live, Terminal/Input.hs:64,91, View.hs:909-911) and for text typed into the live message that follows (the input line is pre-filled with the message, so the verified input line is that text plus the typed text, and Enter ends the live message with the whole line, Input.hs:101-110,186-196; the sender then prints `HH:MM @<contact> [LIVE] <text>`, View.hs:2400-2408, time prefix :2427-2429, which a later `expectsMessage` consumes; if that line never appears and the input row stops changing, the peer has locked up: ending the live message kills the prompt's blink thread, Input.hs:189-190, which may hold the terminal lock while it redraws, and `withTermLock`, Output.hs:138-142, doesn't release it on kill; measured 3 times in 100 Enters sent exactly on the blink, never with ordinary timing; the receiver already has the final text, so the harness restarts the peer with `stop()`/`start()`; the live state is set only after the core returns, which also overwrites the input line, Input.hs:68-72,101-113, so typing into the live message must wait until the receiver, the GUI, shows the LIVE item: typed back-to-back, the text went as a separate message and the live message stayed open, measured; the sender prints nothing to wait for)
+  infix fun expects(line: String)              // like <##: the next output line must equal this (polled, 6)
+  infix fun expectsMessage(line: String)       // like <#: the next line, with the timestamp stripped
+  fun expectsAny(vararg lines: String)         // the next N lines, in any order, like concurrently_
+  fun eventually(line: String)                 // skip lines until one equals this
+  fun nextLine(timeout: Duration = 10.seconds): String   // the next complete output line, returned rather than asserted (JSON responses such as `/_get chat … count=1`, a link the CLI prints for the GUI to paste)
+  fun repeatUntil(cmd: String, every: Duration, deadline: Duration, done: (String) -> Boolean): String   // sends cmd (as `sends`) every `every` until a line printed after it (its response or a later event, before the next send) satisfies `done`, returns that line; fails at the deadline. Catalogue rows that say "repeats <cmd> until …" use it (e.g. `/_connect plan 1 <link>` until the AUTH error, `/get servers summary 1` until the single `agent servers summary: {…}` line, about 4,600 characters and so wrapped and joined by the output model, contains `"_connDeleted":1`, a send every 2 s until the AUTH error line)
+  fun stop(); fun start()                      // PEERCTL: stop/start the process on the same database; start() returns once the input prompt is drawn
+  fun snapshot(): PeerSnapshot; fun restore(s: PeerSnapshot)  // PEERCTL: copy and restore its database files, including any -journal (a stopped CLI can leave one)
+  fun contactId(name: String): Long            // sends `/i @<name>` (as `sends`), consumes its echo, takes the first later line "contact ID: N" (View.hs:1885; v7.0.3 too) and removes the contiguous block from it through "peer chat protocol version range: …" (View.hs:1898/1945), or, with no active connection, through the last line of that response's batch (one response is printed as one locked batch, Output.hs:311-314; UI theme and custom-data lines, View.hs:1899-1900, would follow, and peers set neither); event lines before it stay for later `expects`
+}
+data class PeerFlags(val reactions: Boolean = false, val markRead: Boolean = false, val fullLinks: Boolean = false,
+                     val key: String? = null)   // `--key`, passed on every start (incl. the names-role restart and `start()`)
+data class PeerServers(val smp: String = "smp1", val xftp: String = "xftp1")   // `-s` / `--xftp-server` (8.2); `smp2`/`xftp2` run only in tests with code `SMP2`/`XFTP2`
+```
+
+- **Own directories, per test.** At the end of a passing test every peer and relay is stopped and waited for (`waitFor`, force-killed after a timeout; pty4j's `destroy()` sends SIGTERM to the process group and closes only streams that were never opened, so after `waitFor` the harness closes the pty's input and output streams itself, which frees the master fd; `destroy()` never sends SIGKILL, `destroyForcibly()` does), then its `<jvmDir>/t<n>` directory is deleted (a fresh CLI database is about 1.8 MB and a full run starts over 1,000 peers and relays); a deletion error is logged, not failed; a failing test also stops and waits for its peers and relays but keeps the directory for the report. Every CLI process (peers, relays, mobile hosts, fixture and `RelayPeer.run` one-shots) gets `TMPDIR=<its directory>/tmp` (for fixture one-shots, the directory of the database prefix), created before start: otherwise the agent's XFTP work folder is the system `/tmp` (the CLI passes no temp folder to the agent, Hs/Library/Commands.hs:271-273, so it falls back to `getTemporaryDirectory`, simplexmq Agent/Client.hs:1433-1436; the chat's own fallback is Hs/Files.hs:27; `--temp-folder`, Options.hs:421-426, would set the same in both builds, while `TMPDIR` also covers the chat's own temp use), and moving a received file into `$HOME/Downloads` with `renameFile` (Hs/Library/Subscriber.hs:410) fails with EXDEV when they are on different filesystems — `/tmp` is on the root filesystem here and `/home` on another, and the stable release has no copy fallback (in one experiment a 7.1.0.10 build completed a cross-filesystem receive, mechanism unknown, so the rule holds for every build); it also keeps peer temp files inside `t<n>`. Peers, relays and mobile hosts run with the repo root as working directory, so the catalogue's repo-relative paths (`/f #team tests/fixtures/test.pdf`) resolve: the CLI resolves file paths against its own working directory (Hs/Library/Internal.hs:743-745), and the test JVM's is `common/`. Each peer runs with `HOME=<jvmDir>/t<n>/peers/<name>` (`n` = the test's index in the JVM; a peer reused across tests would reopen a database that already has a contact `alice` from the previous test, and the new contact would become `alice_1`); `stop()`/`start()` inside one test keep the directory. `$HOME/Downloads` is created before the first start (received files go there only if it exists, otherwise to the temp directory, i.e. `TMPDIR`, Files.hs:29-32), and `-d` is always given (the default database would be the real `~/.simplex`, Terminal/Main.hs:26). Every peer also gets `--user-display-name <name>` and `--mute` (the network namespace doesn't isolate D-Bus, so unmuted peers would send desktop notifications).
+- **Terminal only.** The CLI runs the terminal UI, the `-p` WebSocket server, the headless mode or a single `-e` command (`src/Simplex/Chat/Terminal/Main.hs:31-43`), so interactive peers are terminal peers; structured data comes from typing `/_get …` and similar commands.
+- **Display flags.** The real CLI's defaults differ from the Haskell test client's (`testView`, `showReactions`, `markRead`, `showFullLinks` are on in tests/ChatClient.hs:184-189, `testView` at :308, and off in the CLI: src/Simplex/Chat.hs:117-123, with `--mark-read` an off-by-default switch, Options.hs:458-462). `testView` has no CLI option, so catalogue rows quote only lines the real CLI prints. The others are per-peer `PeerFlags`, set by `cli(name, flags = …)`: `--reactions` (received reactions are printed), `-r/--mark-read` (shown items are marked read, which starts a received timed message's timer), `--show-full-links` (full links, the "… link for old clients" lines; the option exists only in the current build: v7.0.3 has no such option and prints those lines unconditionally, View.hs:1053/1125/1187 at the tag, so `cli` passes the flag only to current-build peers). Rows that need a flag name it in their notes.
+- **pty.** The CLI needs a terminal (without one it crashes with `Prelude.undefined` from the terminal library), so peers run under pty4j with a fixed size: 4000 × 50, so that most output lines don't wrap (P1 checks that the longest full link fits; longer lines — JSON responses such as `/_get chat … count=1` — are joined by the output model below; a zero-size pty makes the CLI fail with `divide by zero`).
+- **Output model.** The CLI draws with absolute cursor positioning: it moves the cursor above the input line, writes the message, erases to end of line and lets the terminal scroll (Terminal/Output.hs:321-380), and it redraws the input line on every keystroke. The peer runs a VT screen model (cursor positioning, erase sequences, `\r`, scrolling) that keeps scrolled-off history and yields each output line once it is complete above the input line, with prompt prefixes removed and lines the terminal soft-wrapped at the pty width joined back (the model tracks the wrap flag of each row: a row is marked wrapped only when a printable character arrives with the last column already filled, so a line of exactly the pty width followed by erase and CR LF is not joined, and an erase while that wrap is pending keeps the last column, unlike xterm, which would lose the line's last character; verified against the stable CLI's 4,197-character `/_get chat` line); it counts one cell per code point, as the CLI positions text by character count (Output.hs:321-375), and ignores colour and cursor show/hide sequences; each peer keeps a cursor, as `getTermLine` does. P1 tests the model against the CLI's own output.
+- **Typing.** The CLI loses typed characters while it prints: every output event, including ones that print nothing (the sender's own status and receipt events, Terminal/Output.hs:144-158), runs `withTerminal` (Output.hs:92,97-98,311-319), and haskell-terminal starts a stdin reader for each such call that reads into a slot nobody empties and is cancelled when the call ends (terminal `Platform.hsc:58-70,149-166`); each event can take up to 2 characters, Enter included. Measured: 200 sends of about 85 characters while receipts arrived, 14 echoes didn't match and 2 had none; with no events arriving, 0 of 200. So `sends`, `types` and `contactId` write the text without Enter and poll the VT model's input line (the row after the prompt, which is `> `, or `> <chat name> [LIVE] ` / `> <chat name> [    ] ` while a live message is open, switching every second, Input.hs:112-113) until it equals the text; if it is unchanged for 200 ms and still differs (each keystroke redraws the whole line, Output.hs:336, so there is no short absolute deadline), they erase with Backspace, sent as DEL `0x7f`, the pty's erase character (`0x08` is read as Ctrl-H plus forward Delete, which erases nothing at the end of the line: haskell-terminal Decoder.hs:27, Platform.hsc:107; only VERASE maps to Backspace, Platform.hsc:104), until the line is empty (a stolen first character can leave a line longer than the text, because typing into an empty line inserts the active chat prefix, Input.hs:351-357), or in a live message down to the pre-filled text (see `types`), and retype (bounded retries, then the test fails). Only then they write Enter; `sends` then waits for the echo, and both `sends` and `types` wait until the input line no longer holds the typed text after either prompt (plain `> `, or the live prompt while a live message is open) and re-send Enter if it still does after about 500 ms (safe for `/live`: after its Enter the line is empty and then holds the pre-filled message, Input.hs:110, never the typed command; a successful Enter in a live message clears the line and sets the plain prompt at once, Input.hs:208,221) (an extra Enter on an empty line outside a live message does nothing, Input.hs:177, and submitting clears the line at once, Input.hs:215-221, so this can't submit twice). The CLI also inserts the active chat while keys arrive (Input.hs:234, 351-357): into an empty line for any first character except `@ # / > \ ! + -`, and after a space typed right after a lone `!`, `>` or `\` (the active chat is set by sending, reading, editing or deleting, Input.hs:78-81, 84, by received messages that notify, contact events and joining a group, Output.hs:178-180,189,191,194,202, and unset at Output.hs:196 and Input.hs:76, 82-83, 86; format Output.hs:236-252). So texts are written with an explicit chat (`@alice hi`), and for a text that starts with `! `, `> ` or `\ ` the peer types those two characters, waits until the input line starts with them (the CLI inserts the chat in the same redraw as the space), erases with DEL whatever follows them, then types the rest; the input-line check expects the full text. Measured over the same 200 sends: 0 corrupted, 0 missing echoes, 18 retypes; typing into a live message the moment the receiver shows it lost 2 characters in 7 of 60 runs (the live prompt's blink thread starts redrawing then, Input.hs:106,120-126), and with this rule 20 of 20 runs with a deliberately dropped character ended with the right text.
+- **Consuming output.** As in the Haskell tests, each `expects` consumes one line; helpers such as `connect()` consume the lines they cause. Lines a test doesn't care about are skipped with `eventually`.
+- **Contact ids differ from the Haskell tests.** A user created through `CreateActiveUser` — every real CLI user (`--user-display-name` or the prompt, Hs/Core.hs:151-157, :177) and the GUI's user (`apiCreateActiveUser` in `resetForTest`) — also gets the preset "Ask SimpleX Team" contact card and a notes folder (Hs/Library/Commands.hs:466-478; v7.0.3 too), so contact 2 is the card and the first real contact is 3; the Haskell test client creates users with `createUserRecordAt` (tests/ChatClient.hs:366) and has no card. Catalogue rows therefore use name commands where they exist (`/d alice`, `/set disappear @alice yes 3`, `@#team @alice <text>`, `/call @alice`, `! @alice <text>`, `/accept member #team @alice`), and `contactId(name)` for API commands that take only ids (`/_call end @<id>`, `/_get content types @<id>`, `/_send @<id> json …`, `/_set prefs @<id> …`). On the GUI the card is in `chatModel.chats` but hidden from the list (`filteredChats`, ChatListView.kt:1554; `isContactCard`, ChatModel.kt:1933); with the notes folder it still counts wherever the app counts `chatModel.chats` (the SimpleX Lock notice, App.kt:100, and the update notice, desktop Main.kt:69-73) and blocks the "You have no chats" state (ChatListView.kt:458), so catalogue 01 `youHaveNoChatsEmptyState` uses a fixture.
+- **Names only.** The GUI user and peers have display names only, so CLI lines read `alice: contact is connected`; a full name, description or badge would add text (View.hs:3022-3034).
+- `CliVersion.Current` = the CLI built by the runner (`cabal build -f uitest --builddir=dist-uitest exe:simplex-chat`, 7.1.1).
+- `CliVersion.Stable(tag)` = the release binary from the GitHub release `tag`: asset `simplex-chat-ubuntu-22_04-x86_64` for v6.4.2 and later, `simplex-chat-ubuntu-22_04-x86-64` for earlier tags (the fixture CLI v6.3.7 included; the other name returns 404), checked against the release's `_sha256sums`. The tag is a Gradle property, `-PuiStableTag=<tag>` (one per run), with the default `v7.0.3` pinned in `build.gradle.kts` (GitHub's "Latest" release on 2026-10-10; v7.0.4 is a pre-release) and bumped by hand; to test another release, run again with another tag. `uitestPrepare` downloads it outside the namespace into `~/.cache/simplex-uitest/cli/<tag>/`, verifies the published SHA-256, and writes the path into `env.properties`. The binary needs glibc 2.34 (the host has 2.36); it reports its own version (v7.0.3 prints `v7.0.0.12`), so tests never assert the tag in CLI output. A stable CLI can't be a remote host (`minRemoteHostVersion` 7.1.0.9, Remote.hs:81-82).
+- **Relays and mobile hosts** are CLI processes too. Relays run without a pty: `--relay --headless --user-display-name <name> -d <dir> -s <smp1> --xftp-server <xftp1>` (headless creates the relay address on first start and prints `Chat relay address is created:` followed by the link, Hs/Core.hs:190-196; `--relay-web-domain` and `--relay-web-dir` must be given together, Options.hs:295-298); the harness reads the link and registers the relay in the GUI's servers (or the settings test does it through the UI). A headless relay takes no typed commands, so `RelayPeer.run(cmd)` stops the relay, runs the command once with `-e <cmd> -t 3` and the running relay's `--relay`, `-s`, `--xftp-server` and `-d` options on its database, with stdin `/dev/null` (`-t` is the wait after the command, default 3 s, Options.hs:387-395, used at Terminal/Main.hs:61; the process must stay alive after the command returns, because async effects such as `/da`'s server-side deletion run in a background thread nothing waits for, simplexmq Agent.hs:1013, and after a restart the agent retries them only from its cleanup task 30 s later, Env/SQLite.hs:247 — with `-t 0` the deletion reached the server in 0 of 4 runs, with `-t 3` in 4 of 4), and starts it again (`PEERCTL`). A headless relay that has no address after the command (e.g. after `/da`) creates and prints a new one on start, and `RelayPeer.link` is refreshed from that output. `relay(…)` and `start()` wait for the `Chat relay address is created:` line (on later starts, `Current user: <name>`, Hs/Core.hs:87, the only line a headless relay prints then after the welcome banner, Terminal/Main.hs:38-41; a `start()` after a `run()` that deleted the address waits for the address line instead) with their own 60 s timeout (first start measured 4–8 s, slower while peers start). Relays are usable right after that line: messages wait on the SMP server until the relay subscribes (measured: delivery 0.41–0.43 s after a post sent the instant `Current user:` appeared, 0.35 s in steady state). Each relay restart logs `internal error: SEMsgNotFound "setMsgUserAck"`, which is harmless and must not fail a test that checks relay output for errors. Relay directories are per test, like peers'. Relays have no pty and don't read stdin, so they are started under `setpriv --pdeathsig KILL` and die with their JVM even when it is killed (the parent-death signal fires when the *thread* that spawned the process ends, so the harness spawns them from one daemon thread that lives as long as the JVM). Every CLI process (peers, relays, mobile hosts, fixture and `RelayPeer.run` one-shots) gets `TERM=xterm` and `LC_ALL=C.UTF-8` in its environment (in the C locale an emoji typed into the CLI silently kills its input thread, and one it prints kills it with `commitAndReleaseBuffer: invalid argument`, measured; emoji reach peers in normal rows, e.g. reaction lines; the host has `C.utf8`, and P1 asserts it); pty peers end with their pty when the JVM dies. A remote-desktop mobile host is a current-build terminal peer (catalogue 04 §K).
+- Peers that use SimpleX names need the names server role, which `-s` doesn't enable on the first start (Operators.hs:189-193). The Haskell tests enable it with `/_servers 1 <json>` (`enableNamesRole`, tests/ChatClient.hs:487-505), but the real CLI prints `/_servers` as text without server ids (View.hs:139, :1664-1690), so the harness has no JSON to edit. Instead `cli(…)` (and so `mobileHost(…)`) starts every peer once, stops it and starts it again before the test sees it: on every later start `-s` sets the servers with all roles, names included (src/Simplex/Chat.hs:300-304), so every peer on `smp1` (where the resolver is) can resolve names; no catalogue row depends on a peer failing to resolve one. The restart is needed for a second reason, so it stays even if the names role is set another way: the same per-event `withTerminal` calls save and restore the terminal settings, and on a peer's very first start this can leave the pty in echo mode, so every typed command comes back as an extra output line (measured: 8 of 21 and 5 of 12 first starts; 0 of 96 restarts). In addition `start()` clears ECHO and ICANON on the pty through its master fd (pty4j `UnixPtyProcess.getPty().getMasterFD()`; `tcsetattr` on the master changes the slave's flags, measured), and P1 checks that a started peer's pty does not echo. A new peer's first start creates its database and takes about 4–15 s depending on load (measured: one-shot 3.8–4.6 s; under a pty 4.6–11.2 s alone, 7.0–14.6 s with four in parallel; a restart 0.1–0.4 s), so `cli(…)` returns at once and does the first start, stop and restart in the background; the peer's first `sends`/`types`/`expects` waits for it, so a test's peers start in parallel (that wait has its own 30 s deadline, measured with the start–stop–start cycle in parallel: 9 peers 11.3 s, 21 peers 15.7 s, 20.6 s with 2 cores busy; the 9-peer member-list test would otherwise spend 45–110 s of its 2-minute deadline starting peers).
+- Kotlin can't define `##>` (`<` and `>` aren't allowed in JVM method names), so infix words keep the same shape.
+
+### 8.2 Servers: `uitest-servers`
+
+(As built: see 0.5.6. Differs: `smp1` only, args `<dir> <portBase>`, no control protocol or names resolver, no `restoreBaseline`; `xftp1` is configured in the GUI but not served (P1b); the process is spawned from the test thread during the first reset (bridge: its main thread), not from a dedicated daemon thread.)
+
+A test-only executable component in `simplex-chat.cabal`, built only with a manual flag:
+
+```
+flag uitest
+  manual: True
+  default: False
+
+executable uitest-servers
+  if !flag(uitest) || flag(client_library)
+    buildable: False
+  main-is: UITestServers.hs
+  hs-source-dirs: tests
+  other-modules: ChatClient, ChatTests.DBUtils, ChatTests.DBUtils.SQLite, NameResolver
+  default-extensions: StrictData (as in the test-suite)
+  ghc-options: -threaded
+  build-depends: (the test-suite's build-depends, incl. hspec with the same GHC conditional, wai, warp, http-types, sqlcipher-simple)
+  (client_postgres conditions copied from the test-suite: -DdbPostgres and ChatTests.DBUtils.Postgres; cabal-version 1.12 has no common stanzas)
+```
+
+The default-off flag keeps CI's `cabal build --enable-tests` from building it. `UITestServers.hs` reuses the server configurations of the Haskell tests in `tests/ChatClient.hs` (no simplexmq test modules are needed; the server code is in the simplexmq library), but runs each server as an `async` instead of the `with*` brackets, so a server can be stopped and started (starting an XFTP server first creates its `filesPath` with all parent directories (`createDirectoryIfMissing True`; `withXFTPServer'`, tests/ChatClient.hs:752-757, creates only the last directory), since the server doesn't create it and `reset` deletes the server's whole directory):
+
+- **Per server id** (`smp1`, `smp2`, `xftp1`, `xftp2`) its own `TestParams`: `tmpPath = <jvmDir>/servers/<id>` (created first), `portBase = base + 10 × index` (smp binds portBase+1, xftp portBase+2, ChatClient.hs:638/:709), and query-stats maps from `TM.emptyIO` (tests/ChatTests/DBUtils/SQLite.hs:7-13).
+- SMP: `smpServerCfg` (:635-685) with `serverStoreCfg = persistentServerStoreCfg` (:687-688; the default is `SSCMemory Nothing`, :645), so a stop/start keeps queues. The test server's message quota is 16 per queue (:640); `PEERCTL` tests send fewer than 16 messages to a stopped peer, except catalogue 02 `status_quotaExceeded_warningAlert`, which sends 17 to reach the quota.
+- XFTP: `xftpServerConfig` (:706-746), files, store log and stats under the server's own `tmpPath`.
+- **Distinct hosts.** `/_servers` rejects two servers with the same host (`USEDuplicateServer`, Operators.hs:555-562, compares the host only), so `smp1`/`xftp1` use `localhost` and `smp2`/`xftp2` use `127.0.0.1` (as tests/ChatTests/Profiles.hs:3240 does); the servers bind dual-stack, and clients check the CA fingerprint, not the host name.
+- **Names.** One `NameResolver` (Warp, tests/NameResolver.hs) runs for the process lifetime and `smp1` is started with `resolverNamesConfig` (NameResolver.hs:86) pointing at it, so registrations survive server restarts within a test. Its registry is an in-memory map with insert only (NameResolver.hs:37-55); `UITestServers.hs` adds a `clear-names` command that empties it, and `restoreBaseline()` sends it in every reset, so one test's registrations can't change another's result. The GUI's servers get the names role only in `NAMES` tests.
+- TLS: `tests/fixtures/tls/{ca.crt,server.crt,server.key}`; the harness starts the process with the repo root as working directory (the configs use relative paths). The fingerprint is fixed (`LcJUMfVhwD8yxjAiSaDzzGF3-kLG4Uh0Fl_ZIjrRwjI=`).
+- **Ports.** Each JVM takes the first free slot `k` (0 ≤ k < 120) by holding an exclusive lock (`FileChannel.tryLock`, an fcntl record lock; the channel and lock are kept in a static field, since a collected channel closes and releases the lock, and the slot file is never opened again in that JVM, as closing any descriptor of the file drops the lock) on `slot-<k>.lock` in the run directory for its lifetime (the runner creates a fresh run directory for each invocation, 7.1.1; a slot is released when its JVM exits, and a JVM shutdown hook first stops its peers and relays, closes `uitest-servers`' stdin and waits for it to exit, at most 10 s, and kills any remaining descendant processes (e.g. the `gsettings monitor` the theme detector spawns, which otherwise outlives every GUI JVM), so the next JVM on the slot never meets the old servers on its ports; `uitest-servers` is spawned like the relays, under `setpriv --pdeathsig KILL` from the same daemon thread, 8.1, which covers a JVM that is killed), and gives the process `base = 20000 + 100 × k`, so every port stays below the namespace's ephemeral range (32768–60999), where a fixed bind could collide with an outgoing connection. Other fixed ports a test opens (HTTP and SOCKS stubs, a chosen remote-desktop port) come from the same block.
+
+Control protocol on stdin/stdout, one line per command, every command run under `try`:
+
+```
+start <id> smp|xftp            → ready <id> <server address>
+stop <id>                      → stopped <id>      (after the server has saved its store: stop = cancel, which waits)
+reset <id>                     → ready <id> <server address>   (stop, delete the store, start: "restarted without its store")
+register <domain> [contact=<link>] [channel=<link>]   → registered <domain>
+clear-names                    → cleared
+(any failure)                  → error <id|-> <message>
+```
+
+The process sets `LineBuffering` on stdout (a pipe is block-buffered by default), and the harness ignores output lines that aren't control responses (server logs). It starts `smp1` and `xftp1` at launch and exits on stdin EOF (each SMP server replaces the process's SIGINT handler, so the harness ends it by closing stdin, then, after 10 s, SIGKILL from the shutdown hook's `destroyForcibly()` (7.1)). `TestServers.restoreBaseline()` in each reset starts or resets any server the previous test stopped or reset, stops `smp2`/`xftp2` if they ran, and clears the names registry. `smp2`/`xftp2` are started only for tests that need them (catalogue codes `SMP2`, `XFTP2`).
+
+`TestServers.configure(user)` sends `/_servers <userId> <json>` with the preset operator groups `enabled: false` and one custom group with `smp1` and `xftp1`; this needs no conditions acceptance (`APISetUserServers`, Library/Commands.hs:1805-1819, and `validateUserServers`, Operators.hs:537-596, never check it; disabled groups are skipped through `opEnabled`, :544, :592-593). The preset operators are global rows created at chat start (src/Simplex/Chat.hs:295) and enabled by default (Presets.hs:27/41). `configure` runs right after `startChat` (the core rejects `/_servers` with `chatNotStarted` before it, found in P1a); a fresh user has no connections, so nothing connects in between; a fixture database that already has a user is started by `initChatController` before `configure` (7.2), which is harmless because the run has no network and fixtures are created against the local servers (11.1). In `NAMES` tests the custom group's `smp1` also gets the names role (see **Names** above).
+
+This replaces the `smp-mini` approach: the `smp-server` executable doesn't build from the cabal tarball because the TH `embedDir` of `.well-known` is missing from `extra-source-files`.
+
+### 8.3 Network isolation
+
+(As built: as below for desktop (0.5.9); peers have no `--mute` yet, so the D-Bus point stands. The Android runner does not apply `wd.sh net isolate`, open item, 0.5.9.)
+
+The Gradle run executes in an unprivileged user, network and pid namespace with only loopback (runner script, 7.1.1). Everything it starts (test JVMs, CLI peers, relays, `uitest-servers`) inherits it. Checked on this host: loopback works, `localhost` resolves from `/etc/hosts`, public DNS and every public address fail with "Network is unreachable".
+
+- The isolation is network-only: D-Bus and X11 sockets are files and stay reachable, hence `--mute` for peers (8.1) and the recording notification manager for the GUI.
+- Tests can never reach public servers by accident, including the preset operators' servers.
+- Onboarding needs no core change: onboarding opens no connection (the conditions text is built into the core); after onboarding, the test calls `GuiUser.useLocalServers()` (same `/_servers` call as `configure`) before anything connects. `acceptConditions` re-enables the preset operators during onboarding (ChooseServerOperators.kt:301-305), which is why the call comes after "Chats" appears.
+- Remote desktop ("Link a mobile") works over loopback: simplexmq's `getLocalAddress` keeps 127.x addresses (ordering them last), and ConnectMobileView.kt:526 keeps `127.0.0.1` when it is the first address — in the namespace it is the only one.
+- Multicast discovery works on loopback with `ip route add 224.0.0.0/4 dev lo src 127.0.0.1` (without `src` the packet's source is 0.0.0.0 and simplexmq rejects it because the source must equal the invitation host, RemoteControl/Client.hs:387-389). All JVMs share one namespace and UDP port 5227, so multicast tests are in the `Multicast` category and run in the serial second pass (7.1.1). A multicast reconnect needs a stored pairing first (new hosts are refused over multicast, RemoteControl/Client.hs:118). (`ip link set lo multicast on`, also run, is not needed on kernel 6.18 but harmless; measured with a copy of simplexmq's Discovery.hs listener and sender: both group joins succeed and receive with source 127.0.0.1)
+- Inside the namespace every process runs as uid 0 of the user namespace; files it creates belong to the real user outside.
+- Link previews use `http://127.0.0.1:<port>` pages from the local HTTP server; `localhost` URLs are not parsed as links by the core (Markdown.hs:388).
+
+## 9. Screen objects and the DSL
+
+### 9.1 Screen objects
+
+(As built: see 0.5.1. Built screens: `App`, `ChatListScreen`, `NewChatScreen`, `UserPickerScreen`, `ProfilesScreen`, `AddressScreen`, `AppearanceScreen`, `ProfileScreen`, `ChatScreen`, `ContactInfoScreen`, `GroupInfoScreen`, `MemberInfoScreen`, plus the chat-list, onboarding and What's New helpers; no `GuiUser`, `ChatRow`, `ContactRequestRow`, `GroupInvitationRow`, `ConnectPlanAlert` or `RelayPeer`; `ChatListScreen.row()` returns the screen.)
+
+```kotlin
+class GuiUser(override val name: String, internal val d: UiDriver) : TestUser {
+  val chatList get() = ChatListScreen(d)
+  fun userPicker(): UserPickerScreen = chatList.openUserPicker()
+  fun settings(): SettingsScreen = userPicker().settings()
+  fun newChat(): NewChatSheet = chatList.newChat()
+  fun openChat(name: String, block: ChatScreen.() -> Unit = {}): ChatScreen = chatList.row(name).open(block)
+  fun useLocalServers()                        // after onboarding (8.3)
+  fun console(cmd: String): List<String>       // Developer tools → Chat console, for setup steps the UI has no button for
+}
+class ChatListScreen(private val d: UiDriver) {
+  fun row(name: String): ChatRow               // resolves name → chat id from chatModel, waits for exactly one match
+  fun request(name: String): ContactRequestRow // a contact with a pending request ("Open to accept"; accept/reject through the row menu)
+  fun invitation(group: String): GroupInvitationRow  // tap opens the "Join group?" alert (ChatListNavLinkView.kt:196-199)
+  fun openUserPicker(): UserPickerScreen
+  fun newChat(): NewChatSheet
+  fun pasteLink(link: String): ConnectPlanAlert
+}
+class ChatRow(private val d: UiDriver, val key: UiKey) {
+  val unread: UiUnread; val incognito: Boolean; val node: UiNode
+  fun open(block: ChatScreen.() -> Unit = {}): ChatScreen; fun menu(action: String)
+}
+class ContactRequestRow(private val d: UiDriver, val key: UiKey) { val node: UiNode; fun accept(incognito: Boolean = false): ChatRow; fun reject() }
+class GroupInvitationRow(private val d: UiDriver, val key: UiKey) { fun join(): ChatRow; fun delete() }
+class ChatScreen(private val d: UiDriver) {
+  val title: UiNode; val banner: UiNode
+  val messageText: String; val placeholder: String   // the compose field's text and placeholder, through UiDriver.composeField() (7.4); on Android read from its EditText (catalogue 05 setup item 5)
+  fun send(text: String)                       // Ui.Chat.Message + Ui.Chat.Send
+  fun item(text: String): ChatItemNode         // text matched inside chat.item[…] nodes only
+  fun shouldSeeMessage(text: String)           // waits for an item with this text
+  fun info(): ChatInfoScreen
+}
+class ChatItemNode(private val n: UiNode) { val sender: String?; val meta: UiItemMeta; fun menu(action: String) }
+class NewChatSheet(private val d: UiDriver) { fun createOneTimeLink(): String; fun createGroup(name: String): ChatScreen; fun createChannel(name: String): ChatScreen }
+class ConnectPlanAlert(private val d: UiDriver) { val profileName: String; fun openNewChat(): ChatScreen }
+class UserPickerScreen(private val d: UiDriver) { fun address(): AddressScreen; fun settings(): SettingsScreen; fun profiles(): ProfilesScreen }
+class SettingsScreen(private val d: UiDriver)
+class AddressScreen(private val d: UiDriver) { fun create(): String; fun businessAddress(on: Boolean) }
+class ChatInfoScreen(private val d: UiDriver)      // members added by the sub-areas that use them
+class ProfilesScreen(private val d: UiDriver)
+class RelayPeer(val name: String) { val link: String; fun run(cmd: String): List<String>; fun stop(); fun start() }  // 8.1
+```
+
+The address screen is reached from the user picker ("Create SimpleX address" / "Your SimpleX address", UserPicker.kt:220-223); Settings has no address entry. Names resolve to ids through `chatModel` (the test runs in the same JVM), so a test says `row("bob")` while the driver finds `chatList.row[@12]` regardless of list order. Each catalogue sub-area adds the screen objects its tests need.
+
+### 9.2 DSL entry
+
+(As built: `uiTest { }` takes no parameters; `app(user: String?): App` (`null` = onboarding boot); `restart(): App`; `cli(name, flags)`; `connect(peer)` and the other helpers of 0.5.7. `app()` is not limited to one call per test. Not built: `realTimes`, `fixture`, `relay`, `mobileHost`, `servers`, `allowUncaught`, `screenshot`, `shouldHave`, `peerVersion`.)
+
+```kotlin
+abstract class UiTest {                        // base class: per-JVM setup in its companion, watchdog, report on failure
+  open val peerVersion: CliVersion = CliVersion.Current      // `…CompatStableTest` subclasses override it (10.1)
+  fun uiTest(realTimes: Boolean = false, block: UiTestScope.() -> Unit)   // realTimes: display clock off (7.7)
+  inner class UiTestScope {
+    fun app(name: String, onboarded: Boolean = true, fixture: ((String) -> Unit)? = null): GuiUser  // runs resetForTest; first call, once per test
+    fun cli(name: String, version: CliVersion = peerVersion, flags: PeerFlags = PeerFlags(), servers: PeerServers = PeerServers()): CliPeer   // 8.1
+    fun relay(name: String, web: Boolean = false, register: Boolean = true): RelayPeer  // headless relay; registered in the GUI's servers unless register = false (relay-settings tests add it through the UI); run(cmd) via stop + `-e` + start
+    fun mobileHost(name: String): CliPeer                           // current-build CLI acting as the remote-desktop host, created as cli(name, CliVersion.Current) (the start–stop–start cycle of 8.1 included)
+    val servers: TestServers                                        // stop/start/reset (SRVCTL), register names (NAMES)
+    fun restart(fixture: ((dbPrefix: String) -> Unit)? = null)      // RESTART: restartCore(fixture) (7.3)
+    fun connect(gui: GuiUser, peer: CliPeer)                        // one-time link from the GUI, joined by the peer; consumes its lines
+    fun <T : Throwable> allowUncaught(type: KClass<T>, block: () -> Unit)   // a step expected to raise an uncaught app error of this type (6)
+    fun screenshot(name: String, of: UiNode? = null)                // named shot (7.7); every passing catalogue test also saves one at its end (except realTimes tests and -PuiShots=off); in a realTimes test it fails
+    infix fun UiNode.shouldHave(m: SemanticsMatcher); infix fun ChatRow.shouldHave(m: SemanticsMatcher)
+    infix fun <T> T.shouldBe(expected: T)
+  }
+}
+```
+
+`app()` must be the first call of a test and may be called once; a second call fails. Across tests the JVM is reused through `resetForTest` (7.3).
+
+### 9.3 Example tests
+
+(As built: the three tests exist as `OneTimeLinkCompatTest`, `AddressCompatTest` and `JoiningCompatTest` without stable subclasses. `JoiningCompatTest` reads `connect(bob)`, `alice.chatList.open("team")`, `click(Ui.Alert.Confirm(Ui.AlertSource.Shared))`, `bob.eventually("#team: alice joined the group")`.)
+
+These are catalogue rows written in the DSL (the names are catalogue names). All three rows include `S`, so their tests live in `…CompatTest` classes with a stable subclass (10.1).
+
+```kotlin
+package chat.simplex.app.ui.main
+
+open class OneTimeLinkCompatTest : UiTest() {        // catalogue 01, "1-time link"
+  @Test fun oneTimeLinkCliConnectsViaShortLink() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    val link = alice.newChat().createOneTimeLink()
+    bob sends "/c $link"; bob expects "confirmation sent!"
+    bob expects "alice: contact is connected"
+    alice.chatList.row("bob")                          // the pending row has become contact "bob"
+  }
+}
+@Category(StableCompat::class)
+class OneTimeLinkCompatStableTest : OneTimeLinkCompatTest() { override val peerVersion: CliVersion = CliVersion.Stable() }
+
+open class AddressCompatTest : UiTest() {            // catalogue 01, "Address"
+  @Test fun addressCliConnectsAndRequestAppears() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")
+    val address = alice.userPicker().address().create()
+    bob sends "/c $address"; bob expects "connection request sent!"
+    alice.chatList.request("bob")                      // contact row with "Open to accept" (accepting is another row's test)
+  }
+}
+@Category(StableCompat::class)
+class AddressCompatStableTest : AddressCompatTest() { override val peerVersion: CliVersion = CliVersion.Stable() }
+```
+
+```kotlin
+package chat.simplex.app.ui.groups
+
+open class JoiningCompatTest : UiTest() {            // catalogue 03, "Joining"
+  @Test fun groupInvitation_tapRowShowsJoinAlert() = uiTest {
+    val alice = app("alice"); val bob = cli("bob")    // bob is the group host
+    connect(alice, bob)
+    bob sends "/g team"; bob expects "group #team is created"
+    bob expects "to add members use /a team <name> or /create link #team"
+    bob sends "/a team alice"; bob expects "invitation to join the group #team sent to alice"
+    alice.chatList.invitation("team").join()          // tap the row → «Join group?» → «Join»
+    bob expects "#team: alice joined the group"
+  }
+}
+@Category(StableCompat::class)
+class JoiningCompatStableTest : JoiningCompatTest() { override val peerVersion: CliVersion = CliVersion.Stable() }
+```
+
+Each test asserts what its catalogue row lists; the bodies above show the shape.
+
+### 9.4 Key lint
+
+(As built: not built. Superseded for now by the 2026-10-14 minimal-app-code rule (13), which makes "keys everywhere" a non-goal.)
+
+A UI test that opens every screen reachable through the screen objects and fails if any node with a click action has no `TestTag` (a semantics walk: `SemanticsActions.OnClick` present, `TestTag` absent), with two exemptions no `Modifier.ui` can reach: `LinkTestMarker` link nodes whose nearest ancestor carrying a `TestTag` in the merged tree is their `Text` or the row it merges into (3.5), and the `ModalBottomSheetLayout` scrim that Material adds while a sheet is shown (matched as `OnClick`, no role, no `TestTag`, content description ["Close sheet"] and no children, not by bounds: start-modal sheets are 388 dp wide, measured; CreateProfile's image sheet, WelcomeView.kt:73; the profile editor's, UserProfileView.kt:80; AddGroupView.kt:88, AddChannelView.kt:248, GroupProfileView.kt:89, the attach sheet ChatView.kt:990). Screens that can't be reached in a test — composables not reachable from the UI (`BadgesYourLevelView` and `BadgesPayView`, behind the uncalled `ChooseLevelButton`, BadgesSupportSimplexView.kt:77) and the badge-display screens, which need a badge credential the harness doesn't have — are excluded; their keys are added anyway. It keeps "keys everywhere" true once all areas are keyed. A second, source-level check lists the top-level `var`s of the app's UI files (commonMain and desktopMain `views/`), and the top-level `val`s there whose type is mutable (`MutableState`, `MutableStateFlow`, mutable collections; e.g. `chatViewScrollState`, ChatView.kt:3230; `connections`, CallView.desktop.kt:28; `failedComposables`, Utils.kt:633), and fails on any that is not in the reset list of `clearUiState` (7.3) or an explicit allow-list (extension properties without a backing field hold no state and are skipped, 7.3), so file-level UI state added later is reset too.
+
+## 10. Test catalogue (all screens, all features)
+
+The catalogue is the definition of "thorough": one row per user-facing feature, with the entry path (exact `strings.xml` labels), the main file:line, the test method names, what the GUI must show and what the CLI peer must print (with the matching Haskell test), what the test needs, and notes. `00-legend.md` holds the shared format, Needs codes, output conventions, the owner of each overlapping feature and the class map (sub-area → test class and package).
+
+| File | Area | Sub-areas | Tests | Ignored |
+|---|---|---|---|---|
+| `01-onboarding-chatlist-connect-profiles.md` | Onboarding, What's New, chat list (search, filters, lists, rows, row menus, requests, pending connections, cards), servers summary, user picker and chat profiles, new chat sheet, 1-time links, contact/address connection plans, prepared direct chats, pending connection info, address and business-address settings, SimpleX name, contact info, preferences, delete-contact variants | 15 | 352 | 0 |
+| `02-chat-view-messages.md` | Chat view shell and toolbar, composing (markdown, links, previews, mentions, bot commands), live and timed messages, voice, attachments, replies, edit and history, delete and rendering of moderated items, multi-select, forwarding, reactions, copy/share/save, member-side reports, item info, unread and scrolling, search and content filters, drafts, status icons, special items, notes, context menus and keys | 24 | 281 | 4 |
+| `03-groups-channels-business.md` | Create group, invite, group info rows, profile and welcome message, group preferences, member admission and review, group link, joining and group/channel/business plans, member list and multi-select, member info, member contacts, support chats, moderator-side reports, moderation, mentions-only notifications, events and history, leave/delete/clear, channels as owner and as subscriber, business chats from both sides | 20 | 312 | 4 |
+| `04-settings-database-remote.md` | Settings root, privacy, SimpleX Lock and self-destruct, appearance, network and servers, calls settings, chat data and database, migration, version and developer tools, help, startup notices, remote desktop "Link a mobile" (desktop is the controller, a CLI is the host), supporter-perks screens without badge display | 13 | 232 | 20 |
+| | | **72** | **1,177** | **28** |
+
+The four catalogue files and the legend live in `plans/ui-tests/catalogue/` while the plan is in review; P1 moves all five into the repo at `apps/multiplatform/common/src/desktopTest/resources/uitest-catalog/` (with `05-android-only.md` and `05-android-carryover.md` beside them, for the Android harness) (their paths are already repo-relative), and tests read them from the classpath.
+
+### 10.1 Rules
+
+(As built: none of the category, Compat-stable or traceability machinery is built (P1b). Tests outside these rules exist: desktop-only tests in `chat.simplex.app.ui.desktop` (`OnboardingTest`, `…DesktopTest`) and Android-only tests in `chat.simplex.app.ui` and `chat.simplex.app.ui.back`; the traceability check needs a rule for them before it is built.)
+
+- **Classes.** Each sub-area maps to one test class, or to several consecutive classes when it has more than 30 tests (82 class bases in all; the legend's class map lists each base and its first test; the package is `chat.simplex.app.ui.<main|chat|groups|settings>` for catalogues 01–04, legend rules). A base with `S` tests has, for those tests, `open class <Base>CompatTest` and `@Category(StableCompat::class) class <Base>CompatStableTest : <Base>CompatTest()`, which overrides `peerVersion`; its other tests are in `<Base>Test`. JUnit 4 runs the Compat tests once per peer version. Test method names are the catalogue names. `S` is never combined with `RELAY`.
+- **Traceability check.** `CatalogueTraceabilityTest` is a plain JUnit test (it doesn't boot the app). It parses catalogues 01–04 from the classpath (not 05, which belongs to the Android harness) and fails if:
+  - a catalogue name has no declared `@Test` method in its mapped class (the Compat class for `S` names), or has more than one;
+  - an `IGNORE` name's method lacks `@Ignore`, or its reason differs from the row's (the cell text after `IGNORE: `, verbatim);
+  - a method's Needs-derived categories (method and class annotations) differ from those its row implies (`RELAY` → `NeedsRelay`, `NAMES` → `NeedsNames`, `FIXTURE` → `NeedsFixture`, `MCAST` → `Multicast`, `SLOW` → `Slow`); `Smoke` and `StableCompat` are not compared;
+  - a base with `S` names lacks `<Base>CompatStableTest` with `@Category(StableCompat::class)` overriding `peerVersion`;
+  - a `@Test` method in `chat.simplex.app.ui` has no catalogue row (except the traceability test, the key lint and its source-level check (9.4) and the harness's own tests in `chat.simplex.app.ui.harness`: VT model, longest link, reset completeness, alert dismissal by reflection, render cost; the harness tests carry no `Smoke` category);
+  - a committed screenshot under `uitest-screenshots/` belongs to no catalogue test (its `<TestClass>/<test>` has no catalogue name);
+  - in strict mode (`-PuiStrict`, passed to the test JVM as `simplex.uitest.strict`, 7.1; P7), any non-`IGNORE` name still carries `@Ignore`.
+- The check finds classes by walking the test classes directory and loads them with `Class.forName(name, false, loader)`, so no test class is initialised (initialising one would run `UiTest`'s per-JVM setup).
+- **Assumption skips.** A test may skip itself through a JUnit assumption only where its row says so (one row: catalogue 02 `meta_signature_missingAlert`, which depends on the stable tag); the runner reports skips separately from passes.
+- **Overlaps are tested once.** The owner of each overlapping feature is fixed in `00-legend.md`.
+- **Badge display stays excluded.** No row asserts a badge; the supporter-perks screens are tested without badge display.
+- **Categories.** `XFTP` needs no category (`xftp1` runs in every JVM). `StableCompat` marks the stable subclasses. `Smoke` marks one test per sub-area with runnable tests (71, P2), never an `MCAST` test; `CatalogueTraceabilityTest` also carries `@Category(Smoke::class)`, so `-PuiTags=Smoke -PuiExcludeTags=StableCompat` runs the 71 smoke tests plus the traceability check.
+
+### 10.2 Runtime and resources
+
+Per test: a reset (database, prefs, composition; a few seconds) plus the test itself (5–20 s typical; the 30-second timed-message test and the other `Slow` tests up to 10 min). The full suite is several hours serially. Classes run in parallel with `-PuiForks=N`; each JVM has its own data directory and its own server ports. Memory: the Gradle single-use daemon (~2 GB, `org.gradle.jvmargs`), plus per parallel JVM a 2 GB heap, the native core, `uitest-servers` and the peers (an idle CLI peer is about 60–80 MB RSS; the 21-member group test needs about 1.7 GB of peers). As built, the runner picks `-PuiForks` from free memory: (MemAvailable − 2.5 GB) / 1 GB, between 1 and 4, unless `-PuiForks=N` is given, and refuses to start with less than 3 GB available (15.4 item 24); pass a lower `-PuiForks` when a class with a large group runs. The `Smoke` run (71 sub-areas with runnable tests, plus the traceability check) boots 71 JVMs, each with a boot, server start, a reset and one test. With `forkEvery = 1` (the design; as built the default is 0, 0.5.9) Gradle also forks a JVM for every other class whose tests the categories filter out (verified with Gradle 8.12; such a JVM initialises no test class and exits quickly), so about 115 forks in all: an estimated 30 minutes serially and about 15 with 2 forks (P1 measures it). It is meant for checks before a PR, not for every edit; a single class runs with `--tests`.
+
+## 11. Infrastructure the catalogue needs
+
+### 11.1 Harness pieces (test code only)
+
+| Piece | Used by (Needs code) | How |
+|---|---|---|
+| Local SMP and XFTP servers | everything (`SMP`, `XFTP`) | (As built: `smp1` only; `xftp1` is configured in the GUI but not served, P1b, 0.5.6.) `uitest-servers` `smp1`/`xftp1` (8.2), once per JVM; peers get `-s`/`--xftp-server`, the GUI gets them in `resetForTest` (or `useLocalServers()` after onboarding) |
+| Second SMP / XFTP server | private routing, sent-via-proxy, unknown-XFTP approval, manual server add, a member connection that fails (`SMP2`, `XFTP2`) | `uitest-servers` `smp2`/`xftp2` on host `127.0.0.1` |
+| Names | SimpleX names (`NAMES`; 13 tests) | the process-lifetime resolver behind `smp1` and `register` lines; GUI and peers get the names role |
+| Chat relays | channels and relay settings (`RELAY`; 90 tests) | headless relay processes (8.1) |
+| Network namespace | every test | 8.3 |
+| CLI peers | `P`, `S` | `CliPeer` (8.1): the current build from `dist-uitest`, or the release binary where a `P` row names a stable peer; for `S`, the release binary, in `…CompatStableTest` (10.1). Peers use `smp1`/`xftp1` unless a row puts them on `smp2`/`xftp2` (`PeerServers`) |
+| Multicast | `MCAST` | the loopback multicast route (8.3); `Multicast` category, run serially in the second pass (7.1.1) |
+| Developer tools | `DT` | `appPrefs.developerTools.set(true)` after `app()` (SimpleXAPI.kt:149); the toggle itself is tested through the UI in catalogue 04 |
+| Local HTTP server | link previews (`HTTP`) | serves pages with Open Graph tags on `http://127.0.0.1:<port>`; `privacyLinkPreviewsShowAlert` is pre-set except in the first-time-alert tests |
+| SOCKS5 stub | SOCKS proxy routing (`SOCKS`) | in-JVM SOCKS5 server on a port from the JVM's block, with RFC 1929 username/password auth (the default proxy mode isolates by credentials, SimpleXAPI.kt:5301) and domain addressing; records CONNECTs to the local SMP port |
+| Server control | delivery errors, retries, upload/download failures, address-switch abort (the switch stays abortable only while the SMP server is stopped) (`SRVCTL`) | `stop`/`start`/`reset` (8.2); races are avoided by stopping the server before the action (a 17 MB file leaves only about 0.4 s of visible upload and about 1 s of download, measured, so a large file alone doesn't avoid them); an XFTP request in flight when its server is reset hangs until its request timeout (TCP connection background timeout + protocol background timeout + 4096 KB × the per-KB timeout: `http2RequestTimeout` adds the connection timeout to the chunk timeout, simplexmq Transport/HTTP2/Client.hs:189-194, 209-210, FileTransfer/Client.hs:209-214, 300-306), and the retry 2 s later gets AUTH at once; the error arrives 75 s after the reset with CLI defaults (127 s with `--tcp-timeout 14`; 118 s with the GUI's 30 s background timeout and 10 ms/KB, SimpleXAPI.kt:5256-5258), so a test that resets an XFTP server during a transfer first sets short network timeouts and passes an explicit timeout, or is `Slow` with an explicit 180 s timeout (measured, matching that sum plus the 2 s retry — 57 s with the lowest values the settings UI offers, about 20 s with the UI's lowest per-KB value plus `/network socks=off timeout=1` in the chat console, which catalogue 02 `sndFile_xftpResetDuringUpload_showsFileError` uses); the next reset restores the baseline. After a plain stop/start of the XFTP server, by contrast, an in-flight upload may hang the same way (2 of 4 measured runs; the other 2 finished 0.8–1.7 s after the start) and then completes: the store log keeps the FNEW record, so the retried chunk is accepted (tests/ChatClient.hs:711-712, simplexmq FileTransfer/Server/StoreLog.hs:121-123, FileTransfer/Server.hs:572-605); while the server is still down the errors are temporary and never surface: each round of 3 attempts ends, after the backoff that follows the third failure, without an error, and the worker restarts at once (FileTransfer/Agent.hs:268-277, 520-544, Env/SQLite.hs:257, Agent/Client.hs:2311), taking the chunk with the fewest retries (each retry adds 1, AgentStore.hs:3777, 3824) from its stored delay, so the upload resumes once the server is back, though after a longer outage the next attempt can be up to 180 s away. After a restart, clients reconnect with backoff from 2 s up to 180 s (simplexmq `defaultReconnectInterval`, Agent/Env/SQLite.hs:197-202; message delivery retries cap at 120 s, :205-219; both stay at 2 s for 10 s, then grow ×1.5), which `UiIdle` doesn't see. `/reconnect` (`ReconnectAllServers`) does not shorten this: with the server down the agent holds no connection to close, and the resubscription and delivery workers keep sleeping (Agent/Client.hs:1048-1079 closes only existing clients; the resubscription worker, Client.hs:820-853, and delivery retries, Agent.hs:2601, keep sleeping; measured: 40 s down → delivery 14.9 s after the start, with or without `/reconnect`; 10 s down → 3.2 s; 20 s → 4.4 s). So tests keep outages under about 10 s (the backoff stays at 2 s for the first 10 s), or stop and start their CLI peers after the server starts (`PEERCTL`, delivery within about 2 s, measured 0.9 s unencrypted and 1.5 s with `--key`; the GUI side the same with `restart()`, about 1–3 s), or pass an explicit timeout of about half the outage plus 5 s |
+| Peer control | ratchet sync, offline peers, stopped relays (`PEERCTL`) | `CliPeer.stop/start/snapshot/restore` (8.1), `RelayPeer.stop/start` (9.1) |
+| Core restart inside a test | passphrase prompts, lock screen, startup DB errors, persistence, self-destruct, notices checked at first composition (`RESTART`) | `restart()` (7.3) |
+| Boot without a user | onboarding (`ONBOARD`) | `app(name, onboarded = false)` (7.2); `ONBOARD` means the test boots with no user |
+| Database fixtures | legacy states, startup DB screens, invalid-data items, backdated items (`FIXTURE`) | `app(name, fixture = …)` (7.2), or a fixture passed to `restart(fixture)` (applied while the core is stopped, 7.3) for data the test produced itself. **SQL edits** (backdating, fake migration rows, legacy rows) use the current CLI, as the system `sqlcipher` (3.x) can't open SQLCipher 4 databases: `<current CLI> -d <prefix> [--key <key>] --maintenance -y -e "/sql chat <SQL>" -t 0`, with stdin `/dev/null` (with several users and none active the CLI would otherwise wait at "Select user profile:"; it re-activates a lone inactive user on open, so a fixture that clears `active_user` does that last), and the helper fails if the output contains `chat db error` (a failing `/sql` still exits 0) (or `/sql agent`; `--maintenance` doesn't start the chat; `-y` confirms pending migrations, which the default console mode would prompt for, Simplex/Chat.hs:77, e.g. on a v6.3.7 fixture). The database must already have a user: with none the CLI exits with "no active user in maintenance mode" (Hs/Core.hs:89-91), so SQL edits apply only to databases that have a user (the GUI's own after onboarding, or one created by a CLI). The key is `ksDatabasePassword.get()` for the GUI's own database and absent for a fixture database created unencrypted. **Databases from an older CLI** (`-PuiFixtureTags`, default `v6.3.7`, the last release before short links; downloaded by `uitestPrepare`; path from `UiEnv.fixtureCli(tag)`) are created without a pty and without `CliPeer` flags (v6.3.7 has no `--user-display-name`): `printf '<name>\n' \| <cli> -d <prefix> -s <smp1 address> -e '<cmd>' -t 1`, the display name answered on stdin; with no `--key` the database is unencrypted, which the GUI opens with the empty key (7.2). Fixtures always use the local servers |
+| TTL expiry | chat TTL tests | setting or lowering a TTL through the UI expires backdated items at once (`APISetChatTTL`/`APISetChatItemTTL`, Library/Commands.hs:1842/1884); group items created in the last 12 h are kept (:5969-5970), so fixtures backdate both `item_ts` and `created_at` by more than 12 h. Only "expires on startup" waits for the expiration thread (first run 30 s after start, then every 30 min, src/Simplex/Chat.hs:124-127) and is `Slow` |
+| Stubs | `FD`, `CB`, `URI`, `NTF`, `TOAST` | file dialogs (7.6), in-memory clipboards, recording `LocalUriHandler`, `RecordingNtfManager`, recorded toasts, AppLock focus simulation (`appWasHidden()` + `recheckAuthState()`), `escape()` |
+| `platform` object | app-update notice | `UiTestPlatform`, the same `PlatformInterface` as desktop/Main.kt:65-90 |
+| Pre-set prefs | every onboarded test not about them | `laNoticeShown`, `appUpdateNoticeShown`, `whatsNewVersion` (via `setLastVersionDefault`), `oneHandUICardShown`, `addressCreationCardShown`, `getStakeBannerDismissed`, `supporterBannerShown`, `showHiddenProfilesNotice`, `showMuteProfileAlert`, `showDeleteConversationNotice`, `showDeleteContactNotice`, `privacyDeliveryReceiptsSet`, `privacyLinkPreviewsShowAlert`. Tests about a notice clear its pref; notices checked once at first composition (SimpleX Lock notice, App.kt:94-103; app-update notice, desktop Main.kt:79-87; What's New, ChatListView.kt:219-228) need a `restart()` after their conditions are set up Separately, the per-JVM baseline (7.2 `bootJvm`, before `PrefStores.capture`) sets `AppearanceBarsBlurRadius` = 0, toolbar blur off, for every test including onboarding boots (user decision 2026-10-13, performance); `appearance_toolbarBlur` switches it on itself. |
+| Fixture files | attachments | In the repo: `tests/fixtures/test.jpg`, `test.pdf`, `test_1MB.pdf`, `test.txt`; `images/files.gif` (animated GIF, 1.0 MB); `website/src/video/connect.mp4` (1.9 MB, over the 1023 KB auto-receive limit); `docs/themes/example.theme` (theme import). Added in P1 to `apps/multiplatform/common/src/desktopTest/resources/uitest-fixtures/`, generated once with ffmpeg (commands in a README beside them, `-fflags +bitexact`, so they are reproducible) and committed: `small.mp4` (a 2 s test pattern, under 1023 KB), `audio.webm` (audio only), `video.webm` (with a video track), `broken.mp4` (random bytes with an .mp4 name, undecodable). Written by the harness at run time: a 150 MB file of random bytes (the XFTP-reset-during-upload test needs a few seconds of visible upload; a 17 MB file gives about 0.4 s), a sparse file over 1 GB, and a JPEG over 510 KiB (received as an image that isn't auto-accepted) |
+
+### 11.2 App-side seams
+
+Besides keys and typed semantics (which include the `PlatformTextField` key parameter of 3.3 and making `keyForItem` internal) and the `UiIdle` busy tracker of section 6 (hooks in `ChatController.sendCmd`, `startReceiver`, `withBGApi`/`withLongRunningApi`/`withApi`; approved 2026-10-13 and implemented, 0.5.2), the catalogue needs three seams, which are approved, and the screenshots (7.7) need a fourth, the display clock (approved 2026-10-12). Each is an `internal var` (or constructor parameter) defaulting to the production implementation. `bootJvm` installs the fakes of the three catalogue seams for every test (the display clock is set per test by `uiTest(realTimes)`, 7.7) (the production implementations need VLC, audio devices or an AWT clipboard, and some paths reach them without asserting on them), and `clearUiState` resets their per-test state together with the app's globals around them (`AudioPlayer.currentlyPlaying`, D/platform/RecAndPlay.desktop.kt:95; `RecorderInterface.stopRecording`, C/platform/RecAndPlay.kt:10); the catalogue codes mark the rows that drive or assert on a seam.
+
+| Seam | Location | Unblocks |
+|---|---|---|
+| Recorder factory | D/platform/RecAndPlay.desktop.kt:25-90 (VLC `pulse://`/`dshow://`) | voice recording and voice drafts (9 tests; catalogue code `REC`) |
+| Audio player / video frame provider | RecAndPlay.desktop.kt:92, D/platform/VideoPlayer.desktop.kt:217 (player), :221 (`getBitmapFromVideo`), :269 (`hasVideoTrack`) | voice playback, video previews and playback, the decoding-error alert, the video-or-file choice for pasted .webm files, the incoming-call ringtone (11 tests; code `AV`); the seam is an app-side interface (vlcj's `MediaPlayer.status()`/`media()` and their API classes are final and need native libvlc, so the fake can't be a vlcj object); the fake starts at position 0 and advances on the real clock (a fake that reports the end on the first poll raced the two assignments `play()` makes after `start()` returns, leaving the pause icon in 64 of 600 runs), and at the end of a track it reports a position equal to the media duration (`status().time()` == `media().info().duration()`, RecAndPlay.desktop.kt:269-273) while `isPlaying` is still true, as VLC does (:132-137), so the app's poll ends playback and sets progress to 0 for `resetOnEnd` (voice items, CIVoiceView.kt:66) or to the full duration (the compose preview, ComposeVoiceView.kt:56), :209-212, instead of leaving a partial slider |
+| Display clock | `getTimestampText`, `getTimestampDateText`, `localTimestamp`, `localDate` (C/model/ChatModel.kt:3944-3998), `FloatingDate` (C/views/chat/ChatView.kt:2894), the 60 s grouping check (ChatView.kt:3765, :3784), the SimpleX-name sale countdown (SetSimplexNameView.kt:195-205): an `internal var` with `displayInstant(t)` and `displayNow()`, production = identity and `Clock.System.now()` | stable screenshots (7.7): in UI tests every displayed time and "now" map to one fixed instant (all tests unless `realTimes = true`) |
+| Clipboard read on Ctrl+V | D/platform/PlatformTextField.desktop.kt:147-152 (AWT system clipboard, throws headless) | Ctrl+V in the compose field when the clipboard holds plain text or an image rather than a file list (1 test; code `IMGCB`) |
+
+OS drag and drop is not exercised: the drop target (`desktopOnExternalDrag`, D/platform/Modifier.desktop.kt:19-58, used at ChatView.kt:979-987) needs an AWT drop event, and the compose state it feeds is local to `ChatView` (ChatView.kt:148). The attach path behind it (`onFilesAttached`, ComposeView.kt:290) is reached by Ctrl+V of a file list from the in-memory clipboard (PlatformTextField.desktop.kt:144-145 → ComposeView.kt:1516). Message links are clicked through the text layout (3.5, no app change).
+
+### 11.3 Out of reach in-process (rows marked `IGNORE` with one of these reasons)
+
+- Real WebRTC calls (the browser page).
+- Tray, close-to-tray, window size/position persistence, the floating console window, the crash-restart loop and crash alert.
+- The app-update download (hard-coded GitHub URL and private HTTP client).
+- OS folder opener (`desktopOpenDir`), until the seam in section 13 is approved.
+- OS drag and drop onto the window (11.2).
+- Destinations on public servers (e.g. "Follow SimpleX Network News", badge-code redemption, the migration upload, which goes to the preset XFTP servers of a temporary user created at `SimpleXAPI.kt:722`): unreachable in the namespace.
+- Known app bugs that make the expected result unreachable, until fixed (each is reported when the test is written): the "Error importing chat database" alert (`apiImportArchive` throws `Exception`, `importArchive` catches only `Error`).
+- Pixel-level visual settings: only the persisted prefs are asserted.
+- Host "pending approval" and "join rejected", which need Haskell `chatHooks`.
+- External resources: the channel-webpage embed script (loaded from simplex.chat); real Tor and onion services.
+- Code that is commented out or unused, where a visible entry point remains in the source: "Sign messages", `migrationFromStage`, the expired group-invitation item (`CIGISExpired` is never set by the core); commented-out features with no remaining entry point ("Renegotiate encryption", invite by email) get no rows.
+
+## 12. Phases and PRs
+
+| Phase | Deliverable | Depends on |
+|---|---|---|
+| P1a (complete 2026-10-13, 15.1) | A thin vertical slice that proves the approach on the real app before the rest is built (about 1–2 weeks): the runner script and namespace (7.1.1, 8.3); `desktopUiTest`; per-JVM directories; `UiTestApp` (`bootJvm`, `resetForTest`, `restartCore`, onboarding boot); `UiIdle` (approved, 6, 13) with the hard timeout (no other watchdog parts); `InProcessDriver` with click, text input, keys and `waitUntil`; `CliPeer` Current only; `uitest-servers` with one SMP server only (no XFTP, relays, names resolver or control protocol); pre-set prefs; the keys and screen objects these tests use. Tests (catalogue names, Current CLI only, no stable subclasses): the three of 9.3 (`oneTimeLinkCliConnectsViaShortLink`, `addressCliConnectsAndRequestAppears`, `groupInvitation_tapRowShowsJoinAlert`), 02 `sendText_enter_peerReceives` and 04 `appearance_settingsPersistAcrossRestart` (a `restartCore` with `PrefStores`). Not in P1a: screenshots, Kover, the seams of 11.2, the dialog drain and file choosers, the Stable CLI, relays, mobile hosts, HTTP and SOCKS stubs, stub generation and traceability, K0. Exit: the 5 tests pass 20 consecutive runs; these are measured on the real app and recorded in 15: boot and reset time per test, frame render cost (14), `captureToImage` time on the full scene (the settle-step input of 7.7), memory growth over 20 resets in one JVM, and the offline Gradle run in the namespace; the scene runner choice (`runInternalSkikoComposeUiTest` or the fallback) and the DSL shape are confirmed or changed before P1b | — |
+| P1b | The rest of the harness, completing what P1a started: runner script and namespace (7.1.1, 8.3), `desktopUiTest` and `uitestPrepare` tasks, per-JVM directories, `UiTestApp` (`bootJvm`, `resetForTest`, `restartCore`, onboarding boot, fixtures), `UiIdle` (approved 2026-10-13, 13) and the watchdog (6), the four seams of 11.2 and their fakes (and the fixed display clock), screenshots (7.7: capture, settle loop, masks, compare-and-write, summary, docs index, the `.gitattributes` LFS line; `uiVolatile()` on the volatile composables), coverage measurement (7.8: Kover on `desktopUiTest`, per-pass reports merged by the runner, the zero-coverage list), `InProcessDriver` with all input methods, `TestRoot` stubs, `CliPeer` (Current + Stable, peer control), relays and mobile hosts, `uitest-servers` (cabal flag, all servers, names resolver, control protocol), HTTP and SOCKS stubs, pre-set prefs; K0 (all helper parameters and fixed keys) and the keys and screen objects the three 9.3 tests use (chat list rows and requests, group invitation row, user picker and address screen, new chat sheet and one-time link, chat screen, compose and items); the catalogue and legend moved into the repo; `CatalogueTraceabilityTest`; every catalogue name generated as a stub in its mapped class (the Compat class and its stable subclass for `S` names) with the categories its Needs imply (10.1) — `@Ignore("not written")` for runnable rows, `@Ignore("<the row's IGNORE reason>")` for `IGNORE` rows (the generator escapes `"`, `\` and `$`); the three tests of 9.3; measurements of frame render cost (14) and of the `Smoke` run time (10.2); one run of the connection-failure recipe of catalogue 03 `memberInfo_connectionFailedSection`, which is derived from the core and agent code only, choosing its sync point before the server reset; on day one, `./gradlew -g .gradle/uitest-home --offline --no-daemon help` on the real project inside the namespace, after the outside step has filled that home (configuring the real project there has worked once, `./gradlew help` in 3 min 11 s; an offline run is not confirmed yet)  | P1a |
+| P2 | One stub per sub-area with runnable tests (71) turned into a passing `Smoke` test, with the keys each needs | P1b |
+| P3 | Catalogue 01 in full (352 tests) | P2 |
+| P4 | Catalogue 02 in full (281 tests) | P2 |
+| P5 | Catalogue 03 in full (312 tests) | P2 |
+| P6 | Catalogue 04 in full (232 tests) | P2 |
+| P7 | Key lint (9.4); strict traceability: every name is a passing test or `@Ignore` with its row's `IGNORE` reason | P3–P6 |
+| P8 | Changed-area runs (user decision 2026-10-13, later phase): `scripts/uitest.sh -PuiAffected=<base>` runs only the tests a branch can affect. `git diff <base>` lists the changed files, and each file selects test classes two ways. (1) Catalogue refs: the rows whose code-ref cells cite the file give the test names, and through them their classes. (2) Coverage map: each full run records, from Kover (7.8), which test class executed which file; this also covers files no row cites. Changes to shared foundations (theme, `ChatModel`, `SimpleXAPI`, common helpers) add `Smoke`. Haskell core changes run `Smoke`, or everything on request. Unmapped files are reported and run `Smoke` | P7, 7.8 |
+
+All shared infrastructure is in P1, so P3–P6 are independent and can proceed in parallel. Within each, one PR per catalogue sub-area keeps reviews small (keys for that sub-area + its screen objects + its tests).
+
+P1a is the proof of concept: it runs real tests on the real app early, with the riskiest parts in place (boot, reset, restart, the scene runner, CLI peers, the driver), and its measurements adjust P1b before anything else is built. P1 (P1a and P1b together) fixes the API shape before keys are spread across about 190 files. Elsewhere in this plan "P1" means P1a and P1b together; measurements attributed to P1 are taken in P1a where its scope allows. The catalogue rows already contain the expected GUI state and CLI lines, so writing a test is mostly translating a row into DSL calls.
+
+## 13. Decisions log and open questions
+
+Settled (2026-10-10, with additions dated 2026-10-12):
+- **Local servers:** `uitest-servers`, an executable component in `simplex-chat.cabal` behind a default-off `uitest` flag, using `tests/ChatClient.hs` (8.2).
+- **Onboarding presets:** no core change; the run is network-isolated and tests switch to local servers after onboarding (8.3).
+- **App seams (11.2):** approved — recorder factory, audio/video provider, Ctrl+V clipboard reader; and (2026-10-12) the display clock for stable screenshots (7.7).
+- **Android (2026-10-12, changed 2026-10-13):** first out of scope, researched separately (`plans/ui-tests/2026-10-12-android-ui-test-automation.md`, Waydroid) with an Android-only catalogue, `05-android-only.md`. Since 2026-10-13 Android is in scope: its harness is built in the same worktree, and screens, helpers and test bodies are shared through `common/src/uiTestShared`, added to `desktopTest` and to `:android` `androidTest` (0.5.1, 0.5.4, 15.2–15.4). Android-only UI (catalogue 05) remains a separate effort.
+- **Coverage (2026-10-12):** the run measures line and branch coverage of the UI, model and platform packages with Kover (7.8); zero-coverage files feed new catalogue rows or recorded exclusions; reported, not enforced.
+- **Test tags only in test/debug builds (2026-10-12):** `uiTagsEnabled`, renamed `uiTestHooksEnabled` (2026-10-14), gates the tags and the `UiIdle` hooks (3.1, 0.5.2); release builds carry none.
+- **Stable CLI:** downloaded by tag; default tag v7.0.3 (GitHub "Latest" on 2026-10-10).
+- **Screenshots (2026-10-12, user request):** tests save committed PNG screenshots, rewritten only when the screen changes outside masked volatile regions or the set of volatile elements changes (7.7); purposes: regressions as image diffs, evidence that tests ran, documentation. Every passing catalogue test except `REALTIME` ones (and none with `-PuiShots=off`) saves an end-of-test shot plus named shots; PNGs are stored with Git LFS; displayed times come from a display-clock seam fixed in UI tests (11.2).
+- **Implementation:** P1a approved (2026-10-13); it goes on a new branch off master in its own worktree, with one build per milestone. P1b is re-planned from P1a's measurements.
+- **Decisions of 2026-10-13 (section 15 table, all approved):** the `UiIdle` hooks are approved (6); the OS folder-opener seam is deferred to P6; for Android, the restart is in-process (05 question 14), the debug-only network-security-config is approved (15), the `FIXTURE` proposal is approved (16), screenshots are deferred (17), and the toast hook is decided only if the `UiAutomation` check fails (13).
+- **`UiIdle` hooks: approved 2026-10-13 and implemented** (0.5.2, 15.1). The fallback below is kept in case the hooks have to be removed.
+- **Desktop forks (2026-10-14):** `forkEvery = 0` by default (one JVM per fork runs many classes; `-PuiForkEvery=1` restores one JVM per class), and the runner picks the number of parallel forks from free memory (15.4 item 24, 0.5.9).
+- **Minimal app code (user rule, 2026-10-14):** keys go only on elements a test acts on or must read; no observation-only helpers (15.4 item 31). For now this supersedes typed semantics (4), "keys everywhere" (Summary item 1, 5) and the key lint (9.4). Revisit only with a new user decision.
+
+Open:
+- **`UiIdle` fallback (kept for reference; the hooks are settled above).** The busy tracker adds a few lines to `sendCmd`, `startReceiver` and the `with*Api` launchers (and an `idle` parameter on `withLongRunningApi`); like the keys it is app-side code. **Approved 2026-10-13** (section 15). The fallback is kept documented in case the hooks have to be removed later; without them the harness works at a cost: waits use fixed deadlines (tests with long commands pass explicit timeouts), `drain()` becomes "`ctrlInitInProgress` false, then 1 s with no new chat event", the screenshot quiet wait becomes "1 s with no new chat event" and settled becomes "two equal captures with no chat event between them" (7.7), the end-of-test dialog poll becomes "a `DialogState` is pending, or 1 s with no new chat event" (6), and the `changingActiveUserMutex` check first waits up to 30 s for the lock (a user switch may be behind a slow core command), failure reports lose the in-flight list, and uncaught job errors are attributed by phase only, not to the test that launched the job (6).
+- **OS folder-opener seam — deferred.** Opening a folder in the OS (`desktopOpenDir`, D/platform/Files.desktop.kt:37-48, reached from the database-folder buttons via `desktopOpenDatabaseDir`, :33, DatabaseView.kt:243, DatabaseErrorView.kt:330) can't be observed headless (it is also called from the app-update download, which is out of reach anyway). A fifth seam (an `internal var` folder opener) would make those rows testable. **Deferred to P6 (2026-10-13)**; until then those rows stay `IGNORE`.
+
+## 14. Risks
+
+- **Scale:** about 190 files of keys and 1,177 tests. Mitigated by keying the helpers first (K0, about 70% of sites), one PR per catalogue sub-area, and the traceability check showing what is left.
+- **Suite duration:** hours when run serially. Mitigated by parallel JVMs (`-PuiForks`, bounded by RAM, 10.2), the `Smoke` category before PRs, and `--tests` for single classes.
+- **Catalogue drift:** line numbers in the catalogue rot as the code changes; the test names and labels are what matter, and the traceability check only matches names.
+- **Merge conflicts** with ongoing UI PRs while keys spread. Mitigated by sub-area-sized PRs merged quickly; keys are additive modifier edits.
+- **Leaks per reset:** each reset leaves a Haskell controller with its agent threads, and old receiver threads can block up to 300 s; bounded by the number of tests one JVM runs. With `forkEvery = 0` (as built) that is a share of the whole run, so RSS (about 4.6 MB per reset, 15.1) and one receiver thread per reset accumulate per fork; `-PuiForkEvery=1` bounds them by one class.
+- **Threading differences:** the default test dispatcher is `UnconfinedTestDispatcher` (ComposeUiTest.skiko.kt:116), so composition coroutines continue on whatever thread resumes them (often IO threads) rather than the EDT, which allows races the real app doesn't have; it also runs `snapshotFlow` collectors inline inside the measure pass, where they see a half-updated list state (measured on a copy of the console's two collectors, TerminalView.kt: the newest line stayed visible 1 time in 30, auto-scroll having turned itself off; ChatView has 7 similar collectors, ChatView.kt:2482-2955). P1 therefore uses `runInternalSkikoComposeUiTest(coroutineDispatcher = StandardTestDispatcher())` (:86-103; needs the `InternalTestApi` and `InternalComposeUiApi` opt-ins, both error-level, set module-wide in 7.1), which runs them during `advanceScheduler` on the EDT (measured: 30 of 30; continuations still queued when the scene closes run on the body thread inside `runTest`, ComposeUiTest.skiko.kt:201, and ones dispatched after that never run), unless it finds a reason not to, in which case the console rows (catalogue 04 `console_*`) read `chatModel.terminalItems` and scroll to the newest line; a failure that looks like such a race is checked against the real app before being reported as a bug.
+- **Render cost:** with a manual clock every 16 ms of virtual time renders a full 1600 × 900 software frame on the EDT (ComposeUiTest.skiko.kt:206-221). If a frame costs more than 16 ms, virtual time lags real time (the advance cap, 6), so composition-scoped delays fire late. Measured in P1a: 2.6 ms per chat-list frame (15.1). As built, the poll loop advances a fixed 16 ms per iteration plus a 16 ms sleep, so virtual time runs at most about half of real time anyway (0.5.3).
+- **One GUI per JVM.** Every other user in a test is a CLI peer; GUI ↔ GUI scenarios are not covered by this plan.
+- **Early class loading.** If a test or JUnit extension initialises an app class before the base class sets `user.home`, the paths would point to the real home; `bootJvm()` checks the paths and fails fast.
+- **Headless rendering** (Skiko software, no AWT window): layout code reads `simplexWindowState.windowState`, which the harness sets to the scene size; code reading real AWT windows (`LocalWindowWidth`, D/views/chat/item/CIVideoView.desktop.kt:37-44) falls back to it.
+
+## 15. Review status and open items (shipped 2026-10-13)
+
+**Review.** The plan and catalogue went through 49 rounds of adversarial review. Each round had five concurrent reviewers:
+- A: consistency
+- B: plan claims vs code
+- C: catalogue rows vs code
+- D: feasibility, measured on toy projects built on the real app jar and core
+- E: Android catalogue and carry-over map
+
+Every finding was applied. The review then stopped on a time box rather than at "two clean rounds", because the two halves behave differently:
+- **The harness design has converged.** B was clean in rounds 38–41, 46 and 48, D in rounds 37, 39, 40 and 48, and E in rounds 45, 46 and 49. The last design findings were details: the image-cache reset (7.3), the key for the security-code status line (4) and the dialog drain at the end of a test (6). All are fixed.
+- **Catalogue rows have not converged.** Each fresh sample of 30–40 rows still finds 3–6 row-level issues. The recurring classes are:
+  - a confirmation alert missing from the steps (e.g. "Use current profile", "Connection request sent!", "Update network settings?");
+  - an assertion on text that is only an icon's content description;
+  - a row that lists labels without a pass condition;
+  - a multi-test row that gives an outcome for only some of its tests.
+
+  Expect issues at a similar rate in rows not re-checked since round 18. These are cheap to fix where they surface. Rule for P1 onwards: when a newly written test fails, check the row against the code before the app, and fix the row in the same PR.
+
+**Open items.**
+
+1. Decisions. **All recommendations below were approved by the user on 2026-10-13**; the "Recommendation" column is now the decision.
+
+   | Decision | Recommendation | Why | Cost if declined |
+   |---|---|---|---|
+   | Go-ahead | Start P1a only (12) | 5 real tests on the real app validate boot, reset, restart, the scene runner and the CLI peers, and give the timings that every budget in this plan depends on; P1b is re-planned from those numbers | — |
+   | `UiIdle` hooks (6, 13) | Approve | A few lines in `sendCmd`, `startReceiver` and the `with*Api` launchers, counters only, with no behaviour change. Waits end as soon as the app is idle instead of at fixed deadlines, and failure reports name the job in flight | Fixed timeouts: slower tests, more flakiness, and errors attributed by phase only |
+   | OS folder-opener seam (13) | Defer to P6 | It only unblocks the few database-folder rows in 04; decide when P6 reaches them | Those rows stay `IGNORE` |
+   | Android question 14, restart | Defer until Android work starts; then prefer the in-process restart (stop the core, run the startup steps again, relaunch `MainActivity`) | It mirrors desktop `restartCore` and keeps each test in one `am instrument` run | — |
+   | Android question 15, debug-only network-security-config | Approve when Android starts | A debug source-set XML that allows cleartext only to `127.0.0.1`; release builds are unchanged | 3 link-preview tests fail, and 1 passes vacuously |
+   | Android question 16, `FIXTURE` mechanism | Approve the proposal when Android starts | It reuses the desktop SQL helper host-side; no app change | 38 carried-over tests stay unrunnable |
+   | Android question 17, screenshots | Defer | Android screenshots are a nice-to-have; failure PNGs already work | No committed Android shots |
+   | Android question 13, toast hook | Decide only if the `UiAutomation` check fails on the device | The hook is needed only if system toasts don't reach the listener | `TOAST` rows can't assert |
+
+2. Measurements. Measured in P1a on the real app: the render cost per 16 ms frame (2.6 ms, 15.1). Not measurable until P1b builds them (so far measured only on toy projects with the real jar):
+   - the settle-step time and per-shot budget (6, 7.7);
+   - the timing of the end-of-test dialog drain (6);
+   - the Kover overhead (7.8).
+3. App bugs found while cataloguing, which are outside this plan and are reported when their tests are written (11.3):
+   - The "Error importing chat database" alert is never shown, because `apiImportArchive` throws `Exception` and `importArchive` catches only `Error`.
+   - The migration upload goes to preset public XFTP servers, so its rows are `IGNORE` in the network-isolated run.
+4. Known nit, left as is: `previewMutex` (LinkPreviews.kt:46) is a `Mutex`, not one of the mutable types the 9.4 source check lists. It is harmless, because its fetches have bounded timeouts.
+5. Review artefacts: the per-round findings are in the session scratchpad (`r<N>{a..e}/findings.md`), and the resume state is in `plans/ui-tests/catalogue/verify/REVIEW-STATE.md`. Toy harness sources (real-jar experiments) are in `r46d`–`r48d`.
+
+### 15.1 P1a results so far (2026-10-13, first session)
+
+These were measured on the real app, built from master `eda94a505` on branch `nd/desktop-ui-tests` in `~/wt-uitest`, with no commits yet. Each run used a headless scene of 1600 × 900 with a `StandardTestDispatcher`, inside the namespace with the dedicated Gradle home, offline. The harness so far is `HarnessBootTest` and `HarnessMeasureTest` (P1a progress: `plans/ui-tests/catalogue/verify/P1a-progress.md`).
+
+- **Day-1 risk check passed.** The outside step filled `.gradle/uitest-home` (1.1 GB), and the offline `--no-daemon` run inside `unshare -rn --pid` compiled and ran the tests. One test costs 66–80 s of wall time, mostly Gradle configuration.
+- **Boot works.** The JVM loaded `libapp-lib.so` and ran `initHS`, `initChatController`, `apiCreateActiveUser` and `startChat`, and `AppScreen()` showed the chat list ("Chats", "Private notes"). Boot, the first reset and the first frame took 10.7–11.5 s.
+- **Reset time is the cost driver.** A reset took 7.2 s (median of 20; the slowest was 8.5 s), and 6–8 s of that is `initChatController` creating and migrating a fresh database. The other steps took 5–14 ms to stop and delete, 40–120 ms to create the user and 40–340 ms to start the chat. Over 1,177 tests that is about 2.3 h of serial reset time. **Fixed in P1a (same day):** a template database is migrated once per run and copied in before `initChatController` (7.2, `DbTemplate`). The JVM that creates it publishes it with an atomic rename, and parallel forks reuse it. A reset now takes **0.94 s** (median of 20; the slowest was 1.08 s), and the first reset of a later JVM 3.8 s instead of 11.5 s. The template is per run, so it always matches the current core's migrations.
+- **Leaks per reset.** RSS grew from 412 to 504 MB over 20 resets (about 4.6 MB each), and live threads went from 15 to 35 (one per reset, the old receiver as 14 predicts), while the Java heap stayed at 21 MB. That is within the class-sized JVMs of 10.2.
+- **Rendering is cheap.** One 16 ms frame of the chat list took 2.6 ms on average, and `captureToImage` of the full scene took 10–23 ms. The settle-step and per-shot budgets of 6 and 7.7 (about 1.4 s per step, 28 s per shot) are therefore conservative, and P1b can lower them after measuring a busy chat.
+- **Confirmed as predicted:** the theme detector's thread throws a `NullPointerException` when the shutdown hook destroys `gsettings monitor` (8.2). No harness code suppresses it: `UiUncaught` and the shutting-down flag are P1b (0.5.11). Boot without the pre-set prefs of 11.1 opens the connect-onboarding view (`addressCreationCardShown`). Without `TestServers.configure` (8.2), What's New opens with "View updated conditions". With `uitest-servers` in place (below) the stopgap is gone: `TestServers.configure` disables the operators and refreshes `chatModel.conditions`.
+- **Setup found:** a new worktree needs `git submodule update --init --recursive` (nanohttpd). `~/build/stage-libs.sh` refuses on current master, because master's `build-lib-linux.sh` no longer matches the reviewed hash. The libs were copied from the build slot instead (`cp -al`, with `libapp-lib.so` as a real copy, since `cmakeBuildAndCopy` writes it in place).
+
+- **First catalogue tests pass** (session 2): `oneTimeLinkCliConnectsViaShortLink`, `sendText_enter_peerReceives` and `groupInvitation_tapRowShowsJoinAlert` pass together in 178 s. They use the first keys in app code: `Ui.kt`, alert confirm and dismiss keyed by manager, chat-list rows on both platforms, the new-chat buttons, `SectionItemView`'s `uiKey` parameter, `LinkTextView` and the message field. Four driver rules were found and are now implemented:
+  1. A click waits until the node's bounds are unchanged between two polls. A click on a sheet still sliding in landed behind it.
+  2. `typeInto` waits until the field's `EditableText` holds the text before the next action. Text input settles a few frames late, and an Enter before that sends nothing.
+  3. Received CLI messages carry an `HH:MM ` prefix, which `expectsMessage` strips (8.1).
+  4. A key on the text field itself carries `EditableText` on the same node, while `LinkTextView`'s key is on its clickable parent, so field reads match the node or its descendants.
+
+- **All five P1a tests pass individually** (session 2): plus `addressCliConnectsAndRequestAppears` and `appearance_settingsPersistAcrossRestart`. The second uses `restartCore` as 7.3 specifies, and its theme, font scale and zoom are checked both in `settings.properties` and in the UI after the restart. More keys were added: the user picker and its address and settings entries, `SettingsActionItem`'s and `ExposedDropDownSetting`'s `uiKey` (with options), the address create and share buttons, the appearance sliders, and the color-mode dropdown. Findings:
+  1. **`TestRoot`'s in-memory clipboard is required, not optional.** The address is read from "Share address", which goes to `ClipboardManager.shareText`; with no AWT clipboard in a headless JVM, the stub is the only way to read it.
+  2. **Some keyed clickables don't merge.** `ExposedDropdownMenuBox`'s clickable node does not merge its children, so the selected value is a child `Text` even in the merged tree. `textOf(key)` reads the node's own text, then its first descendant's, after waiting for the node.
+  3. **Sliders work through `SetProgress`.** The semantics action also runs `onValueChangeFinished`, so the value is stored.
+  4. **The restart logs harmless errors.** It logs `Error updating users` / `Error updating remote hosts: Controller is not initialized` from composables that run before init completes. The test passes; P1b decides whether `restartCore` should compose only after init has started.
+- **Exit check, first attempt:** 12 of 12 consecutive runs passed (all five tests, 149–210 s per run). It was stopped there to continue work, and will be rerun on the final P1a code.
+- **`UiIdle` hooks are in** (approved, 6):
+  - `sendCmd`: inside `withContext(Dispatchers.IO)`, with the status polls excluded by command type (since 2026-10-14 a thin `UiIdle.track` wrapper around that block, 0.5.2);
+  - receiver events: also counted, with the time of the last one (counters removed 2026-10-14; only the time of the last event is kept);
+  - `withApi`/`withBGApi`/`withLongRunningApi`: `idle = false` at `PopChatCollector`, `ProcessedErrors` and `createUpdateJob`.
+
+  The harness uses them in `drain()`, the deadline extension and timeout messages. All 8 tests pass with them.
+- **Peer start is asynchronous, as 8.1 intends, with a 60 s deadline.** A new peer's first start (the `-O0` current CLI) took 8.1–9.6 s at a load average of 9–17, and more than 30 s right after a 13-minute Kotlin compile (load average about 20), which failed a test with the synchronous 30 s start. `cli()` now returns at once, and the peer's first command waits for `Current user:` and the prompt.
+
+
+- **The full reset of 7.2–7.3 is in:**
+  - `PrefStores`: raw `Properties`, the files and `themes.yaml` restored; the `themeOverridesStore` cache nulled; every `SharedPreference._state` refreshed by reflection; theme and locale re-applied; the four model fields copied from prefs once refreshed.
+  - `ModelSnapshot`: a reflection walk of `ChatModel`, its contexts, `AppLock`, `ConnectProgressManager`, `ChannelRelaysModel`, `BadgeModel` and `VideoPlayerHolder`, excluding `ChatController` and `AppPreferences`.
+  - `clearUiState`: image and wallpaper caches, `cachedRemoteFileRequests`, the file-level list states, window state and auth state.
+  - `clearTransientUi`: modals, passcode views, pending dialogs, both alert managers and toasts.
+
+  The template database's key is installed after `PrefStores.restore`, which would otherwise wipe it. `HarnessResetTest` (two tests in one JVM) shows that a preference, an open sheet and a contact from the first test are gone in the second. All 10 tests pass in one run; the median reset is 1.67 s.
+
+- **Two run-time cuts (user request, 2026-10-13):**
+  1. **The runner skips the outside Gradle step** when a fingerprint is unchanged. The fingerprint covers the build files (`*.gradle.kts`, `gradle.properties`, version catalogs), the native C sources, and the staged native libs other than `libapp-lib.so`, which the step itself writes. `env.properties` is now written by the script on every run, and `uitestPrepare` only resolves `desktopTestRuntimeClasspath`. The step took 40–150 s per run; the inside run still compiles changed Kotlin, offline.
+  2. **A peer database template.** While the outside step runs, the runner migrates one user-less CLI database per run: `--maintenance` exits with "no active user in maintenance mode" after running all 174 migrations. Each new peer's directory gets a copy, and the peer creates its user on first start. Measured, interleaved at a load average of 28–31: a first start with a fresh database took 11.4–13.6 s; from the template, 0.36–0.42 s. This replaces 8.1's "4–15 s per new peer".
+
+- **P1a exit check passed (2026-10-13):** 20 of 20 consecutive runs of the five tests on the final P1a code (all passed, 98–329 s per run, mean 142 s; the slow early runs were at a load average of about 30 from other sessions, the later ones 98–127 s). Earlier loops on intermediate code: 12/12 and 7/7. **P1a is complete.**
+
+Next: re-plan P1b from these results.
+
+### 15.2 First test batch after P1a (2026-10-13, user request: "the most important parts of the app")
+
+**Desktop: 12 more catalogue tests pass**, 17 in total including P1a:
+
+| Area | Tests |
+|---|---|
+| Messaging | `unreadCounterIncrementsAndClears`, `reply_menu_sendQuoted_peerSeesQuote`, `delete_ownForEveryone_peerSeesMarkedDeleted`, `reaction_add_peerSeesAdded`, `reaction_received_chipCount` |
+| Contacts | `contactRequestMenuAccept`, `contactRequestMenuReject`, `contactInfoSetLocalAlias` |
+| Profile | `editProfileDisplayName` |
+| Groups | `createGroup_opensChatAndInviteSheet`, `groupSend_allMembersReceive`, `leaveGroup_fromChatListMenu` |
+
+**Two are parked with `@Ignore` and a reason** (both unparked in batch 2, P1a progress note; no test is `@Ignore`d now except the `HarnessMeasureTest` benchmark):
+- `edit_menu_updatesPeer`: a test can't replace the pre-filled text of the controlled message field in edit mode. Neither `performTextReplacement` nor select-all plus `performTextInput` reaches the compose state.
+- `deleteContactAndNotify`: "Delete contact" is an unplaced lazy-list item on the info screen, with zero bounds, and a bounded `ScrollBy` did not bring it into view.
+
+**New keys:**
+- chat items, their context-menu actions (`ItemAction` gained a `uiKey` parameter, on 5 overloads), reaction buttons and chips;
+- the send button;
+- chat-list row menus (accept, accept incognito, reject, leave);
+- `DefaultAppBar`'s title (a `uiKey` parameter); the info screen's alias field and delete button; the delete dialogs' options (`Ui.Alert.Option`);
+- the user picker's current user (desktop);
+- `ProfileNameField` (a `uiKey` parameter); the group name and create button; the profile save button.
+
+**Driver rules found and implemented:**
+1. **Message commands have no echo.** Their CLI "echo" is the sent item `HH:MM @alice …`, so `sends` accepts either form (8.1).
+2. **The verified Enter.** After a context-menu action, the first Enter is dropped (cause still open), so `send` waits for the send button to be enabled, presses Enter, and presses once more if the field hasn't cleared within 1.5 s (now 5 s, and only while the field still holds text and Send is enabled: 15.4 item 10b). This is safe, because `inProgress` blocks a second send (`ComposeView.kt:631`).
+3. **`escape()`** invokes the window back stack (`simplexWindowState.backstack`, filled by the desktop `BackHandler`), for example to close the address screen before using the chat list behind it.
+4. **Scroll into view, bounded.** `performScrollTo` looped until the heap ran out (`OutOfMemoryError` with a 2 GB heap) on a node in the end pane. The driver now scrolls the nearest `ScrollBy` ancestor by the overflow (or a page for an unplaced lazy item), at most 10 times.
+5. **Connections get 30 s.** Under load, a connection took more than 10 s, so the waits for "contact is connected" are 30 s (now 60 s, `CONNECT_TIMEOUT_MS`, 0.5.7).
+6. **A per-test hard timeout** of 4 min (thread dump, then halt), plus heap dumps on OOM. Before them, one hang cost 35 minutes.
+7. **Group sends wait for members to connect.** A group message sent before a member is directly connected arrives forwarded by the host, with a ` [>>]` suffix. The test waits for `#team: member alice is connected` on each member before sending (catalogue 02:40 note).
+
+**Full desktop run at the end of the day:** 24 tests (17 catalogue + 5 harness + 2 parked). After the group-send fix, everything passes except the 2 parked tests; the Groups class was rerun separately with 3/3 passing.
+
+**Catalogue facts confirmed by the real CLI:**
+- a reaction to the peer's own message prints `alice> >> hi` (catalogue 02:177 fixed);
+- leaving prints `#team: alice left the group (signed)`, as 03:240 already says.
+
+**Android (started on the same day):**
+- `~/build/android.sh` gained `ANDROID_TEST=1`, which builds and publishes the `androidTest` APK next to the app APK.
+- `android/build.gradle.kts` got the AndroidX runner, Compose `ui-test-junit4` 1.8.2, espresso-intents and uiautomator.
+- `initUiTags(context)` switches tags on when the app is debuggable.
+- `SmokeTest` boots, creates a user, launches `MainActivity` and finds the new-chat key.
+- `scripts/uitest-android.sh` claims a Waydroid instance (default 2), installs both APKs, runs `pm clear` and grants permissions, runs `am instrument -r`, saves logcat and releases the claim.
+- Research and the full step list: `plans/ui-tests/catalogue/verify/android-harness-research.md`.
+- **The first Android instrumented test passes** (2026-10-13, Waydroid instance 2, claimed and released by the runner): `SmokeTest` reports `OK (1 test)`. The app's own startup in the instrumentation process took 15.4 s after `pm clear` (the estimate was ~45 s). The real `MainActivity` then showed the chat list, and the debug-only key `chatList.newChat` was found 18.2 s after start. The build takes 5 min 44 s for both APKs, from a slot whose Kotlin was already compiled. (The runner's `OK` check was later replaced: it parses `am instrument -r` into per-test `results.txt`, 0.5.9.)
+- **Remaining for Android P1a** (about 2 days, from the research step list; status 2026-10-14 in brackets):
+  1. the boot step plus reset and template (`AndroidUiTestApp`, `AndroidPrefStores`, `AndroidUiState`) [done as `UiTestApp`, `PrefStores` and the shared `CommonUiState`];
+  2. the shared `uiTestShared` source set (screens and test bodies over a `UiDriver`/`Peer` interface), with the desktop re-run [done, without the interfaces: each platform has a `UiScope` with the same methods, and peers share `PeerLines`];
+  3. a host-side peer bridge reached through `adb reverse`, with the SMP server outside the network namespace [done];
+  4. porting the 5 P1a tests [done];
+  5. the Android-only Back and notification tests [Back done, `BackKeyTest` 14; notification tests open];
+  6. a 10-run exit check [open].
+- Decisions: a shared `uiTestShared` source set for screens and test bodies, and the `~/build` test mode.
+
+### 15.3 Second batch (2026-10-14)
+
+**Desktop.**
+- Shared tests now live in `common/src/uiTestShared`: screens, helpers, server config, `CommonReset` and the test bodies.
+- New this batch: `ChatListMenuTest` (mark read/unread, favorite, mute, clear chat from the row menu) and `OneTimeLinkTest.oneTimeLinkSwitchToIncognito`. All 5 pass.
+- The earlier full run passed 24/24 (19 catalogue + 5 harness). With the new tests that makes 24 catalogue tests in all; the whole suite has not been run again since.
+- New keys:
+  - row-menu `markRead`, `markUnread`, `favorite`/`unfavorite`, `ntfs.<next mode>` and `clear`;
+  - the one-time link's "Share profile" row (`link.shareProfile`) and its picker options (`link.profile.incognito`, `link.profile(<userId>)`).
+- New driver calls:
+  - `descriptionsOf(key)` returns content descriptions; for example, the row star is "Favorite" and the muted icon is "Notifications".
+  - `click` taps a point no nested button covers (15.4 item 8). The incognito option's centre is on its ⓘ button.
+  - `CliPeer.eventuallyMatching(regex)`.
+- Peer timeouts now show the peer's output at the moment of timeout. Before, they showed the output at the start of the wait, which wrongly made a failed connect look like "the peer saw nothing".
+
+**Android.**
+- Host bridge, shared tests over `adb reverse`, Espresso-Intents for share and copy, and an app APK install that is skipped when unchanged.
+- Fixes this batch:
+  1. `poll` advances the Compose clock (48 ms per step), as desktop does. Effect `delay()`s run on the test clock, so mark-read (600 ms) and the alias save (500 ms) never finished.
+  2. The message field retries Espresso `replaceText` when the field is recreated while the chat opens.
+  3. Accepting a contact request waits the 30 s connect timeout.
+  4. A timeout takes a screenshot, which the runner pulls into `<run>/failures/`.
+  5. The runner stops the bridge JVM by its PID (`$!` of `setsid java …`). Gradle's forked daemon is in its own session, so stopping the process group left the bridge and servers running.
+  6. The runner stops at once if the bridge exits.
+- **Last run** (`run-20261014-090056`): 14 of 14 executed tests passed, including 3 of the 6 previous failures (unread badge, edit, group send).
+  - Claude Code stopped the run while the host was critically low on memory: 0.7 GB free, with about 7 GB held by another session's JVMs.
+  - Not reached: `ContactsTest` (5, including the remaining previous failures: alias, delete contact, accept request), 3 of the 4 `ChatListMenuTest` tests and the 2 one-time-link tests.
+
+**Status 2026-10-14, about 20:05 UTC (code before the PR; counts from the code, 0.5.1):**
+- Desktop: 142 `@Test` methods (112 shared + 25 desktop-only + 5 harness; `HarnessMeasureTest` is `@Ignore`d, so 141 run).
+- Android: 127 (112 shared + 14 `BackKeyTest` + `SmokeTest`). The last Android run (`run-20261014-164429`, 53/53) predates the exhaustive batches, so 74 shared tests had not run on Android before the final runs.
+- **Latest run results (2026-10-14, final code):** desktop `b22-desktop.log`: 142 completed, 141 passed, 0 failed, 1 skipped (`HarnessMeasureTest`, manual), 6 min 37 s with automatic forks; Android full run `run-20261014-214038` on Waydroid instance 2: 127 tests, 126 passed, 0 failed, 1 skipped (`connectBannerCardOpensPasteLink`, no camera), 18.5 min. Open flakes seen in earlier runs of the same day: 15.4.1, 15.4.1a, item 41.
+
+**Earlier status, 2026-10-14 about 17:00:** desktop 43/43, twice in a row (`b13-desktop-1/2.log`); Android 53/53 in one run (`run-20261014-164429`: 38 shared + 14 Back-key + smoke, 16.5 min of instrumentation). The exhaustive pass then added 99 catalogue tests (74 shared, 25 desktop-only) in two batches (P1a progress, batches 5 and 6).
+
+**Earlier status, end of 2026-10-14 afternoon:**
+- **Desktop 29/29** (24 catalogue + 5 harness): `~/uitest-review-tmp/b6-desktop-full.log`, 7 min 23 s including the build.
+- **Android 25/25** (24 catalogue + smoke): `run-20261014-134126`, 39 s setup plus 5.3 min of instrumentation, with no crashes and no resumes.
+
+**Open.**
+- ~~Rerun those 10 Android tests when memory allows~~ (done: all pass).
+- ~~Delete-contact failure~~ (fixed, 15.4 item 6).
+- ~~Android `PrefStores` reset~~ (done: `android/.../harness/PrefStores.kt`, used by `resetForTest`); ~~Android Back tests~~ (done: `BackKeyTest`, 14).
+- Android notification tests; an Android 10-run exit check.
+- Android template decryption: `bootOnce` now calls `apiStopChat` before `apiStorageEncryption` (15.4 item 25); verified on Waydroid in the final run (reset median 585 ms, n = 126).
+- `wd.sh net isolate` in the Android runner (0.5.9); `xftp1` served by `uitest-servers` (0.5.6); peer `--mute` (8.1).
+- The test-APK build spends about 80 s on the `~/build` snapshot and slot plus a cold Gradle daemon, before about 60 s of real work. A warm daemon during runs would save most of that, but costs 1.5–2.5 GB of RAM; not done.
+- Nothing is committed.
+
+### 15.4 Edge-case failures found while running (2026-10-13/14)
+
+Each entry gives the symptom, the cause (how it was confirmed), and the fix or mitigation. These are traps any later test or harness change can hit again.
+
+**Android harness (instrumented, Waydroid)**
+1. **Effect `delay()` never finishes.**
+   - Symptom: the unread badge stays after opening the chat; a local alias never saves.
+   - Cause: under `createEmptyComposeRule`, `LaunchedEffect` coroutines run on the test clock. Mark-read waits 600 ms (`ChatView.kt` `MarkItemsReadAfterDelay`) and the alias save debounces for 500 ms (`ChatInfoView.kt` `LocalAliasEditor`). Neither finishes unless the clock advances, and `waitForIdle()` doesn't advance it for a pending `delay`.
+   - Fix: every `poll` iteration advances `mainClock` by 48 ms, as desktop already advances 16 ms. Both tests passed after the change.
+2. **Message field emptied after typing.**
+   - Symptom: "message field to hold `hello`" times out right after opening a chat (edit, group send).
+   - Cause (inferred): the compose `EditText` is recreated while the chat finishes opening, so text set by Espresso `replaceText` lands in the old view.
+   - Fix: `setMessageField` retries `replaceText` every 2 s for up to 10 s. Both tests passed after the change.
+3. **45 s stall at the end of every test.**
+   - Symptom: tests took about 45 s longer than their steps.
+   - Cause: `ActivityScenario.close()` starts `InstrumentationActivityInvoker$EmptyActivity` from the test package to push the app to the background. The Espresso-Intents stub `not(isInternal())` treats the test package as external, so logcat shows "Stubbing intent … EmptyActivity", and `close()` waits out its 45 s timeout.
+   - Fix: `Intents.release()` before `scenario.close()`. Close now takes 0.4 s.
+4. **The Haskell core crashes or hangs in database init** (arm64 core under libndk translation).
+   - Two failures, both in `chatMigrateInit` while re-creating a database between tests:
+     - (a) SIGSEGV in a `ghc_worker` thread. One register held an SQL fragment ("ate TEXT"), so it happened during migrations.
+     - (b) A hang at 0% CPU for 29 min. The thread dump (via `wd.sh rootsh kill -3`) shows `Instr` blocked in native `CoreKt.chatMigrateInit`, with no Kotlin lock involved.
+   - Not reproducible on demand, and not seen on desktop. Mitigations:
+     - (i) The template database is saved from the app's own startup database, so later resets copy it and run no migrations. The reset went from 31.6 s to about 4 s.
+     - (ii) A 5 min per-test watchdog logs all stacks and kills the process.
+     - (iii) The runner resumes with the tests not yet run (`-e notClass`, at most 4 passes) and records the test that was running as `crashed`.
+5. **Clicking the middle of a row hits a nested button.**
+   - Symptom: "Incognito" in the profile picker opened the incognito info screen instead.
+   - Cause: the row's centre falls on its ⓘ button.
+   - Fix: `click` finds the nested buttons and taps a point they don't cover (item 8). A first fix, `clickStart` at 5% of the width, was removed: tests must not encode positions.
+6. **A bottom app bar covers scrolled content** (Android delete contact).
+   - Cause, from the click log: the tap went to `(20,1381)–(700,1440)` in a 1440 px window, under the info screen's bottom app bar. One-hand UI is the Android default and puts bars at the bottom. `performScrollTo` stops as soon as the node is inside the scroll viewport, and the viewport extends behind the bar.
+   - Fix: after scrolling, `click` centres the node in its nearest `ScrollBy` ancestor, so bars at either edge can't cover it. The test passes after the change.
+7. **Nodes with empty bounds counted as stable.**
+    - Symptom: after a restart on Android, `userPicker.settings` was clicked at `Rect(0,0,0,0)`, and on desktop the off-screen font slider was "stable" with zero size.
+    - Fix: `waitStable` requires non-empty bounds. Every action that needs a visible node scrolls it into view first; `setSlider` now scrolls too. Without that, a semantics-only action can hide the fact that a user couldn't reach the control.
+8. **Rows with nested buttons** (generalises item 5). There are no tap coordinates or fractions in tests.
+    - `click` takes the target's unmerged semantics node and collects its clickable descendants (nodes with `OnClick`, for example the ⓘ button in the profile picker's "Incognito" row).
+    - It taps the centre when no descendant covers it. Otherwise it taps the middle of the widest span of the centre line that no descendant covers (`uiTestShared/.../harness/TapPoint.kt`).
+    - `clickStart` was removed. The incognito test passes on desktop with a plain `click`.
+9. **Failure screenshots silently missing on Android.** The test package has no external files directory, so the screenshot errors were swallowed. Screenshots now go to the app's external files directory, and the runner pulls them after each pass, before `pm clear`. Screenshot errors are logged.
+10. **A second activity in one test froze after its first frame** (Android `restart()`).
+    - Symptom: after `restart()` (close, `restartCore`, launch again), the chat list draws but taps change nothing. The profile button's tap sets the picker state, yet the picker never appears.
+    - Probes (throwaway, since deleted) isolated it:
+      - dark theme, then picker: passes;
+      - font scale, then picker: passes;
+      - relaunch the activity only: passes;
+      - `restartCore` only, activity kept: passes;
+      - close the activity, then `restartCore` with no activity, then launch while the core is still starting: fails.
+    - Fix: `restart()` restarts the core first, waits until chat is running with the user loaded, then closes and relaunches the activity. Restart semantics are unchanged: both the core and the UI are rebuilt, and settings are re-read. `AppearanceTest` passes on Android.
+    - The root cause inside the app or the test framework, where the UI comes up during core init with no prior activity, is not investigated. It may matter for a real cold start with a slow core and is worth a look if users report a frozen first screen.
+
+**Runner and host**
+
+10a. **The template depended on test order.**
+    - Symptom: a full-package run failed 26 of 27 tests with `apiCreateActiveUser(alice) failed`.
+    - Cause: `SmokeTest` ran first, created "alice" on its own path, and `bootOnce` then saved the template from that database.
+    - Fix:
+      - `bootOnce` asks the core (`listUsers`) and builds a fresh database before saving when users exist;
+      - `SmokeTest` now runs on the harness (`uiTest { app("alice") }`).
+    - Rule: no test may bypass `UiTest`/`app()` to set up state.
+
+10b. **The verified Enter double-pressed a slow send.**
+    - Symptom: the Android edit test failed intermittently, waiting for `chat.send` after the edit was already sent: the screenshot shows the edited message and an empty field.
+    - Cause: the retry for the desktop dropped-Enter quirk pressed again when the field hadn't cleared within 1.5 s. Under translation the send itself took longer, so by the second press the Send button had been replaced by the mic button.
+    - Fix: wait up to 5 s; re-press only while the field still holds text and Send is enabled; tolerate the button vanishing. The outcome check stays that the field has cleared.
+
+11. **The bridge outlived the run.**
+   - Cause: Gradle `--no-daemon` forks a single-use daemon in its own session (`setsid`), so killing the wrapper's process group missed the bridge's `JavaExec` child.
+   - Fix: the bridge is now started directly with `java -cp` and killed by its PID.
+12. **App-code edits cost a 4–7 min desktop compile before any Android run.**
+   - Cause: Gradle `uitestBridge` depended on `desktopTestClasses`.
+   - Fix: `uitestBridgeClasspath` snapshots the harness classes once. The runner runs `java -cp` and calls Gradle only when a bridge source file is newer than the snapshot. The bridge is now up in 1 s.
+   - Rule: never edit `commonMain` while a bridge compile is running; its tests then compile against stale main classes ("Unresolved reference").
+13. **`adb root` on Waydroid restarts `adbd`**, which ends a running `am instrument` (exit 255). Use `wd.sh rootsh <cmd>` for root actions such as `kill -3 <pid>` for a thread dump. `run-as` is blocked on this image.
+14. **Misleading peer timeout output.** "seen: …" was evaluated when the wait started, so a failed connect showed `[]`. Peer timeouts now append the output at timeout time.
+15. **Host memory pressure.**
+    - Other sessions on the qube took about 7 GB mid-run, and Claude Code stopped the background run with 0.7 GB free. The runner's 4.5 GB check at start doesn't protect a 30+ min run.
+    - Keep runs short (class filters), and stop Waydroid when idle.
+    - Never `pkill -f` a pattern that matches your own shell command line.
+15a. **`pm clear` on a shared instance.** The runner runs `pm clear chat.simplex.app.debug` at the start of every pass. On instance 1, which other sessions use with the same debug package, that wipes their app state even when the claim is free. UI test runs use instance 2 only; the queueing helper waits for instance 2 and never falls back to 1.
+
+16. **Waydroid ran alongside a bridge compile.** The bridge compile now runs before the Waydroid boot, and the boot overlaps only the 1 s bridge start. Waydroid comes up 30–34 s after the run starts.
+
+**Desktop harness** (already in 15.2, listed here for completeness): the first Enter after a context-menu action is dropped (verified Enter); `performScrollTo` looped until OOM in the end pane (bounded `ScrollBy`); select-all must settle before `performTextInput` replaces text; connections need 30 s under load; group sends wait for each member's "member alice is connected".
+
+17. **Popups swallow the next pointer or key event.** A desktop popup that is still closing after a menu-item click takes the next right-click or Enter as an outside click and only dismisses itself. This is the likely cause of the old "first Enter after a context-menu action is dropped" quirk.
+    - Fix: `click`, `rightClick` and `pressEnter` wait until no popup is open, unless the target is itself inside one.
+18. **The first tap after typing is lost** (desktop). Focus moves from the text field to the tapped control, and the focus change restarts the control's pointer handler mid-press. "Create profile" needed two taps.
+    - Fix: if the target supports `RequestFocus` and is not inside a popup, the harness focuses it through semantics, settles 3 frames, then taps.
+19. **Controls clicked while still disabled.** "Create profile" stays disabled until the typed name validates.
+    - Fix: `click` waits until the target is enabled, with a clear failure message if it never is.
+20. **`performScrollToNode` deadlocks on desktop.** It runs the scroll on the UI thread and waits for animation frames, but the desktop harness runs with a paused clock. One test JVM hit the 240 s hard timeout, and the halt lost that JVM's remaining tests.
+    - Fix: desktop `scrollTo(key)` pages lazy lists with `ScrollBy`, advancing 40 frames per page, until the key appears. It is polled, so rows that load late, such as group members, are found too.
+    - Android keeps `performScrollToNode`, because its clock auto-advances.
+    - Rule: never call `performScrollTo*` on desktop.
+21. **The chat list lags the model after a settings change, and the model can be reverted by queued group events.**
+    - `rowMenu` waits for no API in flight and settles about 0.5 s of app clock before opening the menu.
+    - Group helpers call `quiesce()` (no API in flight and no events for 1 s) after joins.
+    - See 15.5 item 1 for the app-side race.
+22. **Esc pressed before an async screen close finished.** Creating a profile is a chain of database calls (create, list users, reload chats) ending in `close()`. The test pressed Esc on seeing the new active user, which was too early.
+    - Fix: `ProfilesScreen.add` waits for the new-profile screen to disappear, not just for the active user to change. The general lesson: wait for the visible end state of an operation, not an intermediate model change.
+23. **Parallel desktop JVMs raced on the shared DB template.** The losing atomic directory rename throws a plain `FileSystemException` ("Directory not empty"), not `DirectoryNotEmptyException`.
+    - Fix: if the template exists afterwards, the error is ignored.
+24. **Speed (desktop).** `forkEvery = 0` (one JVM per fork runs many classes) plus parallel forks chosen from free memory (1 GB per fork, 2.5 GB reserved, at most 4). The full suite went from 7 min 23 s (serial, one JVM per class) to about 4.5 min for 43 tests.
+25. **Android template encryption.** Decrypting the template with `apiStorageEncryption` while the startup chat controller held the agent database failed with "database is locked". Chat is now stopped first with `apiStopChat` before `apiStorageEncryption`. In the last run (16:46, before that change) decryption still failed with "database is locked", so resets opened an encrypted template (`reset.init` 3.5–5.2 s); verified in the final Android run (2026-10-14 21:40): no "database is locked", and `reset.init` dropped to about 50 ms.
+
+26. **The reset missed `by lazy` model state.** `ChatModel.migrationState` is declared `by lazy`, so the reflective `ModelSnapshot` saw only the `Lazy` wrapper. After the "migrate from another device" test, the onboarding screens refused to advance in every later test of the JVM, and 12 onboarding tests failed.
+    - Fix: `ModelSnapshot` unwraps `Lazy` fields (initialising them) and snapshots their contents. This applies to every `by lazy` model field on both platforms.
+27. **App background errors were attributed to the wrong test.** A job started by the test's own actions (or by its UI teardown) fails after `runTest` returns, and coroutines-test reports it as "uncaught exceptions before the test started" in the NEXT test.
+    - Fix: each test body ends with `drain()` inside the test, so the test's own background jobs finish while it is still current. The desktop `finally` also flushes the Swing queue and drains, because scene disposal is queued on the EDT.
+    - The full exception list (`suppressed`) is now printed; Gradle's short format hid it.
+28. **Known app issues are allowlisted by message, not ignored wholesale.** `KNOWN_APP_ISSUES` lists app errors traced to a documented finding (15.5 item 3); a match is logged as "UITEST known app issue, not failing the test". It passes a test only when its body completed; a test whose body never ran because of such an error is rerun (at most 3 attempts), and one whose body started but did not complete fails. `AssertionError`s never match. Any other uncaught exception still fails the test. Desktop only; details in 0.5.8.
+29. **Desktop failure screenshots.** A desktop `poll` timeout writes `<run>/failures/<jvm>-NN-<what>.png` (`captureToImage` of the window root). The first one showed that the "chat list title" expectation was wrong (15.6).
+30. **CLI typing under parallel load.** The CLI's echo of a 200-character `/c` link paused for more than the 200 ms "line unchanged" window when 4 JVMs ran together. The window is now 1.5 s (it only matters on a mismatch), and failures report what the input line held.
+31. **App-code additions are kept minimal** (user rule, 2026-10-14). Keys go only on elements a test acts on, or whose text cannot be read otherwise. Observation-only helpers were removed: the `uiMarker` modifier, row icon marks, a key attached only while an error shows, and a QR key. The tests assert those states through the model (`contact.verified`, `chatInfo.incognito`, `draftChatId`, chat item content), visible texts, or existing content descriptions (`seesDescription`, added to both harnesses).
+
+32. **Taps landed on a nested control's touch target.** The chat-list title tap hit the subscription indicator: Compose inflates a small clickable to a 48 dp touch target, so a point outside its drawn bounds still belongs to it. `tapPointInNode` now inflates nested clickables to 48 dp before choosing a free point.
+33. **Desktop has no Back handler on some screens.** The New chat sheet and the pending-connection info ("You invited a contact", opened with `showClose = appPlatform.isAndroid`) register no `BackHandler` on desktop, so Esc does nothing there. The sheet has a "Back" arrow, so `goBack()` clicks `described("Back")` on desktop and presses system Back on Android. The pending-connection info has no close control on desktop; it stays in the center pane until another chat opens, so `closePendingConnectionInfo()` closes it on Android only. Because the panel stays open on desktop, the app turns it into the contact's chat when the peer connects (`replaceConnReqView`), and the open chat is always listed whatever the search (`ChatListView.kt` `filteredChats`); `searchFiltersByAlias` therefore asserts "listed for non-matching text exactly when it is the open chat", which holds on both platforms. This was the cause of the last 3 desktop failures in run b18 (`searchFiltersByAlias`, `searchMatchesPendingConnectionAlias`, `pendingConnectionMenuSetName`).
+34. **`described(text)` needs the merged tree.** A content description on an `Icon` inside an `IconButton` is merged into the button; the unmerged tree has the description on a non-clickable node. Described keys match `hasContentDescription + hasClickAction` and use the merged tree for the tap point.
+35. **Clicks during a user switch were lost.** `UserPickerScreen.switchTo` waits for `switchingUsersAndHosts` to clear and then for `quiesce()`.
+36. **Peer line matching is shared.** `PeerLines` (uiTestShared) holds `sends/expects/eventually*`; desktop and Android `CliPeer` only implement `fill()` and `type()`. The Android bridge socket has a 60 s read timeout so a dead bridge fails the test instead of hanging it.
+37. **Test hooks are off in release builds.** `UiIdle` and `Modifier.ui` do nothing unless `uiTestHooksEnabled` (set from `FLAG_DEBUGGABLE` on Android and by the desktop harness); `sendCmd` and the event loop wrap their bodies with `UiIdle.track`/`trackEvent`, which cost one volatile read when off.
+38. **Android runner is portable.** `UITEST_SERIAL` selects any adb device and skips Waydroid; `ADB`, `JAVA_HOME`, `UITEST_APP_ID`, `WD_INSTANCE`, `WD_OWNER` are read from the environment; the runner refuses to start before `scripts/uitest.sh` has written `env.properties`.
+39. **A new key parameter after a trailing lambda broke Android-only callers.** `uiKey` was added after `onChange`/`selectItem` in `SettingsPreferenceItem`, `SharedPreferenceToggle` and `SelectItemAction`; `androidMain` callers that pass the lambda as a trailing lambda (`Appearance.android.kt`, `PrivacySettings.android.kt`) stopped compiling, and the desktop suite does not compile `androidMain`. Rule: a new `uiKey` parameter goes before the last function-typed parameter, and every app-code change is compiled for Android (`android.sh`) as well as desktop before a run is reported.
+40. **First full Android run of the shared tests (127 tests, 22 min, 121 passed).** Android-only causes of the 6 failures:
+    - Back on the pending-connection info first closes the soft keyboard ("Set contact name" focuses the name field), so one Back left the screen open; `closePendingConnectionInfo()` taps the screen's own "Back" arrow (`described("Back")`) on Android.
+    - Confirming a contact link plan opens the prepared chat full screen on Android, covering the chat list; `contactMenuForNotReadyContactOnlyDelete` calls `backToChatList()` before opening the row menu (no-op on desktop, where the list stays visible).
+    - The "Paste link / Scan" banner opens the QR scanner; Waydroid has no camera, so CameraX fails and the app crashes when the scanner is disposed (15.5 item 4). `connectBannerCardOpensPasteLink` calls `assumeCamera()` (skipped on devices without a camera; no-op on desktop).
+41. **`chatCloseStore` failures were ignored.** It returns an error text ("" on success); the resets deleted the database files whatever it returned. One desktop run (b21) had `apiNewGroup` fail with "SQLite3 returned ErrorIO … disk I/O error" right after a reset (first time in about 20 runs; the disk was not full). Both harnesses now fail the reset when `chatCloseStore` returns an error, so a recurrence names its cause. The I/O error itself is not explained yet (open item).
+
+### 15.4.1 Open flake: a CLI member's group join not completed (desktop, 2 of 5 runs)
+
+- `MemberInfoTest.memberInfo_changeRoleToAdmin` (run b18) and `memberInfo_removeMember` (run b15): bob sends `/j team` and never prints "#team: you joined the group" within 60 s (30 s in b15). No API call is in flight in the app.
+- Bob's agent database after the failure: the group connection's send queue is `confirmed` and its receive queue is `new`, so bob's confirmation was sent and alice's app never replied (no HELLO/secure). Alice's database was reset by the next test, so her side was not inspected.
+- Not reproduced in isolation yet. Next step: keep the app database of a failing test (copy before reset) and check whether alice's agent received the CONF and whether the chat layer called `allowConnection`.
+
+### 15.4.1a Open flake: group row preview not updated (Android, 1 of 2 runs)
+
+- `ChatListRowsTest.previewGroupSenderPrefix` (full Android run, 2026-10-14 21:07): after alice leaves the group chat, bob sends "#team hello all"; for 10 s the `team` row showed the unread badge "1" but kept the preview "mine" (failure screenshot). Passed in the rerun of the class.
+- The badge proves the row recomposed with new chat stats; the preview text comes from `chat.chatItems.lastOrNull()` (`ChatPreviewView.kt:228`). Either the new item did not reach the chat's preview list while its stats did (app-side model update), or an earlier group event incremented the counter and the message was still in transit. Not resolved; next step is to capture `chatModel.chats` for the row on failure.
+
+### 15.4.2 Test strength limits (second review, 2026-10-14)
+
+Under the minimal-app-code rule (item 31) some states are asserted through the model, not the UI. These tests pass if the model is right even when the UI fails to render the state:
+- row icons without a description or key: `incognitoIconOnRow`, `verifiedIconOnRow`, the link image in `previewLink`, the edit icon in `previewShowsDraft`, the badge colour in `unreadCounterGrayWhenMuted`, mark-unread badges (`ChatListMenuTest`, `ChatListMenusPendingTest`);
+- `ChatListScreen.gone()` checks the model only (the list is rendered from the same model);
+- `profilesAddProfile` checks `chatModel.users`;
+- `createListDuplicateNameError` cannot see the error text because it is always composed (transparent when hidden, `TagListView.kt`).
+Harness behaviours that can hide an app defect:
+- `enterWhenSendable` presses Enter again if the field has not cleared after 5 s (needed for 15.5 item 2), so a dropped first Enter is not reported;
+- Android `pressEnter` on the message field taps Send; desktop `escape()` invokes the window back stack directly instead of sending an Esc key event;
+- `isEnabled` is always true for `SectionItemView` keys (a disabled item drops `clickable` and sets no Disabled semantics).
+Known harness limits (accepted for P1a):
+- the known-issue allowlist cannot tell a body-time "database closed" from a teardown one, because Compose reports uncaught coroutine exceptions only when the test ends;
+- Android `clipboardText()` falls back to the device clipboard, which is not cleared between tests;
+- `OnboardingSharedState.selectedOperatorIds` is not reset between tests (no current test depends on it);
+- `:common:desktopUiTest` run without `scripts/uitest.sh` is skipped and reports success with zero tests;
+- on the Android path the test SMP server listens on all host interfaces with the repo's fixture TLS key, and `pm clear` acts on whatever `UITEST_APP_ID` names; never point `UITEST_SERIAL` at a personal device with the release package.
+Fixed from the second code review: `UiKey` is a `data class`, so keys passed to composables compare equal and do not break recomposition skipping (keys are built in release too); the Android bridge client drops its socket after an IO error or EOF so the next call reconnects instead of reading a stale reply, and the bridge keeps accepting after a client drops; `uitest-android.sh` exits non-zero when it gives up after 4 crashed passes, runs its cleanup (bridge, Waydroid claim) on Ctrl-C/TERM, and rebuilds the bridge when `PeerLines.kt` changes; `uitest.sh --inside` refuses to run unless it is PID 1 of the runner's PID namespace (its TERM trap kills `-1`).
+Fixed in the same review: `createGroup_opensChatAndInviteSheet` now checks the open chat, `search_direct_filtersResults` checks the matching item nodes, onboarding `!isEnabled` checks wait for the node first, the Android `TagEditor.Emoji` key was removed (no Android test acts on it), and the desktop scroll margin is 48 dp, not 50 px.
+
+### 15.5 App findings from the UI tests (2026-10-14; not fixed, reported only)
+
+1. **The group mute setting can revert in the UI right after joining a group** (catalogue 01:86, `groupMenuMuteModesAllMentionsNone`).
+   - What was seen: alice joins bob's group and changes the mode from the row menu (All → Mentions). The model shows Mentions once `apiSetSettings` returns, then about 0.5 s later shows All again, with no further user action. It happened in 2 of about 12 runs. Each time, the model's `chatSettings.enableNtfs` was captured in the failure message.
+   - Likely cause: a group event (`UserAcceptedGroupSent` or `UserJoinedGroup`, `SimpleXAPI.kt:3150,3278`) carries a `GroupInfo` read before the settings write, waits in the receiver queue, and is applied after the command reply with `updateGroup(...)`, overwriting `chatSettings`.
+   - Effect: the chat list shows the old mode. Notification decisions read the model, so a just-muted group can still notify until the app reloads its chats.
+   - Not yet confirmed on the core side: the core's stored setting was correct (Mentions) in the probe runs without the revert.
+   - The test now waits for event traffic to stop (`quiesce()`: no API in flight and no events for 1 s) before changing modes.
+   - Fix idea, not done: event-driven `updateGroup` keeps the model's `chatSettings` when it is newer than the event, or the settings command response is applied through the same ordered queue.
+
+2. **The first tap after typing in a text field is lost on desktop** (harness-visible; the real-mouse impact is unknown). Focus moves to the tapped control, and the focus change restarts its pointer handler mid-press. The harness requests focus on the target first (`focusBeforeTap`). Whether a real mouse hits the same problem is not verified; a manual check is needed before reporting it as an app bug.
+
+3. **The onboarding passphrase screen starts chat in the background when disposed** (`SetupDatabasePassphrase.kt:84-95`, `DisposableEffect.onDispose` → `withBGApi { startChat(user) }` when `chatRunning != true`).
+   - Two effects were seen:
+     - after "Encrypt", this races with the encrypt flow's own `startChat(newKey)`, and one of them fails with "failed to list users … database closed" (seen in `onboardingPassphrasePersistsAcrossRestart`);
+     - if the screen is disposed while no controller exists, `startChat` fails with "Controller is not initialized".
+   - Both escape as uncaught coroutine exceptions. In the app they are probably logged ("E: failed starting chat"); a manual check is needed to see whether a user sees an alert.
+   - Allowlisted in the harness as a known app issue (15.4 item 28).
+
+4. **Leaving the QR scanner crashes the app when the camera cannot be initialised** (`QRCodeScanner.android.kt:57-60`). `onDispose` calls `cameraProviderFuture?.get()?.unbindAll()`; when CameraX initialisation failed (no camera; on real devices possibly a camera held by another app or a camera service error), `get()` throws `ExecutionException(InitializationException(CameraUnavailableException))` during disposal, which is uncaught. Seen on Waydroid (0 cameras) in `connectBannerCardOpensPasteLink`; the activity then never reaches DESTROYED. The listener at :89-124 calls `get()` the same way. Fix idea, not done: catch the failure around `get()` in both places.
+
+### 15.6 Catalogue corrections applied from passing tests (exhaustive pass)
+
+- 01:34 and 01:8: accepting conditions enables the operators selected in onboarding, not all preset ones.
+- 01:34: on desktop with no conversations the app then shows the "Talk to someone" connect-onboarding view, and the chat-list title and search are hidden (`shouldShowOnboarding()`, `OnboardingCards.kt:52`), not "the chat list".
+- 01:37: `TestServers.configure()` (not `useLocalServers()`).
+- The other corrections drafted per batch are in `~/uitest-drafts/b*/*/NOTES.md`, sections "Catalogue corrections". They are applied to the catalogue files after each batch passes.
+
diff --git a/plans/ui-tests/2026-10-12-android-research-progress.md b/plans/ui-tests/2026-10-12-android-research-progress.md
new file mode 100644
index 0000000000..442e0f6864
--- /dev/null
+++ b/plans/ui-tests/2026-10-12-android-research-progress.md
@@ -0,0 +1,68 @@
+# Android UI test automation research — PROGRESS log
+
+## Next steps (keep current)
+Investigation DONE (2026-10-12 15:50). Findings: plans/ui-tests/2026-10-12-android-ui-test-automation.md. Tool: ~/waydroid/wd.sh + ~/waydroid/README.md.
+Open follow-ups (need user decisions/builds, not started):
+1. Build an androidTest APK (fix testInstrumentationRunner -> androidx.test.runner.AndroidJUnitRunner, add ui-test-junit4) and run one createAndroidComposeRule test on Waydroid via `am instrument` (unverified so far).
+2. Peer bridge + runner script (design in findings §5.1).
+3. Truly-clean offline reinstall from ~/waydroid/debs untested (only simulated).
+4. libhoudini A/B vs libndk.
+
+## State (what is running / changed)
+- Installed on root FS (non-persistent): waydroid 1.6.2, weston 10, lzip, lxc etc. (28 debs cached in ~/waydroid/debs). nft rule `ip qubes custom-input iifname "waydroid0" accept`. Waydroid net is OPEN (not isolated).
+- All Waydroid state now in ~/waydroid (var/ bind-mounted on /var/lib/waydroid, images/, translation/, waydroid_script/, venv/, downloads/ (1 GB OTA zips, deletable)); Android /data in ~/.local/share/waydroid (contains the SimpleX debug app with test profile "alice uitest"; no real user data).
+- Waydroid + weston are RUNNING and CLAIMED by another session ('pr7679', since 15:44) — left running on purpose; do not `wd.sh down` while claimed. Stop: `WD_OWNER=pr7679 ~/waydroid/wd.sh down` only after that session is done (or claim expires after 30 min idle).
+- Emulator: not running (x27 was started for the probe and shut down).
+- ~/android-uitest-research/{waydroid-var,waydroid-images,waydroid_script,venv,dl} were MOVED to ~/waydroid (no longer here).
+
+## Log
+- 13:30 Host facts: Qubes AppVM `claude-8tb`, Debian 12, kernel 6.18.51 qubes, Intel i7-10700 (avx2), 8 cpus, 12 GB RAM, no swap, NO /dev/kvm. sudo works without password. Root FS 25G (7.9G free, non-persistent AppVM), /home 1.8T.
+- Kernel: CONFIG_ANDROID_BINDER_IPC=y, CONFIG_ANDROID_BINDERFS=y (binder in /proc/filesystems) => Waydroid's kernel requirement is met. Cmd: `grep binder /proc/filesystems; grep BINDER /boot/config-$(uname -r)`.
+- Waydroid is NOT installed here (`which waydroid` empty, no /var/lib/waydroid, no ~/.local/share/waydroid). Earlier Waydroid use was in ANOTHER qube: ~/QubesIncoming/waydroid/{output.txt,attach-full.txt} are logcats sent from it (LineageOS 18/20-based Waydroid, APKs in /storage/emulated/0, package chat.simplex.app.debug ran). Translation layer not identifiable from the logcat (no houdini/ndk strings).
+- Internet works (curl https://repo.waydro.id -> 200).
+- Emulator: AVDs x27 (API27 x86_64 default), x30 (API30 x86_64 default), t27 (arm64), Medium_Phone (API 36.1 playstore). Memory note says only x27 boots with -accel off.
+- APKs: many ~/android-arm64-v8a-debug-*.apk; newest master: ~/android-arm64-v8a-debug-master-7c2c750.apk (Oct 12).
+- 13:35 Emulator API30 x86_64 'default' image: build.prop abilist=x86_64,x86 only, no native bridge => cannot run arm64 libsimplex.so. Emulator path for the REAL app is dead without an x86_64 APK (and TCG is slow).
+- 13:36 apt candidates: lxc 5.0.2, dnsmasq, weston 10, cage 0.1.4 available in Debian 12. Waydroid from repo.waydro.id (bookworm).
+- 13:38 Installed waydroid 1.6.2 + weston (scripts/01-install-waydroid.sh). OK.
+- 13:40 scripts/02-init-waydroid.sh started (`waydroid init -s VANILLA -i ~/android-uitest-research/waydroid-images`, /var/lib/waydroid bind-mounted from /home). Download takes >10 min.
+- ~/build/android.sh: arm64-v8a only, prebuilt ~/libsimplex.so + ~/libsupport.so (checks ELF is AArch64), never builds the core for Android.
+- 13:45 waydroid init download is slow (~0.4-0.5 MB/s from ota.waydro.id); system zip in /var/lib/waydroid/cache_http (bind-mounted to ~/android-uitest-research/waydroid-var/cache_http).
+- 13:46 Cloned casualsnek/waydroid_script to ~/android-uitest-research/waydroid_script; venv with deps at ~/android-uitest-research/venv (run: `sudo ./venv/bin/python waydroid_script/main.py -a 13 install libndk`). scripts/03-prefetch-translation.sh prefetches libndk + libhoudini zips (Android 13) into ~/.cache/waydroid-script/downloads (running in background).
+- 13:47 App code (master d72f68e6d, ~/wt-uitest-ref): 0 testTag uses; no testTagsAsResourceId; android/src/androidTest has only ExampleInstrumentedTest.kt; testInstrumentationRunner = OLD "android.support.test.runner.AndroidJUnitRunner" (must become androidx.test.runner.AndroidJUnitRunner); androidTest deps: androidx.test.ext:junit 1.2.1 + espresso 3.6.1; ui-test-junit4 commented out. Compose 1.8.2, Kotlin 2.1.20, minSdk 26, targetSdk 36.
+- 13:48 No x86_64-android core target anywhere: flake.nix has only aarch64-android and armv7a-android(-prebuilt) cross targets; no nix on this host. android build.gradle.kts splits = arm64-v8a, armeabi-v7a only.
+- 13:48 APK ~/android-arm64-v8a-debug-master-7c2c750.apk: package chat.simplex.app.debug, 7.1-beta.6 (386), debuggable, native-code arm64-v8a only (libsimplex.so 203 MB).
+- 13:46 Killed `waydroid init` (serial 0.45 MB/s; `sudo pkill -f 'waydroid init'` also killed my own shell -> exit 144; use pgrep by comm). Saved partial system zip as dl/system.partial (485 MB prefix).
+- 13:47 scripts/02-fetch-images.sh: parallel range download from the sourceforge mirror (OTA json gives URL/sha256/size), resumable per part. Mirror-redirect resolution alone took ~4 min (cached in dl/*.url).
+- 13:58 Vendor zip complete + sha256 OK (dl/lineage-20.0-20260927-MAINLINE-waydroid_x86_64-vendor.zip). System parts ~108 MB of 362 MB remaining fetched by 14:07; aggregate bandwidth only ~0.3-0.5 MB/s (other sessions are downloading heavily).
+- 13:45 libndk (17.8 MB) + libhoudini zips prefetched OK into ~/.cache/waydroid-script/downloads.
+- 14:26-14:29 Emulator probe (scripts/10-emulator-probe.sh x27): x27 boots headless under TCG in 149 s (evidence/emulator-x27/boot.txt); abilist x86_64,x86, ro.dalvik.vm.native.bridge=0 => no ARM translation. `adb install` of the 266 MB arm64 APK hung >16 min under TCG (killed by me); would fail NO_MATCHING_ABIS anyway. Emulator shut down (no emulator running now).
+- 14:35 System zip assembled but sha256 mismatch: cause = the 2nd download run was killed by `timeout` while its curl children kept appending to the same part files as the 3rd run (concurrent appends). Located via zlib inflate error (offset 624361540) and patched 1 MiB blocks from the mirror (scripts/02d-repair-zip.py); sha256 now matches OTA id 053552725b...
+- 14:44 Images unzipped: waydroid-images/system.img (1.83 GB), vendor.img (562 MB). Download zips kept in dl/ (can be deleted).
+- 14:45 `waydroid init -f` from preinstalled images via /etc/waydroid-extra/images symlink (scripts/02-init-waydroid.sh): OK, no download. waydroid_base.prop: ro.hardware.gralloc=default, ro.hardware.egl=swiftshader (auto, no /dev/dri), ro.adb.secure=1.
+- 14:45 libndk installed: scripts/04-install-translation.sh libndk -> abilist x86_64,x86,arm64-v8a,armeabi-v7a,armeabi; native.bridge=libndk_translation.so.
+- 14:46 weston 10 needs `--use-pixman` (not --renderer=pixman); `waydroid shell` needs `--` before the command.
+- 14:50 Session start (scripts/05-start-session.sh): boot_completed after 74 s (first boot). Container got NO IPv4: Qubes nft `ip qubes input` policy drop blocks DHCP from waydroid0. Fix: scripts/06-net-allow.sh (`nft add rule ip qubes custom-input iifname "waydroid0" accept`) -> eth0 192.168.240.112.
+- 14:53 scripts/07-adb-connect.sh: key appended to /data/misc/adb/adb_keys, `adb connect 192.168.240.112:5555` -> device lineage_waydroid_x86_64.
+- 14:55-15:06 `adb install -r -g ~/android-arm64-v8a-debug-master-7c2c750.apk` hung 11 min: Waydroid had FROZEN the container (suspend_action=freeze, screen-off/idle). Fix: `sudo waydroid container unfreeze; waydroid prop set persist.waydroid.suspend false; adb shell 'svc power stayon true; settings put system screen_off_timeout 2147483647'`. Install then finished immediately: "Success" (evidence/waydroid/install.txt).
+- 15:03 PROOF: `am start -W -n chat.simplex.app.debug/chat.simplex.app.MainActivity` -> COLD start TotalTime 2559 ms; real arm64 core runs under libndk (logcat "SIMPLEX: started server/receiver"). After ~6 s "Opening database…" then onboarding (evidence/waydroid/01-launch.xml, 03-onboarding.xml).
+- 15:05 `adb shell screencap` FAILS in Waydroid (rc=1, 0-byte file; SurfaceFlinger "no identification data"). Plan: weston --debug + weston-screenshooter from the Wayland side.
+- 15:06 `uiautomator dump /dev/tty` works, ~2.2 s. Compose nodes: clickable View nodes have NO text and NO resource-id (text is on a non-clickable child TextView) -> today a host driver must tap the bounds of the text node / its clickable ancestor; testTag would be invisible without testTagsAsResourceId.
+- 15:07 Interaction proof: tap (360,1284) "Get started" -> "Your profile" screen (04-*.xml); tap EditText, `input text alice`, keyevent 111 (ESC hides IME), tap "Create profile" bounds -> "Your network / Setup routers / Continue" screen (05-, 06-*.xml). Core created the user under translation.
+- 15:05 NET (scripts/20-net-probe.sh, evidence/net/net-probe.txt): (a) device -> host server bound on bridge IP 192.168.240.1 works; (b) `adb reverse tcp:5223 tcp:8766` -> host 127.0.0.1-only server works (device connects to 127.0.0.1:5223; note toybox nc needs stdin kept open); (c) 127.0.0.1-only host server is NOT reachable via bridge IP (expected); (d) container HAS internet (ping 1.1.1.1 ok) through Qubes masquerade -> tests need an nft forward drop for isolation.
+- 15:10 New requirement: durable tool at ~/waydroid (wd.sh + README). Cached 28 debs (8.5 MB) for offline reinstall in ~/waydroid/debs (list from /var/log/apt/history.log). Wrote ~/waydroid/wd.sh (setup/up/down/status/who/claim/release/wait-free/install/launch/reset-app/shot/dump/nodes/find/tap/tap-text/text/key/logcat/shell/reverse/net). Next: stop the research session, move images/var/translation/waydroid_script/venv into ~/waydroid, re-run from env -i shell.
+- 15:09 Moved state into ~/waydroid: var/ (bind-mounted to /var/lib/waydroid), images/, translation/ (libndk+houdini zips), waydroid_script/, venv/, downloads/ (OTA zips), debs/; added fetch-images.sh + repair-zip.py. Research dir keeps only notes/scripts/evidence.
+- 15:09 First `env -i ... wd.sh up`: setup ran (packages present, bind mount, symlink, translation already there), Android booted in 38 s.
+- 15:12 BUG found+fixed: weston and `waydroid session start` started under `up` inherited the flock fd -> every later wd.sh command blocked on the lock. Fix: `{LFD}>&-` on both background launches (wd.sh lines ~116/123). (Also: `pgrep -f 'wd.sh …'` self-matched my shell again -> exit 144; use pgrep -x.)
+- 15:13 Running scripts/30-wd-e2e.sh in env -i (down, up, install, reset-app, launch, shot, dump, nodes, tap-text, text, key, create profile) -> evidence/wd-e2e/30-e2e.log.
+- 15:20 e2e run #1 issues: (1) tap-text failed "DEV: unbound variable" (dump in subshell) -> fixed (need_dev first); (2) screenshots black 3113 B: `waydroid session start` creates NO window; `waydroid show-full-ui` does, but weston kiosk-shell never mapped the Waydroid toplevel (scene-graph empty although the client attached 720x1440 shm buffers). Fix: weston desktop-shell + ~/waydroid/weston.ini (panel-position=none) and `up` uses `waydroid show-full-ui`. Screenshot now works (evidence/wd-e2e/15-desktop-shell.png home screen; 17-app-later.png SimpleX onboarding; screenshot pixel coords == uiautomator coords, e.g. "Get started" at 360,1284).
+- 15:21 Funny side effect seen: `input text "alice uitest"` with no focused field: SPACE activated the focused Compose button ("Get started"). wd.sh tap-text into the field first.
+- 15:28 e2e run #2: `up` failed "umount /var/lib/waydroid/rootfs" (stale rootfs mount left by a quick down/up). Fixed: `down` waits for the session to stop and unmounts rootfs; `up` unmounts a stale rootfs (umount -R, lazy fallback).
+- 15:37 e2e run #3 (scripts/30-wd-e2e.sh under `env -i`, log evidence/wd-e2e/30-e2e.log): ALL STEPS rc=0. down 2 s; up 54 s (boot); install 8 s (266 MB APK, already-installed update); reset-app (pm clear) 1 s; launch 3 s (cold); onboarding visible ~45 s after launch on the freshly-cleared app (first DB creation under translation); shot ~0.5 s; dump 2 s; nodes 3 s; tap-text "Get started" -> profile screen; tap-text "Enter profile name…", text "alice uitest" -> 11-profile-typed.png shows the text + IME; tap-text "Create profile" -> 12-after-create.png "Your network / Continue". Note: KEYCODE_ESCAPE does not hide the IME (keyboard stays up; harmless here).
+- 15:42 Claim/lock test (evidence/wd-e2e/40-claim-net.txt): other owner and anonymous mutating calls rejected while claimed; owner allowed; read-only allowed; release works. `wd.sh net isolate` -> ping 1.1.1.1 blocked, `net open` restores. Net probe while isolated (evidence/net/net-probe-isolated.txt): bridge server + adb reverse still work, internet blocked.
+- 15:43 Simulated qube restart (umount var, rm /etc/waydroid-extra/images, delete nft rule) then `env -i wd.sh up` -> auto-setup + boot in 56 s (evidence/wd-e2e/50-up-after-simulated-restart.txt). Offline deb reinstall only simulated (`apt-get install -s --no-download debs/*.deb` resolves; packages were already installed, so a real from-scratch offline install is UNTESTED).
+- 15:44 App data persisted across down/up (onboarding stage "Your network").
+- 15:44 ANOTHER SESSION ('pr7679') has claimed the instance and is driving it (`tap-text Continue`). I stopped all device actions. Waydroid is left RUNNING for them (not stopping it: someone else is using it).
+- Removed stale 463 MB partial zip from ~/waydroid/var/cache_http. Wrote ~/waydroid/README.md.
+- Compose ui-android 1.8.2 (gradle cache) has androidx.compose.ui.semantics.testTagsAsResourceId (SemanticsProperties_androidKt.setTestTagsAsResourceId). ui-test-junit4 is NOT in the gradle cache (a build would download it).
+- 15:50 Wrote final findings doc plans/ui-tests/2026-10-12-android-ui-test-automation.md (incl. "Same tests as desktop?" §5, catalogue carry-over via scripts/40-catalog-codes.py: 1,167 names; P 758, — 238, FD 39, RELAY 90, CB 90, IGNORE 28; 04 §K remote desktop 17 desktop-only). Done.
diff --git a/plans/ui-tests/2026-10-12-android-ui-test-automation.md b/plans/ui-tests/2026-10-12-android-ui-test-automation.md
new file mode 100644
index 0000000000..c05c52b382
--- /dev/null
+++ b/plans/ui-tests/2026-10-12-android-ui-test-automation.md
@@ -0,0 +1,317 @@
+# Android UI test automation on this host
+
+**Date:** 2026-10-12. **Status (2026-10-14):** the instrumented harness (layer (a), 3.1) is built and running in `~/wt-uitest`: 127 Android tests (112 shared with desktop + 14 `BackKeyTest` + `SmokeTest`); what is built is described in the desktop plan, section 0.5 (`plans/ui-tests/2026-10-10-desktop-ui-test-dsl-plan.md`), and run findings are in §8. Sections 0–7 below are the 2026-10-12 investigation, with notes where the build differs.
+Running log: `plans/ui-tests/2026-10-12-android-research-progress.md`. Evidence: `~/android-uitest-research/evidence/`. Tool: `~/waydroid/` (`wd.sh` + `README.md`).
+
+## 0. Summary
+
+- **Runtime: Waydroid works, the emulator does not.** On this KVM-less qube, Waydroid (LXC, LineageOS 20 /
+  Android 13 x86_64, libndk arm64 translation) runs the real arm64-only SimpleX debug APK headless:
+  - Android boots in 37–56 s; the 266 MB APK installs in 5–8 s; the app cold-starts in 2.2–2.6 s.
+  - The Haskell core works under translation. After `pm clear`, the first database creation takes ~45 s (measured later inside the instrumented harness: the app's startup took 15.4 s, plan 15.2).
+  - The emulator only runs x86_64 AVDs under TCG with no ARM translation (x27 boots in 149 s). The real app can't run on it.
+- **Proof:** a clean-environment script installed, reset and launched the app, took screenshots, dumped the UI
+  hierarchy, tapped through onboarding, typed a name and created a profile, all with rc=0
+  (`evidence/wd-e2e/30-e2e.log`, PNGs `10-`, `11-`, `12-*.png`).
+- **Networking:** Android reaches host servers on the bridge IP (192.168.240.1), and loopback-only host servers
+  through `adb reverse`. Both still work with the internet blocked for the container (`wd.sh net isolate`).
+- **Automation layer, recommended: instrumented Compose tests** (`createEmptyComposeRule()` + `ActivityScenario.launch(MainActivity)` after the reset, `05-android-only.md` setup item 4; run with
+  `am instrument`) behind the desktop plan's `UiDriver` (as built: behind per-platform `UiScope`s with the same methods, no `UiDriver`). Test bodies, screen objects and `Ui` keys are shared, and
+  only the driver and the peer transport differ. CLI peers and `uitest-servers` stay on the host and are reached
+  through `adb reverse`.
+  - A host-driven layer (uiautomator/adb, Maestro, Appium) works today with no app change, which `wd.sh` proves.
+    It suits LLM-guided exploratory testing, but it can't see typed semantics, has no idling, and costs 2–3 s per observation.
+- **Built (2026-10-13/14):**
+  - the `androidTest` source set: `testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"`; added `androidx.test:runner` 1.6.1, `androidx.test:core` 1.6.1, `espresso-intents` 3.6.1 and `ui-test-junit4` 1.8.2 (with the existing `ext:junit` and `espresso-core`); `common/src/uiTestShared/kotlin` added as an `androidTest` source dir;
+  - no shared `UiDriver`: each platform has its own `UiScope` with the same method names, and the shared screens and test bodies compile against either;
+  - the host peer bridge (§5.1, as built);
+  - the runner `scripts/uitest-android.sh` (§5.1, as built).
+  - Not built: `testTagsAsResourceId` and `ui-test-manifest` (not needed by the instrumented layer).
+  - An x86_64 APK is **not needed** and would be expensive: no x86_64-android GHC cross target exists.
+
+## 1. Host facts
+
+- Qubes AppVM `claude-8tb`: Debian 12, kernel 6.18.51 (qubes), Intel i7-10700, 8 vCPU, 12 GB RAM, no swap,
+  **no `/dev/kvm`**, no `/dev/dri`. The root FS is non-persistent (25 GB, reset on qube restart); /home is 1.8 TB.
+- The kernel has `CONFIG_ANDROID_BINDER_IPC=y` and `CONFIG_ANDROID_BINDERFS=y`, so Waydroid needs no kernel modules.
+- Before today Waydroid was not installed on this qube. The earlier Waydroid use (PR #7570 attach sheet) was in
+  another qube; its logcat is `~/QubesIncoming/waydroid/attach-full.txt`, and it showed the same SwiftShader/gralloc stack.
+
+## 2. Runtime: Waydroid vs emulator
+
+| | Waydroid (chosen) | Android emulator |
+|---|---|---|
+| Real SimpleX APK (arm64-v8a only) | **runs** (libndk translation, `ro.product.cpu.abilist=x86_64,x86,arm64-v8a,…`) | **no**: x86_64 AVDs have no native bridge (`ro.dalvik.vm.native.bridge=0`, `evidence/emulator-x27/boot.txt`); arm64 AVDs can't run without KVM ("QEMU2 emulator does not support arm64") |
+| Boot | 37–56 s warm, ~75 s first boot | x27: 149 s (TCG); x30 not tried (its image has no native bridge either); the API 36.1 image needs KVM (earlier note) |
+| Install 266 MB APK | 5–8 s | >16 min, never finished (killed) |
+| App cold start | 2.2–2.6 s (`am start -W`) | n/a |
+| Headless | yes: weston headless backend + pixman, `waydroid show-full-ui` | yes (`-no-window`) |
+| Screenshot | `weston-screenshooter` (weston `--debug`); `adb screencap` **fails** (empty file) | `screencap` works |
+| UI dump / input | `uiautomator dump` 2–3 s; `input tap/text/keyevent` | same |
+| Host servers | bridge IP 192.168.240.1 or `adb reverse` (both verified) | `10.0.2.2` or `adb reverse` |
+| Internet isolation | `wd.sh net isolate` (nft forward drop); host still reachable (verified) | not examined |
+| Multiple instances | **two** since 2026-10-14 (instance 1 shared, instance 2 for UI test runs; `~/waydroid2`, plan 15.4 item 15a); runs are serial within an instance | several AVDs, each slow |
+| RAM | app process ~680 MB RSS / 490 MB PSS (`dumpsys meminfo`); whole container not measured | 2 GB guest RAM (AVD config) + QEMU |
+
+Gotchas found and solved, all handled in `wd.sh`:
+1. **Qubes firewall:** the `ip qubes input` chain has policy drop, so the container gets no DHCP lease or IPv4.
+   Fix: `nft add rule ip qubes custom-input iifname "waydroid0" accept`.
+2. **Container freeze:** Waydroid freezes the container when Android idles, and an `adb install` then "hung" for
+   11 min. Fix: `waydroid prop set persist.waydroid.suspend false`, plus stay-awake settings and an unfreeze before
+   every device command.
+3. **No window:** `waydroid session start` creates no window, so screenshots were black. `waydroid show-full-ui`
+   creates one, but weston **kiosk-shell never maps it** (empty scene graph, even though the client attached
+   720x1440 shm buffers). Fix: weston desktop-shell with `panel-position=none`.
+4. **Stale rootfs mount:** a quick down→up left rootfs mounted, and the next session failed on "umount rootfs".
+   `down` and `up` now unmount it.
+5. **Lock fd inheritance:** daemons started while `wd.sh` held its flock inherited the fd and blocked every later
+   command. Fix: `{LFD}>&-`.
+6. **Slow download:** `waydroid init` downloads serially at ~0.4 MB/s here. Replaced by a parallel, resumable range
+   download (`~/waydroid/fetch-images.sh`) and init from local images (`/etc/waydroid-extra/images`).
+   A corrupted part, caused by two downloaders appending to the same file, was repaired block by block (`repair-zip.py`).
+
+## 3. Automation layer
+
+### 3.1 Options evaluated
+
+| Layer | Works here? | Finds nodes by | Sync | Sees typed semantics / chatModel | Speed | App change |
+|---|---|---|---|---|---|---|
+| (a) Instrumented: `createEmptyComposeRule()` + `ActivityScenario.launch(MainActivity)` after the reset (`05-android-only.md` setup item 4) + Compose test APIs, `adb shell am instrument` | yes (built 2026-10-13; §8) | `testTag` (= `Ui` keys) directly, text, any `SemanticsMatcher` | Compose idling + the plan's polling (§6) | **yes** (same process) | ms per query | androidTest set-up only (keys from the desktop plan apply as they are in commonMain) |
+| (b) Host-driven: `uiautomator dump` + `adb shell input` (what `wd.sh` does) | **yes, proven** | text / content-desc / bounds; `resource-id` only with `testTagsAsResourceId` | polling only | no (accessibility tree only) | 2–3 s per dump | none today; `testTagsAsResourceId` for keys |
+| (c) Maestro / Appium (UiAutomator2 server) | likely (both just need adb), not tried | same accessibility tree as (b) | built-in waits | no | ~0.3–1 s per query (typical; not measured here) | same as (b) |
+
+Evidence for (b):
+- Compose nodes appear as `android.view.View`. The clickable node has an empty text and no resource-id, and the
+  text sits on a non-clickable child `TextView` (`evidence/waydroid/03-onboarding.xml`).
+- `wd.sh nodes` resolves this by tapping the nearest clickable ancestor.
+- `testTagsAsResourceId` exists in the app's Compose (`androidx.compose.ui:ui-android:1.8.2`,
+  `SemanticsProperties_androidKt.setTestTagsAsResourceId`). One `Modifier.semantics { testTagsAsResourceId = true }`
+  on the root makes every `Ui` key visible as `resource-id` to (b) and (c).
+
+### 3.2 Reset, peers and servers
+
+- **Reset:**
+  - `pm clear chat.simplex.app.debug` takes 1 s, then the first launch takes ~45 s to create the database under
+    translation. This is too slow to run per test.
+  - Instrumented tests should reuse the desktop plan's in-process `resetForTest` (stop the core, delete the
+    database, start the core): sub-second apart from the core's own work.
+  - Or use AndroidX Test Orchestrator `clearPackageData` for full isolation at ~45 s per test.
+  - `run-as` is blocked on this Waydroid image (plan 15.4 item 13; an earlier note here said it works). Fixture database copies (plan `FIXTURE`) need another route; open.
+- **CLI peers:** the CLI is a glibc x86_64 binary, so it runs on the host, not in Android. It reaches the same
+  servers as the app.
+- **Servers:** `uitest-servers` on the host. The app reaches them through `adb reverse tcp:<p> tcp:<p>` per port, so
+  the **same server address** (`smp://…@localhost:<p>`) works for both the app and the host peers. The alternative
+  is binding them on `192.168.240.1`.
+- **Isolation:** the desktop plan's loopback-only netns can't contain the container. The equivalent is
+  `wd.sh net isolate`: the container reaches only the host. (As built, the runner does not apply it yet; §6 item 3.c.) Host peers and servers can still run in a netns if the
+  adb server and their ports are exposed to it; the simplest form runs them on the host with `-s` pointing only at
+  local servers.
+
+### 3.3 Not verified (needs a build) — resolved 2026-10-13
+
+Resolved: the runner class is fixed, `ui-test-junit4` 1.8.2 is added, and the instrumented tests run on Waydroid instance 2 (`SmokeTest` first, plan 15.2). The original text:
+
+
+- No instrumentation APK was built or run (builds were out of scope). The current
+  `android/build.gradle.kts` has `testInstrumentationRunner = "android.support.test.runner.AndroidJUnitRunner"`
+  (stale support-library class; must be `androidx.test.runner.AndroidJUnitRunner`), and `ui-test-junit4` is
+  commented out (it is not in the Gradle cache either).
+- Risk is low: the test APK is dex only and runs inside the app's (already translated) process.
+- The first check after a build is `am instrument -w chat.simplex.app.debug.test/androidx.test.runner.AndroidJUnitRunner`
+  with one trivial `createEmptyComposeRule()` + `ActivityScenario.launch(MainActivity)` test on Waydroid.
+
+## 4. Proof run (evidence)
+
+`~/android-uitest-research/scripts/30-wd-e2e.sh`, run under `env -i HOME=/home/user PATH=/usr/bin:/bin:/usr/sbin:/sbin`.
+Log: `evidence/wd-e2e/30-e2e.log`.
+
+| Step | Result |
+|---|---|
+| `wd.sh down` / `up` | 2 s / 54 s (boot), serial `192.168.240.112:5555` |
+| `install ~/android-arm64-v8a-debug-master-7c2c750.apk` | Success, 8 s (7.1-beta.6, `chat.simplex.app.debug`) |
+| `reset-app` (pm clear), `launch` | 1 s, cold start 2.2 s; onboarding after ~45 s (first database) |
+| `shot` | `evidence/wd-e2e/10-onboarding.png` (SimpleX "Be free in your network", "Get started") |
+| `dump`, `nodes` | `10-onboarding.xml`; "Get started" tap point 360,1284 (= pixel position in the PNG) |
+| `tap-text "Get started"` → `tap-text "Enter profile name…"` → `text "alice uitest"` | `11-profile-typed.png` (name in field, IME up) |
+| `tap-text "Create profile"` | `12-after-create.png`: "Your network / Setup routers / Continue" (core created the user under translation) |
+
+Also:
+- `evidence/waydroid/*.xml`: the first manual run.
+- `evidence/net/*.txt`: network probes, open and isolated.
+- `evidence/wd-e2e/40-claim-net.txt`: lock/claim and isolate tests.
+- `evidence/wd-e2e/50-up-after-simulated-restart.txt`: `up` re-running setup after the root-FS state was removed.
+
+## 5. Same tests as desktop?
+
+**Short answer: yes for test bodies, screen objects and `Ui` keys, if the Android runner is the instrumented
+layer (5.1). The host-driven layer (5.2) can share the DSL's surface but not its assertions.**
+
+### 5.1 Instrumented tests behind `UiDriver` (recommended)
+
+- (As built: no shared `UiDriver`; each platform has a `UiScope` with the same methods, and the shared directory is added to `:android`'s `androidTest`, not `androidInstrumentedTest`. The message field is set with Espresso `replaceText` with retries, no `setSelection`, and read with a `ViewAssertion`; its hint (placeholder) is not read. Plan 0.5.4.)
+- **Shared code.** The plan's `UiDriver` (§7.4) wraps Compose test APIs that exist in both runners:
+  `onNode(hasTestTag(key.tag))`, `performClick`, `performTextInput`, semantics reads, `waitUntil`. On desktop the
+  receiver is `SkikoComposeUiTest` (`runInternalSkikoComposeUiTest`, plan §7.2/§14); on Android it is the
+  `ComposeTestRule` from `createEmptyComposeRule()`. Both implement `SemanticsNodeInteractionsProvider`.
+  - Put the driver, the screen objects (§9.1) and the DSL (§9.2) in a source set compiled for both, e.g. a
+    `uiTestShared` directory added to both `desktopTest` and `androidInstrumentedTest`.
+  - The test classes (`OneTimeLinkCompatTest`, …) then run unchanged on both, except the tests `05-android-carryover.md` lists.
+  - `Ui` keys and typed semantics (§3–4) are in commonMain, so the app code needs nothing Android-specific.
+- **Per-platform parts:**
+  - `escape()`: desktop invokes `simplexWindowState.backstack` (desktopMain, `D/DesktopApp.kt:32,272`) inside `runOnUiThread` (plan §7.4); on Android it is the system Back from the test thread (`Espresso.pressBack()`, 05 `BACK`, carry-over R9), not wrapped, and the IME and `MainActivity.onBackPressed` also act on it (05 §13);
+  - input threading: the desktop driver wraps input injection and the failure capture in `runOnUiThread` (plan §7.4, §6); on Android it must not — `AndroidInputDispatcher.flush` already injects on the main thread (ui-test 1.8.x, AndroidInputDispatcher.android.kt:547-565), and a perform, lookup or capture inside `runOnUiThread` throws "cannot be run from the main thread" (`EspressoLink.runUntilIdle`, EspressoLink.android.kt:75-83) — so the wrapper is a per-platform function that does nothing on Android;
+  - the test dispatcher: plan §14 chooses `StandardTestDispatcher` because the default unconfined one runs `snapshotFlow` collectors inside measure; the Android P1 checks what `createEmptyComposeRule` uses and whether a `TestDispatcher` can be passed (e.g. in `effectContext`), and if it can't, the 04 `console_*` rows take the plan's fallback on Android (read `chatModel.terminalItems`, scroll to the newest line);
+  - the compose field is an `EditText` inside `AndroidView`, so `performTextInput` can't reach it: typing goes through Espresso `replaceText` plus `setSelection`, reads by getting `EditText.text`/`.hint` in an Espresso `ViewAction` behind `ChatScreen.messageText`/`placeholder` (`05-android-only.md` setup item 5, `05-android-carryover.md` R12);
+  - boot/reset (a once-per-process boot step first waits for and stops the core that `SimplexApp.onCreate` started, and sets toolbar blur off in the baseline, as on desktop, `05-android-only.md` setup item 4; `resetForTest` calls the same commonMain core functions; it runs before `MainActivity` is launched with `ActivityScenario.launch`, under `createEmptyComposeRule()`, so the reset's prefs and UI-state clearing are in place before `onCreate`, `05-android-only.md` setup item 4);
+  - surfaces outside the scene (§7.6). File choosers become Espresso-Intents stubs instead of `UiFiles`;
+    `LocalUriHandler` changes too: it is Compose's `AndroidUriHandler`, which calls `startActivity` with `ACTION_VIEW`,
+    so links are recorded and stubbed with Espresso-Intents as well (`uitest-catalog/05-android-carryover.md` rule R13,
+    which also covers the clipboard); notifications are read in-process with `NotificationManager.getActiveNotifications()`
+    (`SYSNTF` in `05-android-only.md`).
+  - Keyboard shortcuts and right-click/hover are desktop-only (§5.3).
+- **Peers and servers from inside the device.** The test JVM runs inside Android, so `CliPeer` (pty4j + VT model)
+  can't spawn the CLI there: it is a glibc x86_64 binary. Split `CliPeer` behind an interface:
+  - On desktop it stays in-process.
+  - On Android a host process, the **peer bridge**, owns the real `CliPeer`s, `RelayPeer`s and `uitest-servers`.
+    It is a small Kotlin/JVM main in the test tree that reuses the desktop `CliPeer` code.
+  - **As built** (`UiBridge.kt` in the desktop harness; client `Bridge` in the Android `CliPeer.kt`): a line protocol on
+    `127.0.0.1:7777`, one client at a time; the Android side uses a fixed port 7777 and a 60 s read timeout.
+    - `servers` → `ok <smp1> <xftp1>` (`xftp1` is configured but not served yet, plan 0.5.6);
+    - `start <name> <flags, comma-separated: reactions, markRead, fullLinks>` → `ok`, sent only after the peer has started
+      (synchronous; the peer's database is copied from the peer template of the run directory named in `env.properties`, when present);
+    - `type <name> <text>` (verified typing, host-side) → `ok`;
+    - `drain <name>` → `lines N`, then the N new output lines;
+    - `stop <name>` → `ok`; any failure → `err <message>`; when the client disconnects, the bridge stops all its peers.
+  - Comparison (`sends` echo, `expects`, `eventually`, `contactId`) runs **device-side** on the drained lines, in the
+    shared `PeerLines` class, so `bob expects "…"` has the same semantics as on desktop.
+  - The test connects through `adb reverse tcp:7777 tcp:7777`, and the server ports (base + 1, base + 2) are reversed as well.
+  - Proposed earlier and not built: `sends`/`contactId`/`expect … <timeoutMs>` as bridge commands, `servers reset`, `snapshot`.
+- **Runner.** (The package name `chat.simplex.app.debug` used throughout assumes `application_id.suffix=.debug` in `local.properties`, as `local.properties.example` sets it; root `build.gradle.kts:23-25`.)
+  - **As built:** `scripts/uitest-android.sh <app.apk> <androidTest.apk> [am instrument -e …]`, with APKs from
+    `ANDROID_TEST=1 bash ~/build/android.sh`. It needs one earlier `scripts/uitest.sh` run (CLI, `uitest-servers`,
+    `env.properties`) and 4500 MB free.
+  - Environment: `UITEST_SERIAL` (any adb device; skips Waydroid), `WD_INSTANCE` (default 2), `WD_OWNER`
+    (default `uitest-$USER`), `UITEST_APP_ID` (default `chat.simplex.app.debug`), `ADB`, `JAVA_HOME`.
+  - It claims and boots Waydroid in the background, starts the bridge with `java -cp`, installs the APKs (the app APK
+    only when changed), sets the `adb reverse` ports, and per pass runs `pm clear`, grants permissions and
+    `am instrument -w -r`; after a process crash it resumes with `-e notClass` (at most 4 passes).
+  - Results are not JUnit XML: `build/uitest-android/run-<timestamp>/results.txt` (`<class>#<test> <code>`: 0 pass,
+    −2 fail, −3/−4 skipped, `crashed`), plus `instrument*.txt`, `logcat.txt`, `timings.txt`, `failures/`, `bridge.log`.
+    The exit status is non-zero on any failure or crash. Details: plan 0.5.9.
+  - It does **not** run `wd.sh net isolate` (open item, §6 item 3.c).
+  - Considered and not used: `./gradlew :android:connectedFossDebugAndroidTest` (the app has `google`/`foss` flavors,
+    foss the default, `android/build.gradle.kts:40-50`).
+- **Throughput limits.**
+  - Runs are serial within a Waydroid instance: no parallel JVMs as on desktop (§10.2). UI test runs use instance 2; instance 1 is shared with other sessions.
+  - In-process reset avoids the 45 s first-database cost per test.
+  - The core runs under arm translation; it measured fine for onboarding, but no figure exists yet for a full Android run (the 1,094 carried-over tests of 01–04, 18 of them `IGNORE`, plus the runnable tests of `05-android-only.md`).
+
+### 5.2 Host-driven over adb/UiAutomator(2) with `testTagsAsResourceId`
+
+- **Reach.**
+  - The same DSL surface can run in a host JVM, with peers local exactly as on desktop.
+  - The driver maps `Ui.X.Y` → `resource-id` (with `testTagsAsResourceId`), text → `text`, and click → `input tap`
+    at the node centre. `wd.sh` already does this from the shell.
+- **What is lost.**
+  - Typed semantics (§4: unread count, item meta/status, sender, verification, incognito, muted) are custom
+    `SemanticsPropertyKey`s that are not exported to accessibility. Assertions on them would need the app to mirror
+    them into `stateDescription`/`contentDescription`, which changes what TalkBack reads.
+  - Name→id resolution through `chatModel` (§9.1 `row("bob")`) is lost; the alternative is text matching or
+    `/_get` via a peer.
+  - No Compose idling; every observation is a 2–3 s `uiautomator dump`, or less with a resident UiAutomator2 server (not measured here).
+  - Off-screen lazy-list items aren't in the tree, so scrolling is needed.
+- **Fit.** Good for smoke tests and LLM-guided exploratory testing (`~/waydroid/README.md` "How an LLM agent should
+  drive the GUI"). Not a substitute for the catalogue's assertions.
+
+### 5.3 Catalogue carry-over (1,177 names; counts from `plans/ui-tests/catalogue/tools/needs.py`)
+
+| Group | Names | On Android |
+|---|---|---|
+| Rows needing only peers, servers, restart, fixtures, clipboard, toasts, URI (`P` 763, `—` 241, `RELAY` 90, `XFTP` 72, `RESTART` 48, `FIXTURE` 38, `CB` 90, …; overlapping) | ~1,050 | carry over through 5.1 with the peer bridge; `RESTART` rows only once `restart()` has an Android mechanism (`05-android-only.md` open question 14), `FIXTURE` rows only once fixtures have one (open question 16). Assertions on Android-specific layouts (one-pane navigation instead of the desktop's side-by-side list+chat, ChatListView.kt:612) need different screen-object steps, but test bodies stay the same if screen objects own navigation |
+| `FD` file-dialog rows | 42 | port with an Espresso-Intents picker stub instead of `UiFiles` |
+| `REC`/`AV` seams | 19 | port only once the §11.2 seams have Android actuals (MediaRecorder/ExoPlayer) |
+| 04 §K Remote desktop "Link a mobile" (desktop is the controller) | 17 | **desktop-only**. Android is the *host* side ("Use from desktop"), a different test set with a CLI controller |
+| 02 §W right-click and Enter rows, `IMGCB` Ctrl+V | 3 | desktop-only; the other §W rows run with long press or Back (`05-android-carryover.md`) |
+| 04 §C SimpleX Lock (desktop passcode) | 22 | partially: Android has system-auth/biometric lock modes in addition to the passcode; 20 rows carry over with "Lock mode" set to "Passcode" first (map R8), and the relock and notice rows are replaced by `05-android-only.md` §10 |
+| 04 §D Appearance with `FD` (wallpaper image, theme export/import) | 6 | via picker stub |
+| `IGNORE` rows (window chrome, tray, OS drag-and-drop, WebRTC, public servers, `chatHooks`, …) | 28 | still ignored; window/tray/drag-and-drop ones are N/A on Android |
+
+**Android-only areas the catalogue doesn't have:**
+- notification modes and the onboarding "Setup notifications" stage (periodic/instant service, battery-optimisation prompts);
+- runtime permission prompts (POST_NOTIFICATIONS, camera, microphone);
+- share-into-app intents and app-link opening (`am start -a VIEW -d https://simplex.chat/…`);
+- back gesture / predictive back and IME-overlap layouts (e.g. PR #7570);
+- rotation and split-screen (PR #7497);
+- calls in the Android WebView;
+- "Use from desktop" (host side);
+- Waydroid limits: no camera, so QR scanning is out of reach; the MediaProvider NPE blocks file-send from the
+  system picker, so stub the picker in tests.
+
+## 6. Recommendation
+
+1. **Runtime:** Waydroid via `~/waydroid/wd.sh` (setup steps in `~/waydroid/README.md`; it re-provisions itself
+   after qube restarts from `~/waydroid`). Use the emulator only for framework-only questions with stub APKs, as before.
+2. **Now, no app change:** LLM-guided and smoke GUI testing with `wd.sh nodes/shot/tap-text/text` on the existing
+   debug APKs. This is already usable and is shared between sessions with `claim`/`WD_OWNER`.
+3. **Desktop plan alignment (after its P1 keys land):** (status 2026-10-14: a, b, c and d are done, except the items marked below; see §0 "Built" and plan 0.5)
+   - **a.** Android build set-up (done, except `ui-test-manifest` and `testTagsAsResourceId`, not built):
+     - fix `testInstrumentationRunner` to `androidx.test.runner.AndroidJUnitRunner`;
+     - add `androidTestImplementation("androidx.compose.ui:ui-test-junit4:<compose 1.8.2>")` and
+       `debugImplementation("androidx.compose.ui:ui-test-manifest:…")`;
+     - optionally add `testTagsAsResourceId = true` on the root in debug builds, for (b)/(c) and the LLM tool.
+   - **b.** Move `UiDriver`, the screen objects and the DSL into a source directory shared by `desktopTest` and
+     `androidInstrumentedTest`; keep boot, reset and surfaces per platform. (Done as `common/src/uiTestShared`, shared by
+     `desktopTest` and `androidTest`, without a `UiDriver` interface.)
+   - **c.** Peer bridge (host JVM main reusing `CliPeer`/`RelayPeer`/`TestServers`) plus a runner script:
+     `wd.sh up` → `wd.sh net isolate` → start bridge + servers → `adb reverse` ports → install app + test APK →
+     `am instrument` → collect JUnit XML. (Done with `CliPeer` and `TestServers`, no relays; results go to `results.txt`,
+     not JUnit XML. **The runner does not call `wd.sh net isolate`** (open item): the container keeps internet access
+     during runs, and isolation rests on the local server configuration and on onboarding opening no connection.)
+   - **d.** Start with the 3 example tests of plan §9.3 on Android; then measure per-test time under translation
+     before planning catalogue-wide runs. (Done: §8.)
+4. **x86_64 APK: not worth it now.**
+   - `flake.nix` has only `aarch64-android` and `armv7a-android` cross targets, and nix is not installed here.
+   - `~/build/android.sh` packages prebuilt arm64 `libsimplex.so`/`libsupport.so` only.
+   - An x86_64 build would need a new haskell.nix `x86_64-android` cross toolchain (GHC, plus openssl, libffi,
+     gmp and iconv for x86_64-android), a CI job, and `x86_64` in the Gradle `splits`/`abiFilters`.
+   - That is days of toolchain work for a speed-up translation doesn't need: onboarding is already responsive.
+   - Revisit only if translation proves too slow for catalogue-scale runs.
+
+**Costs/risks:**
+- runs are serial within an instance (two instances since 2026-10-14; UI test runs use instance 2);
+- arm translation is fast enough for onboarding, but bulk message and file tests are not measured yet;
+- Waydroid quirks (freeze, window mapping, stale mounts) are handled in `wd.sh`, though new ones may appear;
+- the root FS is reset on restart, so the offline deb reinstall path is only simulated, not tested from a truly clean root;
+- Android 13 only (one OS version);
+- no camera.
+
+## 7. Decisions and open questions
+
+Decided (user, 2026-10-12):
+- Test tags are for testing only, so they exist only in debug builds: `testTagsAsResourceId = true` is set on the root in debug builds only (decided, not built: the instrumented layer doesn't need it), and the shared `Modifier.ui` emits tags only when `uiTestHooksEnabled` (formerly `uiTagsEnabled`) is set: by `initUiTags(context)` from `SimplexApp` when the app is debuggable, and by the desktop harness (desktop plan §3.1, 0.5.2). Release builds carry no tags. Typed semantics are deferred (plan 13, minimal-app-code rule of 2026-10-14).
+- Android-only UI gets its own catalogue, `plans/ui-tests/catalogue/05-android-only.md`.
+
+Decided (user, 2026-10-13; recommendations in plan section 15): restart is in-process (05 question 14; built, plan 15.4 item 10); the debug-only network-security-config is approved (15; not built yet); the `FIXTURE` proposal is approved (16; not built, and `run-as` is blocked); Android screenshots are deferred (17); the toast hook is added only if the on-device `UiAutomation` check fails (13). Android work started on 2026-10-13, after desktop P1a.
+
+Open:
+
+1. ~~Instrumented runner: Gradle `connectedFossDebugAndroidTest` against the Waydroid adb device, or a plain
+   `am instrument` runner script?~~ Resolved: the script, `scripts/uitest-android.sh` (§5.1).
+2. ~~Is in-process `resetForTest` enough isolation on Android, or do some areas need Orchestrator `clearPackageData`?~~
+   Answered in §8: in-process reset is enough so far; notification and service areas are not tested yet.
+3. libndk vs libhoudini: only libndk was tested. Houdini is Intel's and often faster on Intel CPUs; worth one A/B
+   run of a message-heavy test later.
+
+## 8. Findings from running the harness (2026-10-14)
+
+The full list, with causes and fixes, is in plan §15.4 (`plans/ui-tests/2026-10-10-desktop-ui-test-dsl-plan.md`). The ones that change this write-up:
+- **Open question 2 (in-process reset):** the reset isolates tests, but the translated core sometimes crashes (SIGSEGV) or hangs in `chatMigrateInit` when the database is re-created. Mitigations:
+  - the template database comes from the app's own startup database, so later resets run no migrations;
+  - a 5 min per-test watchdog;
+  - runner resume after a crash.
+
+  Orchestrator `clearPackageData` is still not needed.
+- **Speed, measured:** the reset went from 31.6 s to about 4 s; closing the activity from 45 s to 0.4 s, by releasing the Espresso-Intents stub first; bridge startup from 1–7 min to 1 s, by running it without Gradle. Waydroid now boots alongside the bridge start, so run setup takes 33 s with an unchanged app APK. A simple test now takes 15–20 s, against 65–90 s before. In the last full run (`run-20261014-164429`, 53/53, 16.5 min of instrumentation, about 19 s per test on average) the `reset` phase took 5.1 s median (3.7–7.7 s, n = 53, from logcat), because the template was still encrypted ("database is locked" on decryption; the `apiStopChat` fix is not yet run, plan 15.4 item 25). Final run 2026-10-14 (`run-20261014-214038`, 127 tests, 126 passed, 1 skipped, 18.5 min, about 8.8 s per test): the template is now decrypted, and the `reset` phase took 585 ms median (64 ms–3.2 s, n = 126).
+- **Compose test clock:** `poll` must advance `mainClock`, because effect `delay()`s (mark-read 600 ms, alias 500 ms) run on the test clock.
+- **Root actions:** `adb root` restarts `adbd` and kills a running `am instrument`. Use `wd.sh rootsh`, for example `kill -3 <pid>` for thread dumps; `run-as` is blocked.
+
diff --git a/plans/ui-tests/2026-10-13-p1a-start-here.md b/plans/ui-tests/2026-10-13-p1a-start-here.md
new file mode 100644
index 0000000000..5a8bbcb3b8
--- /dev/null
+++ b/plans/ui-tests/2026-10-13-p1a-start-here.md
@@ -0,0 +1,70 @@
+# Desktop UI tests — P1a: start here
+
+> **Historical (2026-10-14):** P1a was completed on 2026-10-13 (plan 15.1). This page is kept for history; for the harness as built see plan section 0.5, "As built (2026-10-14)", which also lists the design items not built yet.
+
+This page tells the implementer of P1a which parts of the plan to read and in what order to build. The plan is `plans/ui-tests/2026-10-10-desktop-ui-test-dsl-plan.md`; section numbers below refer to it. P1a's scope and exit criteria are in its row in §12.
+
+## Goal
+
+Get five real catalogue tests passing on the real desktop app, headless, with a real core and a CLI peer. Measure what the rest of the plan depends on. Change the plan where the measurements disagree with it. Then build P1b.
+
+The five tests:
+- 01 `oneTimeLinkCliConnectsViaShortLink`
+- 01 `addressCliConnectsAndRequestAppears`
+- 03 `groupInvitation_tapRowShowsJoinAlert`
+- 02 `sendText_enter_peerReceives`
+- 04 `appearance_settingsPersistAcrossRestart`
+
+The first three are written out in §9.3. Run them on the Current CLI only.
+
+## Read (about 2 hours)
+
+| Read | Why |
+|---|---|
+| Summary, §1, §2 | What is being built and how the parts fit |
+| §3.1, §3.2 | `Modifier.ui(key)`, `uiTagsEnabled` (debug/test only), and where a key must sit |
+| §6 | Synchronization: the manual clock, `UiIdle` or its fallback, the hard timeout. Skip the end-of-test dialog drain |
+| §7.1 and §7.1.1 | Gradle task, opt-ins, `forkEvery` (planned 1; as built 0 by default, `-PuiForkEvery`, plan 0.5.9), runner script |
+| §7.2, §7.3 | `bootJvm`, `resetForTest`, `restartCore`, `PrefStores`, and what a reset must clear |
+| §7.4 | Driver: input injection, waits, field reads |
+| §8.1, §8.2, §8.3 | CLI peers, `uitest-servers` (SMP only for P1a), network namespace |
+| §9.1–§9.3 | Screen objects, DSL, example tests |
+| §10.1 | How catalogue names map to test classes |
+| §12 (P1a row), §15 | Scope, exit criteria, open items |
+
+Skip for P1a: §3.3–§3.5, §4, §5, §7.5–§7.8, §9.4, §11.
+
+## Build order
+
+1. **Day 1 risk check.** Run `./gradlew -g .gradle/uitest-home --offline --no-daemon help` on the real project inside the namespace, after filling that Gradle home from outside (§7.1, §8.3). If the offline run fails, fix it before anything else, because everything later runs this way.
+2. Add the `desktopUiTest` source set and task, with the opt-ins, `forkEvery = 1` (as built: default 0, plan 0.5.9) and per-JVM directories (§7.1).
+3. Build `uitest-servers` with one SMP server (§8.2), plus the runner script and namespace (§7.1.1, §8.3).
+4. Write `bootJvm` and the onboarding boot (§7.2). Set `user.home` before any app class loads, and repeat `System.load(libapp-lib)` + `initHS()`, because `initHaskell` is private to the desktop module.
+5. Write the scene and driver: `runInternalSkikoComposeUiTest` with a `StandardTestDispatcher`, the clock-lead rule after input (not built: the poll advances a fixed 16 ms, plan 0.5.3), and desktop input wrapped in `runOnUiThread` (§6, §7.4).
+6. Add the `UiIdle` hooks if approved, otherwise the fallback, plus the hard timeout (§6, §13).
+7. Write `CliPeer` for the Current CLI with the peer flags and typing rules of §8.1 (as built: partly; no `--mute`, different typing constants, plan 0.5.5).
+8. Add the keys and screen objects that the five tests touch (§3.1, §3.2, §9.1). Put each key on the same modifier chain as the clickable.
+9. Write the five tests (§9.2, §9.3, and the catalogue rows).
+10. Implement `resetForTest` and `restartCore` with `PrefStores` (§7.2, §7.3). Then run all five tests in one JVM and in fresh JVMs.
+11. Take the measurements and run the exit check below. Write the numbers into §15 and adjust the budgets in §6 and §7.7.
+
+## Exit check
+
+- Each of the five tests passes 20 consecutive runs.
+- These are measured on the real app and recorded in §15:
+  - boot and reset time per test;
+  - frame render cost;
+  - `captureToImage` time on the full scene;
+  - memory growth over 20 resets in one JVM;
+  - the offline Gradle run in the namespace.
+- The scene runner choice and the DSL shape are confirmed, or the plan is changed, before P1b starts.
+
+## Traps the review found (each cost at least one round)
+
+- **Use the right code.** Branch off master in a new worktree. The catalogue's file:line references are pinned to `d72f68e6d` (`~/wt-uitest-ref`), not to the dirty `~/simplex-chat` checkout.
+- **Merged nodes hide tags.** A tag on a child of a merged node is invisible in the default tree (§3.2).
+- **The real CLI is not the Haskell test client.** A real profile gets the "Ask SimpleX Team" contact. `testView` lines are never printed. Peers need the flags in §8.1, and they must use name commands or `CliPeer.contactId`, not hard-coded contact ids.
+- **Advancing the clock by 0** runs queued tasks but renders no frame (§6).
+- **`hideAllAlerts` is not enough to close an alert.** It drops the composables but leaves continuations waiting. Close alerts with Escape (§6, "End of each test"). (Not built: the harness only calls `hideAllAlerts` at the next reset, plan 0.5.11.)
+- **Line refs before the app.** A failing new test is first checked against its catalogue row and the code, because rows still contain errors at a small rate (§15). Fix the row in the same PR.
+- **The root filesystem on this host is small.** Build under `/home`, not `/tmp`.
diff --git a/plans/ui-tests/catalogue/00-legend.md b/plans/ui-tests/catalogue/00-legend.md
new file mode 100644
index 0000000000..2fbbb6bc99
--- /dev/null
+++ b/plans/ui-tests/catalogue/00-legend.md
@@ -0,0 +1,208 @@
+# UI test catalogue 0: shared legend and rules
+
+Applies to catalogues 01–04. The plan (`20261010-desktop-ui-test-dsl-plan.md`, §10) points here.
+
+## Paths
+
+All paths are repo-relative:
+- `C/` = `apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/`
+- `D/` = `apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/`
+- `H/` = `tests/ChatTests/`; other Haskell tests are given as `tests/<File>.hs`
+- Haskell core paths without a prefix (`Library/…`, `Store/…`, `Types/…`, `Messages.hs`, …) are under `src/Simplex/Chat/`; `Agent/…` and other simplexmq paths are in simplexmq at the commit pinned by `cabal.project`
+- UI strings: `apps/multiplatform/common/src/commonMain/moko-resources/base/strings.xml`
+- **Log** / "the command log" in any catalogue is the app's command log, `chatModel.terminalItems`: `sendCmd` adds `TerminalItem.cmd(obfuscated)` and `.resp` (`C/model/SimpleXAPI.kt:936-954`); commands sent with `log=false` (the subscription total :560, the servers summary :569, badge redemption :580) never appear there. `<uid>` and `<userId>` in logged commands are the same user id; JSON arguments are pretty-printed (`SimpleXAPI.kt:6546-6551`), so assertions match `"key": value` with a space
+- **Pref** `<Key>` in catalogues 01–04 is the key in `settings.properties` (key strings at `C/model/SimpleXAPI.kt:390-530`, properties at :103-280); theme overrides live in `themes.yaml` instead; catalogue 05 writes `Pref <property> = <value>` with the AppPreferences property name, since Android has no `settings.properties`
+
+Line numbers are those of master at `d72f68e6d` (2026-10-10), checked out at `~/wt-uitest-ref`.
+
+At P1 the catalogue moves into the repo at `apps/multiplatform/common/src/desktopTest/resources/uitest-catalog/`.
+
+## Canonical row format (parsed by the traceability check)
+
+- Every feature table has a column titled exactly **`Test case(s)`**. It contains only backticked test names separated by `, `. Nothing else goes in that cell.
+- A test name is a valid Kotlin identifier, unique across all four catalogues.
+- Test names in prose, notes or other columns are not counted.
+- Every catalogue ends with a table titled `## Count` with columns `Section | Tests | Ignored`. `Tests` counts the names in that section's `Test case(s)` cells; `Ignored` counts the subset that must be `@Ignore` (see below). The last row is `| **Total** | **N** | **M** |`.
+- Features that can't be tested in-process are rows too: their names go in the `Test case(s)` column like any other, and the `Needs` cell says `IGNORE: <reason>`; the reason must fall under a plan §11.3 bullet. The `@Ignore` string is the cell text after `IGNORE: `, verbatim, including any parenthetical. The traceability check requires a `@Test` method for every name; for `IGNORE` rows that method carries `@Ignore("<reason>")`.
+- **Needs apply to every name in the row.** A row whose tests need different things is split, so that counts and JUnit categories derived from Needs are exact.
+- **Needs cells contain only codes from the table below**, each optionally followed by `×N` (number of peers for `P`, of relays for `RELAY`, e.g. `P ×3`, `RELAY ×2`) and/or a short parenthetical detail (e.g. `FIXTURE (legacy address)`, `FD (wallpaper image)`). Setup states that are not harness capabilities (lock on, two users, four chats, a group) belong in the row's notes, not in Needs.
+- Section headings carry the section's test count, e.g. `### B. Composing and sending text, links, mentions, commands (29 tests)`; the file header states the totals; nothing follows the `## Count` table.
+
+## Users and CLI output
+
+- The GUI user is **alice**, created with a display name only (no full name). CLI peers are created with `--user-display-name <name>` and also have no full name.
+- So CLI lines never contain a full name: `alice: contact is connected`, `alice wants to connect to you!`, not `alice (Alice): …`.
+- When a Haskell test is cited, its expected lines are rewritten for these roles and names. The GUI user's own output is asserted on the GUI, never as a CLI line.
+
+## Needs codes (one shared set)
+
+| Code | Meaning |
+|---|---|
+| `P` | CLI peer(s), the current build unless the row names a stable one |
+| `S` | also run with the stable-release CLI peer. These tests live in their class base's separate `open class <Base>CompatTest` (class map), whose subclass `<Base>CompatStableTest` overrides the peer version; never combined with `RELAY` (channels need current-build peers) |
+| `SMP` | local SMP server (always available, so never needed in a cell; stopping or starting it is `SRVCTL`) |
+| `SMP2` | a second local SMP server (private routing, manual server add, a peer on another server) |
+| `XFTP` | informational: the row transfers files through the local XFTP server. The server is always available (like `SMP`), so the code derives no category and requires nothing; it only marks file rows |
+| `XFTP2` | a second local XFTP server (unknown-relay approval) |
+| `RELAY` | chat relay CLI process(es) |
+| `NAMES` | SMP server in names mode + mock name registry |
+| `HTTP` | local HTTP server (link previews, `http://127.0.0.1:<port>`) |
+| `SOCKS` | in-JVM SOCKS5 stub |
+| `SRVCTL` | stop/start a local server mid-test |
+| `PEERCTL` | stop/start a CLI peer or relay, or restore its database copy |
+| `RESTART` | core restart inside the test |
+| `FIXTURE` | database fixture (named in the row): prepared before boot via `app(fixture = …)`, or between `restart()` steps for data the test produced itself (then also `RESTART`) |
+| `ONBOARD` | the test boots with no user (`app(name, onboarded = false)`); tests that reach onboarding later need no `ONBOARD`: through a restart they have `RESTART`, and in-app (e.g. deleting the database, which shows onboarding at once) they need neither |
+| `FD` | file-dialog completion, or asserting that no file dialog is awaiting (`UiFiles`, plan §7.6) |
+| `CB` | in-memory clipboard (`LocalClipboardManager`/`LocalClipboard`) |
+| `IMGCB` | the approved Ctrl+V clipboard seam (plan §11.2): Ctrl+V in the compose field when the clipboard holds plain text or an image (a file list needs only `CB`) |
+| `URI` | `LocalUriHandler` stub (links, browser, calls) |
+| `NTF` | recording notification manager |
+| `TOAST` | toast assertions |
+| `DT` | developer tools on |
+| `REC` | recorder seam (plan §11.2) |
+| `AV` | audio/video player seam (plan §11.2) |
+| `MCAST` | multicast on loopback (plan §8.3); runs in the non-parallel `Multicast` category |
+| `SLOW` | 30 s or more (timed-message deletion, TTL expiry, large groups) |
+| `REALTIME` | needs the real display clock: `uiTest(realTimes = true)`, no screenshots (plan §7.7) |
+| `—` | no other code applies: no peer and no harness capability |
+| `IGNORE: <reason>` | cannot run in-process; `@Ignore` with this reason |
+
+## Catalogue 05 (Android-only)
+
+`05-android-only.md` covers UI that exists only on Android or behaves materially differently there (added 2026-10-12). It is for the Android harness (`plans/ui-tests/2026-10-12-android-ui-test-automation.md`, Waydroid), not the desktop run: its tests are outside the desktop counts, class map and traceability check above, and the count tools read 01–04 only. It defines its own extra Needs codes (`PERM`, `SYSUI`, `SYSNTF`, `INTENTS`, `INTENT`, `BG`, `BACK`, `IME`, `VIEW`, `SHELL`, `ROT`) and IGNORE reasons at its top; rows of 01–04 carry over to Android unchanged unless `05-android-carryover.md` lists them (REPLACED by a 05 test, DESKTOP-ONLY, or ADAPT with the Android change; 357 of 1,177 listed, 2026-10-13).
+
+## Ownership of overlapping features
+
+A feature is tested once, in the catalogue that owns it. Duplicates are deleted from the other catalogue. Rows that are unique stay where they are.
+
+| Feature | Owner | The other catalogue keeps only |
+|---|---|---|
+| User picker, chat profiles list, add/activate/search/hide/unhide/mute/delete profile, your-profile editing, user chat preferences | 01 (§5, §14) | 04: settings-root rows, colour-mode switch, Esc keys, lock-protected profile actions |
+| Onboarding incl. passphrase setup and the onboarding "Link a mobile" screen (QR, device name, back) | 01 (§1) | — |
+| What's New (auto-show, pages, read-more, from settings) | 01 (§2) | 04 Help: none |
+| SimpleX Lock notice, delivery-receipts startup prompt, app-update channel notice | 04 | 01: none |
+| Remote desktop pairing, use, disconnect, stored pairing, delete, port, multicast — including pairing from onboarding | 04 (§K) | 01: the onboarding "Link a mobile" screen UI only |
+| Message draft setting ("Message draft" in More privacy): turning it off | 04 (privacy) | 02 §S: draft behaviour with the setting on (default) |
+| Sent-via-proxy setting ("Show message status") and the proxy icon | 04 (network) | 02: none |
+| "Remove link tracking" setting and its effect while typing | 04 (privacy) | 02: none |
+| "Show encryption" setting and the lock icon on items | 04 (privacy) | 02: none |
+| Group invitation item in the direct chat with the host (tap to join, incognito label, sent item), and the join-time "Invitation expired!" alert | 03 (§8) | 02 §U: the expired invitation item label (an `IGNORE` row: never produced by the core) |
+| Group event items (merged/collapsed events, expand/hide, role changes) | 03 (§16) | 02: selecting a merged range (§K) and deleting it (§U) |
+| Welcome message received as the first item | 03 (§4) | — |
+| Group disappearing messages (preference and expiry) | 03 (§5) | 02 §D: direct-chat timed messages |
+| Group toolbar ⋮ entries ("Invite members", "Group link") | 02 (§A) | 03: entry points on the group info screen |
+| "Send link previews" setting | 04 (privacy): turning it off | 02 §B: previews with the setting on (default), the first-time alert, fetch, cancel, received cards |
+| "Auto-accept images" setting | 04 (privacy): turning it off | 02 §G: automatic receipt with the setting on (default) |
+| Calls: toolbar call buttons, call items, incoming call alerts, the WebRTC `IGNORE` row | 02 | 01 §13: the contact-info call buttons and their "prohibited"/"allow" alerts |
+| Chat-list rows and row menus for every chat type (rendering, flags, favorite, tags, mute modes) | 01 (§3) | 03: group-specific actions (join/delete invitation, leave, delete, archive reports) and the report/support/pending flags asserted in their own sections |
+| A contact deleted by the peer (row label, disabled compose and its alert) | 01 (§15) | — |
+| Private notes clear | 01 (§3, notes menu) | — |
+| Address and business-address settings | 01 (§11) | 03: business-chat flows (customer and business sides, team members) |
+| Contact, invitation, address, bot, name, signature, URI and link-card connection plans; prepared direct chats | 01 (§8, §9) | — |
+| Group, channel, relay-address and business connection plans; joining groups and channels; prepared groups and business chats | 03 (§8, §19, §20) | 01: search filtering on a pasted known group link (§3), the channel button of a SimpleX-name plan (§8), pending-connection info of a group link (§10) |
+| Mentions while composing (picker, filter, limit, received highlight) | 02 (§B) | 03 §15: mentions-only mute notification, blocked member's mention ignored |
+| Moderation (single, full delete, multiple, received moderation, not offered) | 03 (§14) | 02: rendering of blocked-by-admin and collapsed marked-deleted items |
+| Reports: member side (compose, reasons, sent alert, not offered, preference off, not visible to other members) | 02 (§O) | — |
+| Reports: moderator side (banner, reports view, archive, delete, multi-archive, jump to reported message, archive all from chat list) | 03 (§13) | — |
+| Member contacts: create, accept, reject, incognito | 03 (§11) | 02: the "requested connection" event item; 01: none |
+| Clear chat and chat TTL from contact info | 01 (§13) | — |
+| Clear chat from group info | 03 (§17) | — |
+| Chat toolbar ⋮ menu (incl. mute) | 02 (§A) | 01: none |
+| Contact preferences | 01 (§14) | 02: feature items and offers in the chat, the compose "Allow voice messages?" alert |
+| Group preferences, their effects in group chats (incl. reactions or voice off) and the resulting feature items | 03 (§5) | 02: the disabled attach button when group files are off (§F), reports with the preference off (§O) |
+
+## Class map
+
+Each sub-area (a `###` section) is one test class, or several consecutive classes when it has more than 30 tests. A class holds the names from its first test up to the next class's first test, in catalogue order. Packages: catalogue 01 → `chat.simplex.app.ui.main`, 02 → `chat.simplex.app.ui.chat`, 03 → `chat.simplex.app.ui.groups`, 04 → `chat.simplex.app.ui.settings`. Within a class's range, names whose row has `S` go to `open class <Base>CompatTest` (plus `@Category(StableCompat::class) class <Base>CompatStableTest : <Base>CompatTest()`), the others to `<Base>Test`. The traceability check reads this table; regenerate it with the counts after any change.
+
+| Cat | § | Sub-area | First test | Classes | Tests | Ignored |
+|---|---|---|---|---|---|---|
+| 01 | 1 | Onboarding | `onboardingWelcomeShowsDesktopActions` | `OnboardingTest` | 24 | 0 |
+| 01 | 2 | What's New | `whatsNewFromSettings` | `WhatsNewTest` | 6 | 0 |
+| 01 | 3 | Chat list | `chatListTitleAndProfileButton` | `ChatListToolbarSearchTest` | 18 | 0 |
+| 01 | 3 | Chat list | `unreadFilterToggle` | `ChatListFiltersListsTest` | 25 | 0 |
+| 01 | 3 | Chat list | `previewShowsLastTextMessage` | `ChatListRowsTest` | 22 | 0 |
+| 01 | 3 | Chat list | `contactMenuMarkRead` | `ChatListMenusPendingTest` | 15 | 0 |
+| 01 | 3 | Chat list | `contactRequestMenuAccept` | `ChatListRequestsCardsTest`, `ChatListRequestsCardsCompatTest`, `ChatListRequestsCardsCompatStableTest` | 26 | 0 |
+| 01 | 4 | Servers summary | `serversSummaryOpensFromIndicator` | `ServersSummaryTest` | 10 | 0 |
+| 01 | 5 | User picker and profiles | `userPickerOpensAndShowsCurrentUser` | `UserPickerTest` | 11 | 0 |
+| 01 | 5 | User picker and profiles | `profilesListShowsAllVisible` | `ChatProfilesTest` | 21 | 0 |
+| 01 | 5 | User picker and profiles | `editProfileDisplayName` | `ProfileEditTest` | 12 | 0 |
+| 01 | 6 | New chat sheet and contacts | `newChatSheetShowsActions` | `NewChatSheetTest` | 17 | 0 |
+| 01 | 7 | 1-time link (create / share / QR / incognito / profile) | `createOneTimeLinkShowsLinkAndQr` | `OneTimeLinkTest`, `OneTimeLinkCompatTest`, `OneTimeLinkCompatStableTest` | 17 | 0 |
+| 01 | 8 | Paste link and connection plans (contact, invitation, address, bot, name, signature, URI and link-card links) | `pasteLinkInvalidTextAlert` | `ConnectPlanTest`, `ConnectPlanCompatTest`, `ConnectPlanCompatStableTest` | 29 | 0 |
+| 01 | 9 | Connecting a prepared chat (compose area) | `preparedContactInvitationConnectButton` | `PreparedChatTest` | 11 | 0 |
+| 01 | 10 | Pending connection info screen | `pendingInfoInvitedShowsLinkQrShare` | `PendingConnectionTest` | 7 | 0 |
+| 01 | 11 | Address screens | `addressScreenNoAddressShowsCreate` | `AddressTest`, `AddressCompatTest`, `AddressCompatStableTest` | 23 | 0 |
+| 01 | 12 | SimpleX name | `simplexNameEntryShownWithAddress` | `SimplexNameTest` | 8 | 0 |
+| 01 | 13 | Contact info screen | `contactInfoOpensFromChatHeader` | `ContactInfoTest` | 28 | 0 |
+| 01 | 14 | Preferences | `contactPrefsDisappearingMessagesAllow` | `ContactPreferencesTest` | 12 | 0 |
+| 01 | 15 | Delete contact variants | `deleteContactOnlyConversation` | `DeleteContactTest` | 10 | 0 |
+| 02 | A | Chat view shell, toolbar, banner | `directChat_opens_showsToolbarAndBanner` | `ChatShellTest` | 11 | 0 |
+| 02 | B | Composing and sending text, links, mentions, commands | `sendText_enter_peerReceives` | `ComposeTest`, `ComposeCompatTest`, `ComposeCompatStableTest` | 29 | 0 |
+| 02 | C | Live messages | `liveMessage_menuStart_alertConfirm_peerSeesStarted` | `LiveMessageTest` | 10 | 0 |
+| 02 | D | Timed / disappearing messages | `timed_send30s_bothSidesDelete` | `TimedMessageTest` | 6 | 0 |
+| 02 | E | Voice messages | `voice_record_send_peerReceivesVoice` | `VoiceMessageTest` | 11 | 0 |
+| 02 | F | Attachments – sending | `attach_sheet_showsImageVideoFile` | `SendAttachmentTest`, `SendAttachmentCompatTest`, `SendAttachmentCompatStableTest` | 21 | 1 |
+| 02 | G | Receiving files: download, cancel, errors, save, viewers | `rcvImage_autoReceived_renders` | `ReceiveFileTest` | 20 | 0 |
+| 02 | H | Replies / quotes | `reply_menu_sendQuoted_peerSeesQuote` | `ReplyTest`, `ReplyCompatTest`, `ReplyCompatStableTest` | 7 | 0 |
+| 02 | I | Edit and history | `edit_menu_updatesPeer` | `EditMessageTest`, `EditMessageCompatTest`, `EditMessageCompatStableTest` | 12 | 0 |
+| 02 | J | Delete / reveal / blocked | `delete_ownForMe_localOnly` | `DeleteMessageTest`, `DeleteMessageCompatTest`, `DeleteMessageCompatStableTest` | 8 | 0 |
+| 02 | K | Multi-select and selection toolbar | `select_enterMode_showsCounterToolbar` | `MultiSelectTest` | 9 | 0 |
+| 02 | L | Forwarding | `forward_contactToContact_peerSeesForwarded` | `ForwardTest` | 17 | 0 |
+| 02 | M | Reactions | `reaction_add_peerSeesAdded` | `ReactionTest`, `ReactionCompatTest`, `ReactionCompatStableTest` | 8 | 0 |
+| 02 | N | Copy / Share / Save / text selection | `copy_text_toClipboardAndToast` | `CopyShareTest` | 9 | 0 |
+| 02 | O | Reports, member side | `report_member_spam_moderatorsReceive` | `MemberReportTest` | 7 | 0 |
+| 02 | P | Chat item info | `info_sent_showsSentAt` | `ItemInfoTest` | 15 | 0 |
+| 02 | Q | Unread handling, scrolling, pagination | `unread_openChat_scrollsToFirstUnread` | `UnreadScrollTest` | 18 | 0 |
+| 02 | R | Search and content filters | `search_direct_filtersResults` | `ChatSearchTest` | 11 | 0 |
+| 02 | S | Draft persistence | `draft_text_restoredAfterChatSwitch` | `DraftTest` | 8 | 0 |
+| 02 | T | Status icons and delivery | `status_direct_sentThenDelivered` | `ItemStatusTest`, `ItemStatusCompatTest`, `ItemStatusCompatStableTest` | 9 | 0 |
+| 02 | U | Special items | `e2eeInfo_direct_pq` | `SpecialItemTest`, `SpecialItemCompatTest`, `SpecialItemCompatStableTest` | 19 | 1 |
+| 02 | V | Private notes | `notes_sendText_saved` | `NotesTest` | 7 | 0 |
+| 02 | W | Context menus and keyboard | `contextMenu_rightClick_opens` | `ContextMenuTest` | 5 | 0 |
+| 02 | X | Rare states and out-of-reach rows | `call_webrtcSession_connects` | `ChatEdgeCasesTest` | 4 | 2 |
+| 03 | 1 | Create group | `createGroup_buttonDisabledForEmptyOrInvalidName` | `CreateGroupTest` | 12 | 0 |
+| 03 | 2 | Invite members | `inviteMembers_listsOnlyEligibleContacts` | `InviteMembersTest`, `InviteMembersCompatTest`, `InviteMembersCompatStableTest` | 11 | 0 |
+| 03 | 3 | Group info screen rows | `groupInfo_headerShowsProfileAndCopiesName` | `GroupInfoTest` | 13 | 0 |
+| 03 | 4 | Group profile and welcome message | `editGroupProfile_renameNotifiesMembers` | `GroupProfileTest` | 14 | 0 |
+| 03 | 5 | Group preferences | `groupPrefs_disappearingOnWithTtl` | `GroupPreferencesTest` | 19 | 1 |
+| 03 | 6 | Member admission and review | `memberAdmission_enableReviewAll` | `MemberAdmissionTest` | 16 | 2 |
+| 03 | 7 | Group link | `groupLink_createdAutomatically` | `GroupLinkTest` | 14 | 0 |
+| 03 | 8 | Joining (alice as joiner), connect-plan states, invitations | `joinGroup_pasteShortLinkPrepareAndJoin` | `JoiningTest`, `JoiningCompatTest`, `JoiningCompatStableTest` | 24 | 0 |
+| 03 | 9 | Member list and multi-select | `memberList_rolesAndStatuses` | `MemberListTest` | 10 | 0 |
+| 03 | 10 | Member info | `memberInfo_openShowsSections` | `MemberInfoTest` | 28 | 0 |
+| 03 | 11 | Member contacts | `memberContact_createAndSendInvitation` | `MemberContactTest` | 5 | 0 |
+| 03 | 12 | Support chats, «Chats with members» / «Chat with admins» | `supportChat_memberSendsToAdmins` | `SupportChatTest` | 13 | 0 |
+| 03 | 13 | Reports, moderator side | `reports_moderatorBannerAndCounts` | `ModeratorReportTest` | 9 | 0 |
+| 03 | 14 | Moderation | `moderate_markDeletedForAll` | `ModerationTest` | 6 | 0 |
+| 03 | 15 | Mentions, notification side | `mentions_mentionsOnlyMuteStillNotifies` | `MentionNotificationTest` | 2 | 0 |
+| 03 | 16 | Group events and history | `groupEvents_memberConnectedMerged` | `GroupEventsTest` | 8 | 0 |
+| 03 | 17 | Leave, delete, clear | `leaveGroup_notifiesMembers` | `LeaveDeleteClearTest` | 8 | 0 |
+| 03 | 18 | Channels: alice as owner, with relays and CLI subscribers | `createChannel_noRelaysBlocksCreation` | `ChannelOwnerCreateTest` | 16 | 0 |
+| 03 | 18 | Channels: alice as owner, with relays and CLI subscribers | `channel_broadcastPlaceholderAndDelivery` | `ChannelOwnerBroadcastTest` | 15 | 0 |
+| 03 | 18 | Channels: alice as owner, with relays and CLI subscribers | `channelSubscribers_listAndCount` | `ChannelOwnerManageTest` | 27 | 1 |
+| 03 | 19 | Channels: alice as subscriber, with a CLI owner and relays | `joinChannel_pasteLinkOpenChannel` | `ChannelSubscriberTest` | 26 | 0 |
+| 03 | 20 | Business chats | `business_customerConnectsCreatesBusinessChat` | `BusinessChatTest` | 16 | 0 |
+| 04 | A | Settings root and global keys | `settingsRoot_listsDesktopItems` | `SettingsRootTest` | 7 | 0 |
+| 04 | B | Privacy (Your privacy, More privacy, receipts) | `privacy_sectionsAndFooter` | `PrivacyTest` | 24 | 0 |
+| 04 | C | SimpleX Lock (desktop passcode) and self-destruct | `lock_enable_setsPasscode` | `LockTest` | 22 | 0 |
+| 04 | D | Appearance | `appearance_language_switch` | `AppearanceTest` | 24 | 0 |
+| 04 | E | Network & servers | `network_rootLayout` | `NetworkServersTest` | 22 | 0 |
+| 04 | E | Network & servers | `socks_enable_confirm` | `NetworkProxyTest` | 21 | 0 |
+| 04 | F | Audio & video calls | `calls_screenLayout_noLockScreenOption` | `CallSettingsTest` | 6 | 0 |
+| 04 | G | Chat data, database, encryption, startup DB errors | `chatData_layout` | `ChatDataTest` | 21 | 2 |
+| 04 | G | Chat data, database, encryption, startup DB errors | `dbEncrypt_setFirstPassphrase` | `DatabaseEncryptionTest` | 14 | 1 |
+| 04 | H | Migrate to/from device | `migrateFrom_stopsChatAndAuth` | `MigrationTest` | 15 | 6 |
+| 04 | I | App version, update checker, developer tools | `version_screenShowsVersions` | `VersionDevToolsTest` | 15 | 0 |
+| 04 | J | Help & support | `help_layout` | `HelpTest` | 8 | 2 |
+| 04 | K | Remote desktop: "Link a mobile" (the desktop GUI is the controller, the CLI is the mobile host) | `linkMobile_layout` | `RemoteDesktopTest` | 17 | 0 |
+| 04 | L | Supporter perks (badge-display screens excluded) | `badges_supportScreenLayout` | `SupporterPerksTest` | 8 | 1 |
+| 04 | M | Out of reach in-process | `tray_closeToTrayBehaviour` | `SettingsOutOfReachTest` | 8 | 8 |
+
+## Count rules
+
+- After any change, recount with `tools/recount.py <file>` (it rewrites the section headings and the `## Count` table from the `Test case(s)` cells), then update the file header and regenerate the class map (`tools/classmap.py table`).
+- A class holds at most 30 tests (a sub-area with more is split, class map); the largest class now has 29, the bound the plan quotes for per-JVM leaks (§7.3).
+- The plan's numbers derived from the catalogue (Summary, §7.7 screenshot count, §10 table, §10.1, §10.2, §11.1 NAMES/RELAY, §11.2, §12, §14) are regenerated from the four `## Count` tables, the class map and the Needs counts (`tools/catcheck.py`, `tools/classmap.py`, `tools/needs.py`).
diff --git a/plans/ui-tests/catalogue/01-onboarding-chatlist-connect-profiles.md b/plans/ui-tests/catalogue/01-onboarding-chatlist-connect-profiles.md
new file mode 100644
index 0000000000..70981bddf5
--- /dev/null
+++ b/plans/ui-tests/catalogue/01-onboarding-chatlist-connect-profiles.md
@@ -0,0 +1,311 @@
+# UI test catalogue 1: onboarding, chat list, connecting, profiles, address, contact info
+
+Rows follow `00-legend.md` (paths, row format, Needs codes, users and CLI output, ownership). Each row has the exact strings.xml labels, file:line, test names, the GUI and CLI checks with matching Haskell tests, and blockers. Totals: **352 test cases, none of them `@Ignore`**, in 15 sections (details in `## Count` at the end).
+
+## Setup every test needs
+1. **Compose the real root** (`App.kt` → `AppScreen`/`MainPage`) so that `AlertManager.shared`/`privacySensitive.showInView()` (`C/App.kt:242,255`) render alerts. Alerts are material `AlertDialog` popups and the menus are `DropdownMenu` popups; both can be found with `onAllNodes`. `DefaultDialog` (a separate AWT window, `D/views/helpers/DefaultDialog.desktop.kt:25`) is defined but never used, so it doesn't block anything.
+2. **Pre-set prefs** for onboarded tests unless the test is about them (full list in plan §11.1; onboarding boots keep defaults). Three notices are checked once at first composition, so a test about one of them changes the pref and then calls `restart()`: `laNoticeShown` (the "SimpleX Lock" alert appears once there are more than 3 chats, `C/App.kt:94-103`), `appUpdateNoticeShown` (the app-update channel notice, `apps/multiplatform/desktop/src/jvmMain/kotlin/chat/simplex/desktop/Main.kt:79-87`) and `whatsNewVersion` (What's New, `ChatListView.kt:219-228`). The others take effect without a restart: `oneHandUICardShown`, `addressCreationCardShown`, `getStakeBannerDismissed` (crowdfunding is always available on desktop, `C/views/onboarding/WhatsNewView.kt:1073`), `supporterBannerShown` and `showHiddenProfilesNotice` are read through `.state` (`ChatListView.kt:950-955`, `UserProfilesView.kt:191`); `showMuteProfileAlert`, `showDeleteConversationNotice` and `showDeleteContactNotice` are read when the action runs (`UserProfilesView.kt:119`, `ChatInfoView.kt:259,337`); `privacyLinkPreviewsShowAlert` is read when a typed link is first detected (`ComposeView.kt:476`); `privacyDeliveryReceiptsSet` is read only in `startChat` (`SimpleXAPI.kt:679`; catalogue 04 owns its tests).
+3. **Local servers only.** `acceptConditions` → `setServerOperators` (`C/views/onboarding/ChooseServerOperators.kt:293-311`) enables the operators selected during onboarding (`enabledOperators`, :331-358), whose preset servers are unreachable in the loopback namespace; onboarded tests get the local servers in `resetForTest`; onboarding tests call `TestServers.configure()` (`configureServers(smp1, xftp1)`) after the chat list appears and before anything connects (plan §8.3). No core change is needed.
+4. **Async waits.** Most actions run through `withBGApi`; every lookup and assertion polls with the manual clock (plan §6). Known delays: the What's New modal waits 1 s (`ChatListView.kt:225`), name search is debounced 300 ms (`ChatListView.kt:1143`), and the subscription indicator polls every 1 s (`ChatListView.kt:686`).
+5. **Controls with no text or contentDescription.** Tests find these by their `Ui` keys (plan §3):
+   - unread filter toggle (`ChatListView.kt:758`, `NewChatSheet.kt:582`)
+   - operator logo cards (`ChooseServerOperators.kt:234`)
+   - copy/share icons in `LinkTextView` (`NewChatView.kt:751-762`)
+   - toolbar call button (`ChatView.kt:1291`)
+   - one-hand card close (`ChatListView.kt:168`)
+   - user picker avatars
+6. **Onboarding goes through the passphrase step.** A fresh database has a random passphrase (`initialRandomDBPassphrase`), so "Link a mobile" goes to "Setup database passphrase" first (`D/views/onboarding/SimpleXInfo.desktop.kt:19`), and "Create profile" goes there right after the profile is created (`C/views/WelcomeView.kt:400`). Tests reaching later steps pass it (e.g. "Use random passphrase").
+7. **QR codes can't be read in the test.** Assert link text through the clipboard stub, or read `chatModel.showingInvitation`/`userAddress` directly.
+8. **Context menus** open on right-click (`D/views/chatlist/ChatListNavLinkView.desktop.kt:39-41`): use the driver's `rightClick()` or `longClick()` (plan §7.4).
+
+---
+
+### 1. Onboarding (24 tests)
+
+| Area | Feature | Entry path (labels) | Main file:line | Test case(s) | Verification (GUI / CLI / Haskell) | Needs | Testability notes |
+|---|---|---|---|---|---|---|---|
+| Onboarding | Welcome screen (desktop) | First launch, onboarding stage `Step1_SimpleXInfo` | `C/App.kt:275-292`; `C/views/onboarding/SimpleXInfo.kt:67`; `D/views/onboarding/SimpleXInfo.desktop.kt:16-23` | `onboardingWelcomeShowsDesktopActions`, `onboardingWhySimplexIsBuiltOpensHowItWorks` | Shows "Link a mobile", "Create your profile" and "Why SimpleX is built."; the last opens HowItWorks, headed "You were born without an account." (`HowItWorks.kt:31`, `why_built_heading`), which the welcome screen does not show | ONBOARD | Desktop stage order differs from Android: "Link a mobile" goes to the passphrase step when `initialRandomDBPassphrase` is set; on desktop with no user HowItWorks repeats the "Link a mobile"/"Create your profile" buttons (`HowItWorks.kt:46` → `SimpleXInfo.desktop.kt:16-21`), so their keys match two nodes while it is open |
+| Onboarding | Create first profile | "Create your profile" → "Your profile" → field "Enter profile name…" → "Create profile" | `C/views/WelcomeView.kt:313,389,415,480,485` | `onboardingCreateProfileValidName`, `onboardingCreateProfileButtonDisabledForEmptyName`, `onboardingCreateProfileInvalidNameShowsCorrectionAlert`, `onboardingCreateProfileBackReturnsToWelcome` | Button is disabled for an empty or invalid name. An invalid name shows the info icon, then the "Invalid name!" / "Correct name to %s?" alert (e.g. `a_1` → "Correct name to a-1?"); confirming replaces the name. Success moves to "Setup database passphrase" (fresh database, setup item 6). Back (`WelcomeView.kt:227`) returns to the welcome screen. Name rule: core `mkValidName` (`src/Simplex/Chat/Library/Commands.hs:6703`; Haskell `tests/ValidNames.hs:60`: `alice_1` → `alice-1`) | ONBOARD | Name validity comes from core `chatValidName` (FFI over `mkValidName`); a `_N` suffix is invalid, so use `a_1` for the invalid case and `a1` or `a-1` for the valid one |
+| Onboarding | Migrate entry | Create profile screen → "Migrate from another device" | `C/views/WelcomeView.kt:201` | `onboardingMigrateFromAnotherDeviceOpensMigrationScreen` | Opens `MigrateToDeviceView` ("Migrate here", `MigrateToDevice.kt:171`) in the `PasteOrScanLink` state, showing "Paste archive link" and "Or import archive file" (`:215-221`) | ONBOARD | Entry only; the full migration is another area |
+| Onboarding | DB passphrase setup | After profile → "Setup database passphrase", fields "New passphrase…" / "Confirm new passphrase…", "Set database passphrase" → "Encrypt database?" / "Encrypt", or "Use random passphrase" → "OK" | `C/views/onboarding/SetupDatabasePassphrase.kt:26,96,191,202,229`; `C/views/database/DatabaseEncryptionView.kt:220` | `onboardingSetDatabasePassphrase`, `onboardingSetPassphraseMismatchDisablesButton`, `onboardingUseRandomPassphraseAlert` | Mismatched passphrases keep the button disabled; the button is also disabled when the new passphrase equals the current one or contains whitespace or non-ASCII characters (`SetupDatabasePassphrase.kt:118-123`, `validKey`). "Set database passphrase" shows the "Encrypt database?" alert ("Database will be encrypted."); "Encrypt" sets `storeDBPassphrase=false`, encrypts, shows the "Database encrypted!" alert (`DatabaseEncryptionView.kt:475`, over the next screen) and moves to "Your network" (or "Link a mobile" if no user). Random shows the "Use random passphrase" alert ("Random passphrase is stored in settings as plaintext…"); "OK" moves on the same way. Haskell: `testDatabaseEncryption` (H/Direct.hs:1589) | ONBOARD | — |
+| Onboarding | DB passphrase setup | After profile → "Setup database passphrase", fields "New passphrase…" / "Confirm new passphrase…", "Set database passphrase" → "Encrypt database?" / "Encrypt" | `C/views/onboarding/SetupDatabasePassphrase.kt:26,52,96,191,202,229` | `onboardingPassphrasePersistsAcrossRestart` | After "Encrypt" (and its "Database encrypted!" alert), `storeDBPassphrase` is false and no passphrase is stored in settings (`EncryptedDBPassphrase` absent); after the restart the passphrase prompt (`DatabaseErrorView`, "Encrypted database" / "Database passphrase is required to open chat.", `DatabaseErrorView.kt:96-97`) is shown. Haskell: `testDatabaseEncryption` | ONBOARD, RESTART | Restarts the core with the harness restart (plan §11.1). Only "Encrypt" sets `storeDBPassphrase=false` (`SetupDatabasePassphrase.kt:52`); a random passphrase is stored in settings, so the restart would show no prompt. Entering the passphrase on the startup screen is tested in 04 §G `dbError_enterPassphraseOnStartup_open`; this test stops at the prompt |
+| Onboarding | Your network | "Your network" → "Setup routers" button; "Continue" | `C/views/onboarding/YourNetwork.kt:42,136,173` | `onboardingYourNetworkShowsSetupRouters`, `onboardingContinueGoesToConditions` | Title and subtitle shown; "Continue" goes to "Network commitments" | ONBOARD | Reached after the passphrase step (setup item 6). The notifications button exists only on mobile (`YourNetwork.kt:105`) |
+| Onboarding | Server operators | "Setup routers" → "Server operators" → operator cards, "How it helps privacy", "OK" | `ChooseServerOperators.kt:178,234,281,362` | `onboardingChooseOperatorsToggle`, `onboardingChooseOperatorsCannotDeselectAll`, `onboardingHowItHelpsPrivacyInfo` | Tapping a card toggles its check circle. With none selected, "OK" and close are disabled. Info screen title "Network operators". Haskell: `testOperators` (Direct.hs) | ONBOARD | Reached after the passphrase step. Cards are logo images with no text; found by their `Ui` keys |
+| Onboarding | Conditions | "Network commitments" → "Privacy policy and conditions of use." / "Accept" | `ChooseServerOperators.kt:42,134,293,314` | `onboardingAcceptConditionsCompletesOnboarding`, `onboardingConditionsLinkOpensConditionsText` | "Accept" sets the stage to `OnboardingComplete` and shows the chat list "Chats". The link opens "Conditions of use" (`SimpleConditionsView`, `NetworkAndServers.kt:836`), whose "Accept" also leads to "Chats" | ONBOARD | Accepting enables the operators selected in onboarding (`ChooseServerOperators.kt:299-305`, `enabledOperators` :331-358), whose servers are unreachable in the namespace; tests that connect afterwards call `TestServers.configure()` (setup item 3) |
+| Onboarding | Conditions with no operator enabled | "Network commitments" | `ChooseServerOperators.kt:48-51,293` | `onboardingAcceptButtonDisabledWithNoOperators` | With no operator enabled in the core, the initial selection is empty and "Accept" is disabled | ONBOARD, FIXTURE (all operators disabled) | Deselecting in the UI falls back to the operators enabled in the core (`ChooseServerOperators.kt:48-51`), so the state needs a fixture |
+| Onboarding | Notifications mode | (mobile only) | `C/views/onboarding/SetNotificationsMode.kt:25` | `onboardingNoNotificationsStepOnDesktop` | On "Your network" the desktop screen shows "Setup routers" and no "Setup notifications" (`YourNetwork.kt:58-59,181`; the Android-only button at `:105-109,214` is the one entry to "Private notifications") | ONBOARD | Assert it's absent |
+| Onboarding | First contact after onboarding | Complete onboarding → New chat → 1-time link | (see §7) | `onboardingThenConnectToCliPeerViaLocalServers` | After onboarding (passphrase step included) the test calls `TestServers.configure()`, creates a 1-time link; CLI `/c <link>` gives "confirmation sent!" then "alice: contact is connected". Haskell: `testAddContact` (H/Direct.hs:191) | ONBOARD, P | Smoke test of the local-server setup |
+| Onboarding | Link a mobile (onboarding) | Welcome → "Link a mobile" → "Link a mobile" screen: "This device name", "Discoverable via local network", QR code, "Share link" | `C/views/onboarding/LinkAMobileView.kt:24,52`; `C/views/remote/ConnectMobileView.kt:269` | `onboardingLinkAMobileShowsQrAndDeviceName` | After the passphrase step (`SimpleXInfo.desktop.kt:19`) the screen shows the device name field, the discoverable toggle and the QR code; with developer tools on, "Share link" puts the invitation on the clipboard stub. Pairing with a CLI acting as the mobile, including from onboarding, is tested in catalogue 04 §K | ONBOARD, CB, DT | "Share link" is shown only with developer tools on (`C/views/remote/ConnectMobileView.kt:207-213`); remote desktop works over loopback (plan §8.3); the test turns `offerRemoteMulticast` off before opening the screen so that `startRemoteHost` (`ConnectMobileView.kt:282-287`) does not announce over multicast (otherwise Needs would include `MCAST`) |
+| Onboarding | Link a mobile (onboarding) | Welcome → "Link a mobile" → "Setup database passphrase" ("Use random passphrase" → "OK") → "Link a mobile" screen → Back | `C/views/onboarding/LinkAMobileView.kt:24,52`; `C/views/remote/ConnectMobileView.kt:269` | `onboardingLinkAMobileBackReturnsToWelcome` | Back returns to the welcome screen | ONBOARD | – |
+| Onboarding | Only hidden users exist | Create profile while only hidden users exist | `WelcomeView.kt:399-410` | `onboardingCreateProfileWhenOnlyHiddenUsersExist` | Continues like a fresh install: with no visible user (`WelcomeView.kt:398-404`) onboarding moves on to "Setup database passphrase" or "Your network", not straight to `OnboardingComplete` | ONBOARD, FIXTURE (only hidden users, none active) | Fixture: a database whose only users are hidden and none is active (`active_user = 0`), so startup takes the no-user path (`C/platform/Core.kt:153-166`) |
+
+### 2. What's New (6 tests)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Startup | What's New | Automatic 1 s after the chat list when the stored `whatsNewVersion` differs from the last version (including unset); Settings → "Help & support" → "What's new" | `C/views/onboarding/WhatsNewView.kt:68,1030`; `ChatListView.kt:219-228` | `whatsNewFromSettings` | Title "New in v7.0.1" (the last entry, `WhatsNewView.kt:68,176,946`; `isInUs()` is true on desktop, where `androidPlayStoreCountry` stays null, :1083-1086); opens from Settings → "Help & support" → "What's new"; no "OK" button there (`WhatsNewView.kt:218`), closed with back | — | – |
+| Startup | What's New after an upgrade | Automatic 1 s after the chat list when the stored `whatsNewVersion` differs from the last version (including unset) | `C/views/onboarding/WhatsNewView.kt:218,1030`; `ChatListView.kt:219-228` | `whatsNewShownAfterVersionUpgrade`, `whatsNewOkCloses` | Shown automatically 1 s after the chat list when `whatsNewVersion` is older; "OK" closes it | RESTART | The test sets an older `whatsNewVersion`, then restarts so the chat list is composed again |
+| Startup | What's New | Automatic 1 s after the chat list when the stored `whatsNewVersion` differs from the last version (including unset); Settings → "Help & support" → "What's new" | `C/views/onboarding/WhatsNewView.kt:68,1030`; `ChatListView.kt:219-228` | `whatsNewPaginationPrevNext` | Opens on "New in v7.0.1" (the last entry: v7.1 is commented out, `WhatsNewView.kt:973-985`; desktop has no Play Store country, so `isInUs()` is true, `:946,1083-1086`; opens on the last index, `:69`); the previous link "v6.5" (`:913`) shows "New in v6.5", and its next link "v7.0.1" shows "New in v7.0.1" again (`:145,150,160`; no next link on the last entry); on "New in v7.0.1" "Read more" shows the "Open external link?" alert (`WhatsNewView.kt:261`, `C/views/helpers/Utils.kt:618-622`), and "Open" records `https://simplex.chat/blog/20260819-simplex-chat-crowdfunding.html` in the URI stub (`:947`; v7.1 has no post, `:976`) | URI | – |
+| Startup | What's New | Automatic 1 s after the chat list when the stored `whatsNewVersion` differs from the last version (including unset); Settings → "Help & support" → "What's new" | `C/views/onboarding/WhatsNewView.kt:68,1030`; `ChatListView.kt:219-228` | `whatsNewNotShownForNewUser` | The onboarding profile screen calls `setLastVersionDefault` when it is composed (`WelcomeView.kt:345-347`; the mobile layout at :305-307), so after the chat list has been shown for 2 s (the auto-open fires 1 s after its first composition, `ChatListView.kt:225`) no What's New modal is open | ONBOARD | – |
+| Startup | Updated conditions | What's New with "View updated conditions": as in 04 `operators_reviewAcceptConditions`, the console sends `/_servers <userId> <json>` with the SimpleX Chat operator `enabled: true`, then `restart()`; the core returns `UCAReview` with `showNotice` while the conditions were never notified (`src/Simplex/Chat/Operators.hs:117-129`), and the chat list opens What's New with `updatedConditions` after 1 s (`ChatListView.kt:219-228`) | `WhatsNewView.kt:72-81,197-216` | `whatsNewShowsViewUpdatedConditions` | What's New shows "View updated conditions"; opening it already calls `setConditionsNotified` (`/_conditions_notified`, `WhatsNewView.kt:71-79`), so the core's `currentConditions.notifiedAt` is set; the link opens `UsageConditionsView` in the Review state, titled "Updated conditions" with "Accept conditions" (`NetworkAndServers.kt:790-805`) | RESTART | `conditionsAction.shouldShowNotice` is core state |
+
+### 3. Chat list (106 tests)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Toolbar | Title, profile button | Main screen, title "Chats" | `ChatListView.kt:521-665,704` | `chatListTitleAndProfileButton`, `chatListScrollToTopOnTitleClick` | Title "Chats" (`your_chats`, `ChatListView.kt:634`); clicking the profile image opens the user picker (the picker sheet, tagged only while it is visible: Android keeps the picker composed off-screen, `UserPicker.android.kt:143-162`, and on desktop it is the `AnimatedVisibility` content, `UserPicker.desktop.kt:91-108`), whose first option row reads "Create SimpleX address" (`UserPicker.kt:222`); with enough chats to scroll (e.g. 30) scrolled to the last one, clicking the title brings the first chat row back into view (the title is clickable only while the list is off the top, `canScrollToZero`, `ChatListView.kt:611,660`) | — | – |
+| Toolbar | Unread dot for other users | Second user gets messages | `ChatListView.kt:621-627,732` | `chatListUnreadDotOnProfileButtonForOtherUsers` | A badge appears on the profile button once bob has messaged alice's second, non-active user (its unread counter goes up on arrival, `C/model/ChatModel.kt:1033`); after switching to that user, opening bob's chat and switching back, the badge is gone | P | Badge is an empty Text (`ChatListView.kt:732-744`) inside the profile IconButton (:706,713-714); hidden and active users are excluded from the dot (`ChatListView.kt:621-624`) |
+| Toolbar | Chat stopped | Stop chat (Settings › database) | `ChatListView.kt:545-559` | `chatListStoppedChatIndicator` | Red icon "Chat is stopped"; clicking it shows "You can start chat via app Settings / Database or by restarting the app." | — | – |
+| Toolbar | Subscription indicator | Icon next to "Chats" | `ChatListView.kt:668`; `ServersSummaryView.kt:120,349` | `subscriptionIndicatorConnected`, `subscriptionIndicatorPercentageToggle` | With "Show percentage" on (Servers info, `ServersSummaryView.kt:349`; off by default, `SimpleXAPI.kt:155`), the text next to the icon goes from "%" (no subscriptions) to "100%" within 2 s after the 1-time link is created and the new-chat modal is closed with "Keep" in the "Keep unused invitation?" alert (`NewChatView.kt:76-97`; "Delete" removes the queue) — or after an invitation is created through the API with no modal open (`ServersSummaryView.kt:121,141`; the colour alone can't tell connected from a fresh install, :87-104; the 1 s poll skips while a start or fullscreen modal is open, `ChatListView.kt:686-690`); the toggle shows and hides the text. The toggle is "Show percentage" in Servers info (opened from the indicator, `ChatListView.kt:640-654`), "Messages" tab, "Message reception" section (`ServersSummaryView.kt:325-352`); close Servers info to see the toolbar text; the pref key is `ShowSubscriptionPercentage` (`SimpleXAPI.kt:449`) | — | 1 s polling. alice first creates a 1-time link so a queue is subscribed; with no subscriptions and no session the indicator stays in the fresh-install state (`ServersSummaryView.kt:92-94`) |
+| Toolbar | Subscription indicator | Icon next to "Chats" | `ChatListView.kt:668`; `ServersSummaryView.kt:120,349` | `subscriptionIndicatorServerDown` | Stopping the local SMP server lowers the subscribed share | SRVCTL | 1 s polling. alice first creates a 1-time link so a queue is subscribed; with no subscriptions and no session the indicator stays in the fresh-install state (`ServersSummaryView.kt:92-94`) |
+| Toolbar | New chat | Floating button "Start new chat" (bottom bar in one-hand mode) | `ChatListView.kt:102,479-501,585-605` | `newChatButtonOpensNewChatSheet` | With "Reachable app toolbars" on (Pref OneHandUI, default true, `SimpleXAPI.kt:275`) there is no FAB and the bottom-bar button "Start new chat" opens the "New chat" sheet (`ChatListView.kt:241-249,585-605`); with it off, the FAB "Start new chat" opens it (`:251-264,479-501`); with chat stopped neither button exists (the FAB needs `chatRunning == true`, :262, and the bar button is added only in the `else` branch of `if (stopped)`, :545,560,569,585-605), so the FAB's grey disabled state (:482,497) is unreachable | — | – |
+| Search | Text search | "Search or paste SimpleX link" | `ChatListView.kt:788,1541-1569` | `searchFiltersByDisplayName`, `searchFiltersByAlias`, `searchMatchesPendingConnectionAlias`, `searchNoChatsFound`, `searchClearsWhenFilterChanges` | Filters on `anyNameContains` and the pending-connection alias (a pending connection matches only its alias, `ChatListView.kt:1563`). Empty result shows "No chats found". Changing filter clears the text (`ChatListView.kt:1132`); while text is entered the unread toggle is hidden (:811-824), so the filter is changed with a preset or list chip. The open chat is always listed whatever the search (:1554,1557). Haskell: `testFilterSearch` (ChatList.hs) | P | – |
+| Search | Paste link | Paste a SimpleX link into search | `ChatListView.kt:836-845,887` | `searchPasteLinkTriggersConnectPlan`, `searchPasteKnownContactLinkFiltersToContact`, `searchPasteKnownGroupLinkFiltersToGroup` | Field shows the link's description, e.g. "SimpleX contact address (via <host>)" or "SimpleX group link (via <host>)" (`simplexLinkText`, `ChatModel.kt:5157-5160`), and becomes read-only (disabled, :804). A known contact/group filters the list to that chat with no alert; an unknown link with profile data shows the open-chat alert (profile name, "Open new chat", "Cancel"), and "Cancel" clears the field (§8) | P | The app reacts to any text change (`ChatListView.kt:836-845`), so the tests enter the link text directly (Compose's own paste reads `LocalClipboard`, which the harness does not provide) |
+| Search | Name candidate | Type `bobby` or `@bob.simplex` (bare words need 5+ characters) | `ChatListView.kt:1152,1168,1207` | `searchNameShowsConnectToNameRow` | Row "Connect to bobby.testing" / "Connect to @bob.simplex"; "bob" shows no row | — | The row comes from local parsing (`ChatListView.kt:846-847,1158-1161`), with no peer or names server |
+| Search | Name candidate | Type `bobby` (bare words of 5+ characters get `.testing`) or `@bob.simplex` | `ChatListView.kt:1152,1168,1207` | `searchKnownNameFiltersChat` | A known name filters to that chat. Haskell: `Names.hs` `testConnectByName` | P, NAMES | NAMES: `uitest-servers` names mode with the mock registry (plan §8.2); GUI servers need the names role (`enableNamesRole`, `tests/ChatClient.hs:488`) |
+| Filters | Unread | Filter icon next to search; empty state "No unread chats" (tap to clear) | `ChatListView.kt:747,1244-1257` | `unreadFilterToggle`, `unreadFilterEmptyState` | Shows only chats with `unreadTag` (`C/model/ChatModel.kt:1460-1464`): unread messages in unmuted chats, unread mentions in mentions-only groups, and "Mark unread" chats; a muted chat with unread messages is hidden (checked once that chat's row shows the unread count with the filter still off, then the filter is turned on, `ChatPreviewView.kt:460-498`, `ChatModel.kt:1460-1464`: the CLI prints its message when it is sent, before it reaches alice, and a chat without unread messages would be hidden anyway). Empty state "No unread chats" (tap clears the filter). Haskell: `testFilterUnread`, `testFilterFavoriteOrUnread` | P | Icon has no description |
+| Filters | Preset tags | "Favorites", "Contacts", "Groups", "Channels", "Businesses", "Notes", "Reports" | `ChatListView.kt:1281-1304,1410,1579-1617` | `presetFilterFavorites`, `presetFilterContacts`, `presetFilterGroups`, `presetFilterBusinesses`, `presetFilterNotes`, `presetFilterReports` | Presets show only when at least two kinds other than Reports have chats (`ChatListView.kt:1293`); they are chips when those kinds plus Reports plus user lists number at most 3, otherwise a menu (:1294-1303), with Reports always a chip (:1619-1622). Selecting one leaves only that kind in the list (`presetTagMatchesChat`, :1579-1606), so each test also has a chat of another kind that disappears: "Favorites" only the starred chat; "Contacts" contacts, requests, pending connections and business-customer chats, not a group; "Groups" a group, not a business chat or channel; "Businesses" only the business chat; "Notes" only the notes folder; "Reports" (always expanded) only the group with a report. Haskell: `testFilterFavorite`; `testBusinessAddress`; `testGroupMemberReports` (Groups.hs) | P | – |
+| Filters | Preset tags | "Favorites", "Contacts", "Groups", "Channels", "Businesses", "Notes", "Reports" | `ChatListView.kt:1281-1304,1410,1579-1617` | `presetFilterChannels` | "Channels" filter lists channels the user joined or owns | P, RELAY | A channel needs a chat relay |
+| Filters | Collapsed presets | More than 3 tags in total → menu icon "All" | `ChatListView.kt:1293-1303,1461-1517` | `presetFiltersCollapsedMenuWhenMany`, `presetFilterAllResets`, `presetTagsHiddenWhenOnlyOneKind` | With at least two kinds that can collapse (every preset except Reports, `ChatListView.kt:1284,1619-1622`), the presets are separate chips while kinds + Reports + user lists ≤ 3 (:1293-1297) and otherwise a menu whose icon reads "All" or the selected preset (:1477-1491); the menu lists the collapsible kinds that have chats (:1510-1514) and an "All" item only while a filter or search text is active (:1496), which clears both (:1501-1505); with fewer than two collapsible kinds no presets are shown | P | The notes folder counts as the Notes kind and the "Ask SimpleX Team" card is not a contact for the filters (`ChatListView.kt:1584`), so "a single kind" is the fresh list with notes only; one contact makes two kinds |
+| Lists | Create list | Tags row "Add list" / "+" → editor field "List name...", emoji, "Save list" | `C/views/chatlist/TagListView.kt:173,196`; `D/.../TagListView.desktop.kt:25` | `createListFromAddList`, `createListWithEmoji`, `createListDuplicateNameError` | `createListFromAddList`: a new chip with the list's name appears; `createListWithEmoji`: the chip shows the chosen emoji in place of the label icon (`ChatListView.kt:1336-1344`) and the tag returned by `/_create tag` (`CRChatTags`, `Library/Commands.hs:763-765`) carries the emoji; `createListDuplicateNameError`: with an existing list's name "Save list" turns disabled (`isDuplicateEmojiOrName`, TagListView.kt:259-264); the message "List name and emoji should be different for all lists." is always in the semantics tree and only changes colour (transparent otherwise, TagListView.kt:279, 287), so it is checked in the screenshot, not by semantics. Haskell: `testDeleteUserChatTags` (Direct.hs:2304, `/_create tag`) | — | Emoji input is a single-emoji text field on desktop (`D/views/chatlist/TagListView.desktop.kt:33-72`) and an `EmojiPickerView` AndroidView on Android (`TagListView.android.kt:23-51,54-81`), so `createListWithEmoji` is desktop-only; "Save list" when disabled drops its clickable without Disabled semantics (`C/views/helpers/Section.kt:212-217`), so the tests check that a click does nothing |
+| Lists | Assign | Row menu "Add to list" / "Change list" | `ChatListNavLinkView.kt:390`; `TagListView.kt:47,402` | `addChatToListFromContextMenu`, `changeChatListFromContextMenu`, `removeChatFromList` | With no lists it opens the editor (button "Add to list"), which creates the list and assigns the chat; otherwise a list sheet with a check mark on the chat's list; tapping another list moves the chat to it (tags replaced, `TagListView.kt:402-411`), tapping the checked list removes it; the sheet closes after each tap. The item exists only for contacts with an active connection (`ChatListNavLinkView.kt:288-298`) and for groups past the invitation stage (:312-337), not for notes, requests, pending connections or group invitations; the check mark follows `chatInfo.chatTags` (`TagListView.kt:52,109,151-153`) | P | – |
+| Lists | Filter by list | Tap a list chip | `ChatListView.kt:1306-1382,1243` | `filterByUserList`, `emptyListShowsNoChatsInList`, `listUnreadDot` | Filters; empty list shows "No chats in list %s."; " ●" when the list has unread chats; tapping the active chip again clears the filter (:1320-1321); the dot comes from `unreadTags` (:1348; `ChatModel.kt:1037-1051`) | P | – |
+| Lists | Edit, delete, reorder | Right-click (desktop) or long-press (Android) chip → "Edit" / "Delete" / "Change order" (`ChatListView.kt:1326,1331`) | `TagListView.kt:297-353,478` | `editListNameAndEmoji`, `deleteListConfirm`, `reorderListsDrag` | `editListNameAndEmoji`: "Edit" opens the editor with the list's emoji and name; "Save list" stays disabled until one of them changes (`TagListView.kt:259-262`), and after saving the chip shows the new emoji and name (`apiUpdateChatTag`, :231-239); `deleteListConfirm`: "Delete list?" / "All chats will be removed from the list %s, and the list deleted" / "Confirm" removes the chip, and its chats stay in the chat list (dialog at `TagListView.kt:478-500`, deletion at :442-473); `reorderListsDrag`: "Change order" opens the lists in reorder mode, and after a drag the chips follow the new order (`apiReorderChatTags`, :54-70) | — | Emoji editing is desktop-only (see "Create list"), so `editListNameAndEmoji` is desktop-only; reordering is `detectDragGesturesAfterLongPress` (`C/views/helpers/DragAndDrop.kt:144-146`) with no semantics action, so `reorderListsDrag` can't be driven without coordinates |
+| Lists | Per-user lists | Switch user | `C/model/SimpleXAPI.kt:775-776`; `src/Simplex/Chat/Store/Shared.hs:919-928` (tags selected by `user_id`) | `listsArePerUser` | Lists differ per profile: a new profile starts with none and "Add list"; switching back restores the first profile's lists | — | – |
+| Rows | Message previews | Chat list rows | `ChatPreviewView.kt:41,226-305,308-370` | `previewShowsLastTextMessage`, `previewShowsDraft`, `previewLink`, `previewDeletedMessage`, `previewContactCardMessage` | `previewShowsLastTextMessage`: the last item's text, received or sent; `previewShowsDraft`: after alice types in bob's chat and switches to another chat (`ComposeView.kt:1381-1420`), the row shows the draft text after the edit icon (inline, no content description, `ChatPreviewView.kt:123-127`) in place of the last message (`:229-248`); `previewLink`: a link message (CLI `/_send @<id> json` with a `link` content and preview image) shows the link text and a thumbnail button that opens the link alert (`:318-330`); `previewDeletedMessage`: a message deleted by bob reads "marked deleted" (`:253`); `previewContactCardMessage`: bob's `/share address @alice` reads his name and, on a second line, his bio (`/p bob <bio>`; `:254-258`) | P | – |
+| Rows | Message previews | Chat list rows | `ChatPreviewView.kt:41,226-305,308-370` | `previewImage`, `previewVoice`, `previewFile` | Thumbnail, voice duration, file | P, XFTP | CLI sends `/f`, `/_send ... json` voice/image |
+| Rows | Group sender prefix | Group rows | `ChatPreviewView.kt:277-283` | `previewGroupSenderPrefix` | A received group message reads "bob: <text>" (`appendSender`, `TextItemView.kt:38-44`); alice's own message has no prefix (`ChatPreviewView.kt:280-283`) | P | – |
+| Rows | Report prefix | Group row whose newest main-scope item is a report | `ChatPreviewView.kt:266-275`; `C/views/chat/item/TextItemView.kt:117-118` | `previewReportPrefix` | Report shown with a red italic "<reason>: " prefix | P, RESTART, FIXTURE (report item moved to the main scope) | Current cores always put reports in the member-support scope (`src/Simplex/Chat/Library/Internal.hs:1989`), so only an edited item reaches the preview. bob (a member) reports alice's message with a text: `/_report #<gId> <itemId> reason=spam bad` (parser `Library/Commands.hs:6118`; the group id from `/i #team`, "group ID: N", View.hs:1904, the item id from `/_get chat #<gId> count=1` read with `nextLine`; the CLI's `/report` always sends empty text, Commands.hs:794-797, and the ": " is added only for a non-empty text, TextItemView.kt:116-118); once alice's row shows the red report flag (`reportsCount > 0`, ChatPreviewView.kt:388), between `restart()` steps `group_scope_tag` and `group_scope_group_member_id` are set to NULL; the preview then reads "Spam: " then "bad" |
+| Rows | Unread counter | Badge on the row | `ChatPreviewView.kt:460-501,611` | `unreadCounterIncrementsAndClears`, `unreadCounterGrayWhenMuted` | After bob sends two messages the row badge reads "1" and then "2" (`unreadCountStr`, `ChatPreviewView.kt:611`; absent before the first); opening the chat removes it (items are marked read after 600 ms); in a muted chat the badge still reads "2" and the chat's `chatSettings.enableNtfs` is `MsgFilter.None` and the row shows no mute icon ("Notifications") while the badge is shown (`ChatPreviewView.kt:464,502`); the grey badge colour (`secondary` instead of `primaryVariant`, `:497`) shows in the screenshot. Haskell: `testMarkReadDirect` | P | – |
+| Rows | Mentions | Group with a mention of alice | `ChatPreviewView.kt:465-493` | `mentionBadgeSingleUnread`, `mentionIconWithMultipleUnread` | One unread mention shows the round @ badge: icon "Notifications" with no count text (`ChatPreviewView.kt:484-492`); after one more message from bob the row shows the @ icon "Notifications" plus the badge "2" (`:476-483,494-498`); before the mention the row (notifications "All") has neither. Haskell: `testMemberMention` (Groups.hs) | P | – |
+| Rows | Status icons | Row trailing icons | `ChatPreviewView.kt:97,384-400,502-527` | `mutedIconWhenNoUnread`, `favoriteStarWhenNoUnread`, `incognitoIconOnRow`, `verifiedIconOnRow`, `timestampShown` | `mutedIconWhenNoUnread`: a muted chat without unread messages shows the mute icon ("Notifications", `ChatPreviewView.kt:502-511`); a message replaces it with the unread badge, and "Mark read" brings it back; `favoriteStarWhenNoUnread`: the same with the star ("Favorite", `:512-521`; not shown when muted); `incognitoIconOnRow`: an incognito contact's row shows the mask (no description, `:557-568`; on group rows only without a report/support/pending flag, `:385-396`); `verifiedIconOnRow`: a verified contact shows the shield before the name (no description, `:97-99,143-145`); `timestampShown`: the row shows `getTimestampText` of the last item (`:417`) | P | – |
+| Rows | Connecting text | Pending states | `ChatPreviewView.kt:183-223` | `previewContactShouldAcceptForAddress`, `previewGroupInvitationJoinAs` | `previewContactShouldAcceptForAddress`: alice opens bob's address (no auto-accept), "Open new chat", "Connect", "Send request without message": the row reads "contact should accept…" until bob accepts (shown for a prepared non-bot contact from an address, or a member contact, `ChatPreviewView.kt:194-196`; other pending contacts read "connecting…", `:197-198`); `previewGroupInvitationJoinAs`: an invitation reads "You are invited to group", and one received through an incognito contact reads "Join as <incognito name>" (`:583-588`) | P | "Join as %s" shows only when alice's membership is incognito (`ChatPreviewView.kt:583-587`), so `previewGroupInvitationJoinAs` gets its invitation through an incognito contact |
+| Rows | Connecting text | Pending states | `ChatPreviewView.kt:194-198` | `previewConnectingForInvitation` | "connecting…" | P, PEERCTL | The CLI is stopped after creating its 1-time link, so the contact stays "connecting…" after alice taps "Connect" |
+| Contact menu | Actions | Right-click a contact row: "Mark read"/"Mark unread", "Favorite"/"Unfavorite", "Mute"/"Unmute", "Add to list", "Clear" | `ChatListNavLinkView.kt:278-301,365-472` | `contactMenuMarkRead`, `contactMenuMarkUnread`, `contactMenuFavoriteUnfavorite`, `contactMenuMuteUnmute`, `contactMenuClearChat`, `contactMenuRightClickOpens` | `contactMenuMarkRead`: "Mark read" (offered while the row has unread messages) clears the unread badge; `contactMenuMarkUnread`: "Mark unread" (offered while the row has no unread messages, `ChatListNavLinkView.kt:39-41,288-292`) sets the chat's unread mark (`markChatUnread`, :677-696; `/_unread chat @<id> on`), shown as an unread badge with no count (`ChatPreviewView.kt:464,496`); the menu then offers "Mark read" in its place, which clears the mark (`markChatRead`, :643-675); `contactMenuFavoriteUnfavorite`: "Favorite" puts the filled star (content description "Favorite") on the row, shown when the row has no unread badge and is not muted (`ChatPreviewView.kt:512-520`); the menu then offers "Unfavorite", which removes the star; `contactMenuMuteUnmute`: mute shows the mute icon; `contactMenuClearChat`: "Clear chat?" / "Clear" leaves only the chat banner; `contactMenuRightClickOpens`: right-click on the row opens this menu (`D/views/chatlist/ChatListNavLinkView.desktop.kt:40`). CLI messages are local-only (CLI sees nothing). Haskell: `testMuteContact` (1834), `testContactClear` (559), `testAddContact` (`/_unread chat`) | P | Contact mute cycles All↔None (`SimpleXAPI.kt:5437`). "Delete" opens the §15 dialog, tested there |
+| Contact menu | Prepared contact | Row of a prepared contact before "Connect" | `ChatListNavLinkView.kt:279-299` | `contactMenuForNotReadyContactOnlyDelete` | A prepared contact (link typed into the chat-list search → "Open new chat", before "Connect") has no active connection, so the menu shows only "Delete" (`ChatListNavLinkView.kt:288`) | P | The link is typed into the chat-list search (`ChatListView.kt:837-844`). "Delete" opens "Confirm contact deletion?" (`C/views/chat/ChatInfoView.kt:231-246,421-426`) |
+| Group menu | Mute modes | Row menu "Mute"/"Mute all"/"Unmute" | `ChatListNavLinkView.kt:321-351` | `groupMenuMuteModesAllMentionsNone` | Menu label "Mute" moves All→Mentions, then "Mute all" moves Mentions→None, then "Unmute" moves None→All (`hasMentions` is true for every group, `C/model/ChatModel.kt:1830`); the row icon follows the mode. Haskell: `testMuteGroup`. Leave, delete and archive reports from this menu are in catalogue 03 | P | – |
+| Notes menu | Notes | "Mark unread", "Clear" → "Clear private notes?" | `ChatListNavLinkView.kt:355,449` | `notesMenuMarkUnreadAndClear` | With one note sent the menu offers "Mark unread" and "Clear" (`ChatListNavLinkView.kt:355-362`); "Mark unread" sets the unread mark; "Clear" shows "Clear private notes?" / "All messages will be deleted - this cannot be undone!" (`C/views/chat/ChatInfoView.kt:508-516`), and its "Clear" empties the notes and resets the chat stats, the unread mark included (`C/model/ChatModel.kt:803-816`). Haskell: `testNotes` (`tests/ChatTests/Local.hs:48` "/_unread chat *1 on"); `testFiles` (`Local.hs:164-165` "/clear *" → "notes: all messages are removed") | — | – |
+| Pending conn | Row and menu | Row after creating a 1-time link; menu "Set contact name", "Delete"; click | `ContactConnectionView.kt:23`; `ChatListNavLinkView.kt:143-162,582,775` | `pendingInvitationRowIconAndName`, `pendingConnectionMenuSetName`, `pendingConnectionClickOpensInfo` | The row reads "invited to connect" / "you shared one-time link" (`ChatModel.kt:3251,3266`; its add-link icon, `ContactConnectionView.kt:26`, has the same description "profile image placeholder" as the link icon, so the texts tell the two apart); "Set contact name" and a click each open the §10 screen "You invited a contact"; the screen opened from "Set contact name" focuses the name field (`focusAlias = true`, `ChatListNavLinkView.kt:590`), a click opens it unfocused (`ChatView.kt:827`) | — | – |
+| Pending conn | Row and menu | Row after creating a 1-time link; menu "Set contact name", "Delete"; click | `ContactConnectionView.kt:23`; `ChatListNavLinkView.kt:143-162,582,775` | `pendingConnectionMenuDeleteInitiated` | "Delete pending connection?" with "The contact you shared this link with will NOT be able to connect!"; the CLI first repeats `/_connect plan 1 <link>` until it prints `error: connection authorization failed - …` (the GUI's deletion reaches the server later, in a background thread, simplexmq `Agent.hs:1013-1015`; the plan reads the link from the server, `Library/Commands.hs:4431`), then a CLI `/c` with the deleted link prints "error: connection authorization failed…". Haskell: `testShortLinkDeletedInvitation` (H/Profiles.hs:4268) for deletion; `testPlanShortLinkInvitation` (H/Profiles.hs:3895-3932) for "/_connect plan" and "/c" printing "error: connection authorization failed" on a link the server no longer serves (View.hs:2922-2924); before the deletion reaches the server the plan prints "invitation link: ok to connect" (View.hs:2241) | P | – |
+| Pending conn | Accepted connection row | Row after alice pastes the CLI's full 1-time link ("The invitation link for old clients:") and taps "Use current profile" while the CLI is stopped, then dismisses "Connection request sent!"; menu "Delete" | `ContactConnectionView.kt:26`; `ChatListNavLinkView.kt:582,775`; `ConnectPlan.kt:103-113,417-421` | `pendingAcceptedRowIcon`, `pendingConnectionMenuDeleteAccepted` | The row reads "accepted invitation" / "via one-time link" (`ChatModel.kt:3252,3273`; the link icon, `ContactConnectionView.kt:26`, has the same description as the add-link icon); delete shows "The connection you accepted will be cancelled!" | P, PEERCTL, CB | The connection stays pending only while the link's creator is stopped. A short link would create a prepared contact instead. The current-build peer is started with `--show-full-links` (`src/Simplex/Chat/Options.hs:435`) |
+| Requests | Contact request (contact row) | CLI `/c <gui address>` → a contact row with "Open to accept"; row menu "Accept" / "Accept incognito" / "Reject" | `C/views/chatlist/ChatPreviewView.kt:192`; `C/views/chatlist/ChatListNavLinkView.kt:279-286,527-557`; core `src/Simplex/Chat/Store/ContactRequest.hs:84-107,195-215` | `contactRequestMenuAccept`, `contactRequestMenuReject`, `contactRequestIncognitoHiddenWithShortLinkData` | Every new request creates a contact (`createRequestEntity` → `createContact'`), shown as a contact row with "Open to accept" (its appearance is `addressCliConnectsAndRequestAppears`, §11). Accept: CLI "alice: contact is connected". Reject: CLI prints nothing, row removed. "Accept incognito" is offered only when the address has no short-link data (`addressShortLinkDataSet()`, `ChatListNavLinkView.kt:537`). Haskell: `testUserContactLink` (1362), `testRejectContactAndDeleteUserContact` (1817), `testConnectIncognitoContactAddress`, `testShortLinkAddressPrepareContact` ("incognito not allowed for address with short link data") | P, S | – |
+| Requests | Contact request (contact row) | CLI `/c <gui address>` → a contact row with "Open to accept"; row menu "Accept" / "Accept incognito" / "Reject" | `C/views/chatlist/ChatPreviewView.kt:192`; `C/views/chatlist/ChatListNavLinkView.kt:279-286,527-557`; core `src/Simplex/Chat/Store/ContactRequest.hs:84-107,195-215` | `contactRequestMenuAcceptIncognito` | Accept incognito: CLI sees a random name | P, FIXTURE (address without short-link data) | "Accept incognito" is offered only for an address without short-link data (`addressShortLinkDataSet()`, `ChatListNavLinkView.kt:537`) |
+| Requests | Accept bar in the request's chat | Open the "Open to accept" row → chat bar "Reject" / "Accept" | `C/views/chat/ComposeContextContactRequestActionsView.kt:27,82-160`; `ComposeView.kt:1821` | `contactWithRequestOpenToAccept`, `contactWithRequestComposeAccept`, `contactWithRequestComposeReject` | Opening the row shows the chat with the accept bar in place of the message field (`ComposeView.kt:1821-1829`); a request made by CLI `/c <address>` carries no message (`Connect` takes none, `Library/Commands.hs:6326`; a request message needs `/_connect plan 1 <link>` → `/_prepare contact 1 <full> <short> <data>` → `/_connect contact @<id> text <msg>`, H/Profiles.hs:4194-4201). Reject shows "Reject contact request" / "The sender will NOT be notified."; its "Reject" returns to the chat list with the row gone and the CLI prints nothing (`ComposeContextContactRequestActionsView.kt:122-131`; `ChatListNavLinkView.kt:759-771`). Accept: CLI "alice: contact is connected". Haskell: `testShortLinkAddressPrepareContact` (4188) | P | – |
+| Requests | Accept bar alert | Open the request's chat for an address without short-link data → "Accept" → "Accept contact request" | `C/views/chat/ComposeContextContactRequestActionsView.kt:91-95,136-165` | `contactWithRequestComposeAcceptAlertIncognito` | "Accept contact request" with "Accept" / "Accept incognito" / "Cancel"; Accept incognito: CLI sees a random name | P, FIXTURE (address without short-link data) | With short-link data (any GUI-created address) "Accept" accepts at once (`ComposeContextContactRequestActionsView.kt:91-95`) |
+| Requests | Legacy request row (no contact) | Row "wants to connect to you!"; tap → "Accept connection request?" with "Accept" / "Accept incognito" (not offered while alice's address has short-link data, `ChatModel.kt:276`, ChatListNavLinkView.kt:710) / "Reject"; same in the row menu | `ContactRequestView.kt:22`; `ChatListNavLinkView.kt:125-142,698-773` | `contactRequestLegacyRowWantsToConnect`, `contactRequestTapAlertAccept`, `contactRequestTapAlertReject` | Shown only for a request stored without a contact. Accept: CLI "alice: contact is connected"; Reject removes the row | P, RESTART, FIXTURE (request without contact) | The CLI sends `/c <address>` live; once alice's chat list shows the CLI's request row ("Open to accept", ChatPreviewView.kt:193; `/c` prints when the request is queued), between `restart()` steps `contact_requests.contact_id` is set to NULL and then the request's contact is deleted (in that order: the column is `REFERENCES contacts ON DELETE CASCADE`, Store/SQLite/Migrations/chat_schema.sql:436, and foreign keys are on, so deleting the contact first would delete the request) (current cores always create the contact, `Store/ContactRequest.hs:195-215`) |
+| Requests | Legacy request row (no contact) | Row "wants to connect to you!"; tap → "Accept connection request?" with "Accept" / "Accept incognito" / "Reject"; same in the row menu | `ContactRequestView.kt:22`; `ChatListNavLinkView.kt:125-142,698-773` | `contactRequestTapAlertAcceptIncognito` | "Accept incognito": the CLI is connected with a random name of alice | P, RESTART, FIXTURE (request without contact; address without short-link data) | The CLI sends `/c <address>` live; once alice's chat list shows the CLI's request row ("Open to accept", ChatPreviewView.kt:193; `/c` prints when the request is queued), between `restart()` steps `contact_requests.contact_id` is set to NULL and then the request's contact is deleted (in that order: the column is `REFERENCES contacts ON DELETE CASCADE`, Store/SQLite/Migrations/chat_schema.sql:436, and foreign keys are on, so deleting the contact first would delete the request) (current cores always create the contact, `Store/ContactRequest.hs:195-215`); the fixture also clears the address's short-link data, since "Accept incognito" is offered only without it (`ChatListNavLinkView.kt:710`) |
+| Cards | One-hand toolbar card | "Reachable app toolbars" card: "Bottom bar" / "Top bar", close | `ChatListView.kt:131,1041,1124-1130` | `oneHandToolbarCardSelectBottomBar`, `oneHandToolbarCardDismissShowsAlert`, `oneHandCardAutoHiddenAfterThreeChats` | "Bottom bar" is selected by default (Pref OneHandUI default true, `SimpleXAPI.kt:275`; a selected segment is not clickable, `ChatListView.kt:197`), so the test clicks "Top bar" first: Pref OneHandUI=false, the floating "Start new chat" button appears and the toolbar one is gone; then "Bottom bar": Pref OneHandUI=true, the toolbar button is back and the floating one is gone (`ChatListView.kt:158,167,263,569,585-605`; the list's `reverseLayout` follows the same pref, :994); close shows "Reachable app toolbars" / "You can change it in Appearance settings." and sets `oneHandUICardShown`; the card, shown with 2 chats, is gone once a third chat appears (`:1124-1128`) | — | Close icon has no description. The count is over the filtered chats (`ChatListView.kt:988,1124-1128`), which include the notes folder but not the "Ask SimpleX Team" card, so two added chats reach 3 |
+| Cards | Connect banner | Shown when `addressCreationCardShown` is false and there is a non-card, not-deleted direct contact (a contact still waiting to be accepted counts) or any group (`C/views/newchat/OnboardingCards.kt:69-79`); with chats but none of these, the onboarding cards show instead (`OnboardingCards.kt:52-55`): "New 1-time link" / "Paste link", close | `ChatListView.kt:354,1268` | `connectBannerCardOpensNewLink`, `connectBannerCardOpensPasteLink`, `connectBannerCardDismiss` | "New 1-time link" opens "New chat" with the tab "1-time link" selected and, once the link is created, "Share this 1-time invite link" (`NewChatView.kt:131-138,167,500`); "Paste link" opens it with "Connect via link" selected and "Paste the link you received" (`:170,648`; the pager composes only the current page); close sets Pref AddressCreationCardShown=true and the card disappears (`ChatListView.kt:363,1271`) | — | Without `SIMPLEX_ASSETS` it draws a gradient |
+| Cards | Crowdfunding banner | "Invest in SimpleX Chat!" / "Crowdfunding on Wefunder" | `C/views/chatlist/GetStakeBanner.kt`; `ChatListView.kt:1087-1097` | `getStakeBannerShownAndDismissed` | Banner shown; the dismiss button appears after the first tap (`GetStakeBanner.kt:75`) and hides it | — | Badge banners are excluded |
+| Cards | Crowdfunding banner | "Invest in SimpleX Chat!" / "Crowdfunding on Wefunder" | `C/views/chatlist/GetStakeBanner.kt`; `ChatListView.kt:1087-1097` | `getStakeBannerOpensCrowdfunding` | Tap opens `GetStakeView` (`GetStakeBanner.kt:74-78`); its "Learn more on Wefunder" button is tested in 04 `settingsRoot_crowdfundingOpensGetStake` | — | Badge banners are excluded |
+| Center pane | Onboarding cards | Chats exist but no conversations (desktop centre): "Talk to someone", "Let someone connect to you", "Connect via link or QR code", "Create your link", "Invite someone privately", "Create your public address" | `C/App.kt:389-418`; `C/views/newchat/OnboardingCards.kt:52,332` | `centerConnectOnboardingCardsWithNoConversations`, `centerCardsInviteSomeone`, `centerCardsCreatePublicAddress`, `centerCardsConnectViaLink` | `centerConnectOnboardingCardsWithNoConversations`: page "Talk to someone" with the cards "Let someone connect to you" and "Connect via link or QR code" (`OnboardingCards.kt:357-383`); `centerCardsInviteSomeone`: "Let someone connect to you" switches to the page "Create your link", and "Invite someone privately" opens NewChatView (onboarding text "Send the link via any messenger…"); `centerCardsCreatePublicAddress`: "Create your public address" auto-creates the address ("Use this address in your social media profile…"); `centerCardsConnectViaLink`: "Connect via link or QR code" opens NewChatView in onboarding mode with "Paste the link you received" › "Tap to paste link" and no QR scanner on desktop (`OnboardingCards.kt:376-378`; `NewChatView.kt:648-655`) | — | The cards show only while `addressCreationCardShown` is false (`OnboardingCards.kt:52-55`, `App.kt:405`), so its harness pre-set is cleared first |
+| Center pane | Placeholder | No chat selected | `C/App.kt:407-416` | `noSelectedChatPlaceholder` | "No selected chat" | — | – |
+| Empty | Empty list | A user with no chats | `ChatListView.kt:449-462` | `youHaveNoChatsEmptyState` | "You have no chats" | FIXTURE (user without chats) | Every new user gets a notes folder and the "Ask SimpleX Team" card (core `src/Simplex/Chat/Library/Commands.hs:470-478`), so the empty list needs a fixture database |
+
+### 4. Servers summary (10 tests)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Servers | Servers info | Click the subscription indicator → "Servers info"; "Reconnect all servers" | `C/views/chatlist/ChatListView.kt:638-655`; `C/views/chatlist/ServersSummaryView.kt:691,929` | `serversSummaryOpensFromIndicator`, `serversSummaryReconnectAll` | "Servers info" opens ("No info, try to reload" before stats load); "Reconnect all servers" → "Reconnect servers?" → confirm, no error alert | — | – |
+| Servers | Servers info with traffic | "Servers info"; "Messages" tab; "Showing info for" dropdown "All profiles"/"Current profile" (2+ visible users only); "Reset all statistics"; server row → "SMP server" → "Reconnect"; "Details" | `C/views/chatlist/ServersSummaryView.kt:691,706-712,389,958,592,652` | `serversSummaryShowsLocalSmpConnected`, `serversSummaryAllVsCurrentProfile`, `serversSummarySmpServerDetail`, `serversSummaryDetailedStats`, `serversSummaryReconnectServer`, `serversSummaryResetStats` | `serversSummaryShowsLocalSmpConnected`: local SMP listed under "Connected servers" with message counts; `serversSummaryAllVsCurrentProfile`: with one user there is no "Showing info for" row (`ServersSummaryView.kt:708-713`); once the second, connection-less user is active, "All profiles" (the default, :694) still lists the local SMP server under "Connected servers", and "Current profile" lists no servers and shows "-" for "Messages sent" (`currentUserSMP`, :828-849; `numOrDash`, `Section.kt:381`); `serversSummarySmpServerDetail`: clicking the server row opens "SMP server" with "Server address" (the local server) and "Statistics" "Messages sent"/"Messages received" (:177-190, 558-611); `serversSummaryDetailedStats`: "Details" opens "Detailed statistics" with "Sent messages" › "Sent total" and "Received messages" › "Received total" (:313-317, 452-470); `serversSummaryReconnectServer`: "Reconnect server?"; `serversSummaryResetStats`: "Reset all statistics?" / "Reset" zeroes the counters | P | The test connects a CLI peer and exchanges messages first, because a server is listed only once it has sessions, subscriptions or stats (`src/Simplex/Chat/Stats.hs:216-229`); `serversSummaryAllVsCurrentProfile` also creates a second user |
+| Servers | Servers info, files | Click the subscription indicator → "Servers info" → "Files" | `C/views/chatlist/ServersSummaryView.kt:691,876-906` | `serversSummaryFilesTabShowsXftp` | After alice sends a file to the CLI peer (she attaches it by typing its path, `D/platform/PlatformTextField.desktop.kt:97-110`), the "Files" tab lists the local XFTP server | P, XFTP | The file transfer has to come first: an unused XFTP server is not listed (`src/Simplex/Chat/Stats.hs:260-263`) |
+| Servers | Servers info share | Click the subscription indicator → "Servers info" → share button | `C/views/chatlist/ChatListView.kt:641-652` | `serversSummaryShareJson` | Share copies the pretty-printed `PresentedServersSummary` JSON to the clipboard stub | CB | The share button appears only when Servers info is opened after a summary was loaded: open it, wait for the stats, close it, then reopen it |
+
+### 5. User picker and profiles (44 tests)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Picker | Open, current user | Click the profile button | `C/views/chatlist/UserPicker.kt:46,211-215`; `D/views/chatlist/UserPicker.desktop.kt:90` | `userPickerOpensAndShowsCurrentUser`, `userPickerCurrentUserOpensProfileEditor` | Current profile shown; clicking it opens "Your current profile" | — | Clicking outside closes the picker |
+| Picker | Switch profile | Inactive avatars row (desktop) | `UserPicker.kt:161-176,238-249`; `UserPicker.desktop.kt:27` | `userPickerSwitchProfile` | Active user changes; the chat list reloads. Haskell: `testCreateSecondUser` (H/Direct.hs:1968) | — | Avatars have no text; match by display name. The second user is created in the test |
+| Picker | Unread per user, muted user | Badge on inactive avatars | `UserPicker.desktop.kt:64-66`; `UserPicker.kt:639` | `userPickerUnreadBadgePerUser`, `userPickerMutedUserGrayBadge` | Count matches the CLI messages sent to the second user; grey when muted | P | – |
+| Picker | Option rows | "Create SimpleX address"/"Your SimpleX address", "Chat preferences", "Your chat profiles", "Link a mobile", "Settings" | `UserPicker.kt:219-302,348-396` | `userPickerAddressRowLabelCreateVsYour`, `userPickerChatPreferencesRow`, `userPickerLinkAMobileRow`, `userPickerSettingsRow`, `userPickerDisabledWhenChatStopped`, `userPickerHiddenUsersNotListed` | Labels change with state ("Your SimpleX address" once an address exists; "Linked mobiles" after a pairing is tested in 04 §K); with chat stopped the current-user, address, "Chat preferences", "Your chat profiles" and "Link a mobile" rows are disabled and "Settings" stays enabled; hidden users absent; `userPickerChatPreferencesRow`: "Chat preferences" opens "Your preferences" (`UserPicker.kt:225-231`; `Preferences.kt:73`); `userPickerLinkAMobileRow`: "Link a mobile" opens the screen titled "Link a mobile" with "This device name" (`UserPicker.kt:368-377`; `C/views/remote/ConnectMobileView.kt:94-95`); `userPickerSettingsRow`: "Settings" opens "Your settings" (`UserPicker.kt:381-393`; `SettingsView.kt:99`) | — | – |
+| Profiles | List and add | "Your chat profiles" → "Add profile" → "Create profile" | `C/views/usersettings/UserProfilesView.kt:38,150`; `WelcomeView.kt:61,369` | `profilesListShowsAllVisible`, `profilesAddProfile`, `profilesAddProfileInvalidName`, `profilesAddProfileDuplicateNameError`, `profilesActivateByTap`, `profilesSearchByName` | `profilesListShowsAllVisible`: with users "work" and a hidden "secret" created through the API, the list shows the rows "alice" and "work" but not "secret" (a hidden non-active user is listed only when the search text is its password, `filteredUsers`, `UserProfilesView.kt:305-315`), then "Add profile" and the footer "Tap to activate profile." (:176-188); `profilesAddProfile`: "Add profile" → "Create profile" with a name creates the profile, makes it active and lists it (`apiCreateActiveUser`, `WelcomeView.kt:369-385`); `profilesAddProfileInvalidName`: a name such as "?bob" shows the red info icon and keeps "Create profile" disabled; the icon opens "Invalid name!" / "Correct name to bob?", and confirming puts "bob" in the field (`WelcomeView.kt:120-131,157,480-499`; `mkValidName "?alice"` is `"alice"`, `tests/ValidNames.hs:14`); `profilesAddProfileDuplicateNameError`: a duplicate name shows the "Duplicate display name!" alert ("You already have a chat profile with the same display name. Please choose another name.", `SimpleXAPI.kt:987-991`); `profilesActivateByTap`: clicking another profile's row makes it the active user and the chat list shows its chats (`changeActiveUser`, `UserProfilesView.kt:56-64`); `profilesSearchByName`: typing part of a name lists only the profiles whose name contains it, ignoring case, and hides "Add profile" (`filteredUsers`, `UserProfilesView.kt:305-315`; :181-185) | — | – |
+| Profiles | Hidden-profile notice | Open with 2+ users | `UserProfilesView.kt:190-202` | `profilesHiddenNoticeFirstTime` | "Make profile private!" / "Don't show again" | — | – |
+| Profiles | Hide and unhide | Right-click a user → "Hide" → "Hide profile": "Password to show", "Confirm password", "Save profile password"; search a password; "Unhide" → "Unhide profile" / "Profile password" / "Unhide chat profile" | `UserProfilesView.kt:99-142,208-255,263,305-328`; `HiddenProfileView.kt:27` | `profilesHideProfileWithPassword`, `profilesHidePasswordMismatchDisabled`, `profilesRevealHiddenByPasswordInSearch`, `profilesActivateHiddenViaSearchPassword`, `profilesUnhideActiveRequiresPassword`, `profilesHideOnlyWhenMoreThanOneVisible` | `profilesHideProfileWithPassword`: "Hide" on the non-active user, both passwords typed and "Save profile password" close the screen; the user's row leaves the list (a hidden non-active user is listed only for its password, `filteredUsers`, `UserProfilesView.kt:305-315`) and the "Enter password in search" banner shows for 10 s (:129-140, 166-171); `profilesHidePasswordMismatchDisabled`: while "Confirm password" differs from "Password to show", "Save profile password" stays disabled (`HiddenProfileView.kt:69-70,79`); `profilesRevealHiddenByPasswordInSearch`: a typed password reveals the hidden user; `profilesActivateHiddenViaSearchPassword`: clicking the revealed row makes it the active user and the chat list shows its chats (`changeActiveUser` with the typed password, `UserProfilesView.kt:56-64,324-325`); `profilesUnhideActiveRequiresPassword`: "Unhide" of the active hidden user asks for "Profile password"; `profilesHideOnlyWhenMoreThanOneVisible`: with one visible user (the other one hidden), the visible user's menu has no "Hide" ("Mute" and "Delete" remain, `UserProfilesView.kt:231-251`). Core side: `testUserPrivacy` (H/Direct.hs:2752) | — | Banner timing is 10 s; a second user is created in the test |
+| Profiles | Hidden user not listed or counted | Hide a user that has a contact with the CLI peer | `UserProfilesView.kt:305-315`; `ChatListView.kt:621-625` | `profilesHiddenNotListedAfterHide` | The hidden user is absent from "Your chat profiles"; CLI messages to it don't light the profile button's unread mark, checked once the CLI's `/_get chat @<id of its contact with the hidden user> count=1` (repeated, as in §13 `contactInfoSendReceiptsDefault`) shows the message's `itemStatus` `sndRcvd`: alice's core has then received it (new users send receipts, `src/Simplex/Chat/Store/Profiles.hs:143`), while the CLI prints the sent message before delivery | P | – |
+| Profiles | Mute | Menu "Mute"/"Unmute" | `UserProfilesView.kt:115-128,389` | `profilesMuteUnmute`, `profilesMutedAlertDontShowAgain` | `profilesMuteUnmute`: "Muted when inactive!" alert; notifications-off icon on the row, gone after "Unmute"; `profilesMutedAlertDontShowAgain`: "Don't show again" closes the alert and sets Pref ShowMuteProfileAlert=false (`UserProfilesView.kt:119,389-397`), and muting again after "Unmute" shows no alert | — | – |
+| Profiles | Delete with peer check | Menu "Delete" → "Delete chat profile?" with "Profile and server connections" / "Local profile data only" | `UserProfilesView.kt:67-97,330-375` | `profilesDeleteInactiveWithConnections`, `profilesDeleteInactiveLocalDataOnly` | With connections: the queues are deleted on the server in a background thread (`deleteUser'` → `deleteConnectionsAsync_`, simplexmq `Agent.hs:898-901, 1007-1015`), so the CLI sends repeatedly, every 2 s with a deadline, until sending gets `[<deleted profile name>, contactId: <id>, connId: <id>] error: connection authorization failed - this could happen if connection was deleted, …` (H/Direct.hs:2270). Local only: a CLI send prints no error within `wait(5 s)` (the queues stay on the server). Haskell: `testDeleteUser` (H/Direct.hs:2211) | P | – |
+| Profiles | Delete active / last / hidden | Menu "Delete" → "Delete chat profile?" with "Profile and server connections" / "Local profile data only" | `UserProfilesView.kt:327-364`; `UserPicker.kt:252` | `profilesDeleteActiveSwitchesToNext`, `profilesDeleteLastVisibleShowsCreateChatProfile`, `profilesDeleteHiddenActiveRequiresPassword` | Deleting the active user activates the next visible one; deleting the last visible user shows the picker with "Create chat profile"; the active hidden user's deletion asks for "Profile password" → "Delete chat profile" | — | – |
+| Profile edit | Your current profile, peer notified | Picker → current user: "Profile name:", "Full name:" (only when different), "Bio:", "Add description"/"Edit description", "Edit image"/"Delete image", "Save and notify contacts" | `C/views/usersettings/UserProfileView.kt:32,61,166-246` | `editProfileDisplayName`, `editProfileBio`, `editProfileDescription`, `editProfileUnsavedChangesAlertSave` | CLI: "contact alice changed to alice2" / "use @alice2 <message> to send messages"; "contact alice updated bio: …"; "contact alice updated description: …" (`src/Simplex/Chat/View.hs:2342`); `editProfileUnsavedChangesAlertSave`: after changing the name to alice2, leaving shows "Save preferences?", and its "Save and notify contacts" saves it: the CLI prints "contact alice changed to alice2" (`UserProfileView.kt:104,288-293`). Haskell: `testUpdateProfile` (H/Profiles.hs:208) | P | – |
+| Profile edit | Your current profile, local checks | Picker → current user: "Profile name:", "Full name:" (only when different), "Bio:", "Add description"/"Edit description", "Edit image"/"Delete image", "Save and notify contacts" | `C/views/usersettings/UserProfileView.kt:93-99,201,218-226,238,288-305`; `C/model/SimpleXAPI.kt:1930` | `editProfileFullNameShownOnlyIfDifferent`, `editProfileBioTooLarge`, `editProfileUnsavedChangesAlertExit`, `editProfileNameUsedByOtherUserError`, `editProfileSaveDisabledWhenUnchanged` | "Full name:" shown only when it is non-empty and differs from the name; an over-limit bio shows the error icon next to "Bio:"; clicking it shows the "Bio too large" alert; Save is disabled; after changing the name, leaving the screen shows "Save preferences?" / "Save and notify contacts" / "Exit without saving" (`UserProfileView.kt:288-293`), and "Exit without saving" closes it, and reopening the user picker shows "alice" (the picker closed 500 ms after the profile screen opened, `UserPicker.kt:170-174`); a name used by another user shows "Duplicate display name!"; Save is disabled while nothing changed | — | `editProfileNameUsedByOtherUserError` creates a second user; `editProfileFullNameShownOnlyIfDifferent` sets a full name through the API first |
+| Profile edit | Your current profile, image | Picker → current user → "Edit image" / "Delete image" | `C/views/usersettings/UserProfileView.kt:178-186,263-286` | `editProfileImageSetAndDelete` | An image chosen from a file appears on the profile and is saved with "Save and notify contacts" (`chatModel.currentUser.profile.image` is set); "Delete image" clears it and saving stores no image. An image-only change sends no peer-visible line (`src/Simplex/Chat/View.hs:2334`), so the test has no peer | FD | Image picker is a bottom sheet; the file dialog is completed by the test |
+| Profile edit | Name validation, user switch | Picker → current user ("Your current profile") | `C/views/usersettings/UserProfileView.kt:35-37,298-310` | `editProfileInvalidNameDisablesSave`, `editProfileClosesOnUserSwitch` | An invalid or empty name disables Save; switching the active user with `changeActiveUser(null, <second userId>, null)` from test code (the path the user picker uses; a raw `/_user` switches the core but not `chatModel.currentUser`, which the editor watches, UserProfileView.kt:32-36, SimpleXAPI.kt:747) closes the editor | — | `editProfileClosesOnUserSwitch` needs a second user (created in the test) |
+
+### 6. New chat sheet and contacts (17 tests)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| New chat | Sheet | "Start new chat" → "New chat": "Create 1-time link", "Paste link", "Create group", "Create public channel"; "Your contacts" | `C/views/newchat/NewChatSheet.kt:43,111,186-207` | `newChatSheetShowsActions`, `newChatSheetCreateGroupEntry`, `newChatSheetCreateChannelEntry` | The four actions are shown; the group and channel entries open their creation screens | — | Group and channel flows are another area |
+| New chat | Contacts list order | "Start new chat" → "New chat": "Create 1-time link", "Paste link", "Create group", "Create public channel"; "Your contacts" | `C/views/newchat/NewChatSheet.kt:85,420-437,648` | `newChatSheetContactsListSorted` | Order: card, contact with request, request, recent (`NewChatSheet.kt:85,648`) | P, RESTART, FIXTURE (request without contact) | The card is the built-in "Ask SimpleX Team" card (`src/Simplex/Chat/Library/Commands.hs:470`); the request row is made as in §3 `contactRequestLegacyRowWantsToConnect` |
+| Contacts | Contact rows | Tap / right-click a contact row | `C/views/contacts/ContactListNavView.kt:31-140`; `ContactPreviewView.kt:21` | `newChatSheetContactTapOpensChat`, `newChatSheetContactWithRequestOpensChat`, `newChatSheetContactMenuDelete` | Opens the chat and closes the sheet; a contact with a pending request opens its chat with the accept bar (`ContactListNavView.kt:56`); delete runs §15 | P | – |
+| Contacts | Contact card | Card "Tap to Connect" → "Connect with %1$s?" with "Use current profile" / "Use new incognito profile" / "Cancel" | `ContactListNavView.kt:62-70`; `ChatListNavLinkView.kt:824,886` | `contactCardConnectCurrentProfile`, `contactCardConnectIncognito` | "Connection request sent!"; CLI "alice wants to connect to you!" (incognito: "<rand> wants to connect to you!"); after `/ac`, connected. Haskell: `testPlanAddressContactViaAddress` (2341) | P, RESTART, FIXTURE (contact without connection carrying the CLI's address, inserted after the CLI's /ad) | Group members never become contact cards and the only built-in card ("Ask SimpleX Team") points at public servers, so the card is a fixture; cards are hidden from the main chat list |
+| Contacts | Search and filter | "Search or paste SimpleX link"; favourites filter icon; "No filtered contacts" | `NewChatSheet.kt:476,578,608-666` | `newChatSheetSearchFiltersContacts`, `newChatSheetSearchIncludesArchived`, `newChatSheetFavoritesFilterToggle`, `newChatSheetNoFilteredContacts` | Archived contacts included while searching; the favourites filter icon toggles Pref ShowUnreadAndFavorites, and while it is on the list keeps only favourite contacts (`NewChatSheet.kt:579-580,642`); "No filtered contacts" | P | – |
+| Contacts | Search and filter | "Search or paste SimpleX link"; favourites filter icon; "No filtered contacts" | `NewChatSheet.kt:476,578,608-666` | `newChatSheetPasteLinkInSearchConnects` | A pasted link runs the plan and closes the sheet | P, CB | – |
+| Contacts | Search and filter | "Search or paste SimpleX link"; favourites filter icon; "No filtered contacts" | `NewChatSheet.kt:476,578,608-666` | `newChatSheetConnectToNameRow` | Typing a name shows the row "Connect to %s" (bare words of 5+ characters get `.testing`, e.g. "Connect to bobby.testing"; `@bob.simplex` is kept as typed); tapping it shows the CLI's profile alert over the sheet; «Open new chat» opens the prepared chat and closes the sheet (`closeAllModalsEverywhere`, ConnectPlan.kt:726-740) | P, NAMES | – |
+| Contacts | Archived contacts | "Archived contacts" row → list | `NewChatSheet.kt:210-258,669` | `archivedContactsListAndOpen`, `archivedContactsSendMessageRestores` | After "Only delete conversation" bob leaves the chat list and the "Archived contacts" row (shown only while some contact is archived, `NewChatSheet.kt:226-258`) lists bob; opening bob there and sending "hi" gives `bob <# "alice> hi"`, puts bob back in the chat list with the preview "hi", and the "Archived contacts" row disappears. Haskell: `testDeleteConversationKeepContact` (609) | P | – |
+
+### 7. 1-time link (create / share / QR / incognito / profile) (17 tests)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Invite | Create link | "Create 1-time link" → tabs "1-time link"/"Connect via link"; "Creating link…"; "Share this 1-time invite link"; "Or show this code" | `C/views/newchat/NewChatView.kt:53,182,468,799` | `createOneTimeLinkShowsLinkAndQr` | Link text and QR shown. Haskell: `testAddContact` | — | "Or show this code" is drawn upper-case (`NewChatView.kt:507`): match it ignoring case or by its key |
+| Invite | Copy and share | Copy and share icons on the link | `NewChatView.kt:716-766` | `oneTimeLinkCopyToClipboard`, `oneTimeLinkShareButton` | Clipboard stub gets the short `simplex:`/https link | CB | Icons have no description |
+| Invite | CLI connects | CLI `/c <link>` | – | `oneTimeLinkCliConnectsViaShortLink` | CLI "confirmation sent!", then "alice: contact is connected"; GUI row turns into contact "bob". Haskell: `testShortLinkInvitation` (H/Profiles.hs:3879) | P, S | – |
+| Invite | CLI connects | CLI `/c <link>` | – | `oneTimeLinkCliConnectsViaFullLink` | CLI "confirmation sent!", then "alice: contact is connected"; GUI row turns into contact "bob". Haskell: `testAddContact` (H/Direct.hs:191; full link in every matrix case) | P, S, DT | The "Full link"/"Short link" toggle is visible only with developer tools (`NewChatView.kt:585`) |
+| Invite | Short/full toggle | "Full link"/"Short link" | `NewChatView.kt:585` | `oneTimeLinkShortFullToggleRequiresDevTools` | Hidden without developer tools | DT | – |
+| Invite | Error and retry | SMP server down | `NewChatView.kt:190-194,211` | `oneTimeLinkCreationErrorShowsRetry` | "Connection error" alert with "Retry"/"Cancel"; after "Cancel", the refresh icon with "Retry"; after the server is started again, tapping it shows the link | SRVCTL | The app's agent caches a failed server connection for 3 s (`persistErrorInterval`, 3 s in the app and in `testAgentCfg`; only some Haskell tests set it to 0, e.g. `H/Profiles.hs:253`), so the retry happens more than 3 s after the failure, after the server is started again |
+| Invite | Keep unused | Close without using the link | `NewChatView.kt:70-100` | `oneTimeLinkKeepUnusedAlertKeep`, `oneTimeLinkKeepUnusedAlertDelete` | "Keep unused invitation?" / "You can view invitation link again in connection details." / "Keep" / "Delete"; `oneTimeLinkKeepUnusedAlertKeep`: "Keep" only closes the alert, and the pending row ("invited to connect") stays in the chat list; `oneTimeLinkKeepUnusedAlertDelete`: "Delete" removes the row, and the command log has `/_delete :<connId> full notify=on` (`NewChatView.kt:82-88`; `C/model/SimpleXAPI.kt:1854-1858,4270`) | — | – |
+| Invite | Keep unused | Close without using the link | `NewChatView.kt:70-100` | `oneTimeLinkUsedNoAlert` | No alert after the link was copied or shared | CB | – |
+| Invite | Save the QR code by clicking it | "Create 1-time link" → click the QR code ("QR Code", `image_descr_qr_code`, strings.xml:897) → choose a folder → choose a file for the copy → close the sheet | `C/views/newchat/QRCode.kt:89-99`; `D/views/helpers/Utils.desktop.kt:239-252`; `D/platform/Share.desktop.kt:25-43`; `NewChatView.kt:498,510,76-96` | `oneTimeLinkQrClickSavesPng` | The first save dialog is directories-only; after `respondSave(<dir>)` the folder holds one `IMG_<ts>.png`; a second save dialog awaits and `respondSave(<file>)` writes a copy there; closing the sheet shows no "Keep unused invitation?" alert (`onShare` → `markShowingInvitationUsed`, ChatModel.kt:1249-1251). Optionally decode the PNG with BoofCV (already an app dependency, QRCode.kt) and compare it with `chatModel.showingInvitation`'s short link | FD | The same click exists on every QR code (address, group link, member address, server, Link a mobile); one row covers the code path |
+| Invite | Learn more | ⓘ "Learn more" end button | `NewChatView.kt:611`; `AddContactLearnMore.kt:17` | `oneTimeLinkLearnMore` | "One-time invitation link" text | — | – |
+| Invite | Incognito / profile | "Share profile" row → "Select chat profile" (search field) → "Incognito" or another profile | `NewChatView.kt:288-465,524-580` | `oneTimeLinkSwitchToIncognito`, `oneTimeLinkSwitchBackFromIncognito`, `oneTimeLinkChangeToOtherProfile`, `oneTimeLinkChangeToHiddenProfileViaPassword` | `oneTimeLinkSwitchToIncognito`: footer "A new random profile will be shared."; CLI sees a random name ("<rand>: contact is connected"); `oneTimeLinkSwitchBackFromIncognito`: choosing the active profile again puts its name back in the "Share profile" row and removes the footer (`NewChatView.kt:559-578`); the core recreates the link for that user (`APIChangeConnectionUser`, `src/Simplex/Chat/Library/Commands.hs:2157-2185`), and a CLI connecting with the new link prints "alice: contact is connected"; `oneTimeLinkChangeToOtherProfile`: GUI switches active user; CLI "<other profile>: contact is connected"; `oneTimeLinkChangeToHiddenProfileViaPassword`: the hidden profile is listed in "Select chat profile" only after its password is typed in the search field (`filteredProfiles`, `NewChatView.kt:768-777`); choosing it makes it the active user, and the CLI prints "<hidden profile>: contact is connected". Haskell: `testSetConnectionIncognito` (2574), `testResetConnectionIncognito`, `testChangePCCUser` (3054), `testChangePCCUserFromIncognito`, `testShortLinkInvitationSetIncognito`, `testShortLinkInvitationChangeUser` | P | A hidden profile is chosen by typing its password in the search field |
+| Invite | Incognito info | ⓘ next to "Incognito" in "Select chat profile" | `NewChatView.kt:248-265,403`; `C/views/usersettings/IncognitoView.kt:18` | `oneTimeLinkIncognitoInfoButton` | ⓘ next to "Incognito" opens the incognito info screen ("Incognito mode") | — | – |
+
+### 8. Paste link and connection plans (contact, invitation, address, bot, name, signature, URI and link-card links) (29 tests)
+
+Entry for every row: New chat › "Paste link" → "Paste the link you received" → "Tap to paste link" (reads the clipboard stub). The same plans run from chat-list search, the new-chat search, a tapped link card, or a `simplex:` URI. Code: `C/views/newchat/NewChatView.kt:628,671`, `C/views/newchat/ConnectPlan.kt:24-406`. Assert the CLI-side `/_connect plan` output where noted.
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Paste | Invalid or empty clipboard | "Tap to paste link" | `NewChatView.kt:671-699` | `pasteLinkInvalidTextAlert`, `pasteLinkClipboardEmptyNoop` | `pasteLinkInvalidTextAlert`: "Invalid link!" / "The text you pasted is not a SimpleX link."; `pasteLinkClipboardEmptyNoop`: with no text on the clipboard, clicking "Tap to paste link" does nothing: no alert, and the row stays (`NewChatView.kt:675`) | CB | – |
+| Plan | Progress and cancel | Paste the CLI's short link into "Search or paste SimpleX link" | `C/model/ChatModel.kt:55-61`; `ChatListView.kt:561-567`; `C/views/chat/ChatView.kt:304` | `planProgressIndicatorAndCancel` | With the link's SMP server stopped the plan fails at once and the retry alert "Connection error" ("Retry" / "Cancel") opens (`sendCmdWithRetry`, `C/model/SimpleXAPI.kt:845-874`); the plan stays pending behind it, so the toolbar spinner appears after 1 s (no text on desktop); "Cancel" ends the plan, the spinner goes away and the search is cleared | P, SRVCTL, CB | "Loading profile…" text is Android-only (`ChatView.kt:304`) |
+| Invitation | Short link: OK | CLI `/c` short link | `ConnectPlan.kt:91-102,700` | `planInvitationShortLinkOpenNewChat` | Alert with the CLI profile "bob" and "Open new chat" (`ConnectPlan.kt:711-727`); it opens bob's prepared chat, whose banner reads "Tap Connect to chat" and whose compose area shows "Connect" (§9, `ChatView.kt:2257-2259`). Haskell: `testShortLinkInvitationPrepareContact` (4077; Ok plan with short-link data) | P, CB | – |
+| Invitation | Full link: OK | CLI's "The invitation link for old clients:" line | `ConnectPlan.kt:103-113,448,408` | `planInvitationFullLinkUseCurrentProfile`, `planInvitationFullLinkUseIncognito`, `planInvitationFullLinkCancel` | "Connect via one-time link?" / "Your profile will be sent to the contact that you received this link from." → "Use current profile" / "Use new incognito profile" / "Cancel" → "Connection request sent!" / "You will be connected when your contact's device is online, please wait or check later!"; CLI "alice: contact is connected" (incognito: "<rand>: contact is connected"; Cancel: no request, no pending row). Haskell: `testPlanInvitationLinkOk` (486), `testConnectIncognitoInvitationLink` (2462) | P, S, CB | Stable CLI is a good full-link source. The current-build peer is started with `--show-full-links` (`src/Simplex/Chat/Options.hs:435`) so it prints the full link; the stable CLI (v7.0.3) prints it without any option (its `View.hs` has no `showFullLinks` gate) |
+| Invitation | Own link | Paste the GUI's own 1-time link | `ConnectPlan.kt:114-123` | `planOwnInvitationConnectToYourself` | "Connect to yourself?" / "This is your own one-time link!" (buttons in the error colour); "Use current profile" (`ConnectPlan.kt:470-476`) → dismiss "Connection request sent!" (`ConnectPlan.kt:417-433`); this gives two contacts, both shown as "alice". Haskell: `testPlanInvitationLinkOwn` (507) | CB | – |
+| Invitation | Already connecting | Paste the full link → "Use current profile" → dismiss "Connection request sent!"; paste the same link again before CLI is online | `ConnectPlan.kt:124-142` | `planInvitationAlreadyConnectingFullLink` | "Already connecting!" / "You are already connecting via this one-time link!". Haskell: `testPlanInvitationLinkConnecting` (543) | P, PEERCTL, CB | Stop the CLI process after it creates the link. The current-build peer is started with `--show-full-links` (`src/Simplex/Chat/Options.hs:435`) so it prints the full link |
+| Invitation | Known | Paste after connecting | `ConnectPlan.kt:143-152,519` | `planInvitationKnownContactOpenChat` | Pasting the short link again after connecting: the profile alert "bob" has "Open chat", not "Open new chat" (`ConnectPlan.kt:533`), and opens bob's chat with the banner "Your contact" (`ChatView.kt:2267`) and the messages already exchanged. Haskell: `testShortLinkInvitationPrepareContact` (H/Profiles.hs:4103) | P, CB | "Known" happens only for short links (H/Direct.hs:502-503) |
+| Invitation | Known: prepared contact | Paste the short link of a prepared contact | `ConnectPlan.kt:143-152,519` | `planInvitationConnectingPreparedOpensKnown` | Pasting the short link of a prepared contact shows the profile alert with "Open new chat" (before Connect) / "Open chat" (after). Haskell: `testShortLinkInvitationPrepareContact` (4088-4089, Profiles.hs) | P, CB | The core never returns Connecting with a contact; a prepared or connecting contact plans as Known (`src/Simplex/Chat/Library/Commands.hs:4655-4662`) |
+| Invitation | Deleted link → error | CLI deletes the invitation (`/_delete :1`, prints `connection :1 deleted`, `H/Profiles.hs:4279-4280`; the queue is deleted on the server later, in a background thread: `deleteAgentConnectionAsync`, `Library/Commands.hs:1381`, simplexmq `Agent.hs:1013-1015`), repeats `/_connect plan 1 <short link>` until it prints `error: connection authorization failed - …` (the plan reads the link from the server, `Library/Commands.hs:4431`), then alice pastes it | `C/model/SimpleXAPI.kt:1722-1728` | `planInvitationDeletedLinkError` | The plan call fails with SMP AUTH and the alert "Connection link removed" / "Your contact removed this link, or it was a one-time link that was already used.…" appears | P, CB | – |
+| Address | Short link: OK | CLI `/ad` short link | `ConnectPlan.kt:155-168` | `planAddressShortLinkOpenNewChat` | Profile alert "bob" with "Open new chat" (`ConnectPlan.kt:711-727`); it opens bob's prepared chat with the banner "Tap Connect to send request" (`ChatView.kt:2260`). Haskell: `testShortLinkAddressPrepareContact` (4188; Ok plan with short-link data) | P, CB | – |
+| Address | Full link: OK | CLI full address | `ConnectPlan.kt:169-181` | `planAddressFullLinkConnectAlert` | "Connect via contact address?" → "Use current profile" → "Connection request sent!" / "You will be connected when your connection request is accepted…"; CLI "alice wants to connect to you!"; after `/ac`, connected. Haskell: `testUserContactLink` | P, S, CB | The current-build peer is started with `--show-full-links` (`src/Simplex/Chat/Options.hs:435`) so it prints the full link; the stable CLI (v7.0.3) prints it without any option (its `View.hs` has no `showFullLinks` gate) |
+| Address | Own address | Paste own address | `ConnectPlan.kt:182-193` | `planOwnAddressConnectToYourself` | "Connect to yourself?" / "This is your own SimpleX address!" with "Use current profile" / "Use new incognito profile" (`ConnectPlan.kt:463-484`); "Use current profile" shows "Connection request sent!", and a contact row "alice" with "Open to accept" appears (alice's own request: `alice_1` in `testPlanAddressOwn`, H/Profiles.hs:2194-2200). Haskell: `testPlanAddressOwn` (2181) | CB | – |
+| Address | Repeat request | Paste the full address → "Use current profile" → dismiss "Connection request sent!"; paste it again while pending | `ConnectPlan.kt:194-205` | `planAddressRepeatConnectionRequest` | "Repeat connection request?" / "You have already requested connection via this address!". Haskell: `testPlanAddressConnecting` (2229; ConnectingConfirmReconnect plan) | P, CB | The request stays pending while the CLI doesn't run `/ac`. The current-build peer is started with `--show-full-links` (`src/Simplex/Chat/Options.hs:435`) so it prints the full link |
+| Address | Connecting, prohibited | After Connect on a prepared contact (CLI not yet accepted), paste the CLI's full address | `ConnectPlan.kt:206-215` | `planAddressConnectingProhibitOpensKnown` | Profile alert with "Open chat" | P, CB | ConnectingProhibit comes only from the full-address lookup (`src/Simplex/Chat/Library/Commands.hs:4686-4687`); the short address plans as Known. The current-build peer is started with `--show-full-links` (`src/Simplex/Chat/Options.hs:435`) so it prints the full link |
+| Address | Known | After connecting, paste the address again | `ConnectPlan.kt:216-246` | `planAddressKnownContactOpenChat` | "Open chat". Haskell: `testPlanAddressOkKnown` (2147) | P, CB | – |
+| Address | Contact via address | With a contact card for the CLI's address, paste the address | `ConnectPlan.kt:216-246` | `planAddressContactViaAddressOpensChat` | Pasting the address shows "Open chat" and opens the card's chat. Haskell: `testPlanAddressContactViaAddress` (2341) | P, CB, RESTART, FIXTURE (contact without connection carrying the CLI's address) | The card is inserted between `restart()` steps after the CLI's `/ad` (as in §6) |
+| Address | Deleted contact | After the CLI deletes the contact (`/d alice`) and alice's chat-list row shows the item "deleted contact" (the deletion has reached her, as in `contactDeletedByPeerShowsDeleted`), paste the address again | `ConnectPlan.kt:155-168`; `src/Simplex/Chat/Library/Commands.hs:4688` | `planAddressDeletedContactReconnect` | The plan is Ok again: the prepare alert "Open new chat" (short link), and connecting gives a new contact. Until alice has processed the deletion the plan is still Known and the alert offers "Open chat" (`contactDeleted`, `src/Simplex/Chat/Library/Commands.hs:4519,4688-4689`). Haskell: `testPlanAddressContactDeletedReconnected` (2276), `testShortLinkAddressDeleteContact` (4230) | P, CB | – |
+| Bot | Bot address | CLI profile with peerType bot | `ConnectPlan.kt:720`; `ComposeView.kt:1807` | `planBotAddressShowsBotIcon` | After "Open new chat": the banner "Tap Connect to use bot" (`ChatView.kt:2260`), the chat row "Open to use bot" (`ChatPreviewView.kt:189`) and a "Connect" button instead of the contact-request composer (`ComposeView.kt:1806-1812`); the alert's cube icon (`ConnectPlan.kt:720`) has the generic description "profile image placeholder", so it is checked in the screenshot only | P, CB | Set the bot profile through the CLI `/_profile` JSON |
+| Signature | Signed address card | CLI `/share address @alice` → tap the card in the chat list | `ChatPreviewView.kt:355-367`; `ConnectPlan.kt:807` | `planSignedAddressCardVerified` | Info line "Link signature verified." in the profile alert. Haskell: `testShareAddressViaChat` (3937; verified owner signature) | P | The CLI runs `/ad` before `/share address @alice` |
+| Signature | Failed signature verification | A tampered signed address card: bob runs `/ad` and `/share address @alice` (a genuinely signed card), reads the item with `/_get chat @<alice's contact id> count=1` (the real CLI prints JSON, `View.hs:129`, including `ownerSig` and its `chatBinding`; the peer's output model joins the line if it wraps, plan §8.1), and re-sends the card with `/_send @<alice's contact id> json [{"msgContent":{"type":"chat",…,"ownerSig":{…the same chatBinding, an altered ownerSig}}}]`; alice keeps the signature because the binding matches her connection (`Library/Subscriber.hs:1931-1938`) | `ConnectPlan.kt:809`, `FramedItemView.kt:407` | `planOwnerSignatureFailed` | Tapping the tampered card plans the link with its `ownerSig`; `verifyLinkOwner` returns `OVFailed "signature verification failed"` (`Library/Commands.hs:4751-4760`) and the alert shows "⚠️ Signature verification failed: signature verification failed." (`ConnectPlan.kt:809`, strings.xml:586, `Commands.hs:4760`) | P | The sender drops `ownerSig` only when forwarding (`Library/Commands.hs:1158-1164`); `/_send … json` passes it through (`Protocol.hs:882-886`) |
+| Names | Connect by name | "Connect to @bob.simplex" row, or paste a name | `ChatListView.kt:1207`; `ConnectPlan.kt:81-89` | `planConnectByNameContact` | Profile alert with name caption. Haskell: `testConnectByName` | P, NAMES | – |
+| Names | Name not found | "Connect to @bob.simplex" row, or paste a name | `ChatListView.kt:1207`; `C/model/SimpleXAPI.kt:1707-1710` | `planConnectByNameNotFound` | Alert "Name not found". Haskell: `testConnectByNameNotFound` | NAMES | – |
+| Names | Name of a contact and a channel | Type `bob.simplex` (no `@` or `#` prefix) → "Connect to bob.simplex" row | `ChatListView.kt:1207`; `ConnectPlan.kt:81-89` | `planConnectByNameOtherKindButton` | Second button "Join channel #bob" when the name also resolves to a channel that doesn't claim the domain (the argument is the other name's short form, not the typed text: `ConnectPlan.kt:84-88`, `ChatModel.kt:5224-5227`; when the channel claims it, the channel is primary and the button reads "Connect to @bob.simplex", Commands.hs:4451-4454, H/Names.hs:356-360). Haskell: `testConnectByNameContactAndChannel` (H/Names.hs:381, `/_connect plan 1 acme.simplex`) | P, NAMES, RELAY | The channel needs a chat relay. Only a bare domain gets the other kind (`src/Simplex/Chat/Library/Commands.hs:4446-4474`); an `@`-prefixed name parses as a short contact name with no other kind (`Commands.hs:4477-4478`) |
+| URI | SimpleX link in message text | Click a SimpleX link in a received message's text | `C/views/chat/item/TextItemView.kt:373`; `C/views/helpers/Utils.kt:599-600`; `ChatListView.kt:775-784` | `planOpenedViaSimplexUriHandler` | The plan alert appears (`openVerifiedSimplexUri` → `connectIfOpenedViaUri` → `planAndConnect`) | P | The CLI sends its 1-time link as message text. `chatModel.appOpenUrl` is set only when there is no current user (ChatListView.kt:777-778) and by Android (`MainActivity.kt:149`) |
+| Card | Link card in a message | bob runs `/ad` then `/share address @alice`; alice opens bob's chat and clicks the card | `C/views/chat/item/FramedItemView.kt:400-410`; `C/views/newchat/ConnectPlan.kt:155-168` | `planViaChatItemLinkCard` | The profile alert for bob with "Link signature verified." and "Open new chat" (the card plans as ok to connect with a verified owner signature, `H/Profiles.hs:3937-3955`) | P | Distinct from the chat-list card of `planSignedAddressCardVerified` |
+| Card | Link card contents | CLI `/ad`, then `/share address @alice`; open the chat with bob | `C/views/chat/item/CIChatLinkHeader.kt:18-78`; `C/views/chat/item/FramedItemView.kt:402-416`; `C/model/ChatModel.kt:5111-5121` | `linkCardInMessageShowsNameAndSignedInfoLine` | The received item shows the card: "bob", the info line "Contact address (from owner)" (`chat_link_contact_address` + `chat_link_from_owner`, strings.xml:580-582) and "Tap to open" (strings.xml:576); no text below the card (the message text equals the link, `APIShareMyAddress`, `Library/Commands.hs:1247-1259`). bob prints `bob <# "@alice contact address of @bob (signed):"` and the link (as in `testShareAddressViaChat`, tests/ChatTests/Profiles.hs:3944-3946) | P | Same setup as `planSignedAddressCardVerified`; could instead extend `planViaChatItemLinkCard`'s verification |
+
+### 9. Connecting a prepared chat (compose area) (11 tests)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Prepared | Invitation | Prepared chat: banner "Tap Connect to chat", button "Connect" | `ComposeView.kt:652,1799-1805`; `ChatView.kt:2251-2268` | `preparedContactInvitationConnectButton`, `preparedContactBannerTexts`, `preparedContactRowOpenToConnect` | `preparedContactInvitationConnectButton`: "Connect" connects; CLI "alice: contact is connected". Haskell: `testShortLinkInvitationPrepareContact` (`/_connect contact @2 text hello`); `preparedContactBannerTexts`: the banner reads "Tap Connect to chat" before connecting and "Your contact" once connected (`ChatView.kt:2257-2267`); `preparedContactRowOpenToConnect`: the prepared chat's row in the chat list reads "Open to connect" (`ChatPreviewView.kt:190-191`), and clicking it opens the chat with the "Connect" button | P | – |
+| Prepared | Address request | "Tap Connect to send request"; send button → "Send contact request?" with "Send request" / "Send request without message" / "Add message" | `ComposeView.kt:672-691,1806-1819` | `preparedContactAddressSendRequestWithMessage`, `preparedContactAddressSendRequestWithoutMessage`, `preparedContactSendRequestAlertAddMessage`, `preparedContactAfterConnectShowsContactShouldAccept` | With text: "Send request" / "Cancel"; empty: "Send request without message" / "Add message" ("Add message" closes the alert and sends nothing: the CLI prints no request, `ComposeView.kt:684-689`). CLI "alice wants to connect to you!" (plus "alice> hello" when sent with text); GUI shows "contact should accept…". Haskell: `testShortLinkAddressPrepareContact` | P | – |
+| Prepared | Bot | Bot profile → "Connect" | `ComposeView.kt:1807-1812` | `preparedBotConnect` | The compose area shows only "Connect" (bolt icon, no message field; a non-bot address gets the send-request field, `ComposeView.kt:1813-1818`); after "Connect" bob prints `alice: accepting contact request...`, `alice: you can send messages to contact`, `alice: contact is connected`, and alice's compose area shows the message field. Haskell: `testShortLinkAddressChangeAutoReply` (H/Profiles.hs:5219-5237) | P | CLI sets peerType bot through `/_profile` and turns on `/auto_accept on` for its address; the connection is accepted without approval because of `/auto_accept on`, not because bob is a bot |
+| Prepared | Profile and incognito before connecting | Compose profile picker ("Your profile", "Incognito") | `C/views/chat/ComposeContextProfilePickerView.kt:34`; `ComposeView.kt:1686` | `preparedContactChangeProfileBeforeConnect`, `preparedContactIncognitoBeforeConnect` | `preparedContactChangeProfileBeforeConnect`: with a second user alice2 (created in the test) picked, the CLI prints "alice2: contact is connected", not alice (`ComposeContextProfilePickerView.kt:80-94`; H/Profiles.hs:4780-4797); `preparedContactIncognitoBeforeConnect`: with "Incognito" picked the CLI prints "<rand>: contact is connected" with a random name, not alice (H/Profiles.hs:4716-4721); after connecting the picker is gone. Haskell: `testShortLinkChangePreparedContactUser` (4762), `testShortLinkInvitationConnectPreparedContactIncognito` (4705) | P | – |
+| Prepared | Retry | Stop SMP during connect | `ComposeView.kt:667-669`; `C/views/chat/ComposeContextProfilePickerView.kt:128-140` | `preparedContactConnectRetryAfterServerError` | Error, then a second attempt succeeds; after the failed attempt, choosing another profile shows "Can't change profile". Haskell: `testShortLinkAddressConnectRetry` | P, SRVCTL | The app's agent caches a failed server connection for 3 s (`persistErrorInterval`, 3 s in the app and in `testAgentCfg`; only some Haskell tests set it to 0, e.g. `H/Profiles.hs:253`), so the retry happens more than 3 s after the failure, after the server is started again |
+
+### 10. Pending connection info screen (7 tests)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Pending | Info screen | Click a pending row / "Set contact name": "You invited a contact" or "You accepted connection"; "One-time invitation link", QR, "Share 1-time link", "Learn more", "Delete" | `C/views/newchat/ContactConnectionInfoView.kt:33,77,159`; `ChatView.kt:824-827` | `pendingInfoInvitedShowsLinkQrShare` | "You invited a contact", "One-time invitation link", QR, "Share 1-time link" (clipboard stub) | CB | – |
+| Pending | Info screen | Click a pending row / "Set contact name": "You invited a contact" or "You accepted connection"; "One-time invitation link", QR, "Share 1-time link", "Learn more", "Delete" | `C/views/newchat/ContactConnectionInfoView.kt:33,77,159`; `ChatView.kt:824-827` | `pendingInfoAcceptedShowsNoLink` | "You accepted connection", no link | P, PEERCTL | The CLI that created the link is stopped so the connection stays pending. The current-build peer is started with `--show-full-links` (`src/Simplex/Chat/Options.hs:435`) so it prints the full link, which the test types into search (that starts the plan, ChatListView.kt:833-845), taps "Use current profile" in "Connect via one-time link?", dismisses "Connection request sent!" (`ConnectPlan.kt:103-113,417-433`), then clicks the pending row; no `CB` is needed |
+| Pending | Info screen | Click a pending row / "Set contact name": "You invited a contact" or "You accepted connection"; "One-time invitation link", QR, "Share 1-time link", "Learn more", "Delete" | `C/views/newchat/ContactConnectionInfoView.kt:33,77,159`; `ChatView.kt:824-827` | `pendingInfoIncognitoShown`, `pendingInfoLearnMore`, `pendingInfoDelete` | Incognito row "Incognito"; "Learn more" opens a page titled "One-time invitation link" with "To connect, your contact can scan QR code or use the link in the app." (`ContactConnectionInfoView.kt:68-72,140,145`; `C/views/newchat/AddContactLearnMore.kt:19-20`), a text the info screen doesn't show; delete alert as in §3 | — | – |
+| Pending | Alias | Field "Set contact name…" | `ContactConnectionInfoView.kt:126-128,193` | `pendingInfoSetAliasPersistsToContact` | After "friend" is typed into "Set contact name…", the pending row reads "friend" (`ChatModel.kt:3243`); after the CLI connects (`bob <## "alice: contact is connected"`), the contact's row and chat title read "friend", not "bob" (`localAlias.ifEmpty`, `ChatModel.kt:1912`). Haskell: `testSetConnectionAlias` (3247; alias carried to the contact) | P | – |
+| Pending | Group-link pending | Join a group through a full link | `ContactConnectionInfoView.kt:127-128` | `pendingInfoGroupLinkHidesAlias` | No alias editor | P, PEERCTL | The host is stopped so the group-link join stays pending. The current-build peer is started with `--show-full-links` (`src/Simplex/Chat/Options.hs:435`) so it prints the full link, which the test types into search (that starts the plan, ChatListView.kt:833-845), taps "Use current profile" in "Join group?", dismisses "Connection request sent!" (`ConnectPlan.kt:264-275,417-433`), then clicks the pending row; no `CB` is needed |
+
+### 11. Address screens (23 tests)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Address | No address | Picker "Create SimpleX address" → "SimpleX address": "For social media" › "Create SimpleX address"; "Or to share privately" › "Create 1-time link"; "SimpleX address or 1-time link?" | `C/views/usersettings/UserAddressView.kt:41,272-322,462,478`; `UserAddressLearnMore.kt:27` | `addressScreenNoAddressShowsCreate`, `addressCreateOneTimeLinkButton`, `addressLearnMore` | `addressScreenNoAddressShowsCreate`: "For social media" › "Create SimpleX address", "Or to share privately" › "Create 1-time link", and "SimpleX address or 1-time link?" (`UserAddressView.kt:307-321`); `addressCreateOneTimeLinkButton`: "Create 1-time link" opens NewChatView on the 1-time link with "Share this 1-time invite link" (:462-474; `NewChatView.kt:500`); `addressLearnMore`: "SimpleX address or 1-time link?" opens "Address or 1-time link?" with "Share address publicly", "Share 1-time link with a friend" and "Connection security" (`UserAddressLearnMore.kt:27-50`) | — | – |
+| Address | Create | "Create SimpleX address" | `UserAddressView.kt:74-113` | `createAddressNoContactsSharesAutomatically` | No contacts: no alert; the address is created and shared at once ("Share with SimpleX contacts" is on in "Address settings") | — | – |
+| Address | Create | "Create SimpleX address" | `UserAddressView.kt:74-113` | `createAddressWithContactsAsksToShare`, `createAddressWithContactsAsksToShareCancel` | With contacts: "Share address with SimpleX contacts?" / "Share" (`createAddressWithContactsAsksToShare` taps "Share"); CLI "alice set new contact address, use /info alice to view". Cancel: the address is created but not shared, and the CLI prints nothing. Haskell: `testProfileLink` (1550) | P | – |
+| Address | Show and share | QR, "Share address", "Share via chat" | `UserAddressView.kt:343-366` | `addressQrAndShareAddress` | QR and "Share address": the clipboard gets the short link | CB | – |
+| Address | Show and share | QR, "Share address", "Share via chat" | `UserAddressView.kt:343-366` | `addressShareViaChat` | Share via chat opens the share list; pick bob: bob's chat opens with the address card in the compose preview (`ComposeView.kt:1651-1665`); click send; CLI "alice> contact address of @alice (signed):" followed by the link line (no signature line: it is printed only in the test view, `src/Simplex/Chat/View.hs:1006-1007`). Haskell: `testShareAddressViaChat` | P | – |
+| Address | CLI connects | CLI `/c <address>` | – | `addressCliConnectsAndRequestAppears` | Contact row with "Open to accept" (§3). Haskell: `testUserContactLink` | P, S | – |
+| Address | Upgrade | "Upgrade address" → "Upgrade address?" → "Upgrade" (`UserAddressView.kt:225-240`) | `UserAddressView.kt:202-269,348-353` | `addressUpgradeShortLink` | "Upgrade address" disappears and the "Short link" / "Full link" toggle appears (`UserAddressView.kt:343-349`) | FIXTURE (address without short link) | `shouldBeUpgraded` only happens for old addresses |
+| Address | Business | Toggle "Business address" | `UserAddressView.kt:367-372,625` | `addressBusinessToggleAutoEnablesAutoAccept` | Footer "Add your team members to the conversations."; turning it on forces "Auto-accept" on | — | Customer connections and business chats are catalogue 03 §20 |
+| Address | Settings | "Address settings": "Share with SimpleX contacts", "Auto-accept", "Accept incognito", "Welcome message" ("Enter welcome message… (optional)"), "Save" | `UserAddressView.kt:498-582,585-622,650-673,739-775` | `addressSettingsShareWithContactsOn`, `addressSettingsShareWithContactsOff`, `addressSettingsShareCancelReverts`, `addressAutoAcceptOn`, `addressAutoAcceptOff`, `addressWelcomeMessage` | `addressSettingsShareWithContactsOn`: "Share address with SimpleX contacts?" / "Share", then CLI "alice set new contact address, use /info alice to view" (`src/Simplex/Chat/View.hs:2338`); `addressSettingsShareWithContactsOff`: "Stop sharing address?" / "Stop sharing", then CLI "alice removed contact address"; `addressSettingsShareCancelReverts`: "Cancel" in either alert puts the toggle back and the CLI prints nothing (`UserAddressView.kt:585-622`); `addressAutoAcceptOn`: CLI "connection request sent!" then connected without approval; `addressAutoAcceptOff`: a new address has Auto-accept off (`autoAccept = null`, `UserAddressView.kt:84`), so the test first turns it on; turning it off then saves at once, like turning it on (:650-673); a CLI connecting then prints "connection request sent!" and alice's list gets a contact row "Open to accept" (`ChatPreviewView.kt:192-193`; the core creates a contact for every request, Store/ContactRequest.hs:84-107), with no connection until alice accepts; `addressWelcomeMessage`: alice first turns Auto-accept on (turning it on clears the welcome text and saves at once, :650-662), then enters "hello!" and taps "Save"; a CLI connecting then gets "alice> hello!" (the welcome is sent when the request is accepted, `src/Simplex/Chat/Library/Commands.hs:1471-1479`). Haskell: `testProfileLink`, `testUserContactLinkAutoAccept` (1631), `testAutoReplyMessage` (1927), `testShortLinkAddressChangeAutoReply` | P | – |
+| Address | Settings save button | "Address settings" → "Welcome message", "Save" | `UserAddressView.kt:576,778-781` | `addressSettingsSaveDisabledWhenUnchanged` | "Save" is disabled until the welcome message changes, and disabled again after saving (:576, 778-781) | — | – |
+| Address | Settings | "Address settings": "Share with SimpleX contacts", "Auto-accept", "Accept incognito", "Welcome message" ("Enter welcome message… (optional)"), "Save" | `UserAddressView.kt:498-582,585-622,650-673,739-775` | `addressAutoAcceptIncognito` | alice turns "Auto-accept" on (a new address has it off, and turning it on saves at once with incognito off, `UserAddressView.kt:650-662`); "Accept incognito" is then drawn (only while Auto-accept is on, :564-567), and she turns it on and taps "Save" (the toggle alone only edits the settings, :739-753); then CLI `/c <address>`: the CLI is connected with a random profile of alice | P, FIXTURE (address without short-link data) | "Accept incognito" is hidden when short-link data is set |
+| Address | Unsaved settings | Close with changes | `UserAddressView.kt:528-545,808` | `addressSettingsUnsavedChangesAlertSave`, `addressSettingsUnsavedChangesAlertExit` | "Save settings?" / "Save SimpleX address settings" / "Exit without saving", after the welcome message is edited; `addressSettingsUnsavedChangesAlertSave`: the command log has `/_address_settings <uid> {…}` (`C/model/SimpleXAPI.kt:4289`), the screen closes, and reopening "Address settings" shows the new welcome message; `addressSettingsUnsavedChangesAlertExit`: the screen closes with no `/_address_settings` command, and reopening shows the old one | — | – |
+| Address | Delete | "Delete address" → "Delete address?" | `UserAddressView.kt:147-166,676` | `addressDelete`, `addressDeleteKeepsPendingRequests` | "Delete address?" with "All your contacts will remain connected. Profile update will be sent to your contacts." (address shared: bob is alice's contact before the address is created, so creating it asks "Share address with SimpleX contacts?" and the test taps "Share", `UserAddressView.kt:86-103`; "All your contacts will remain connected." when sharing is off) / "Delete"; each CLI contact gets "alice removed contact address". After a new CLI first repeats `/_connect plan 1 <link>` until it prints `error: connection authorization failed - …` (the GUI's deletion reaches the server later, in a background thread, simplexmq `Agent.hs:1013-1015`; the plan reads the link from the server, `Library/Commands.hs:4485`), then its `/c` fails with "error: connection authorization failed…"; `addressDeleteKeepsPendingRequests`: a request a CLI sent before the deletion keeps its "Open to accept" row, and its menu "Accept" gives that CLI's "alice: contact is connected" (H/Profiles.hs:1853-1862). Haskell: `testProfileLink`, `testRejectContactAndDeleteUserContact`, `testKeepConnectionRequests`, `testShortLinkDeletedAddress` (short link) | P | – |
+
+### 12. SimpleX name (8 tests)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Name | Set name | Address screen → "Get SimpleX name (BETA)", or with a name set the name row under the "Your SimpleX name" section → "Set SimpleX name", placeholder "@yourname.testing" (hard-coded literal, `UserAddressView.kt:385`), "Save", "How to register a test name", "Remove name" | `C/views/usersettings/SetSimplexNameView.kt:42,73-79,157-158`; `UserAddressView.kt:375-405` | `simplexNameEntryShownWithAddress`, `simplexNameValidationIcon` | With an address the "Get SimpleX name (BETA)" row is shown; invalid names show the error icon in the name field | — | Neither test resolves a name: the row comes from `contactDomain` alone (`UserAddressView.kt:376-379`) and the icon from a local check (`SetSimplexNameView.kt:73-79,157-158`). The sale countdown depends on the clock |
+| Name | Set name | Address screen → "Get SimpleX name (BETA)", or with a name set the name row under the "Your SimpleX name" section → "Set SimpleX name", placeholder "@yourname.testing" (hard-coded literal, `UserAddressView.kt:385`), "Save", "How to register a test name", "Remove name" | `C/views/usersettings/SetSimplexNameView.kt:42`; `UserAddressView.kt:375-405` | `simplexNameSaveConfirmBroadcast`, `simplexNameSaveNotOwnAddressError`, `simplexNameRemove`, `simplexNameUnsavedChangesAlert`, `simplexNameRemovedWhenAddressDeleted` | "Save" shows "Profile update will be sent to your SimpleX contacts." / "Save" (name registered to alice's address with `register alice.simplex contact=<alice's address>`); confirming saves it, and the address screen shows the section "Your SimpleX name" with the row "alice.simplex" in place of "Get SimpleX name (BETA)" (`UserAddressView.kt:375-378`). A name registered without alice's address shows "Error saving name" / "The SimpleX name alice.simplex is registered without SimpleX address. Add your SimpleX address to the name via the registration page.". With a name set, "Remove name" clears the field and "Save" removes it: the row reads "Get SimpleX name (BETA)" again and the "Your SimpleX name" section title is gone. `simplexNameUnsavedChangesAlert`: leaving with a changed valid name shows "Save SimpleX name?" / "Save" / "Exit without saving", and "Exit without saving" returns to the address screen, which still reads "Get SimpleX name (BETA)" (`SetSimplexNameView.kt:102-121`). After "Delete address" and "Create SimpleX address", the entry reads "Get SimpleX name (BETA)" again. Haskell: `testSetNameNotOwnAddress` (core error NoValidLink), `testAddressDeleteRemovesName` | NAMES | The not-own name is registered with `register alice.simplex` and no `contact=` (using a CLI peer's address instead would need P). The sale countdown depends on the clock |
+| Name | Set name | Address screen → "Get SimpleX name (BETA)", or with a name set the name row under the "Your SimpleX name" section → "Set SimpleX name", placeholder "@yourname.testing" (hard-coded literal, `UserAddressView.kt:385`), "Save", "How to register a test name", "Remove name" | `C/views/usersettings/SetSimplexNameView.kt:42`; `UserAddressView.kt:375-405` | `simplexNameRegisterLinkOpensBrowser` | "How to register a test name" shows the "Open web link?" alert first (`SetSimplexNameView.kt:178`); opening it records `https://simplex.domains/#testing` in the URI stub | URI | The sale countdown depends on the clock |
+
+### 13. Contact info screen (28 tests)
+
+Entry for every row: open the chat → click the header → `ChatInfoView`.
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Info | Header and alias | Header, field "Set contact name…" | `C/views/chat/ChatInfoView.kt:56,711,822,1352` | `contactInfoOpensFromChatHeader`, `contactInfoSetLocalAlias`, `contactInfoClearLocalAlias` | `contactInfoOpensFromChatHeader`: clicking the chat title opens contact info with the contact's name in the header and the field "Set contact name…" (`ChatInfoView.kt:711-730`); `contactInfoSetLocalAlias`: after "friend" is typed (saved 500 ms after the last key, `ChatInfoView.kt:865-870`), the chat-list row reads "friend" instead of "bob" (`ChatModel.kt:1912`); `contactInfoClearLocalAlias`: after clearing the field the list shows the contact's display name again. Haskell: `testSetAlias` (3043) | P | – |
+| Info | Header and alias | Header, field "Set contact name…" | `C/views/chat/ChatInfoView.kt:56,711,822,1352` | `contactInfoHeaderShowsNameBioCopy` | Name and bio; copying shows "Copied to clipboard" | P, CB, TOAST | – |
+| Info | Action buttons | "search", "call", "video", "Mute"/"Unmute" | `ChatInfoView.kt:574-578,880-1059` | `contactInfoSearchButton`, `contactInfoMuteButtonToggles`, `contactInfoCallProhibitedAlert`, `contactInfoAllowCallsAlert` | `contactInfoSearchButton`: "search" (disabled while the chat has no items) opens the search field in the chat toolbar (`ChatInfoView.kt:880-901`; `ChatView.kt:435-437`); `contactInfoMuteButtonToggles`: "Mute" turns the contact's notifications off: the button then reads "Unmute" and the chat-list row shows the mute icon; "Unmute" turns them back on (:904-924); `contactInfoCallProhibitedAlert`: both sides allow calls by default (`src/Simplex/Chat/Types/Preferences.hs:561`), so the CLI first runs `/set calls @alice no`; once alice's "Contact preferences" show "Contact allows" "no" for "Audio/video calls", "call" shows "Calls prohibited!" / "Please ask your contact to enable calls." (`!allowedCallsByPrefs`, `ChatInfoView.kt:1009,1053-1058`); `contactInfoAllowCallsAlert`: alice sets "Audio/video calls" "You allow" to "no" in "Contact preferences" and taps "Save and notify contact", while the CLI keeps its default "yes" (the alert needs the contact's preference to be exactly yes, not always: `needToAllowCallsToContact`, `ChatInfoView.kt:972-977`); "call" then shows "Allow calls?" / "You need to allow your contact to call to be able to call them." / "Allow", and "Allow" makes the CLI print "alice updated preferences for you:" and an "Audio/video calls: enabled …" line (`allowFeatureToContact`, `SimpleXAPI.kt:2623-2631`) | P | – |
+| Info | Action buttons | "search", "call", "video", "Mute"/"Unmute" | `ChatInfoView.kt:574-578,880-1059` | `contactInfoCallButtonsStubbed` | Clicking "call" makes the URI stub record `http://localhost:<port>/simplex/call/?token=<token>` (`D/views/call/CallView.desktop.kt:167`; nothing is recorded before), and the active-call area appears (icon "audio call", `D/views/chatlist/ChatListView.desktop.kt:85,144`), whose right-click menu has "Hang up" (:58, 63, 123-124, 91-99, 150-158) | P, URI | – |
+| Info | Incognito section | Contact connected incognito | `ChatInfoView.kt:583-591` | `contactInfoIncognitoSection` | "Your random profile" with a name equal to the CLI's contact name | P | – |
+| Info | Verification | "Verify security code"/"View security code" → "Security code", "Mark verified", "Clear verification" | `ChatInfoView.kt:158-185,1208`; `VerifyCodeView.kt:27,56` | `contactInfoVerifyCodeMatchesCli`, `contactInfoMarkVerified`, `contactInfoClearVerification` | The code on screen with whitespace and line breaks removed equals the code line of CLI `/code alice` with spaces removed (the screen splits the code into 24-character lines, `VerifyCodeView.kt:65,132-136`; the core compares codes without spaces, `src/Simplex/Chat/Types.hs:1997-2000`) (the real CLI prints "alice security code:", the code, then a "pass this code to your contact…" hint; only the test view prints the bare code, `src/Simplex/Chat/View.hs:2020-2023`); `contactInfoMarkVerified`: "Mark verified" closes the "Security code" screen (`VerifyCodeView.kt:40-45`), the info row then reads "View security code" (`ChatInfoView.kt:1208-1215`) and reopens the screen showing "bob is verified", its status line `verified` (plan §4; `VerifyCodeView.kt:66-72`), and bob's chat-list row is `verified` (`ChatPreviewView.kt:97-98`); `contactInfoClearVerification`: on the verified contact "Clear verification" leaves the screen open, which turns to "bob is not verified" with "Mark verified" back (`VerifyCodeView.kt:66-72,105-108`), and the info row reads "Verify security code" again. Haskell: `testMarkContactVerified` (3116) | P | "Scan code" is mobile only |
+| Info | Send receipts | "Send receipts": yes / no / default (yes) | `ChatInfoView.kt:84-88,203-229,1228` | `contactInfoSendReceiptsNo`, `contactInfoSendReceiptsDefault` | The CLI sends a message, then reads its status with `/_get chat @<alice's contact id> count=1` (JSON, View.hs:129; id from `contactId`, plan §8.1): with "default (yes)", the command is repeated until `itemStatus` is `sndRcvd` (the receipt reaches the CLI some time after the sent echo, and the real CLI prints no event for it); with "no", a read after `wait(5 s)` still shows no `sndRcvd` (absence needs a bounded wait). The terminal never prints ⩗ (`showReceipts` is off in the real CLI, `src/Simplex/Chat.hs:119`). Haskell: `testConfigureDeliveryReceipts` (`/receipts @bob on`) | P | – |
+| Info | Message TTL | "Delete messages after": never / 1 day… | `ChatInfoView.kt:90-98,620-623,1405-1452` | `contactInfoChatTtlEnable`, `contactInfoChatTtlDisable` | `contactInfoChatTtlEnable`: picking "1 day" (from "default (never)") asks "Enable automatic message deletion?"; "Delete messages" leaves `/_ttl <uid> @<contactId> 86400` in the command log (`C/model/SimpleXAPI.kt:4231`) and the picker reads "1 day"; `contactInfoChatTtlDisable`: then picking "never" asks "Disable automatic message deletion?"; "Disable delete messages" leaves `/_ttl <uid> @<contactId> 0` and the picker reads "never" ("Cancel" reverts the picker, `ChatInfoView.kt:1427`). Haskell: `testSetDirectChatTTL` (2930) | P | – |
+| Info | Encryption, address, servers | Rows "E2E encryption" ("Quantum resistant"), "Address" with "Share address", "Servers" › "Network status", "Receiving via", "Sending via" | `ChatInfoView.kt:626-679` | `contactInfoE2eeQuantumResistant`, `contactInfoContactAddressSection`, `contactInfoServersSection`, `contactInfoNetworkStatusAlert` | `contactInfoE2eeQuantumResistant`: row "E2E encryption" reads "Quantum resistant"; `contactInfoContactAddressSection`: "Address" section with "Share address" shown when CLI shared its address (`/pa on`); `contactInfoServersSection`: "Receiving via" and "Sending via" show localhost; `contactInfoNetworkStatusAlert`: clicking "Network status" shows the alert "Network status" / "You are connected to the server used to receive messages from this connection." (`ChatInfoView.kt:645-653`; `SimpleXAPI.kt:7652-7654`) | P | "E2E encryption" / "Quantum resistant" are hard-coded literals (`ChatInfoView.kt:629`), not strings.xml labels |
+| Info | Change address | "Change receiving address" → "Change receiving address?" / "Change"; "Abort changing address" → "Abort" | `ChatInfoView.kt:117-143,1166-1184,1361-1378` | `contactInfoSwitchAddress` | CLI "alice started changing address for you" then "alice changed address for you". Haskell: `testSwitchContact` (3024) | P | – |
+| Info | Change address | "Change receiving address" → "Change receiving address?" / "Change"; "Abort changing address" → "Abort" | `ChatInfoView.kt:117-143,1166-1184,1361-1378` | `contactInfoAbortSwitchAddress` | Stop smp1; "Change receiving address" → "Change"; "Abort changing address" is enabled → "Abort"; start smp1; messages flow. Haskell: `testAbortSwitchContact` (3039) | P, SRVCTL | smp1 is stopped before "Change receiving address" → "Change", so the switch stays in `RSSwitchStarted` and "Abort changing address" is enabled (`canAbortSwitch`, `ChatInfoView.kt:662-665`); smp1 is started again after "Abort". With the server up the agent reaches `RSSendingQADD` at once (simplexmq Agent.hs:2879-2881), which is abortable only below agent version 8 (Store.hs:210-219); `testAbortSwitchContact` uses `testCfgVPrev` for that reason. Same approach as 03 `memberInfo_abortSwitchAddress` |
+| Info | Fix connection | "Fix connection" (runs at once, no confirmation) | `ChatInfoView.kt:144-149,193,600-602` | `contactInfoFixConnection` | CLI "alice: connection synchronization agreed" then "alice: connection synchronized". Haskell: `testSyncRatchet` (3242), roles swapped | P, RESTART, FIXTURE (alice's own database copy restored) | alice must be the desynchronised side: copy her database, exchange messages, restore the copy between `restart()` steps, then receive a CLI message. Restoring the CLI's copy desynchronises the CLI instead |
+| Info | Clear, theme, developer | "Clear chat"; "Chat theme"; "For console" ("Local name", "Database ID", "Debug delivery") | `ChatInfoView.kt:608-616,681-705,1252` | `contactInfoClearChat`, `contactInfoWallpaperEntry` | "Clear chat?" (text "bob" and "All messages will be deleted - this cannot be undone! The messages will be deleted ONLY for you.") / "Clear" (`ChatInfoView.kt:497-503`); after "Clear" the messages exchanged before are gone from the chat while bob stays in the chat list; "Chat theme" opens the wallpaper editor, checked by its "Set default theme" (`ThemeModeEditor.kt:523`), since its title "Chat theme" (:250) equals the button label on the info screen | P | "Renegotiate encryption" is commented out (`ChatInfoView.kt:603-605`) |
+| Info | Clear, theme, developer | "Clear chat"; "Chat theme"; "For console" ("Local name", "Database ID", "Debug delivery") | `ChatInfoView.kt:608-616,681-705,1252` | `contactInfoDeveloperSection` | "For console" ("Local name", "Database ID", "Debug delivery"); "Message queue info" alert | P, DT | "Renegotiate encryption" is commented out (`ChatInfoView.kt:603-605`) |
+| Info | Contact not ready | Pending contact | `ChatInfoView.kt:593-606,644` | `contactInfoNotReadyContactHidesSections` | No verify/preferences/servers sections | P | alice connects through the CLI's address; the CLI never sends `/ac`, so the contact stays not ready |
+
+### 14. Preferences (12 tests)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Contact prefs | Per contact | Info → "Contact preferences": "Disappearing messages" ("You allow" toggle, "Delete after"), then "Delete for everyone", "Message reactions", "Voice messages", "Audio/video calls", each with a "You allow" dropdown (always/yes/no/default (…)); every section has "Contact allows"; "Reset", "Save and notify contact" | `C/views/chat/ContactPreferences.kt:28,77,126,161,209,220` | `contactPrefsDisappearingMessagesAllow`, `contactPrefsFullDeletion`, `contactPrefsReactions`, `contactPrefsVoice`, `contactPrefsCalls`, `contactPrefsResetRevertsChanges`, `contactPrefsUnsavedAlertSave`, `contactPrefsUnsavedAlertExit`, `contactPrefsContactAllowsReflectsPeer` | each change is saved with "Save and notify contact", after which the CLI prints "alice updated preferences for you:" and one line for the changed feature, named as in `chatFeatureNameText` (`src/Simplex/Chat/Types/Preferences.hs:68-76`; `src/Simplex/Chat/View.hs:2062-2076`): `contactPrefsDisappearingMessagesAllow`: on a new contact "You allow" is already on and "Delete after" is shown (the default user preference allows it, `src/Simplex/Chat/Types/Preferences.hs:556`; `contactUserPrefsToFeaturesAllowed`, `SimpleXAPI.kt:6301-6306`; `ContactPreferences.kt:190`); turning "You allow" off hides "Delete after", and saving prints a "Disappearing messages: off …" line; turning it on again shows "Delete after" set to 1 day (`?: 86400`, `ContactPreferences.kt:184`), and saving prints a "Disappearing messages: enabled …" line; `contactPrefsFullDeletion`: a "Full deletion: …" line; `contactPrefsReactions`: a "Message reactions: …" line; `contactPrefsVoice`: e.g. "Voice messages: enabled (you allow: default (yes), contact allows: always)"; once the CLI has set voice to no (as `testSetContactPrefs` does), "Voice messages: enabled for you (you allow: default (no), contact allows: always)" (`prefEnabled`, `Preferences.hs:1146-1153`); `contactPrefsCalls`: an "Audio/video calls: …" line; `contactPrefsResetRevertsChanges`: after a change, "Reset" restores the saved values and disables "Reset" and "Save and notify contact" again; the CLI prints nothing (`ContactPreferences.kt:67-69,120-124,210-219`); `contactPrefsUnsavedAlertSave`: leaving with changes shows "Save preferences?", and "Save and notify contact" saves (the CLI prints the update); `contactPrefsUnsavedAlertExit`: "Exit without saving" closes, and the CLI prints nothing; `contactPrefsContactAllowsReflectsPeer`: after the CLI runs `/set voice @alice no`, the "Voice messages" section's "Contact allows" row reads "no" (`ContactPreferences.kt:152-155`; `FeatureAllowed.text`, `SimpleXAPI.kt:6351-6356`). Haskell: `testSetContactPrefs` (3279), `testFeatureOffers`, `testAllowFullDeletionContact` | P | The Files preference is not shown for contacts (group only) |
+| User prefs | Global | Picker "Chat preferences" → "Your preferences" | `C/views/usersettings/Preferences.kt:25,65,168,179` | `userPrefsTimedMessagesAndTtl`, `userPrefsFullDeleteReactionsVoiceCalls`, `userPrefsResetAndUnsavedAlert` | "Save and notify contacts"; each CLI contact gets the preferences update. `userPrefsResetAndUnsavedAlert`: after a change, "Reset" restores the saved values and disables "Reset" and "Save and notify contacts" again, and the CLI prints nothing (`Preferences.kt:58,108-112,168-177`); leaving with a change shows "Save preferences?": "Exit without saving" closes and the CLI prints nothing (reopening shows the saved values), "Save and notify contacts" saves and the CLI prints the update (:47-50, 179-187). Haskell: `testUpdateMultipleUserPrefs` | P | – |
+
+### 15. Delete contact variants (10 tests)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Delete | Active contact | Row menu "Delete" or info "Delete contact" → "Delete contact?" with "Only delete conversation" / "Delete contact" / "Cancel" | `ChatInfoView.kt:231-281` | `deleteContactOnlyConversation`, `deleteConversationNoticeDontShowAgain`, `deleteContactCancel` | `deleteContactOnlyConversation`: bob's row leaves the chat list, and a later `bob #> "@alice hi"` still reaches alice (the contact stays): the row comes back with the preview "hi" and opening it shows "hi" without the earlier messages; `deleteConversationNoticeDontShowAgain`: "Conversation deleted!" / "You can send messages to bob from Archived contacts." / "Don't show again"; `deleteContactCancel`: "Cancel" closes the alert; the chat and its messages stay and the CLI prints nothing (`ChatInfoView.kt:271-276`). Haskell: `testDeleteConversationKeepContact` (609) | P | – |
+| Delete | Delete contact | "Delete contact" → second alert "Contact will be deleted - this cannot be undone!" with "Keep conversation" switch, "Delete without notification", "Delete and notify contact" | `ChatInfoView.kt:306-362,459,471` | `deleteContactAndNotify`, `deleteContactWithoutNotification`, `deleteContactKeepConversation`, `deleteContactFromInfoClosesChat` | `deleteContactAndNotify`: CLI "alice deleted contact with you"; `deleteContactWithoutNotification`: the row is removed and the CLI prints nothing (`notify = false`, `ChatInfoView.kt:334-342`); `deleteContactKeepConversation`: with the pre-set `showDeleteContactNotice` cleared (the test is about the notice, which is read when the action runs, `ChatInfoView.kt:337-339,346-348`), "Contact deleted!" notice and the row stays; `deleteContactFromInfoClosesChat`: deleting from contact info closes the info view and the chat (`ChatInfoView.kt:487-492`). Haskell: `testDeleteContactDeletesProfile` (571), `testDeleteContactKeepConversation` (591) | P | – |
+| Delete | Archived contact | Contact with `chatDeleted` → "Confirm contact deletion?" | `ChatInfoView.kt:364-419` | `deleteArchivedContactConfirm` | "Confirm contact deletion?" with "Delete and notify contact" / "Delete without notification" / "Cancel" (`ChatInfoView.kt:366-412`); each delete option removes the contact: "Delete and notify contact" leaves `/_delete @<id> full notify=on` in the Log and bob prints "alice deleted contact with you" (`C/model/SimpleXAPI.kt:4270,7334`; `src/Simplex/Chat/View.hs:461`); "Delete without notification" leaves `/_delete @<id> full notify=off` and bob prints nothing | P | The contact is archived with "Only delete conversation" (`ChatInfoView.kt:258`; the core sets `chatDeleted`, `Library/Commands.hs:1372`); for the second option alice and bob connect again after the first deletion and the new contact is archived the same way |
+| Delete | Not-ready contact | Pending contact → "Delete" → "Confirm contact deletion?" → "Confirm" | `ChatInfoView.kt:421-457` | `deleteNotReadyContactConfirm` | Removed | P | alice connects through the CLI's address; the CLI never sends `/ac` |
+| Delete | Deleted by peer | CLI `/d alice` (full deletion, notify on by default, `Library/Commands.hs:6281,6474-6482`; the real CLI's contact 2 is its "Ask SimpleX Team" card, plan §8.1) | – | `contactDeletedByPeerShowsDeleted` | CLI "alice: contact is deleted". The GUI row shows the item "deleted contact" with the inactive overlay icon. In the chat the compose field shows "contact deleted" (disabled); clicking it shows "You can't send messages!" (`C/views/chat/SendMsgView.kt:101-112`). Haskell: `testDeleteContactKeepConversation` (receiving side) | P | Owned here (legend); catalogue 02 has no duplicate |
+
+---
+
+## Notes (not tests)
+- **Notifications.** The notifications-mode step exists only on Android (`YourNetwork.kt:105`); `onboardingNoNotificationsStepOnDesktop` asserts it is absent. System notifications go to the recording notification manager (`NTF`).
+- **Not on desktop or not in the code.** QR scanning and "Scan code" (camera, mobile only); "Renegotiate encryption" (`ChatInfoView.kt:603-605`) and "Invite friends" by email (`UserAddressView.kt:366`) are commented out; there is no chat archiving (the only "archive" features are "Archive reports" in groups, catalogue 03, and "Archived contacts", §6); contacts have no "Files" preference.
+- **"Share address" label.** strings.xml defines `share_address` twice (:572 "Share address…", :1957 "Share address"); moko keeps the later value, so the button (`ShareAddressButton`, `ChatInfoView.kt:1274-1277`) reads "Share address" in §11 and §13.
+- **Badge display** is excluded (plan decisions). Crowdfunding and register-name links only reach the `LocalUriHandler` stub.
+- **Lock-protected profile actions** (`doWithAuth`) are tested in catalogue 04 (SimpleX Lock).
+- **Ignored rows** in this catalogue: none. Real WebRTC calls are an `IGNORE` row in catalogue 02.
+
+## Count
+
+| Section | Tests | Ignored |
+|---|---|---|
+| 1 Onboarding | 24 | 0 |
+| 2 What's New | 6 | 0 |
+| 3 Chat list | 106 | 0 |
+| 4 Servers summary | 10 | 0 |
+| 5 User picker and profiles | 44 | 0 |
+| 6 New chat sheet and contacts | 17 | 0 |
+| 7 1-time link (create / share / QR / incognito / profile) | 17 | 0 |
+| 8 Paste link and connection plans (contact, invitation, address, bot, name, signature, URI and link-card links) | 29 | 0 |
+| 9 Connecting a prepared chat (compose area) | 11 | 0 |
+| 10 Pending connection info screen | 7 | 0 |
+| 11 Address screens | 23 | 0 |
+| 12 SimpleX name | 8 | 0 |
+| 13 Contact info screen | 28 | 0 |
+| 14 Preferences | 12 | 0 |
+| 15 Delete contact variants | 10 | 0 |
+| **Total** | **352** | **0** |
diff --git a/plans/ui-tests/catalogue/02-chat-view-messages.md b/plans/ui-tests/catalogue/02-chat-view-messages.md
new file mode 100644
index 0000000000..fce226541b
--- /dev/null
+++ b/plans/ui-tests/catalogue/02-chat-view-messages.md
@@ -0,0 +1,325 @@
+# UI test catalogue 2: chat view, messages, chat item info
+
+Every user-facing feature of the desktop chat view, compose bar, chat item context menus and item info, mapped to planned tests: **281 test cases in 24 sections, 4 of them `IGNORE`** (see `## Count`). Format, users, CLI-line conventions, Needs codes and overlap ownership follow `00-legend.md`.
+
+Controls without a label today (selection-toolbar delete/forward, status ticks, scroll buttons, call and content-filter buttons, the compose clear-text (x) button, "go to item" buttons, selection circles, and the live-message bolt, which shares the send button's "Send Message" label) get keys in K2 (plan §5.2); rows below that use them assume those keys.
+
+**Conventions**
+- The GUI user is **alice**; CLI peers are bob, cath and dan. CLI lines are taken from the named Haskell tests, rewritten for these roles (`00-legend.md`, Users and CLI output).
+- `<#` means a timestamped line and `<##` a plain line, as in `H/Utils.hs`.
+- Labels in quotes are exact English strings from `strings.xml`; where the app capitalises or formats a string at runtime, the row names the key, and hard-coded literals (such as "//") are cited at their file:line.
+
+**File aliases** (paths per `00-legend.md`):
+- **CV** `C/views/chat/ChatView.kt`, **CIV** `C/views/chat/item/ChatItemView.kt`, **CMP** `C/views/chat/ComposeView.kt`, **SMV** `C/views/chat/SendMsgView.kt`, **INFO** `C/views/chat/ChatItemInfoView.kt`, **SEL** `C/views/chat/SelectableChatItemToolbars.kt`, **CMD** `C/views/chat/CommandsMenuView.kt`, **MEN** `C/views/chat/group/GroupMentions.kt`, **TSEL** `C/views/chat/TextSelection.kt`
+- Item views live in `C/views/chat/item/` (CIFileView, CIMetaView, FramedItemView, MarkedDeletedItemView, CIGroupInvitationView, CIFeaturePreferenceView, CICallItemView, CIMemberCreatedContactView, CIRcvDecryptionError, IntegrityErrorItemView, TextItemView, CIVoiceView, CIVideoView, CIImageView, ImageFullScreenView). The forward destination screen is `C/views/chatlist/ShareListView.kt`.
+- Desktop-specific: **PTF** `D/platform/PlatformTextField.desktop.kt`, **RAP** `D/platform/RecAndPlay.desktop.kt`, **SHR** `D/platform/Share.desktop.kt`, **CIVD** `D/views/chat/item/ChatItemView.desktop.kt`, **CMPD** `D/views/chat/ComposeView.desktop.kt`, **ATT** `D/views/helpers/ChooseAttachmentView.desktop.kt`
+- Status icons: `C/model/ChatModel.kt:4025-4061`
+- Fixture files (plan §11.1): `tests/fixtures/test.jpg` (136.5 KiB), `test.pdf` (266.0 KiB), `test_1MB.pdf`, `test.txt`; `images/files.gif` (the GIF); `website/src/video/connect.mp4` (the mp4 over 1023 KB); P1's committed `apps/multiplatform/common/src/desktopTest/resources/uitest-fixtures/` files `small.mp4` (under 1023 KB), `audio.webm`, `video.webm` and `broken.mp4` (undecodable); written by the harness: a 150 MB file of random bytes, a sparse file over 1 GB and a JPEG over 510 KiB.
+
+---
+
+### A. Chat view shell, toolbar, banner (11 tests)
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Shell | Open direct / group chat | Click the chat in the list | CV:98, CV:918, CV:1194 | `directChat_opens_showsToolbarAndBanner`, `groupChat_opens_showsBannerGroup` | Title = display name ("bob" / "team"); the banner at the top of the message list shows a second node with that name and the avatar above it (CV:2318-2325), so the name is found both in the toolbar and in the list. The context line is not asserted by these tests | P | |
+| Shell | Open notes chat | Click the chat in the list | CV:98, CV:1240-1254, CV:1339 | `notes_opens_showsSearchAndContentFilterIcons` | Notes show the search icon ("Search") and the content-filter icon (always added on desktop, CV:1339; `ContentFilter.alwaysShow` includes Images and Links, CV:3987) | — | Notes title is not clickable (CV:1446) |
+| Banner | Chat banner context line | Scroll to the top of the chat | CV:2251-2380 | `chatBanner_contextText_perChatType` | "Your contact", "Group", "Your group", "Bot" shown under the name | P | bob is alice's contact ("Your contact"); alice creates #team ("Your group", `MemCreator`, CV:2279-2282); bob creates #club and adds alice, who accepts ("Group"); then bob sets `peerType: bot` through `/_profile` (as in 02:49; a profile update rewrites the contact's peer type, `Store/Direct.hs:741`) and his banner reads "Bot" (`contact.isBot`, CV:2264-2265). Direct: `testContactClear`, where the Haskell test client's `/_get chat` shows `(1,"chat banner")` (test-view output, not a peer assertion) |
+| Toolbar | Title opens chat info | Click the title | CV:400 | `toolbarTitle_click_opensChatInfo` | Contact info opens with the field "Set contact name…" (`C/views/chat/ChatInfoView.kt:845`), absent before the click | P | |
+| Toolbar | ⋮ menu items, notification toggle | "More" → menu | CV:1296, 1305-1331, 1356-1374 | `toolbarMenu_direct_items`, `toolbarMenu_group_items`, `toolbarMenu_muteUnmute_togglesNtfMode` | Direct: "Search" plus the notification toggle. Group: "Invite members" (`icon_descr_add_members`) or "Group link", "Search", plus the notification toggle. The toggle switches the chat's notification mode (`testMuteContact`) | P | This section owns the toolbar menu, including mute (`00-legend.md`) |
+| Toolbar | ⋮ menu items in a channel | "More" → menu in a channel alice owns | CV:1305-1331, 1356-1374 | `toolbarMenu_channel_items` | "Channel link", "Search", plus the notification toggle (CV:1356-1374) | P, RELAY | |
+| Toolbar | Start call | Call icon → "Audio call" / "Video call" (`icon_descr_audio_call` / `icon_descr_video_call`, lower-case in strings.xml and capitalised at runtime, CV:1545/1551; the driver looks them up capitalised) | CV:1289, 1542-1556, 906 | `toolbarCall_audio_opensCallLink` | The `LocalUriHandler` stub records `http://localhost:<port>/simplex/call/?token=<token>` (`D/views/call/CallView.desktop.kt:167`) and the GUI shows the active-call area (icon "audio call", `D/views/chatlist/ChatListView.desktop.kt:85,144`), whose right-click menu has "Hang up" (:58, 63, 123-124, 91-99, 150-158; the call state text "starting…" goes only to the browser page, :140-152). bob prints nothing: the invitation is sent only after the browser page reports its capabilities (`D/views/call/CallView.desktop.kt:41-43`), and the stub doesn't run the page (plan §7.6) | P, URI | The call icon gets a key in K2 |
+| Toolbar | Call when no browser can be opened | The `LocalUriHandler` stub is set to throw; call icon → "Audio call" | `D/views/call/CallView.desktop.kt:157-174`, `C/views/call/CallManager.kt:75-97`, `C/App.kt:226-238` | `callStart_browserUnavailable_showsAlertAndEnds` | Alert "Error opening browser" / "The default web browser is required for calls. Please configure the default browser in the system, and share more information with the developers." (`unable_to_open_browser_title`/`_desc`, strings.xml:1291-1292); the call ends at once (`endCall` sets `showCallView` false and `activeCall` null, CallManager.kt:81-86), so no outgoing-call waiting state remains under the alert. bob prints nothing: the invitation is sent only from the `Capabilities` response (CallView.desktop.kt:40-46), and `apiEndCall` fails silently with no current call (`APIEndCall` → `withCurrentCall` throws `CENoCurrentCall`, `Library/Commands.hs:1579-1583, 4232-4240`; `apiEndCall` returns false, `C/model/SimpleXAPI.kt:2160-2163`) | P, URI | The throwing mode is a harness option of the recording `LocalUriHandler` (plan §7.6), not a new Needs code. `endCall` also calls `AppLock.appWasHidden()` (CallManager.kt:82); irrelevant with the lock off |
+
+### B. Composing and sending text, links, mentions, commands (29 tests)
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Send | Enter sends | Type, press Enter | PTF:123-137 | `sendText_enter_peerReceives` | `bob <# "alice> hello there 🙂"` (`testAddContact`) | P, S | |
+| Send | Send button | Click "Send Message" | SMV:452 | `sendText_sendButton_peerReceives` | Same line as above | P | |
+| Send | No send button for empty text; disabled for whitespace | Empty compose; then type spaces | SMV:71-72, 138-167 | `sendButton_hiddenWhenEmpty_disabledForWhitespace` | With empty text the microphone and the live-message bolt are shown instead of the send button; with whitespace-only text the send button is shown disabled | P | |
+| Multiline | Shift+Enter inserts a newline | Shift+Enter, then Enter | PTF:125-133 | `multiline_shiftEnter_peerReceivesTwoLines`, `multiline_received_rendersBothLines` | `multiline_shiftEnter_peerReceivesTwoLines`: `bob <# "alice> hello"`, `bob <## "there"` (`testMultilineMessage`); `multiline_received_rendersBothLines`: after bob `types` `@alice "hello\nthere"` (plan §8.1: the sent item prints as `@alice hello` / `there`, which `sends` would not match, H/Direct.hs:999-1001), alice's received item shows "hello" and "there" on two lines | P | |
+| Group | Group send | Enter in a group | CMP:720 | `groupSend_allMembersReceive` | `bob <# "#team alice> hello"`, `cath <# "#team alice> hello"` (`testGroupCheckMessages`) | P ×2 | Send only after cath prints `#team: member alice is connected`; before that the host forwards the message and cath's line ends with ` [>>]` (measured) |
+| Markdown | Rendering, secret reveal, text on CLI | bob `types` ``@alice *bold* _it_ ~st~ !1 red! `code` #sec#`` (plan §8.1: the CLI prints markdown with the markers of bold, italic, strike and colour removed, so `sends` can't match) / click #secret# / alice sends the same text | `C/views/chat/item/TextItemView.kt` | `markdown_received_rendersBoldItalicCodeStrikeSecretColor`, `markdown_secret_clickReveals`, `markdown_sent_peerSeesTextWithoutMarkers` | The item's semantics `Text` is an `AnnotatedString` whose span styles mark bold, italic, code, strike, secret and colour; the secret span changes on click; bob's own sent line is ``@alice bold it st red `code` #sec#`` (read with `expectsMessage`), and for alice's message the CLI shows ``alice> bold it st red `code` #sec#`` (bold, italic, strike and colour markers removed, code and secret kept: `src/Simplex/Chat/View.hs:2362, 2461-2462`, `Styled.hs:38-47`) | P | Styles are asserted on the annotated string, not on pixels |
+| Emoji | Large emoji for short emoji-only text | Receive "👍" | CIV:575 | `emojiOnly_rendersLargeEmoji` | Rendered without a bubble | P | |
+| Links | Open-link alert | Click a URL | `C/views/chat/item/TextItemView.kt:371, 533-574` | `link_click_showsOpenWebLinkAlert`, `link_openClean_opensSanitizedUri` | "Open web link?". For a plain URL (`http://127.0.0.1/page`) the alert has "Open"; for a URL with a tracking parameter (`http://127.0.0.1/page?utm_source=test`) it has "Open full link" / "Open clean link" / "Cancel", and "Open clean link" makes the `LocalUriHandler` stub record the URL without `utm_source` | P, URI | The link span is clicked at its bounds, computed from the text node's `GetTextLayoutResult` semantics action (no app change) |
+| Previews | First-time alert with "Enable", fetch, cancel | Type `http://127.0.0.1:<port>/page` | CMP:459-524, 1854 | `linkPreview_firstTimeAlert_enable_fetchesPreview`, `linkPreview_sent_peerReceivesLinkContent`, `linkPreview_cancel_sendsPlainText` | `linkPreview_firstTimeAlert_enable_fetchesPreview`: "Enable link previews?" with "Disable" / "Enable"; "Enable" fetches the page and the compose area shows the preview with the page's `og:title` and the URL (CMP:479-483, `C/views/helpers/LinkPreviews.kt:168-180`). `bob <# "alice> http://127.0.0.1:<port>/page"`; bob's `/_get content types @<alice's contact id>` (plan §8.1 `contactId`; only the API form exists, `Library/Commands.hs:6108`) prints `Chat content types: link` in `linkPreview_sent_peerReceivesLinkContent` (format from `testLinkContentFilter`); in `linkPreview_cancel_sendsPlainText` the cancelled preview sends plain text, so it prints `Chat content types: text` | P, HTTP | The local HTTP server serves Open Graph tags. `localhost` URLs don't parse as links, so the address is `127.0.0.1`. `privacyLinkPreviewsShowAlert` is pre-set except in `linkPreview_firstTimeAlert_enable_fetchesPreview`. Turning the "Send link previews" setting off is owned by catalogue 04 (`00-legend.md`) |
+| Previews | First-time alert with "Disable"; received card | Type `http://127.0.0.1/page` → "Disable"; bob sends a link message that carries its preview | CMP:478-487, `C/views/chat/item/FramedItemView.kt:396`, `C/views/helpers/LinkPreviews.kt:196` | `linkPreview_firstTimeAlert_disable_noPreview`, `linkPreview_received_rendersCard` | Disable: no preview card is fetched or shown (CMP:483-485). Received: bob sends an `MCLink` with a `preview` via `/_send @<alice's contact id> json [{"msgContent": {"type": "link", "text": "http://127.0.0.1/page", "preview": {…}}}]` (as in `testLinkContentFilter`); the GUI renders the card: the "link preview image" image, the preview's title and description, and the URL (`LinkPreviews.kt:194-218`) | P | The CLI doesn't fetch previews, so no HTTP server is needed. `privacyLinkPreviewsShowAlert` is pre-set except in `linkPreview_firstTimeAlert_disable_noPreview` |
+| Previews | SimpleX links get no preview | Type a SimpleX link | CMP:435-445 | `linkPreview_simplexLink_noPreview` | No preview card is fetched or shown, checked after `wait(2 s)` (a web link starts its preview only after a 1500 ms debounce, CMP:471-474, 503-513) | P | |
+| Mentions | "@" picker, filter, received mention, edit adds a mention | Type "@b" in a group, pick a member | CV:1043, MEN:37-160 | `mention_picker_select_insertsAndSends`, `mention_picker_filtersByName`, `mention_received_ofMe_highlighted`, `mention_editAddsMention` | `mention_picker_select_insertsAndSends`: picking bob puts "@bob " in the compose field; after sending, `bob <# "#team alice!> hello @bob"`, `cath <# "#team alice> hello @bob"` (`testMemberMention`); `mention_picker_filtersByName`: "@b" lists bob but not cath (members whose name contains the typed text, MEN:83); `mention_received_ofMe_highlighted`: after bob sends `#team hello @alice`, alice's item shows "@alice" in the primary colour, while a mention of another member keeps the text colour (`C/views/chat/item/TextItemView.kt:259-260`); `mention_editAddsMention`: alice edits her "hello" into "hello @bob" with the picker; edited lines never carry the `!` marker (`ttyFromGroupEdited`, `src/Simplex/Chat/View.hs:3103-3104`): `bob <# "#team alice> [edited] hello @bob"`, `cath <# "#team alice> [edited] hello @bob"` (as cath's edit in `testMemberMention`, H/Groups.hs:7990-8000) | P ×2 | This catalogue owns composing mentions (`00-legend.md`) |
+| Mentions | Mention limit | Mention bob, cath and dan, then type "@" | MEN:213, 231, 265-280 | `mention_maxReached_showsLimit` | Limit message (GUI only) "You can mention up to 3 members per message!" (`max_group_mentions_per_message_reached` formatted with 3, MEN:274); every picker row except the mention under the cursor is disabled (MEN:230-231) | P ×3 | Limit is 3 (CMP:58); the box appears only once three distinct members are mentioned (MEN:213), so the group needs three peers |
+| Commands | Bot command menu | Click the "//" button or type "/" | CMP:1283-1296 ("//" at CMP:1293), CMD:36-244, CV:1051 | `commandsMenu_slash_showsBotCommands`, `commandsMenu_selectCommand_sendsToBot`, `commandsMenu_commandWithParams_insertsKeyword`, `commandsMenu_submenu_navigateBack`, `commandsMenu_filterByPrefix` | `commandsMenu_slash_showsBotCommands`: "//" or "/" opens the menu with "Help" `/help`, "Order" `/order` and the submenu row "More" (CMD:80-81,146-160); `commandsMenu_selectCommand_sendsToBot`: clicking "Help" sends at once and clears the compose field: `bob <# "alice> /help"` (CMD:157-160); `commandsMenu_commandWithParams_insertsKeyword`: clicking "Order" puts "/order <number>" in the compose field without sending; bob prints nothing (CMD:154-156); `commandsMenu_submenu_navigateBack`: "More" shows "Status" `/status` under a back row labelled "More"; clicking the back row shows the top list again (CMD:112-122,188-191); `commandsMenu_filterByPrefix`: typing "/or" lists only "Order", and "/st" lists "Status" from the submenu (keyword starts with the typed text, submenus included, CMD:48-61,82-83) | P | Here the peer bob acts as a bot: before alice connects it sets `peerType: bot` and `preferences.commands` through `/_profile`. No Haskell test covers this; command JSON is in `src/Simplex/Chat/Types/Preferences.hs:420`. Its commands: `help` ("Help"), `order` ("Order", params `<number>`) and the menu "More" with `status` ("Status") |
+| Compose | Clear-text (x) button | Type four or more lines, click (x) | SMV:315, PTF:204 | `compose_clearTextButton_clears` | The (x) appears only for text of four or more lines; after the click the field is empty | P | The icon gets a key in K2 |
+
+### C. Live messages (10 tests)
+While a live message is open, `SendMsgView.kt:534-544` runs a loop of finite animations, and the 3 s update loop (SMV:545-550, `delay(3000)` on a composition scope) sends the updates. The harness runs every test with a manual clock that its poll loop keeps in step with real time (plan §6), so the animation loop can't block a lookup and the update loop runs at its real pace.
+
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Live | Start from the send-button menu | Right-click send → "Send live message" → alert "Live message!" → "Send" | SMV:180-200, 523-572 | `liveMessage_menuStart_alertConfirm_peerSeesStarted`, `liveMessage_typingUpdates_peerSeesUpdates`, `liveMessage_finish_peerSeesEnded` | `bob <# "alice> [LIVE started] use /show [on/off/<bob's item id>] hello"`, then `bob <# "alice> [LIVE ended] hello there"` (`testDirectLiveMessage`). For the typing-updates test bob first runs `/show on` (prints `ok`) and then prints `alice> [LIVE] hello …` for each 3-s update; without `/show on` the CLI prints nothing between started and ended (View.hs:869) | P | Updates go out every 3 s |
+| Live | Bolt button with empty text | Click the bolt, confirm "Live message!" with "Send", then type "hi" | SMV:156-166, CMP:1153-1160 | `liveMessage_boltButton_emptyStart` | Nothing is sent until text is typed; then `bob <# "alice> [LIVE started] use /show [on/off/<bob's item id>] hi"` (the real line has the item id, View.hs:2378) | P | The bolt gets its own key in K2; `liveMessageAlertShown` is not pre-set, so the first click shows the "Live message!" alert (SMV:560-571) |
+| Live | Cancel an empty live message | Click "Cancel live message" | SMV:170-174 | `liveMessage_cancelEmpty_nothingSent` | Nothing reaches the CLI | P | |
+| Live | Alert shown once only | Start twice with the bolt (empty field, SMV:162) | SMV:561-571 | `liveMessage_alertShownOnce` | First start shows "Live message!"; its "Send" starts the live message (and sets `liveMessageAlertShown`); after it ends, the second start shows no alert | P | |
+| Live | Group live message | Same, in a group | CMP:1150 | `liveMessage_group_membersSeeLive` | `bob <# "#team alice> [LIVE started] use /show [on/off/<bob's item id>] hello"`, `cath <# "#team alice> [LIVE started] use /show [on/off/<cath's item id>] hello"` (View.hs:2378) … `bob <# "#team alice> [LIVE ended] hello there"`, `cath <# "#team alice> [LIVE ended] hello there"` (`testGroupLiveMessage`) | P ×2 | |
+| Live | Chat switch commits the message to the original chat | Switch chat mid-message | CMP:1381-1395 | `liveMessage_chatSwitch_sendsToOriginalChat` | The original CLI peer gets `[LIVE ended]` | P | |
+| Live | History in Info, received badge | bob `types` `/live @alice hello` (plan §8.1; no echo); alice sees the received message with the "LIVE" label; then bob `types` ` there`, whose Enter ends the live message as "hello there" (Terminal/Input.hs:101-110,186-196); alice opens its Info | `C/views/chat/item/FramedItemView.kt:287-288` | `liveMessage_info_historyHasVersions`, `liveMessage_received_showsLiveBadge` | History has at least 2 versions: the oldest "hello", the newest "hello there"; "LIVE" label on the received message | P | No live option in notes is covered by §V `notes_menu_noReplyLiveTimed` |
+
+### D. Timed / disappearing messages (6 tests)
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Timed | Send with a 30-second timer; both sides delete | Right-click send → "Disappearing message" → "30 seconds" (under the menu header "Send disappearing message") | SMV:201-211, 272-312 | `timed_send30s_bothSidesDelete` | `bob <# "alice> hello!"` (`testDirectTimedMessage`); after 30 s the GUI item is gone, and bob's `/tail @alice 1` no longer shows it | P, SLOW | Waits at least 30 s for the deletion. bob is started with `--mark-read`: a received timed item starts its timer only when read (`src/Simplex/Chat/Library/Commands.hs:1307-1310`). The real CLI prints no deletion line (`timed message deleted: …` is test-view only, `src/Simplex/Chat/View.hs:937`) |
+| Timed | Timer options; custom time | Right-click send → "Disappearing message" | SMV:201-211, 272-312 | `timed_menuOptions_listed`, `timed_customTime_sendsWithChosenTtl` | Menu header "Send disappearing message" (SMV:278-283); options "30 seconds", "1 minute", "5 minutes", "Custom time" → "Delete after" → "Send"; the item is sent with the chosen TTL (item meta, plan §4) | P | No wait for deletion: the custom time is at least 1 minute (the picker's default is 5 minutes, SMV:298), so the item is still there at the end-of-test screenshot |
+| Timed | Menu hidden when the feature is off | bob runs `/set disappear @alice no` (prints `you updated preferences for alice:` / `Disappearing messages: off (you allow: no, contact allows: yes)`, `H/Profiles.hs:3563-3565`; both sides default to allowing it, `src/Simplex/Chat/Types/Preferences.hs:556`); once alice's "Contact preferences" (chat info) show "Contact allows" "no" for "Disappearing messages" (the CLI prints before the change reaches alice: `updateContactPrefs` only queues `XInfo`, `Library/Commands.hs:4114-4127`, applied on receipt, `Library/Subscriber.hs:2793-2796`), alice right-clicks send | SMV:201 | `timed_menuHidden_whenFeatureOff` | No "Disappearing message" item | P | |
+| Timed | Chat-level timer | CLI `/set disappear @alice yes 3` (`Library/Commands.hs:6404`, a decimal TTL is accepted, :6627-6641); then alice sends `hi` and bob sends `@alice hey` (`H/Profiles.hs:3553`), alice only once the feature row shows "3 sec" (Notes) | `C/views/chat/item/CIMetaView.kt:86-91` | `timed_chatPref_receivedMessagesDisappear`, `timed_meta_showsTimerAndTtl` | The new feature item joins the connection's merged feature row (`C/model/ChatModel.kt:3453-3461`, as 02:260-261 describe), which shows "3 sec" beside the timer icon (`C/views/chat/item/CIChatFeatureView.kt:103-114`); after right-click → "Expand" the item reads "Disappearing messages: 3 sec" (`C/model/ChatModel.kt:4329-4331`); the received item disappears after 3 s once read; after 3 s bob's `/tail @alice 2` no longer lists `hi` or `hey` (`testEnableTimedMessagesContact`; the real CLI prints no deletion line, `src/Simplex/Chat/View.hs:937`). The item meta shows the timer icon and no TTL text, because the item TTL equals the chat TTL (CIMetaView.kt:89); the TTL (3) is asserted through `ItemMetaKey.timedTtl` (plan §4) | P | bob runs with `--mark-read` (plan §8.1 `PeerFlags`), so his received `hi` starts its timer. alice sends `hi` only after the merged row shows "3 sec": her core copies bob's TTL on receipt (`Library/Subscriber.hs:2788-2792, 2806-2815`) and the CLI prints before delivery, so an earlier `hi` would carry no TTL. `timed_meta_showsTimerAndTtl` ends after both items are gone, so the end-of-test screenshot doesn't race their deletion |
+
+### E. Voice messages (11 tests)
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Record | Hold to record and send | "Record voice message" button | SMV:325-372, CMP:1365-1379, 1121 | `voice_record_send_peerReceivesVoice` | `bob <# "alice> voice message (00:05)"`, `bob <# "alice> sends file voice_….m4a (…)"` (format from `H/Profiles.hs:3317-3321`) | P, XFTP, REC | The real recorder uses VLC `pulse://` (RAP:25-60); the recorder seam replaces it |
+| Record | Tap then stop, too short, cancel (nothing is sent) | "Record voice message" button | SMV:325-372, CMP:1365-1379, 1121 | `voice_tapToRecord_stopButton_addsPreview`, `voice_tooShort_discarded`, `voice_preview_cancel_deletesTmpFile` | — (GUI only: preview added, recording discarded, temp file deleted) | REC | As above; no peer is needed |
+| Prefs | Contact prohibits voice | Click the greyed microphone | SMV:142-149, 585 | `voice_prohibitedByContact_showsAlert` | "Voice messages prohibited!" / "Please ask your contact to enable sending voice messages." | P | bob runs `/set voice @alice no`; alice clicks the microphone once her "Contact preferences" show "Contact allows" "no" for "Voice messages" (the CLI prints before the change reaches alice: `updateContactPrefs` only queues `XInfo`, `Library/Commands.hs:4114-4127`, applied on receipt, `Library/Subscriber.hs:2793-2796`) |
+| Prefs | Need to allow voice | Microphone → "Allow voice messages?" → "Allow" | SMV:575, CMP:1097 | `voice_needToAllow_allowUpdatesPrefs` | `bob <## "alice updated preferences for you:"` / "Voice messages: enabled…" | P | Setup: alice's voice preference for bob is "no" (set before the test through `/_set prefs @<bobId> {"voice":{"allow":"no"}}` on the GUI core) and bob runs `/set voice @alice yes`; then the microphone is greyed and shows the alert (CMP:1359-1363) |
+| Prefs | Voice disabled mid-recording | Recording when the preference changes | CMP:1353 | `voice_disabledWhileRecording_cancels` | Recording preview cancelled | P, REC | |
+| Receive | Auto-downloaded voice | bob sends voice JSON (`H/Profiles.hs:3300`, with `"filePath": "tests/fixtures/test.txt"`, since the peer resolves paths against the repo root) | `C/views/chat/item/CIVoiceView.kt` | `voice_received_autoDownloaded_showsDuration` | Duration "00:10" (from the message content) | P, XFTP | Auto-download limit at `C/views/helpers/Utils.kt:119-120` |
+| Receive | Voice playback | Click play on a received voice message | `C/views/chat/item/CIVoiceView.kt` | `voice_playback_playPauseProgress` | Play/pause state and progress change | P, XFTP, AV | the test ends after playback finishes, waiting for `audioPlaying == false` and progress 0 (`resetOnEnd = true`, CIVoiceView.kt:66; the `AV` fake reports the end of a track the way VLC does, plan §11.2), since the position is polled on the real clock (RecAndPlay.desktop.kt:129-142) and the slider is not masked |
+| Record | Play the recorded preview before sending | In notes: "Record voice message" (tap), stop → preview; play, pause, drag the slider | CMP:1212-1218, `C/views/chat/ComposeVoiceView.kt:53-84, 106-134` | `voice_preview_playPauseAndSeek` | While recording the play button is disabled and the duration counts up (`RecordingInProgressSlider`); after stop the button is enabled and shows the total duration; play → pause icon and the text follows playback progress; pause keeps the position; dragging the slider seeks (`AudioPlayer.seekTo`); the item is not sent | REC, AV | The play button's content description is "File" (`icon_descr_file`, ComposeVoiceView.kt:65): K2 key needed. Notes chat avoids a peer (as `voice_notes_recordAndSave`) |
+| Notes | Voice in notes | Record in notes | CMP:578 | `voice_notes_recordAndSave` | Item saved | REC | |
+
+### F. Attachments – sending (21 tests, 1 ignored)
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Attach | Attachment sheet | "Attach" → "Image" / "Video" / "File" | CMP:1299-1332, ATT:13-26, CMPD:15-38 | `attach_sheet_showsImageVideoFile` | Three buttons | P | |
+| File | Send a file, with text | "File" → dialog | CMP:343, 935 | `attachFile_send_peerReceivesOffer`, `attachFile_withText_peerReceivesTextAndFile` | `bob <# "alice> sends file test.pdf (266.0 KiB / 272376 bytes)"`, `bob <## "use /fr 1 … to receive it"` (the elided part is `[<dir>/` or-bar `<path>]`) (`testXFTPFileTransfer`); `bob <# "alice> hi, sending a file"` (`runTestMessageWithFile`) | P, S, XFTP, FD | |
+| File | Cancel the file preview | "File" → dialog → (x) | CMP:343 | `attachFile_cancelPreview_nothingSent` | The preview is removed; nothing reaches the CLI | P, FD | |
+| Image | Compressed image, multiple images, caption on last only | "Image" → dialog (multi-select) | CMP:360-414, 877-899 | `attachImage_send_peerReceivesCompressedImage`, `attachImages_multiple_sentAsSeparateMessages`, `attachImage_textOnLastImageOnly` | One "sends file …jpg" per image, each ≤255 KiB (`testSendImage`, `testSendMultiFilesDirect`); `attachImage_textOnLastImageOnly`: two images sent with text "caption" — bob prints the first `alice> sends file …` with no text line before it, then `alice> caption` and the second `alice> sends file …` (CMP:894-896; `tests/ChatTests/Files.hs:516-517`) | P, XFTP, FD | |
+| Image | Cancel the image preview | "Image" → dialog → (x) | CMP:360-414 | `attachImage_cancelPreview` | The preview is removed; nothing reaches the CLI | P, FD | |
+| GIF | Animated image sent uncompressed | "Image" → .gif | CMP:372-381 | `attachGif_sentUncompressedAnimated` | CLI file size equals the source size | P, XFTP, FD | The sent GIF keeps playing on the real clock (`images/files.gif` loops forever), so its image node is volatile in screenshots (plan §7.7) |
+| Video | Send video | "Video" → dialog | CMP:388-409 | `attachVideo_send_peerReceivesVideo` | "sends file video_….mp4" | P, XFTP, FD, AV | The preview frame comes from the audio/video seam |
+| Video | Undecodable video | "Video" → dialog → the undecodable file | CMP:388-409 | `attachVideo_undecodable_showsAlert` | The alert "Decoding error" / "The video cannot be decoded. Please, try a different video or contact developers." and no preview; the video is dropped (CMP:399-408), so nothing reaches the CLI | P, FD, AV | The missing preview frame comes from the audio/video seam |
+| Paste | Typed file path | Type the path of an existing file | PTF:97-110, 222-236 | `paste_filePathText_attachesFile` | File preview appears (any inserted text of two or more characters whose every line names an existing non-directory file — absolute, or relative to the JVM working directory, optionally in double quotes — is attached; a `file:///` URI string is not) | P | |
+| Paste | Ctrl+V file list | Put absolute file paths on the in-memory clipboard, press Ctrl+V | PTF:141-145 | `ctrlV_clipboardFiles_attaches` | The compose area shows the file preview, absent before Ctrl+V: icon "File", the file's name (e.g. "test.pdf") and "Cancel file preview" (`C/views/chat/ComposeFileView.kt:30,36,41`; the file list is read from the Compose clipboard) | P, CB | |
+| Paste | Ctrl+V of an audio-only .webm | Put the absolute path of the audio-only .webm on the in-memory clipboard, press Ctrl+V, send; then the same with the .webm that has a video track | PTF:144-145, CMP:1516, CMP:290-314 | `pasteFileList_webmAudio_sentAsFile` | The .webm without video goes as a file (`bob <# "alice> sends file …webm (…)"`); a second .webm with a video track is sent as a video | P, XFTP, CB, AV | `hasVideoTrack` (`D/platform/VideoPlayer.desktop.kt:269`, a libvlc parse) must be part of the audio/video seam (plan §11.2), which reports "no video track" for this file |
+| Paste | Ctrl+V image | Ctrl+V with an image on the clipboard | PTF:146-150 | `ctrlV_clipboardImage_attachesPng` | The compose area shows the image preview with "Cancel image preview" (`C/views/chat/ComposeImageView.kt:67`), absent before Ctrl+V | P, IMGCB | When the clipboard text isn't a file list, Ctrl+V reads an image from the AWT system clipboard (PTF:150); the clipboard seam (plan §11.2) replaces it |
+| Drag & drop | Drop files | Drop on the chat | CV:980-988, CMP:290-314 | `dragDrop_files_attach` | The file preview with the file's name and "Cancel file preview" appears (`C/views/chat/ComposeFileView.kt:36,41`) | IGNORE: OS drag and drop onto the window | The drop target (`desktopOnExternalDrag`) needs an AWT drop event, and the compose state it feeds is local to `ChatView` (CV:148). The attach path behind it is covered through Ctrl+V of a file list (`ctrlV_clipboardFiles_attaches`, `pasteFileList_webmAudio_sentAsFile`) |
+| Limits | Large file | Pick a file over 1 GB | CMP:327-341 | `attachFile_tooLarge_showsLargeFileAlert` | "Large file!" | P, FD (sparse file over 1 GB) | The badge upsell button isn't asserted (badge display excluded) |
+| Limits | Group files off; attach disabled while editing | Attach in a group with files off; attach while editing | CMP:1304-1318 | `attach_groupFilesProhibited_buttonDisabled`, `attach_disabled_whileEditing` | `attach_groupFilesProhibited_buttonDisabled`: in a group with files off the attach button is disabled (grey, not clickable: `attachmentEnabled` excludes `isGroupAndProhibitedFiles`, CMP:1299-1330), so no alert opens (the "Files and media prohibited!" alert at CMP:1304-1310 is not reachable from the main chat; `testProhibitFiles` covers the core side); `attach_disabled_whileEditing`: the attach button is disabled while editing | P | |
+| Image | Image with quote | bob sends `@alice hi alice`; alice replies to it with an image captioned `hey bob` (`tests/ChatTests/Files.hs:295-304`) | CMP:877-899, 947-950 | `attachImage_withQuote_peerSeesQuote` | `bob <# "alice> > hi alice"`, `bob <## "      hey bob"`, `bob <# "alice> sends file IMG_….jpg (…)"` (`testSendImageWithTextAndQuote`; the GUI names compressed images `IMG_<timestamp>.jpg`, Utils.kt:184) | P, XFTP, FD | |
+| Image | Group image | Image in a group | CMP:877-899 | `attachImage_group_allMembersReceive` | `bob <# "#team alice> sends file IMG_….jpg (…)"` and `cath <# "#team alice> sends file IMG_….jpg (…)"` (`testGroupSendImage`) | P ×2, XFTP, FD | |
+
+### G. Receiving files: download, cancel, errors, save, viewers (20 tests)
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Image | Auto-receive a small image | bob `/img @alice tests/fixtures/test.jpg` | `C/views/chat/item/CIImageView.kt` | `rcvImage_autoReceived_renders` | `bob <## "completed uploading file 1 (test.jpg) for alice"`; the image is received without a tap and shown | P, XFTP | Auto-receive limit `MAX_IMAGE_SIZE_AUTO_RCV` (`C/views/helpers/Utils.kt:119`), with "Auto-accept images" on (default). Turning the setting off is owned by catalogue 04 |
+| Image | Click to download a large image | bob sends an image over the auto-receive limit with `/_send @<alice's contact id> json [{"filePath": …, "msgContent": {"type": "image", …}}]` (`/img` refuses files over 522240 bytes, Library/Commands.hs:3497-3498) | `C/views/chat/item/CIImageView.kt`, CV:599 | `rcvImage_large_clickDownloads` | The image shows the icon "Asked to receive the image" (file status `rcvInvitation`, `C/views/chat/item/CIImageView.kt:89`); after a click the item's file status (`FileStatusKey`, plan §4) becomes `rcvComplete` and the icon is gone (:92) | P, XFTP | `/f` would send a file message, not an image (Library/Commands.hs:3487-3491). The image is a JPEG over 522240 bytes generated by the harness into the peer's directory (fixture list in the header) |
+| File | Download by clicking the icon or "Download" | Click / menu | `C/views/chat/item/CIFileView.kt:75-84`, CIV:452-463 | `rcvFile_clickIcon_receives`, `rcvFile_menuDownload_receives` | The item's file status (`FileStatusKey`, plan §4) goes from `rcvInvitation` to `rcvComplete` (the icon loses its download arrow, which has no description, `CIFileView.kt:162,172`), and the received file's bytes equal the source's | P, XFTP | |
+| File | Waiting alert | `stop xftp1`; bob `/f @alice tests/fixtures/test.pdf`; alice clicks the file, then clicks it again; `start xftp1` | CIFileView:86-98, 163 | `rcvFile_acceptedBeforeUpload_showsWaitingAlert` | The file item reaches alice although bob's upload can't start; after the first click it shows the waiting icon (`RcvAccepted`, CIFileView:163) and the second click shows "Waiting for file" / "File will be received when your contact completes uploading it."; after `start xftp1`, `bob <## "completed uploading file 1 (test.pdf) for alice"` (View.hs:500) and alice's file completes (explicit 30 s timeout) | P, XFTP, SRVCTL | The server is stopped before bob sends, so the accepted file waits for as long as it is down (measured with CLIs: the invitation arrived after 0.5 s, `RcvAccepted` held for 8 s; after the start the upload completed in 4.8 s and the receive in 5.3 s). bob's chunk-creation retries stay at 2 s for the first 10 s of the outage, then grow ×1.5 (`messageRetryInterval.riFast`, simplexmq `Agent/Env/SQLite.hs:205-219`), so the outage stays under about 10 s (plan §11.1 Server control) |
+| Cancel | Stop receiving, then download again | bob `/f @alice tests/fixtures/test.pdf`; after `bob <## "completed uploading file 1 (test.pdf) for alice"` (View.hs:500), `stop xftp1`; alice clicks the file; "Stop file" → "Stop receiving file?" → "Stop"; `start xftp1`; alice clicks the file again | CIV:483-485, 1378, CIFileView:164-166 | `rcvFile_stopReceiving_thenRedownload` | After the first click the item shows the download at 0 (progress circle, `CIFSRcvTransfer 0 1`, Library/Internal.hs:929-943) and stays there while xftp1 is down; after "Stop" it returns to the not-downloaded state (download icon, `RcvInvitation`, Library/Commands.hs:3559); after the start, the second click receives the file, and the file on disk matches the source (as in `testXFTPCancelRcvRepeat`) | P, XFTP, SRVCTL | The server is stopped after bob's upload and before alice's click, so the download can't finish before "Stop" (measured with CLIs: `progress 0%` held for 8 s, `/fc` → `not accepted yet`, re-download 0.26 s after the start). A refused connection is not a host error, so no warning replaces the progress (simplexmq `Agent/Client.hs:1627-1636`); no request is in flight when the server stops, so no short timeouts are needed |
+| Cancel | Sender revokes (CLI); GUI revokes | bob `/fc 1`; "Revoke file" → "Revoke file?" → "Revoke" (alice attaches the file by typing its path, PTF:97-110) | `C/model/ChatModel.kt:4698-4730` | `rcvFile_senderRevoked_showsCancelled`, `sndFile_revoke_peerSeesCancelled` | `rcvFile_senderRevoked_showsCancelled`: bob runs `/f @alice tests/fixtures/test.pdf`, waits for `completed uploading file 1 (test.pdf) for alice`, then `/fc 1` → `bob <## "cancelled sending file 1 (test.pdf)"` (View.hs:2471); alice's item's file status (`FileStatusKey`, plan §4) becomes `rcvCancelled` (drawn as the cancelled-file icon, which has no description, CIFileView.kt:173). `sndFile_revoke_peerSeesCancelled`: alice revokes → `bob <## "alice cancelled sending file 1 (test.pdf)"` (View.hs:2466; `testXFTPDeleteUploadedFile`) | P, XFTP | |
+| Cancel | GUI stops during upload | "Stop file" → "Stop sending file?" → "Stop" (alice attaches the file by typing its path, PTF:97-110) | CIV:483-485, 1378, `C/model/ChatModel.kt:4709-4716` | `sndFile_stopDuringUpload` | `bob <# "alice> sends file test.pdf (266.0 KiB / 272376 bytes)"`, then after "Stop" `bob <## "alice cancelled sending file 1 (test.pdf)"`; the GUI item's file status (`FileStatusKey`, plan §4) becomes `sndCancelled` (`CIFileView.kt:153`) | P, XFTP, SRVCTL | The XFTP server is stopped before sending, so the upload can't finish first |
+| Errors | Auth error | Click the failed item | CIFileView:100-101, 255-271 | `rcvFile_xftpAuthError_showsFileErrorAlert` | "File error" (`testXFTPRcvError` FileErrAuth) | P, XFTP, SRVCTL | bob runs `/f @alice tests/fixtures/test.pdf`; after `bob <## "completed uploading file 1 (test.pdf) for alice"` (View.hs:500) and before the GUI receives, the XFTP server is restarted without its store (`reset xftp1`). A reset during bob's upload would hang his chunk request (plan §11.1 Server control) and alice's file description would never arrive, so her click would show the waiting alert instead |
+| Errors | Send error | alice first shortens the network timeouts: Settings > "Network & servers" > "Advanced network settings" > "Protocol timeout per KB" → "0.003 sec" (the lowest entry, 2500 µs) → "Save and reconnect" → "Update network settings?" → "Update"; then version row > "Developer tools" > "Chat console": `/network socks=off timeout=1`. She sends the 150 MB file (attached by typing its path, PTF:97-110); at the item's first visible upload progress, `reset xftp1`; she clicks the failed item | CIFileView:104-105, 255-271, `C/views/usersettings/networkAndServers/AdvancedNetworkSettings.kt:133-142, 285-288, 342, 556-563`, `C/views/usersettings/DeveloperView.kt:32` | `sndFile_xftpResetDuringUpload_showsFileError` | "File error" within an explicit 40 s timeout after the reset: the upload gets AUTH, a permanent error, so the agent sends SFERR (SndError) | P, XFTP, SRVCTL | An upload in flight at the reset hangs until its request timeout: TCP connection background timeout + protocol background timeout + 4096 KB × the per-KB timeout (simplexmq `Transport/HTTP2/Client.hs:189-194, 209-210` adds the connection timeout to the chunk timeout, `FileTransfer/Client.hs:209-214, 300-306`); the retry, 2 s later, reaches the restarted server and gets AUTH at once. Measured with CLIs: 75 s with CLI defaults, 118 s with the GUI defaults (`C/model/SimpleXAPI.kt:5256-5258`), 57 s with the lowest values the UI offers (so the console step is needed), 19.9 s with these settings; 0.2–2.3 s when the reset falls between two chunk uploads. `/network socks=off timeout=1` sets the protocol timeouts to 1 s (3 s background) and the TCP connection timeouts to 1.5 s (4.5 s background) and keeps the per-KB value (Library/Commands.hs:396-401, 1904-1907); its host mode (public) changes nothing with no SOCKS proxy and the local servers. Worst case: 4.5 + 3 + 10.24 + 2 ≈ 20 s. The settings are saved before the console command, because saving them sends the GUI's own config (AdvancedNetworkSettings.kt:133-142) and would undo it. The 150 MB file leaves about 3–4 s between the first visible progress (at about +6 s) and the last chunk (upload done at +10 s); the 17 MB file left only about 0.4 s (plan §11.1 Server control) |
+| Errors | Temporary file error | bob sends a file that isn't auto-received; alice turns SOCKS on and "Use .onion hosts" to "Required" (04 §E `socks_onionHostsOptions`), then clicks the file | CIFileView:102-103, 106-107 | `rcvFile_temporaryError_showsTemporaryFileError` | Download fails with BROKER HOST (no onion host: `PCEIncompatibleHost`, simplexmq `Messaging/Client.hs:530-541`, `Agent/Client.hs:1297`; host choice fails before any SOCKS connection, so no stub is needed) and the core sets `CIFSRcvWarning` (`Library/Subscriber.hs:429-433`); clicking the item shows "Temporary file error" | P, XFTP | The same setting reaches `SndWarning` |
+| Errors | Expired file | Click the expired item | CIFileView:257-276 | `rcvFile_expired_showsFileExpired` | "File expired" | P, XFTP, SRVCTL, RESTART, FIXTURE (expired file) | The alert needs an Auth or NoFile receive error first (CIFileView:257): bob runs `/f @alice tests/fixtures/test.pdf`, and the XFTP server is reset after `bob <## "completed uploading file 1 (test.pdf) for alice"` (View.hs:500; a reset during the upload leaves alice without the file description, as in `rcvFile_xftpAuthError_showsFileErrorAlert`), alice's receive then fails, and, between two `restart()` steps, the received file's expiry is moved into the past in the GUI database |
+| Deleted | Sender marks deleted before accept | bob broadcast-deletes | CIV:557-567, 698-700 (`MarkedDeletedItemDropdownMenu`), `C/views/chat/item/MarkedDeletedItemView.kt` | `rcvFile_senderDeletedItem_cannotReceive` | bob sends a text-and-file message (`/_send @<alice's contact id> json [{"filePath": …, "msgContent": {"type": "text", "text": "hi, sending a file"}}]`) and broadcast-deletes it; the GUI item reads "marked deleted" and its menu has no "Download" (`testSenderMarkItemDeleted`) | P, XFTP | |
+| Open | Click completed file | Click | CIFileView:107-121 | `rcvFile_clickCompleted_opensSaveDialog` | Save dialog | P, XFTP, FD | |
+| Open | File missing on disk | Delete the received file on disk, then click the item and open its menu | CIFileView:108-124, `C/model/ChatModel.kt:4610-4614` | `rcvFile_missingOnDisk_clickDoesNothing` | The click opens no dialog and records no toast; the menu has no "Save", "Share", "Copy" or "Forward" | P, XFTP, TOAST, FD | FD only asserts that no save dialog is awaiting; "File not found" appears only when connected to a remote host (CIFileView:111-120; catalogue 04 §K) |
+| Viewer | Full-screen image; click closes it | Click the image; click the full-screen image | `D/views/chat/item/CIImageView.desktop.kt:30`, `C/views/chat/item/ImageFullScreenView.kt:82, 173-177` | `rcvImage_click_opensFullScreen`, `fullScreen_click_closes` | Full-screen view opens; a click closes it (desktop has no gallery paging) | P, XFTP | |
+| Video | Received video preview and download | bob `/_send @<alice's contact id> json [{"filePath": "<mp4>", "msgContent": {"type": "video", "text": "", "image": "<preview data URI>", "duration": <s>}}]` | `C/views/chat/item/CIVideoView.kt`, `C/model/SimpleXAPI.kt:3034` | `rcvVideo_previewAndDownload` | The preview from the message content is shown; an mp4 of 1023 KB or less (`apps/multiplatform/common/src/desktopTest/resources/uitest-fixtures/small.mp4`) is received without a click (`MAX_VIDEO_SIZE_AUTO_RCV`, `C/views/helpers/Utils.kt:121`), a larger one (`website/src/video/connect.mp4`, 1.9 MB) after a click on the download icon | P, XFTP, AV | |
+| Group | Group file | bob `/f #team tests/fixtures/test.pdf`; click the file in #team | `C/views/chat/item/CIFileView.kt:75-84` | `rcvFile_group_receive` | bob prints `bob <## "completed uploading file 1 (test.pdf) for #team"`; after the click the file icon shows complete and the file on disk matches the source (`testXFTPGroupFileTransfer`) | P, XFTP | |
+
+### H. Replies / quotes (7 tests)
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Reply | Reply | Right-click → "Reply" | CIV:407-416, CMP:1260 | `reply_menu_sendQuoted_peerSeesQuote`, `reply_cancelContext` | `reply_menu_sendQuoted_peerSeesQuote`: `bob <# "alice> > hello! how are you?"`, `bob <## "      all good - you?"` (`testDirectMessageQuotedReply`); `reply_cancelContext`: "Cancel" (x) on the reply bar removes the quote and keeps the typed text (`C/views/chat/ContextItemView.kt:148-151`, CMP:1260-1262); the message then arrives without a quote: `bob <# "alice> <text>"` | P, S | |
+| Jump | Jump to quoted message, including one not loaded yet; deleted original | Click the quote | CV:3200-3228, 3139, `C/views/chat/item/FramedItemView.kt:655` | `quote_click_scrollsToQuotedAndHighlights`, `quote_click_unloadedItem_loadsAround`, `quote_click_deleted_showsNoMessageAlert` | Original highlighted; "No message" / "This message was deleted or not received yet." | P | The unloaded case uses a 300-message batch, as in `testDirectMessageDeleteMultipleManyBatches`. For the deleted case alice deletes the original with "Delete for me" (an original that bob deletes for everyone under default prefs is only marked deleted and keeps its id, so the click scrolls to it: the quote's item id is null only when the row is gone, CV:3209-3225, `Store/Messages.hs:2715-2718`) |
+| Group | Group reply | Reply to bob in a group | — | `reply_group_peerSeesMemberQuote` | `bob <# "#team alice!> > bob …"`, `cath <# "#team alice> > bob …"` (`testGroupMessageQuotedReply`) | P ×2 | |
+| Rules | Reply replaces edit | "Edit" an own message, then "Reply" on another | CIV:407-416 | `reply_whileEditing_replacesEdit` | The edit context and the edited text are replaced by an empty compose quoting the chosen item | P | No Reply in notes is covered by §V `notes_menu_noReplyLiveTimed` |
+
+### I. Edit and history (12 tests)
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Edit | Edit | "Edit" → change text → Enter | CIV:464-469, CMP:806 | `edit_menu_updatesPeer`, `edit_unchanged_noUpdate`, `edit_cancel_clearsCompose`, `edit_metaShowsEditedIcon` | `edit_menu_updatesPeer`: `bob <# "alice> [edited] hey 👋"` (`testDirectMessageUpdate`); `edit_unchanged_noUpdate`: submitting an unchanged edit prints nothing on bob and the item's meta stays not edited (core "message didn't change", same test); `edit_cancel_clearsCompose`: "Cancel" (x) on the edit bar empties the compose field (`clearState`, CMP:1263-1265); the item keeps its text and bob prints nothing; `edit_metaShowsEditedIcon`: after the edit the item's meta shows the edit icon (`C/views/chat/item/CIMetaView.kt:83-84`) | P, S | |
+| Keyboard | Up arrow edits last message | Up arrow on empty compose | PTF:138, CMP:1185 | `edit_upArrow_editsLastMessage` | Edit mode with the last own message | P | |
+| Receive | Received edit; edit keeps quote | bob `! @alice <new text>` (edits his last message to alice; `! @alice (<old text>) <new text>` picks an earlier one; `EditMessage`, `Library/Commands.hs:6343`) | — | `edit_received_updatesBubble`, `edit_quotedReply_keepsQuote` | The GUI bubble shows the edited text and the edited state (item meta, plan §4); the quote is kept | P | |
+| Receive | Edit image caption | bob updates the caption of a sent image | — | `edit_imageCaption_updates` | The image item's caption changes from the original "old caption" to "new caption" (the old text is gone) and the item is marked edited (`ItemMetaKey.edited`, plan §4) | P, XFTP | |
+| Edit | Edit the caption of alice's own image or file | alice sends `test.jpg` with the text "hi" ("Image" → dialog), and `test.pdf` with "doc" ("File" → dialog); "Edit" on each → replace the text with "hello" / "new doc" → Enter | CIV:464-469, CMP:123-136, CMP:264-278, CMP:1207-1223, `C/views/chat/ComposeImageView.kt:63-70`, `C/views/chat/ComposeFileView.kt:37-46` | `edit_ownImage_previewWithoutCancel`, `edit_ownFile_previewWithoutCancel` | While editing, the compose area shows the image thumbnail / the file name "test.pdf" with no "Cancel image preview" / "Cancel file preview" button (`cancelEnabled = !editing && !inProgress`, CMP:1210, 1222) and the field holds "hi" / "doc"; after Enter bob prints `bob <# "alice> [edited] hello"` / `bob <# "alice> [edited] new doc"` (`ttyFromContactEdited` + `ttyMsgContent`, `src/Simplex/Chat/View.hs:3066-3067`, :2431-2438); the image/file itself is not re-sent (no new "sends file" line) | P, XFTP, FD | Voice items are not editable (CIV:464), so ComposeVoiceView never appears in edit mode; MCChat items get no preview while editing (CMP:276) |
+| Rules | No Edit on received, own voice or forwarded | — | CIV:464 | `edit_notOffered_forReceivedVoiceForwarded` | The item menu has no "Edit" for a received item, alice's recorded voice message or a forwarded item (the core would refuse a forwarded edit, `testForwardEditProhibited`) | P, XFTP, REC | |
+| Rules | Group edit | "Edit" in a group | CIV:464-469 | `edit_group_membersSeeEdited` | bob and cath print `bob <# "#team alice> [edited] hey 👋"` / `cath <# "#team alice> [edited] hey 👋"` (`testGroupMessageUpdate`) | P ×2 | |
+
+### J. Delete / reveal / blocked (8 tests)
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Delete | Delete own message | "Delete" → "Delete message?" → "Delete for me" / "For everyone" | CIV:869-915, 1390-1424 | `delete_ownForMe_localOnly`, `delete_ownForEveryone_peerSeesMarkedDeleted`, `delete_forEveryone_fullDeletion_peerSeesDeleted` | `delete_ownForMe_localOnly`: "Delete for me" removes the item from alice's chat; bob prints nothing; `delete_ownForEveryone_peerSeesMarkedDeleted`: warning "Message will be marked for deletion…", then "For everyone": `bob <# "alice> [marked deleted] hello"`; `delete_forEveryone_fullDeletion_peerSeesDeleted`: after bob runs `/set delete @alice always` (full deletion of alice's messages needs bob's consent) and alice's "Contact preferences" show "Contact allows" "always" for "Delete for everyone" (the CLI prints before the change reaches alice: `updateContactPrefs` only queues `XInfo`, `Library/Commands.hs:4114-4127`, applied on receipt, `Library/Subscriber.hs:2793-2796`): "Message will be deleted - this cannot be undone!" and `bob <# "alice> [deleted] hey"` (`testAllowFullDeletionContact`) | P, S | |
+| Delete | Delete received; received marked-deleted with Reveal/Hide; received full delete | Menu | CIV:503-519, 950-972, `C/views/chat/item/MarkedDeletedItemView.kt` | `delete_received_onlyForMe`, `markedDeleted_received_revealHide`, `delete_received_fullDelete_removed` | `delete_received_onlyForMe`: "Delete message?" offers only "Delete for me", because received items are never deletable for everyone (CIV:1391-1421; `deletable'`, `src/Simplex/Chat/Messages.hs:542-549`); the item disappears and bob prints nothing; `markedDeleted_received_revealHide`: after bob deletes for everyone the item shows "marked deleted"; the menu offers "Reveal", which shows the text, then "Hide"; `delete_received_fullDelete_removed`: with full deletion allowed, bob's broadcast delete removes the item from the GUI chat (`testAllowFullDeletionContact`) | P | For the full-delete test alice first sets "Delete for everyone" to "always" for bob in contact preferences (setup only; the preferences screen is owned by catalogue 01 §14) |
+| Display | Blocked by admin; consecutive deleted items collapsed | bob (owner) runs `/block for all #team cath` (`Library/Commands.hs:6276`); cath sends one message, bob a normal one, then cath two more; for the collapsed count, after another normal message bob deletes two consecutive messages of his own for everyone (`\ #team <text>` for each, `Library/Commands.hs:6341,2687-2690`) | MarkedDeletedItemView:68-110; `C/model/ChatModel.kt:3453-3455` | `blockedByAdmin_items_showBlocked`, `markedDeleted_consecutive_collapsedCount` | One blocked item reads "blocked by admin", two or more consecutive read "%d messages blocked by admin"; the two deleted items read "2 messages marked deleted" (a run mixing blocked and deleted items would read "%d messages marked deleted": all share one merge category) (`testBlockForAllMarkedBlocked`) | P ×2 | Moderation itself is owned by catalogue 03 §14 (`00-legend.md`) |
+
+### K. Multi-select and selection toolbar (9 tests)
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Select | Enter / toggle / leave selection mode | "Select"; click items; (x) | CIV:936, CV:3342, SEL:24-50 | `select_enterMode_showsCounterToolbar`, `select_toggle_updatesCounter`, `select_close_exitsMode` | `select_enterMode_showsCounterToolbar`: "Select" on an item selects it and the toolbar reads "Selected 1" (CV:1967, SEL:33-36); `select_toggle_updatesCounter`: clicking a second item gives "Selected 2", unselecting both gives "Nothing selected"; `select_close_exitsMode`: after (x) (SEL:30) the counter toolbar is gone and the chat toolbar ("bob") and the compose field are back (CV:298, 1170-1176) | P | Selection circles get keys in K2 |
+| Delete | Delete selection | Trash icon → "Delete %d messages?" | CV:327-347, SEL:95-101 | `selectDelete_forEveryone_peerSeesBoth`, `selectDelete_mixed_onlyForMe` | `selectDelete_forEveryone_peerSeesBoth`: `bob <# "alice> [marked deleted] hello"` and `… hey` (`testDirectMessageDeleteMultiple`); `selectDelete_mixed_onlyForMe`: with one of alice's and one of bob's messages selected, "Delete 2 messages?" warns "Messages will be deleted - this cannot be undone!" and offers only "Delete for me" (SEL:157; CV:330-339; CIV:1437-1448); both items disappear and bob prints nothing | P | |
+| Forward | Forward selection | Forward icon | CV:361-384 | `selectForward_multiple_peerReceives` | `testForwardContactToContactMulti` | P ×2 | |
+| Rules | Count limits; merged events; item deleted while selected | 300 messages; collapsed events | SEL:144-145, 130-172 | `select_limits_forward20_delete200`, `select_mergedEvents_selectsWholeRange`, `select_itemDeletedByPeer_recheck` | `select_limits_forward20_delete200`: forward disabled above 20, delete above 200; `select_mergedEvents_selectsWholeRange`: "Select" on a collapsed events row selects every event in it: the toolbar reads "Selected N" for the N collapsed events (`selectUnselectChatItem`, CV:3342-3372; SEL:36); `select_itemDeletedByPeer_recheck`: when bob deletes a selected message of his for everyone, it stays selected but the forward button becomes disabled (marked-deleted items can't be forwarded, SEL:161; recheck on item change, SEL:125-127) | P | Moderating a selection is owned by catalogue 03 §14 |
+
+### L. Forwarding (17 tests)
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Forward | Forward to a contact, with a comment | "Forward" → "Forward message…" list → pick cath → send | CV:638, ShareListView.kt:151, CMP:727-755 | `forward_contactToContact_peerSeesForwarded`, `forward_withComment_sendsCommentQuoted`, `forward_cancelContext` | `forward_contactToContact_peerSeesForwarded`: `cath <# "alice> -> forwarded"`, `cath <## "      hi"` (`testForwardContactToContact`); `forward_withComment_sendsCommentQuoted`: with a comment, cath then prints `cath <# "alice> >> hi"`, `cath <## "      <comment>"` (the comment quotes the last forwarded item, CMP:843-848); `forward_cancelContext`: "Cancel" (x) on the forwarding bar removes it (CMP:1266-1268); nothing is forwarded and cath prints nothing | P ×2 | |
+| Destinations | Contact→group, group→contact, group→group | Same | — | `forward_contactToGroup`, `forward_groupToContact`, `forward_groupToGroup` | `forward_contactToGroup`: `cath <# "#team alice> -> forwarded"`, `cath <## "      hi"` (`testForwardContactToGroup`, H/Forward.hs:205-227); `forward_groupToContact`: `cath <# "alice> -> forwarded"`, `cath <## "      hi"` (`testForwardGroupToContact`, :249-271); `forward_groupToGroup`: `cath <# "#club alice> -> forwarded"`, `cath <## "      hi"` (`testForwardGroupToGroup`, :273-299) | P ×2 | |
+| Destinations | To notes, notes→contact | Same | `C/views/chat/item/FramedItemView.kt:316-343` | `forward_toNotes_showsSavedFrom`, `forward_fromNotes_toContact` | To notes: the item shows a two-row header, "saved from" over "bob" (`testForwardContactToNotes`); from notes to cath: cath prints a plain `cath <# "alice> hi"` with no "-> forwarded" line (`testForwardNotesToContact`) | P | |
+| Source | Go to source; received forwarded header | Hover → arrow button; receive a forwarded message | CIV:284-302, `C/views/chat/item/FramedItemView.kt:345` | `forwarded_goToSource_opensOriginalChat`, `forwarded_received_showsHeader` | The arrow opens the chat with bob at the original item; the received item's header reads "forwarded" (`cath <# "alice> -> forwarded"` in `testForwardContactToContact`) | P ×2 | The arrow button gets a key in K2 |
+| Files | Forward a file | Forward a downloaded file | — | `forward_file_peerReceivesFile` | `testForwardFileContactToContact` | P ×2, XFTP | |
+| Plan | Undownloaded files; nothing to forward; Download button | Forward a selection with files not downloaded | CV:3695-3753, 3002 | `forwardPlan_filesNotAccepted_alertOptions`, `forwardPlan_nothingToForward`, `forwardPlan_downloadButton_receivesFiles` | "Forward %1$s message(s)?", "%1$d file(s) were not downloaded.", "Forward messages without files?", buttons "Forward" / "Download" / "Cancel"; "Nothing to forward!"; `forwardPlan_downloadButton_receivesFiles`: after "Download" no destination list opens and nothing is forwarded; the command log has `/freceive <fileId> …` for each file (CV:3014-3022; `C/model/SimpleXAPI.kt:2228-2241,4303`), and each file item's status (`FileStatusKey`, plan §4) becomes `rcvComplete` | P, XFTP | |
+| Rules | No Forward for deleted/live; items deleted after selection | — | CIV:470-478, CMP:747-752 | `forward_notOffered_forDeletedOrLive`, `forward_itemsDeletedAfterSelection_alert` | `forward_notOffered_forDeletedOrLive`: the menu of a marked-deleted item has no "Forward", and neither has any item's menu while alice's live message is in progress (CIV:124, 470-473); `forward_itemsDeletedAfterSelection_alert`: "%1$s messages not forwarded" | P | In the second test alice selects bob's messages, including his last one, clicks Forward and picks the destination; only then does bob delete them (a selected item that is already marked deleted turns the toolbar's Forward off, `C/views/chat/SelectableChatItemToolbars.kt:113,161,170`). alice sends once bob's chat-list row shows the marked-deleted preview (`C/views/chatlist/ChatPreviewView.kt:253`): the alert comes only when the core returns fewer items than were selected (CMP:747-752), i.e. after alice has processed bob's deletions |
+| Rules | Destination whose preferences prohibit the content | bob hosts group `team` with alice and runs `/set files #team off`; bob `/img @alice tests/fixtures/test.jpg`; alice waits until the image is received (auto-accepted; "Forward" is offered only for a loaded file, CIV:471, `C/model/ChatModel.kt:4610-4614`), then "Forward" on the image → pick "team" | `C/views/chatlist/ShareListView.kt:30-56`; `C/views/chatlist/ShareListNavLinkView.kt:43-58, 70-75` | `forward_destinationProhibitsContent_alert` | "team" is listed but disabled-looking; clicking it shows "Cannot send message" / "Selected chat preferences prohibit this message." (strings.xml:573-574); the group chat doesn't open and no forwarding bar appears; bob prints nothing in `#team` | P, XFTP | After bob's `/set files #team off` (CLI `Files and media: off`, `testProhibitFiles`, tests/ChatTests/Files.hs:1248-1259) alice's group gets a "Files and media: off" feature item; wait for it before forwarding. The same alert covers voice to a contact that prohibits voice and SimpleX links (also "Share via chat" of an address or channel link, which always counts as a SimpleX link, ShareListView.kt:54-56) to a group with "SimpleX links" off |
+
+### M. Reactions (8 tests)
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Add/remove | Add from menu; click own chip to remove; click someone else's chip to add | Menu emoji row (👍 👎 😀 😂 😢 ❤ 🚀 ✅) | CIV:351-374, 194-200, CV:693 | `reaction_add_peerSeesAdded`, `reaction_chipClick_removes`, `reaction_chipClickOthers_adds`, `reaction_row_hidesAlreadyAdded` | `reaction_add_peerSeesAdded`: 👍 from the menu on bob's own "hi": `bob <# "alice> >> hi"` (the real CLI marks the peer's own message with `>>`, measured), `bob <## "    + 👍"` (`testSetMessageReactions`); `reaction_chipClick_removes`: clicking alice's own 👍 chip removes it: `bob <# "alice> > hi"`, `bob <## "    - 👍"`; `reaction_chipClickOthers_adds`: after bob reacts with `+1 alice hi`, clicking his "👍" chip adds alice's reaction: the chip shows "2" (CIV:194-200,227-234) and bob prints `bob <# "alice> > hi"`, `bob <## "    + 👍"` (H/Direct.hs:3336-3355); `reaction_row_hidesAlreadyAdded`: once alice has added 👍, the menu's emoji row no longer offers 👍 (CIV:351-358) | P, S | bob is started with `--reactions` (v7.0.3 has the same switch); without it he prints nothing (`src/Simplex/Chat/View.hs:985-987`) |
+| Receive | Received reaction count | alice reacts 👍 to her "hi", then bob `+1 alice hi` | CIV:228-236 | `reaction_received_chipCount` | Chip shows 👍 with count 2 after both react | P | |
+| Who reacted | Chip menu: direct names | Right-click the chip | CIV:158-207 | `reaction_chipMenu_direct_showsNames` | Contact name plus "you" | P | |
+| Who reacted | Chip menu: group members, click opens member info | Right-click the chip in a group | CIV:158-207 | `reaction_chipMenu_group_membersAndOpenInfo` | After bob and cath react 👍 to alice's message in #team, the menu lists "bob" and "cath" (CIV:168-169; `testSetGroupMessageReactions`); clicking "cath" opens cath's member info, where alice, the owner, sees "Change role" with "member" (`C/views/chat/group/GroupMemberInfoView.kt:607-611`) | P ×2 | |
+| Prefs | Reactions disabled in a direct chat | bob disallows reactions (`/_set prefs @<alice's contact id> {"reactions":{"allow":"no"}}`) | CIV:404 | `reaction_disabled_noMenuRow` | Once alice's "Contact preferences" show "Contact allows" "no" for "Message reactions" (the CLI prints before the change reaches alice: `updateContactPrefs` only queues `XInfo`, `Library/Commands.hs:4114-4127`, applied on receipt, `Library/Subscriber.hs:2793-2796`), the item menu in the chat with bob has no emoji row | P | Direct chat (contact preference); group reactions off is owned by catalogue 03 §5 |
+
+### N. Copy / Share / Save / text selection (9 tests)
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Copy | Copy text | "Copy" | CIV:444-449, CIVD (copyItemToClipboard) | `copy_text_toClipboardAndToast` | Clipboard content; toast "Copied to clipboard" | P, CB, TOAST | |
+| Copy | Copy a file item (copies its path) | "Copy" | CIVD (copyItemToClipboard) | `copy_fileItem_copiesPath` | Clipboard has the file path; toast "Copied to clipboard" | P, XFTP, CB, TOAST | |
+| Share | Share text | "Share" | CIV:425-443, SHR:20-23 | `share_text_copiesToClipboard` | Clipboard has the text | P, CB | |
+| Share | Share a file | "Share" | CIV:425-443, SHR:24-42 | `share_file_savesViaDialog` | Save dialog; toast "File saved" | P, XFTP, FD, TOAST | |
+| Save | Save image; save encrypted file | "Save" | CIVD (SaveContentItemAction) | `save_image_writesFile`, `save_encryptedFile_decrypts` | Bytes equal the source | P, XFTP, FD | |
+| Rules | Copy/Share hidden without content | — | CIV:419-423 | `copyShare_hidden_whenNoContent` | The menu of a received file with no text that isn't downloaded has no "Copy" and no "Share"; after download both appear | P, XFTP | |
+| Selection | Drag-select across messages, then the Copy button or Ctrl+C | Mouse drag | TSEL:354, 528-551 | `textSelection_dragAcrossItems_copyButton`, `textSelection_ctrlC_copies` | Clipboard has the selected text | P, CB | `performMouseInput` drags from inside the first keyed item node's bounds to inside the last one's (positions taken from the nodes, not fixed coordinates) |
+
+### O. Reports, member side (7 tests)
+Here the GUI user **alice** is a plain member who reports; bob (CLI) is the owner, cath (CLI) a moderator and dan (CLI) a plain member whose message is reported. This is `testGroupMemberReports` with the roles rewritten (there alice is the owner, bob the moderator, cath the author and dan the reporter). The moderator side (reports bar, reports view, archive, delete) is owned by catalogue 03 §13 (`00-legend.md`).
+
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Send report | Report a message as a member | "Report" → "Report reason?" → "Spam" → header "Report spam: only group moderators will see it." → check button | CIV:493-495, 999-1042, CMP:1238, 788-804 | `report_member_spam_moderatorsReceive`, `report_reasons_allListed`, `report_sentAlert_dontShowAgain`, `report_cancelReason` | `report_member_spam_moderatorsReceive`: `bob <# "#jokes (support: alice) alice> > dan inappropriate joke"`, `bob <## "      report spam"`, and the same two lines on cath; `report_reasons_allListed`: "Report reason?" lists "Spam", "Inappropriate content", "Community guidelines violation", "Inappropriate profile", "Another reason"; `report_sentAlert_dontShowAgain`: alert "Report sent to moderators" with "Don't show again" (`testGroupMemberReports`); `report_cancelReason`: "Cancel" in "Report reason?" closes it with no report bar in compose (CIV:1031-1035); bob and cath print nothing | P ×3 | |
+| Visibility | Report not shown to other members | alice reports dan's message | CIV:493-495 | `report_notVisibleToOtherMembers` | Owner bob and moderator cath print the report line; dan prints nothing for it (`testGroupMemberReports`, `cath </`) | P ×3 | |
+| Rules | Not offered to moderators / own messages; group preference off | — | CIV:493 | `report_notOffered_forModeratorOrOwn`, `report_groupPrefOff_notOffered` | No "Report" in the menu | P ×3 | For the moderator case bob makes alice a moderator first (`/mr jokes alice moderator`) and alice opens the menu once her chat shows the event "changed your role to moderator"; for the preference case bob runs `/set reports #jokes off` and alice opens the menu once her "Group preferences" show "Member reports" "off" (the CLI prints both when they are queued: `APIMembersRole`, `Library/Commands.hs:2947`, and `sendGroupMessage … XGrpInfo`, :4156; alice applies them on receipt, `Library/Subscriber.hs:1111,1119`) |
+
+### P. Chat item info (15 tests)
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Details | Sent / received details | "Info" | CV:714-757, INFO:254-317 | `info_sent_showsSentAt`, `info_received_showsReceivedAt` | "Sent message", "Sent at", "Received message", "Received at" (CLI equivalent: `/_get item info` in `testDirectMessageEditHistory`) | P | |
+| Details | Developer rows | "Info" with developer tools on | INFO:254-317 | `info_devTools_showsDbIdAndStatuses` | "Database ID", "Message status", "File status" | P, XFTP, DT | The item is a received file (bob `/f`), so "File status" is shown (INFO:301-303) |
+| History | Edit history | "Info" (history is shown directly; "History" is a tab only when there are two or more tabs) | INFO:319-342 | `info_history_listsVersions` | The history lists every version, newest first, the newest marked "(current)" (`item_info_current`, ChatItemInfoView.kt:103-108; `current_version_timestamp` is only in the shared text, :633-634); an unedited message shows one version (Library/Commands.hs:733) | P | |
+| History | Copy a history version | Right-click a version | INFO:319-342 | `info_historyBubble_copy` | Clipboard has the version text | P, CB | |
+| Delivery | Group delivery statuses | "Delivery" tab | INFO:374-445 | `info_delivery_groupMemberStatuses` | The "Delivery" tab lists bob and cath with their status icons (`testSendGroupDeliveryReceipts`) | P ×2 | An empty status list is `Nothing` (Library/Commands.hs:735), and then there is no "Delivery" tab at all (INFO:505-507), so "No delivery information" can't appear |
+| Delivery | Live update on receipts | cath is stopped; alice sends "hi" in #team; once its status is delivered-partial (bob's receipt), she right-clicks it > "Info" > "Delivery"; then cath is started | INFO:374-445, CV:739-751 | `info_delivery_liveUpdatesOnReceipt` | The tab shows bob delivered and cath sent; after the start, `cath <# "#team alice> hi"` and cath's status turns delivered without reopening the modal (`testSendGroupDeliveryReceipts`) | P ×2, PEERCTL | The open modal reloads only on `ChatItemsStatusesUpdated` events for the item that arrive while it is open (CV:739-751); with both peers online the receipts arrive within milliseconds, before the modal can open, so cath is stopped before the send to hold her sent state (as `status_group_partialThenComplete`) |
+| Tabs | Quote, forwarded, saved | "In reply to", "Forwarded", "Saved" tabs | INFO:344-372 | `info_quoteTab_showsQuoted`, `info_forwardedTab_showsSource`, `info_notes_savedTab` | Quote tab: heading "In reply to" and the quoted message (INFO:349); forwarded tab: heading "Forwarded from" and the source item; in notes the tab is "Saved", with heading "Saved from" (INFO:365) | P | |
+| Rows | Disappears at, deleted at, moderated at | — | INFO:264-276 | `info_timed_showsDisappearsAt`, `info_deleted_showsDeletedAt`, `info_moderated_showsModeratedAt` | "Disappears at", "Deleted at", "Moderated at" | P | |
+| Misc | Share button | Share button | CV:731-734 | `info_share_copiesText` | Clipboard has the info text | P, CB | |
+| Misc | Closes on chat switch | Open another chat | CV:753 | `info_closesOnChatSwitch` | The info modal closes | P | |
+
+### Q. Unread handling, scrolling, pagination (18 tests)
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Unread | Opens at first unread; marked read after it is visible; not marked behind compose; unread flag cleared on open | CLI sends 30 messages while another chat is open | CV:1842-1869, 3073-3096, 3483 | `unread_openChat_scrollsToFirstUnread`, `unread_visibleItems_markedReadAfterDelay`, `unread_itemsHiddenBehindCompose_notMarked`, `unreadChatFlag_clearedOnOpen` | `unread_openChat_scrollsToFirstUnread`: the chat opens at the first of the 30 unread messages, not at the newest (CV:1842-1869); `unread_visibleItems_markedReadAfterDelay`: messages in view are marked read 600 ms after they appear and the chat's unread count drops by them (CV:3073-3096; `testMarkReadDirect`); `unread_itemsHiddenBehindCompose_notMarked`: an unread message that lies wholly behind the compose bar is not marked read, and the unread count still includes it after 600 ms (CV:3082-3090); `unreadChatFlag_clearedOnOpen`: a chat marked with "Mark unread" loses the unread flag when opened (`markUnreadChatAsRead`, CV:187,3483-3500; `testAddContact` `/_unread`) | P | Mark-read waits 600 ms |
+| Scroll buttons | Top unread button; right-click "Mark read"; bottom counter / arrow | Click / right-click | CV:2574-2736, 3255-3303 | `unreadFab_top_click_scrollsToOldestUnread`, `unreadFab_top_rightClick_markRead`, `bottomFab_counter_scrollsToBottom`, `bottomFab_arrow_whenScrolledUp` | `unreadFab_top_click_scrollsToOldestUnread`: the top button shows the count of unread items above the view; a click makes the oldest unread item visible at the top (CV:2600-2624, 2697-2716); `unreadFab_top_rightClick_markRead`: "Mark read"; unread count goes to 0; `bottomFab_counter_scrollsToBottom`: the bottom button shows the count of unread items below the view, and a click makes the last item visible (CV:2594-2598, 2628-2645, 3265-3282); `bottomFab_arrow_whenScrolledUp`: scrolled up with nothing unread below, the bottom button shows the arrow and no count, and a click makes the last item visible (CV:2647-2652, 3283-3298) | P | Scroll buttons get keys in K2 |
+| New messages | Auto-scroll at bottom; keep position when scrolled up | CLI sends | CV:2518-2551 | `newMessage_atBottom_autoScrolls`, `newMessage_scrolledUp_keepsPosition` | At the bottom, the new item becomes the last visible item (the list scrolls to index 0, CV:2534-2535); when scrolled up, the same items stay in view, shifted by only 39 dp (CV:2519, 2537) | P | |
+| Pagination | Older messages on scroll up; banner at top; newer after a jump; initial page around first unread | 300-message batch | CV:2739-2830 | `pagination_scrollUp_loadsOlder`, `pagination_reachTop_showsBanner`, `pagination_afterAround_scrollDownLoadsNewer`, `pagination_initial_aroundFirstUnread` | `pagination_scrollUp_loadsOlder`: with all 300 marked read first (row menu "Mark read"; unread chats open around the first unread item, `ChatListNavLinkView.kt:230`, H/Direct.hs:400-403), the chat opens with the newest 100 messages loaded (`INITIAL_COUNT` on desktop, `C/model/SimpleXAPI.kt:4609`); scrolling up loads older pages of 100 (`PRELOAD_COUNT`, :4610; CV:2779-2812) until "1"; `pagination_reachTop_showsBanner`: once the oldest message is loaded the chat banner (contact name, "Your contact") shows above it (the core's chat-banner item, CV:2402-2411); `pagination_afterAround_scrollDownLoadsNewer`: after a jump that loads the chat around an old message (CV:3158-3172), scrolling down loads newer pages (`ChatPagination.After`, CV:2814-2828) until "300" is shown; `pagination_initial_aroundFirstUnread`: with "1"–"150" marked read through the core before the chat is opened (`/_read chat items @<bob's contact id> <id1>,<id2>,…` in the console, as `H/Direct.hs:406-407`, parser `Library/Commands.hs:6134`; no GUI action marks exactly that range), the chat opens with "151", the first unread message, in view and "1" not loaded (the core's initial page is the area around the first unread, `testChatPaginationInitial` H/Direct.hs:403) | P | |
+| Dates | Date separators; floating date while scrolling | — | CV:3061, 2894 | `dateSeparator_betweenDays`, `floatingDate_whileScrolling` | `dateSeparator_betweenDays`: the separator shows the backdated day's date (`getTimestampDateText`, ChatModel.kt:3944; it appears only where an item's date differs from the previous one's, CV:3770). `floatingDate_whileScrolling`: the floating date shows while scrolling over the backdated items (it appears only when their date differs from today's, CV:2943-2945) | P, RESTART, FIXTURE (backdated items), REALTIME | Between two `restart()` steps, some received items are backdated by a day in the GUI database. Runs with `uiTest(realTimes = true)` (plan §7.7): the fixed display clock would put every item on one date |
+| Groups | Avatar shown once per run; click avatar opens member info | — | CV:2026-2103, 3787 | `groupRcv_consecutiveMessages_avatarOnce`, `groupRcv_avatarClick_opensMemberInfo` | Only the first item in a run of bob's consecutive messages shows bob's avatar and name (CV:2026-2030, 3787); a click on the avatar opens bob's member info | P | |
+
+### R. Search and content filters (11 tests)
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Search | Search in direct / group; go to a result; close search | ⋮ "Search"; result arrow | CV:279-290, 800-812, CIV:286-292 | `search_direct_filtersResults`, `search_group_filtersResults`, `search_goToResult_opensAroundItem`, `search_close_restoresAll` | `search_direct_filtersResults`: the chat shows only the matching items: the items matching "ello ther", as in `testAddContact` (whose `/_get chat @2 count=100 search=ello ther` uses the test client's id; the oracle is the item list, not a command run here); `search_group_filtersResults`: in #team with "hello", "hi there" and "hey team", searching "team" leaves only "hey team" (H/Groups.hs:499); `search_goToResult_opensAroundItem`: the search button on a result closes the search field and shows the item with its non-matching neighbours (CIV:286-291; CV:1834-1838; `ChatPagination.Around`, `C/views/chatlist/ChatListNavLinkView.kt:227-228`); `search_close_restoresAll`: closing the search shows all items again, the non-matching ones included (CV:800-812) | P | |
+| Search | Search in notes | Notes: search icon | CV:279-290, 800-812 | `search_notes_filtersResults` | With the notes "keep in mind" and "ahoy!", searching "keep" leaves "keep in mind" and hides "ahoy!" (`testNotes`) | — | |
+| Filter | Content filter menu, files, images, reset | Gallery icon → "Images" / "Videos" / "Voice messages" / "Files" / "All messages" | CV:1339-1354, 1475-1531, 856, 3973 | `contentFilter_menu_listsAvailableTypes`, `contentFilter_files`, `contentFilter_images`, `contentFilter_allMessages_resets` | The menu lists the types present in the chat plus "Images" and "Links" (always shown); "All messages" appears only while a filter is active. With bob's text "received", the file message "hi, sending a file" (test.jpg sent as a file, `runTestMessageWithFile`) and an image, "Files" leaves only the file message, "Images" only the image, and "All messages" shows all three again | P, XFTP | The gallery icon gets a key in K2 |
+| Filter | Links filter; filter with search text | Gallery icon → "Links" | CV:1339-1354, 3973 | `contentFilter_links_showsOnlyLinks`, `contentFilter_withSearchText` | `contentFilter_links_showsOnlyLinks`: only link messages remain: the items `testLinkContentFilter` gets from `/_get chat @2 content=link count=100` (the test client's id; the oracle is the item list, not a command run here); `contentFilter_withSearchText`: with "Links" on and search text typed, only the link messages containing that text remain (the search runs with the filter's content tag, CV:279-290) | P | |
+
+### S. Draft persistence (8 tests)
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Drafts | Text, quote, edit state restored after switching chats; only last chat kept; cleared when sending becomes impossible; forwarding into a chat with a draft | Type, switch chat, come back | CMP:1381-1467, 996-1010 | `draft_text_restoredAfterChatSwitch`, `draft_withQuote_restored`, `draft_editingState_restored`, `draft_onlyLastChatKept`, `draft_clearedWhenSendDisabled`, `draft_forwardIntoChatWithDraft_restoresDraftAfterSend` | `draft_text_restoredAfterChatSwitch`: typed text is back after switching away and back; `draft_withQuote_restored`: the text and the reply bar are back; `draft_editingState_restored`: the edit bar and the edited text are back; `draft_onlyLastChatKept`: type in bob's chat, switch to cath's and type, switch to a third chat: back in bob's chat the compose field is empty, back in cath's chat her text is restored (one draft slot, CMP:1407-1422); `draft_clearedWhenSendDisabled`: with a draft in bob's chat, after bob runs `/d alice` (sending now fails with "contact deleted", `C/model/ChatModel.kt:1696`) the compose field is emptied and the draft dropped (CMP:1429-1434); `draft_forwardIntoChatWithDraft_restoresDraftAfterSend`: forwarding into cath's chat while it has a draft sends the forward (`cath <# "alice> -> forwarded"`), then the draft is back in the compose field (CMP:995-996) | P | The "Message draft" setting and its effect are owned by catalogue 04 (`00-legend.md`) |
+| Drafts | Attachment restored after switching chats | Put a file path on the in-memory clipboard, press Ctrl+V in the compose field, switch chat, come back | CMP:1381-1467, PTF:144-145, CMP:1516 | `draft_withAttachment_restored` | The file preview is restored in the compose area | P, CB | |
+| Drafts | Voice recording finished on switch | Record, switch chat | CMP:1408-1415 | `draft_voiceRecording_finishedOnSwitch` | The recording becomes a voice preview in the draft | P, REC | |
+
+### T. Status icons and delivery (9 tests)
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Receipts | Sent then delivered | bob is stopped; alice sends "hi"; then bob is started | `C/views/chat/item/CIMetaView.kt:99-108`, `C/model/ChatModel.kt:4025-4049` | `status_direct_sentThenDelivered` | The GUI item's status (typed semantics, plan §4) is sent while bob is stopped and turns delivered after the start (`testSendDeliveryReceipts`); after the start the CLI only prints `bob <# "alice> hi"` | P, S, PEERCTL | With bob online his receipt arrives within milliseconds of the send, so he is stopped before the send to hold the sent state |
+| Receipts | Peer receipts off | bob runs `/receipts @alice off` (prints `ok`, `H/Direct.hs:3424`; new CLI users send receipts by default, `Store/Profiles.hs:143`), then alice sends "hi" | `C/views/chat/item/CIMetaView.kt:99-108`, `C/model/ChatModel.kt:4025-4049` | `status_receiptsOff_staysSent` | The GUI item's status (typed semantics, plan §4) is still sent after `wait(5 s)` (`testConfigureDeliveryReceipts`); the CLI only prints `bob <# "alice> hi"` | P, S | |
+| Receipts | Group partial then complete | cath is stopped; alice sends "hi" in #team; then cath is started | `C/views/chat/item/CIMetaView.kt:99-108`, `C/model/ChatModel.kt:4036-4039` | `status_group_partialThenComplete` | The item status is delivered-partial after bob's receipt and delivered-complete after cath's (`testSendGroupDeliveryReceipts`); `bob <# "#team alice> hi"`, then after the start `cath <# "#team alice> hi"` | P ×2, S, PEERCTL | With both peers online the two receipts arrive within milliseconds, so cath is stopped to hold the partial state |
+| Errors | Auth error alert | bob deletes the contact without notifying: `/d alice notify=off` (`chatDeleteMode`, `Library/Commands.hs:6281, 6474-6481`; prints `alice: contact is deleted`, as the API form in `H/Direct.hs:981-982`; a plain `/d alice` notifies alice and disables her compose field); the queue is deleted on the server later, in a background thread (`deleteAgentConnectionsAsync'`, `Library/Commands.hs:1378`; simplexmq `Agent.hs:1013-1015`), so bob repeats `/get servers summary 1` until its JSON shows `"_connDeleted":1` (counted when the server confirms the deletion, simplexmq `Agent/Client.hs:2122-2124`); then alice sends | CIV:130-138, `C/model/ChatModel.kt:4051-4061` | `status_authError_clickShowsDeliveryError` | "Message delivery error" (`testRepeatAuthErrorsDisableContact`) | P | |
+| Errors | Pending while the server is down | Stop the SMP server, send | CIMetaView:99-109, `C/model/ChatModel.kt:4031` | `status_pending_whileServerDown` | The item stays pending (item meta status sndNew); no warning appears | P, SRVCTL | |
+| Errors | Delivery warning alert | bob is stopped; alice sends 17 messages to bob | CIV:130-138, `C/model/ChatModel.kt:4051-4061` | `status_quotaExceeded_warningAlert` | Clicking the warning icon shows "Message delivery warning" | P, PEERCTL | The test server's quota is 16 messages per queue (plan §8.2); the agent sends MWARN on QUOTA (simplexmq Agent.hs:2632) |
+| Meta | Unread dot | Receive a message | CIMetaView:93-116 | `status_rcvNew_dotUntilRead` | The item's status (item meta, plan §4) is new until the item is read | P | The sent-via-proxy icon and the encrypted-file lock belong to their settings in catalogue 04 (`00-legend.md`) |
+| Meta | Signature verified | The CLI owner posts with `/_send #1(as_group=on) sign=on text hello` (`testChannelAsGroupSign`; channel messages are unsigned by default) | CIMetaView:117-121 | `meta_signature_verified` | The item's meta shows it as signed (item meta, plan §4) | P, RELAY | Signed messages come from a channel with relays |
+| Meta | Signature missing alert | bob (current CLI) creates group `team` and runs `/set signatures #team on` (`Library/Commands.hs:6407`) before he adds alice and cath, so their invitations carry it (alice's GUI shows no sign of the preference in a regular group: no feature item, `regularGroupFeatures`, `Types/Preferences.hs:317-319`, and "Group preferences" has no row for it, `C/views/chat/group/GroupPreferences.kt:192-220`, so a later change could reach her after cath's message); cath is a v7.0.3 CLI (`cli("cath", CliVersion.Stable(<stable tag>))`), which signs only in groups with relays (v7.0.3 `Library/Internal.hs:2214-2221`), and sends `#team hi` | CIV:130-138, `C/model/ChatModel.kt:2730-2733`, CIMetaView:118-121 | `meta_signature_missingAlert` | cath's item in alice's group shows the signature-missing mark (`MVSigMissing` for an unsigned message when the group allows signatures, `Types/Shared.hs:170-172`, `Messages.hs:420-424`, `Library/Internal.hs:3047`); tapping it shows the "Signature missing" alert | P ×2 | Uses the stable CLI in every run (not `S`, which means "also with stable"). Depends on the stable tag: v7.0.3 (the default) signs only with relays; the test reads cath's version (`/v`) and is skipped through a JUnit assumption, with that reason, when the run's stable release signs in groups without relays |
+
+### U. Special items (19 tests, 1 ignored)
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| E2EE | Encryption info item, direct | New chat | CIV:684-696 | `e2eeInfo_direct_pq` | "…**quantum resistant e2e encryption**…" | P | The stable CLI (v7.0.3) also negotiates quantum-resistant encryption, so there is no separate old-peer case |
+| E2EE | Encryption info item, group | New group | CIV:684-696 | `e2eeInfo_group_noPq` | "…**end-to-end encryption**…" | P | |
+| Features | Contact changes a preference; offer with "Accept"; timed offer "Set 1 day" | bob `/set voice @alice no`; `/set delete @alice yes`; for the timed offer alice first turns "Disappearing messages" off for bob (saves `{allow: no, ttl: null}`; with her default `yes` there would be no offer, CIFeaturePreferenceView.kt:30, ChatModel.kt:1953-1954), then bob runs `/set disappear @alice no`, then `/set disappear @alice yes` with no TTL (Commands.hs:3629-3634, 6641), so alice's TTL stays unset (a TTL from bob would be copied into alice's pref, Subscriber.hs:2786-2792, and the link would read "Accept") | CIV:757-789, `C/views/chat/item/CIFeaturePreferenceView.kt:33` | `featureItem_contactChangesPref_shown`, `featureOffer_accept_updatesPrefs`, `featureOffer_timed_set1Day` | `featureItem_contactChangesPref_shown`: bob's `/set voice @alice no` turns voice off for both sides (`prefEnabled`, `Types/Preferences.hs:1147-1153`), so alice gets a "Voice messages: off" feature item; it directly follows the five feature items created on connection, so it joins their merged icon row (`CIMergeCategory.ChatFeature`, `C/model/ChatModel.kt:3457-3461`; `mergedFeatures`, `CIChatFeatureView.kt:75-92`) and shows no text; the test right-clicks the row → "Expand" (`expand_verb`, CIV:529-541), then the newest feature item reads "Voice messages: off" and the earlier ones use the GUI feature names, e.g. "Delete for everyone: off" (`full_deletion`; the core says "Full deletion"); `featureOffer_accept_updatesPrefs`: the offer shows "Accept" → `bob <## "alice updated preferences for you:"` (`testFeatureOffers`); `featureOffer_timed_set1Day`: the timed offer shows "Set 1 day" (alice's TTL is unset), and clicking it allows disappearing messages for bob with a 1-day TTL (`allowFeatureToContact(…, 86400)` (ChatView's `acceptFeature`), `CIFeaturePreferenceView.kt:32-34`); the link then disappears from the item and bob prints `bob <## "alice updated preferences for you:"` followed by a "Disappearing messages: …" line (`src/Simplex/Chat/View.hs:2062-2076`) | P | No message is sent between connecting and bob's `/set voice`, so the new item always joins the connection's feature run (see `featureItems_merged_iconRowExpandHide`). Group-preference feature items are owned by catalogue 03 §5 |
+| Features | Merged feature items: icon row, Expand, Hide | alice connects with bob; open the chat; right-click the feature row → "Expand", then right-click an item → "Hide" | CIV:529-541, CIV:757-788, `C/views/chat/item/CIChatFeatureView.kt:28-48, 75-114`, `C/model/ChatModel.kt:3453-3461` | `featureItems_merged_iconRowExpandHide` | After connecting, alice's chat shows one row of five feature icons (one `CIRcvChatFeature` per UI feature, `createFeatureEnabledItems_`, `Library/Internal.hs:3253-3257`, `Types/Preferences.hs:82-91`); "Expand" (`expand_verb`) shows five items "Disappearing messages: off", "Delete for everyone: off", "Message reactions: enabled", "Voice messages: enabled", "Audio/video calls: enabled" (`featureText`, ChatModel.kt:4329-4339; defaults `defaultChatPrefs`, Types/Preferences.hs:553-564); "Hide" (`hide_verb`) collapses them back to the icon row | P | The icons have no content description (CIChatFeatureView.kt:105): K2 key needed. A later feature item that directly follows this run joins the row; `featureItem_contactChangesPref_shown` expands it first |
+| Invitation | Expired invitation item label | — | `C/views/chat/item/CIGroupInvitationView.kt:80` | `groupInvitation_expired` | "Group invitation expired" | IGNORE: code that is unused — the core never sets the `CIGISExpired` status (`src/Simplex/Chat/Messages/CIContent.hs:282`), so the label can't appear | The rest of the invitation item (tap to join, incognito label, sent item) is owned by catalogue 03 §8 (`00-legend.md`) |
+| Calls | Incoming call item with answer; ended states | bob `/call @alice` (`SendCallInvitation` with `defaultCallType`, a video call with encryption, `Library/Commands.hs:6147`, Call.hs:180-181), `/_call end @<alice's contact id>` (no name form) | CIV:600, CV:616-627, `C/views/chat/item/CICallItemView.kt:32-58` | `callItem_incoming_answerButton`, `callItem_endedStates` | `callItem_incoming_answerButton`: "Answer call"; `callItem_endedStates`: bob ends the call with `/_call end` before alice answers, so alice's item shows the red call icon with content description "Missed call" (`CICallItemView.kt:39`; no Text) and "Answer call" is gone, and the chat-list preview reads "missed call" (`CICallStatus.text`, ChatModel.kt:5374) (`Library/Subscriber.hs:3135-3139`; the "ended" state needs a connected WebRTC call, which the browser stub can't give) | P, URI, AV | Answering launches the browser through the `LocalUriHandler` stub (URI only in `callItem_incoming_answerButton`) |
+| Calls | Incoming call alert: accept, reject, ignore | bob `/call @alice` (the same invitation `inviteToCall` sends as `/_call invite @<alice's contact id> {"media":"video","capabilities":{"encryption":true}}`, `tests/ChatTests/Direct.hs:1389-1394`: `defaultCallType`, Call.hs:180-181; `bob <## "ok"`) | `C/App.kt:253-254`, `C/views/call/IncomingCallAlertView.kt:27-79`, `C/views/call/CallManager.kt:27-58, 99-111` | `callAlert_incoming_acceptRejectIgnore` | The alert shows bob's profile, "e2e encrypted video call" and "Reject", "Ignore", "Accept". "Accept" closes the alert and opens the call view, which launches the browser: the `LocalUriHandler` stub records the call page link (`D/views/call/CallView.desktop.kt:157-174`). "Reject" (after a new invitation) closes the alert and the call item shows the rejected state ("Rejected call" icon, CICallItemView.kt:40); bob prints nothing, because rejecting sends no message (`APIRejectCall`, `src/Simplex/Chat/Library/Commands.hs:1530-1540`). "Ignore" closes the alert only (`activeCallInvitation` cleared, IncomingCallAlertView.kt:40-43); the item stays incoming | P, S, URI, AV | v7.0.3 has the same `/call @<name>` command (its Commands.hs:5483). bob ends each invitation with `/_call end @<alice's contact id>` before sending the next one |
+| Calls | Answering a call whose invitation is gone | bob invites; once alice's chat shows the incoming call item with "Answer call" (`CICallItemView.kt:32-58`; bob's `/call` prints `ok` when the invitation is queued, and alice's `calls` row exists only after it arrives), between two `restart()` steps the `calls` row is deleted from the GUI database; click "Answer call" | CV:616-627 | `callItem_answerEnded_showsAlert` | "Call already ended!" | P, RESTART, FIXTURE (calls row deleted), AV | The item stays pending but `apiGetCallInvitations` returns nothing |
+| Events | Delete a whole merged range | Members join; right-click the collapsed events → "Delete" | CIV:530-543, 605-643, `C/views/chat/ChatItemsMerger.kt` | `events_merged_deleteRange` | "Delete %d messages?" / "Messages will be deleted - this cannot be undone!" with only "Delete for me" (`forAll = false`, CIV:886-902, 1426-1448); after it the collapsed events row is gone | P ×2 | Rendering, expanding and role-change event items are owned by catalogue 03 §16 (`00-legend.md`) |
+| Member contact | Open direct chat from member contact item | "Open" | `C/views/chat/item/CIMemberCreatedContactView.kt:46` | `memberContact_openButton_opensDirectChat` | The group item reads "requested connection" with an "Open" button; "Open" opens the direct chat (setup as in `testMemberContactMessage`; the group has "Direct messages" on: alice-created groups start with it off, `C/views/newchat/AddGroupView.kt:160-162`, so alice turns it on in "Group preferences", or bob hosts with `/g`) | P | Creating and accepting member contacts is owned by catalogue 03 §11 |
+| Errors | Decryption error with Fix connection; skipped-messages error without dev tools; sync events | "Fix connection" → "Fix connection?" → "Fix" | CIV:709-721, `C/views/chat/item/CIRcvDecryptionError.kt:51-227`, `C/views/chat/item/IntegrityErrorItemView.kt:32-83` | `decryptionError_fixConnection_syncs`, `integrityError_hiddenWithoutDevTools`, `syncEvents_shownAsEvents` | `decryptionError_fixConnection_syncs`: after "Fix": `bob <## "alice: connection synchronization agreed"` (`testSyncRatchet`); `integrityError_hiddenWithoutDevTools`: without developer tools the skipped-messages item is hidden; `syncEvents_shownAsEvents`: alice's chat then shows the event items "agreeing encryption…", "encryption agreed" and "encryption ok" (the initiator's started/agreed/synchronized items, H/Direct.hs:3262; `ratchetSyncStatusToText`, `C/model/ChatModel.kt:5557-5565`; CIV:749-756) | P, RESTART, FIXTURE (GUI database copy) | As in `setupDesynchronizedRatchet`, but on the GUI side: with the core stopped, the GUI database is copied; the decryption error comes from restoring that old copy after more messages; the skipped IDs come from a CLI process that opens the copy (with the GUI's key) and consumes messages before the GUI continues |
+| Errors | Skipped-messages error with developer tools | As above, developer tools on | `C/views/chat/item/IntegrityErrorItemView.kt:32-83` | `integrityError_skipped_devToolsVisible` | The item reads "%1$d skipped message(s)" (e.g. "3 skipped message(s)"; setup as in `testMsgDecryptError`) | P, DT, RESTART, FIXTURE (GUI database copy) | Same fixture as the row above |
+| Other | Invalid data item | — | CIV:798, `C/views/chat/item/CIInvalidJSONView.kt:30` | `invalidJson_item_rendered` | "invalid data" | P, RESTART, FIXTURE (unparseable chat item) | A chat item row with unparseable content, written with the core stopped. The welcome message item is owned by catalogue 03 §4 |
+| Other | Legacy deleted item | alice sends "hi" to bob; between two `restart()` steps alice's row is rewritten: `UPDATE chat_items SET item_content = '{"sndDeleted":{"deleteMode":"broadcast"}}', item_content_tag = 'sndDeleted' WHERE item_text = 'hi'` | CIV:588-598, 705-706; `C/views/chat/item/DeletedItemView.kt:19-43` | `legacyDeletedItem_rendered` | The item shows italic "deleted" (`deleted_description`, strings.xml:49; ChatModel.kt:4261) in a sent bubble with its meta; its menu has only "Info", "Delete" and "Select" | P, RESTART, FIXTURE (legacy deleted item) | The core no longer creates these contents (`Messages/CIContent.hs:145-146`) but still decodes them (`DBJCISndDeleted`, :591, `singleFieldJSON`, :748), so only pre-4.3 databases have them |
+
+### V. Private notes (7 tests)
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Notes | Send, menu rules, edit | Compose / menus in notes | CMP:580-585, CIV:407 | `notes_sendText_saved`, `notes_menu_noReplyLiveTimed`, `notes_edit_updates` | The note "keep in mind" appears in the notes chat (as in `testNotes`); the menu has no Reply, live or timed options; an edited note shows the new text | — | No peer; clearing notes is owned by catalogue 01 (notes menu) |
+| Notes | Attach image/file, delete (removes file), image filter | Attach in notes | CMP:580-585, CIV:1391 | `notes_attachImage_storedLocally`, `notes_attachFile_storedLocally`, `notes_delete_removesFile`, `notes_contentFilterImages` | `notes_attachImage_storedLocally`: the image appears as a note; `notes_attachFile_storedLocally`: the file appears as a note; `notes_delete_removesFile`: after delete the file is removed from the files folder (as in `testFiles`); `notes_contentFilterImages`: the content filter "Images" shows the image note and not the file note (CV:3980) | FD | Delete offers only "Delete for me" |
+
+### W. Context menus and keyboard (5 tests)
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Menus | Right-click and long-press open the menu | Right-click / long-press | CIV:327-335, 388-553 | `contextMenu_rightClick_opens`, `contextMenu_longPress_opens` | `contextMenu_rightClick_opens` and `contextMenu_longPress_opens`: on bob's text item the menu opens with "Reply" and "Copy" (CIV:408,445), which are absent before | P | |
+| Menus | Menu items per item type | Right-click each item type | CIV:388-553 | `contextMenu_itemsMatrix_byItemType` | In alice's chat with bob, below the reactions row on message items: alice's sent text "hi": "Reply", "Share", "Copy", "Edit", "Forward", "Info", "Delete", "Select"; bob's received text: the same without "Edit"; bob's file offer (`/f @alice tests/fixtures/test.pdf`, not yet received): "Reply", "Download", "Info", "Delete", "Select" (no "Share", "Copy" or "Forward": no text and the file is not loaded; CIV:407-485); bob's text after he runs `\ @alice hi` (deleted for everyone under default prefs, so only marked deleted): "Reveal", "Info", "Delete", "Select" (CIV:557-568, 698-700); the merged row of the five feature items created on connection: "Expand", "Delete", "Select" (CIV:531-542); the single "contact bob changed to …" event after bob runs `/p bob Bobby` (`RcvDirectEventContent` has no merge category, `C/model/ChatModel.kt:3475-3476`): "Delete", "Select" (CIV:544-551); the call item: "Delete", "Select" (CIV:600-603, 376-384); deleted content: bob creates #club, adds alice, who accepts, and runs `/set delete #club on`; after `\\ #club @alice hi` alice's sent "hi" becomes moderated content (`Store/Messages.hs:2847-2860`, as in testGroupModerateFullDelete): "Info", "Delete", "Select" (CIV:557-568) | P, XFTP, AV | The call item comes from an incoming invitation, whose alert plays the ringtone (IncomingCallAlertView.kt:30-33) |
+| Keys | Enter does nothing when send is disabled; Esc closes the item-info modal | Keys | PTF:134 | `enter_whenSendDisabled_noop`, `escape_closesItemInfoModal` | Nothing sent; the info modal closes | P | Esc goes through the harness `escape()` (plan §7.4), which invokes `simplexWindowState.backstack` as the window's key handler does |
+
+### X. Rare states and out-of-reach rows (4 tests, 2 ignored)
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Calls | A real WebRTC call session | Answer / start a call | `D/views/call/CallView.desktop.kt` | `call_webrtcSession_connects` | — | IGNORE: real WebRTC calls (the browser page) | The call link, waiting state, incoming invitations and call items are covered in §A and §U; this is the only WebRTC row (`00-legend.md`) |
+| Files | Inline (SMP) file transfer and its "Waiting for file" alert ("File will be received when your contact is online, please wait or check later!") | bob sends a file that isn't auto-received; then `restart(fixture)` sets the received file to the legacy inline protocol on alice's database (`/sql chat UPDATE files SET protocol='smp', ci_file_status='rcv_accepted' WHERE file_id=<id>`, `<id>` being alice's local `files.file_id`, the GUI item's `file.fileId`: the alert needs the item status `RcvAccepted`, which comes from `files.ci_file_status`, CIFileView.kt:86-97, `Store/Messages.hs:2713`; `rcv_files.file_status` is not read by the GUI; on start the core resumes only receives with status `new` and `to_receive=1`, `Store/Files.hs:809-824`, so the state survives) | `C/views/chat/item/CIFileView.kt:93-97` | `rcvFile_inlineSmpTransfer_waitingAlert` | Clicking the file shows "Waiting for file" / "File will be received when your contact is online, please wait or check later!" | P, XFTP, FIXTURE, RESTART | No CLI sends inline files any more (the v6.3.7 fixture CLI is XFTP-only too), so the legacy state comes from a fixture |
+| Signing | Send a signed message from the menu | — | SMV:213-237 | `send_signedMessage_fromMenu` | — | IGNORE: code that is commented out — "Sign messages" (SMV:213-237) | |
+| Compose | Compose restored after a failed send | alice picks Reply on bob's message; bob deletes it for everyone (`\ @alice <text>`, `src/Simplex/Chat/Library/Commands.hs:6341`); nothing in the GUI drops the quote of a deleted item; once bob's message shows "marked deleted" in alice's chat (the deletion has reached her), alice sends | CMP:966-1007 | `send_apiFailure_restoresCompose` | The core rejects the quote of a deleted item (`SEInvalidQuote`, `Library/Commands.hs:4855`); the GUI shows "Error sending message" (SimpleXAPI.kt:1240-1242) and the compose field gets the text and the quote back | P | |
+
+Not features on desktop, so no rows: the mentions scroll button in the chat (doesn't exist; unread mentions appear only in the chat list) and swipe to reply (disabled on desktop, CV:1987).
+
+Seam use (plan §11.2): REC — 9 (four recording tests, `voice_disabledWhileRecording_cancels`, `voice_notes_recordAndSave`, `voice_preview_playPauseAndSeek`, `draft_voiceRecording_finishedOnSwitch`, `edit_notOffered_forReceivedVoiceForwarded`); AV — 11 (`voice_playback_playPauseProgress`, `voice_preview_playPauseAndSeek`, `attachVideo_send_peerReceivesVideo`, `attachVideo_undecodable_showsAlert`, `rcvVideo_previewAndDownload`, `pasteFileList_webmAudio_sentAsFile`, and the incoming-call ringtone in `callItem_incoming_answerButton`, `callItem_endedStates`, `callAlert_incoming_acceptRejectIgnore`, `callItem_answerEnded_showsAlert`, `contextMenu_itemsMatrix_byItemType`); IMGCB — 1 (`ctrlV_clipboardImage_attachesPng`).
+
+## Count
+| Section | Tests | Ignored |
+|---|---|---|
+| A Shell, toolbar, banner | 11 | 0 |
+| B Composing, links, mentions, commands | 29 | 0 |
+| C Live messages | 10 | 0 |
+| D Timed messages | 6 | 0 |
+| E Voice | 11 | 0 |
+| F Sending attachments | 21 | 1 |
+| G Receiving files | 20 | 0 |
+| H Replies | 7 | 0 |
+| I Edit | 12 | 0 |
+| J Delete / reveal / blocked | 8 | 0 |
+| K Multi-select | 9 | 0 |
+| L Forwarding | 17 | 0 |
+| M Reactions | 8 | 0 |
+| N Copy / share / save | 9 | 0 |
+| O Reports, member side | 7 | 0 |
+| P Item info | 15 | 0 |
+| Q Unread / scroll / pagination | 18 | 0 |
+| R Search / filters | 11 | 0 |
+| S Drafts | 8 | 0 |
+| T Status icons | 9 | 0 |
+| U Special items | 19 | 1 |
+| V Private notes | 7 | 0 |
+| W Context menus / keyboard | 5 | 0 |
+| X Rare states and out-of-reach rows | 4 | 2 |
+| **Total** | **281** | **4** |
diff --git a/plans/ui-tests/catalogue/03-groups-channels-business.md b/plans/ui-tests/catalogue/03-groups-channels-business.md
new file mode 100644
index 0000000000..51395bd099
--- /dev/null
+++ b/plans/ui-tests/catalogue/03-groups-channels-business.md
@@ -0,0 +1,329 @@
+# UI test catalogue 3: groups, channels, business chats
+
+Groups, channels and business chats, mapped to the desktop code and the core tests: **312 test cases in 20 sections, 4 of them `@Ignore`** (see `## Count`). Format, Needs codes, user names and ownership of overlapping features follow `00-legend.md`.
+
+**How to read the tables**
+- The GUI user is **alice** (display name only). CLI peers are bob, cath, dan and eve; their role in a row (host, moderator, member, joiner, customer, team member, channel owner) is given in the Notes or Verification text. Chat relays are headless CLI processes started by the harness (`--relay --headless`, plan §8.1); they have no terminal, so their side is never asserted as CLI lines — relay effects are asserted on the GUI or on a peer's CLI.
+- When a Haskell test is cited, its lines are rewritten for these roles: the GUI user's own output is asserted on the GUI, and CLI lines name the GUI user `alice` without a full name.
+- Labels in «» are the exact English values from `apps/multiplatform/common/src/commonMain/moko-resources/base/strings.xml`.
+- **Group info** means: click the chat title in the group's toolbar.
+- Paths: `C/` and `H/` as in the legend; `V/` = `C/views/`.
+
+## 0. Harness facts (setup, not tests)
+
+- **Relays.** The harness starts each relay as `simplex-chat --relay --headless --user-display-name <relayN> -d <dir> -s <smp1> --xftp-server <xftp1>` (plan §8.1; `--relay-web-domain relay.example.com --relay-web-dir <dir>` together for channel webpages, `src/Simplex/Chat/Options.hs:295-298`). Headless mode creates the relay address on first start and prints `Chat relay address is created:` with the link (`src/Simplex/Chat/Core.hs:190-196`); the harness reads it and registers the relay in alice's servers. Registering a relay through the UI is tested in catalogue 04.
+  - A relay can't type commands. Rows where a relay must leave or reject (`/leave`) stop the relay (`PEERCTL`), run the command once on its database with the same options as the running relay, `simplex-chat --relay -d <dir> -s <smp1> --xftp-server <xftp1> -e "<command>" -t 3` with stdin `/dev/null` (`--execute`, Options.hs:381; `-t` is the wait after the command, kept at 3 s so async effects such as `/da`'s server-side deletion complete before the process exits; plan §8.1), and start it again.
+- **CLI subscribers** join with `/c <shortLink>` (testConnectChannelCLI, `H/Groups.hs:9206`, which runs with `testOptsNoFullLinks`). The `/_connect plan` + `/_prepare group` route of the Haskell helpers is not usable from a real CLI: the plan's link data is printed only in test view (`src/Simplex/Chat/View.hs:2281`).
+- **Group host helpers:** `createGroup2'` (`H/Utils.hs:815`) and `fullAddMember` (`H/Utils.hs:917`). On the peer you will see `#team: alice invites you to join the group as member` and `use /j team to accept`.
+- **Member screening on a CLI host:** `/set admission review #team all` (`H/Groups.hs:3684`). The "pending approval" path (as opposed to review) needs Haskell `chatHooks`, which a CLI process can't set (see the `IGNORE` rows in §6).
+- **Business address on a CLI peer:** `/ad` then `/auto_accept on business [text …]` (`H/Profiles.hs:1950`). The GUI's own business address is set up with the catalogue-01 address flow (01 owns address settings).
+- **Channels need current-build peers.** `S` is used only on plain-group compatibility rows.
+- **Channel name.** Channel rows (§18–§19) use the channel `#team`; Haskell lines with other names are rewritten to it.
+- **SimpleX names** use the `NAMES` server mode (legend).
+
+---
+
+### 1. Create group (12 tests)
+
+| Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|
+| Name validation | New chat ▸ «Create group» ▸ «Create secret group» | V/newchat/NewChatSheet.kt:197; V/newchat/AddGroupView.kt:136-168 | `createGroup_buttonDisabledForEmptyOrInvalidName`, `createGroup_invalidNameAlertOffersFix` | `createGroup_buttonDisabledForEmptyOrInvalidName`: «Create group» row disabled while the name is empty or invalid (V/newchat/AddGroupView.kt:167); `createGroup_invalidNameAlertOffersFix`: for `a_1` the red info icon opens «Invalid name!» / «Correct name to a-1?», and confirming puts `a-1` in the field (V/newchat/AddGroupView.kt:141-145; V/WelcomeView.kt:485-499) | — | — |
+| Create, then invite step | «Create group» | V/newchat/AddGroupView.kt:43-57 | `createGroup_opensChatAndInviteSheet` | The group chat opens with its feature items and the «Invite members» sheet | — | Defaults to history ON (AddGroupView.kt:162) |
+| Skip inviting | «Create group» ▸ «Skip inviting members» | V/chat/group/AddGroupMembersView.kt:165-188,255 | `createGroup_skipInviting` | «Skip inviting members» closes the sheet and leaves the group chat open | P | The sheet shows «Skip inviting members» only when alice has at least one contact |
+| Group image | Edit-image button / delete-image button | V/newchat/AddGroupView.kt:117-125 | `createGroup_withProfileImage`, `createGroup_removeImageBeforeCreate` | `createGroup_withProfileImage`: the avatar is shown in the chat list and in the Group info header; `createGroup_removeImageBeforeCreate`: the delete-image button (shown only while an image is chosen) clears it before «Create group», and the group is created with no image: the chat list and Group info show the default group icon (V/newchat/AddGroupView.kt:119-124) | FD | Image chosen through the completed file dialog |
+| Same name | Create "team" twice | — | `createGroup_sameNameGetsLocalSuffix` | Developer tools «Local name» shows `team_1` (testGroupSameName, H/Groups.hs:870) | DT | — |
+| Incognito group | «Incognito» toggle ▸ «Create group» | V/newchat/AddGroupView.kt:59-62,170; V/chat/group/GroupLinkView.kt:119-123,288-296 | `createGroupIncognito_opensGroupLinkStep`, `createGroupIncognito_inviteMembersProhibited` | The «Group link» step opens and creates the link by itself: QR code, «Share link», «Continue» (no «Delete link»). In Group info the «Invite members» row keeps its label in the secondary (grey) colour, and tapping it shows the alert «Can't invite contacts!» (V/chat/group/GroupChatInfoView.kt:757-758; V/chatlist/ChatListNavLinkView.kt:920-925) | — | — |
+| Incognito group, CLI joiner | «Incognito» toggle ▸ «Create group» ▸ link to CLI | V/newchat/AddGroupView.kt:59-62 | `createGroupIncognito_cliJoinerSeesIncognitoHost` | CLI `/c <link>` gives `connection request sent!`, `#team: joining the group...`, `#team: you joined the group`; when alice sends hello, the CLI shows `#team <incognito>> hello` (testNewGroupIncognito, H/Groups.hs:572) | P | — |
+| Prefs/admission during invite | «Set group preferences» / «Set member admission» | V/chat/group/AddGroupMembersView.kt:178-185 | `createGroup_setPreferencesDuringInviteStep`, `createGroup_setAdmissionDuringInviteStep` | `createGroup_setPreferencesDuringInviteStep`: «Set group preferences» opens «Group preferences»; turning «Delete for everyone» on and «Save and notify group members» leave `/_group_profile #<groupId> {…}` in the command log (C/model/SimpleXAPI.kt:4210), and Group info ▸ «Group preferences» later shows it on; `createGroup_setAdmissionDuringInviteStep`: «Set member admission» opens «Member admission»; «Review members» «all» and «Save and notify group members» leave the same command, and Group info ▸ «Group preferences» ▸ «Member admission» later shows «all» (V/chat/group/AddGroupMembersView.kt:52-66) | P | Rows only appear when alice has at least one contact |
+
+### 2. Invite members (11 tests)
+
+| Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|
+| Who appears in the list | Group info ▸ «Invite members» | V/chat/group/AddGroupMembersView.kt:96-111,165-175 | `inviteMembers_listsOnlyEligibleContacts`, `inviteMembers_searchFiltersContacts` | `inviteMembers_listsOnlyEligibleContacts`: current members and not-ready contacts are excluded: with bob a member, the list shows cath and not bob; `inviteMembers_searchFiltersContacts`: with bob and cath both listed, typing "ca" leaves only cath (name match ignoring case, `getContactsToAdd`, V/chat/group/AddGroupMembersView.kt:96-111) | P ×2 | — |
+| No contacts to invite | Group info ▸ «Invite members» | V/chat/group/AddGroupMembersView.kt:165-175 | `inviteMembers_noContactsToAdd` | «No contacts to add» when alice has no eligible contacts | — | — |
+| Selection | contact rows, «Clear» | V/chat/group/AddGroupMembersView.kt:266-298 | `inviteMembers_selectionCounterAndClear` | Selecting two contacts shows «2 contact(s) selected» and «Clear»; «Clear» unselects both and shows «No contacts selected» (V/chat/group/AddGroupMembersView.kt:272-292) | P ×2 | — |
+| Role picker | «New member role» | V/chat/group/AddGroupMembersView.kt:223-240 | `inviteMembers_rolePickerLimitedToOwnRole` | An admin alice is not offered «owner» | P ×2 | bob is the CLI host, alice an admin |
+| Send invitation | «Invite to group» | V/chat/group/AddGroupMembersView.kt:67-85 | `inviteMembers_singleContactAsMember`, `inviteMembers_asObserver` | CLI: `#team: alice invites you to join the group as <role>`, with `member` for `inviteMembers_singleContactAsMember` (the default role, V/chat/group/AddGroupMembersView.kt:39) and `observer` for `inviteMembers_asObserver` (picked as «observer» in «New member role» first); after `/j team`: `#team: you joined the group`. alice sees the member row «connected» (fullAddMember H/Utils.hs:917; the «You sent group invitation» item is tested in §8) | P, S | — |
+| Send invitation to several | select both contacts ▸ «New member role» = «admin» ▸ «Invite to group» | V/chat/group/AddGroupMembersView.kt:39,67-85,223-240 | `inviteMembers_multipleContactsAsAdmin` | Each CLI: `#team: alice invites you to join the group as admin`; both member rows appear (createGroup3' H/Utils.hs:842) | P ×2, S | — |
+| Incognito contact | contact with theater-mask icon | V/chat/group/AddGroupMembersView.kt:329-379 | `inviteMembers_incognitoContactProhibited` | «Can't invite contact!» (testCantInviteContactIncognito, H/Profiles.hs:2864) | P | Contact connected incognito |
+| Re-add invited member | Group info ▸ «Invite members» again | V/chat/group/AddGroupMembersView.kt:96-111 | `inviteMembers_reAddInvitedMember` | bob, invited but not yet joined, is still in the list (only current members are excluded). Inviting him again gives the CLI a second `#team: alice invites you to join the group as member` / `use /j team to accept` (testGroupReAddInvited, H/Groups.hs:909) | P | — |
+| Entry points on the group info screen | info action «Invite», «Invite members» row | V/chat/group/GroupChatInfoView.kt:440,764 | `inviteMembers_infoScreenEntryPoints` | Both open the same sheet | — | The toolbar ⋮ entry is tested in catalogue 02 (§A) |
+
+### 3. Group info screen rows (13 tests)
+
+| Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|
+| Header | Group info | V/chat/group/GroupChatInfoView.kt:963-1011 | `groupInfo_headerShowsProfileAndCopiesName` | Clicking the name shows toast «Copied to clipboard» (GroupChatInfoView.kt:972) and fills the clipboard | CB, TOAST | — |
+| Local alias | «Set chat name…» | V/chat/group/GroupChatInfoView.kt:591,1395 | `groupInfo_setLocalAlias`, `groupInfo_clearLocalAlias` | `groupInfo_setLocalAlias`: chat list and Group info show the alias (core behaviour: testSetGroupAlias, H/Profiles.hs:3265); `groupInfo_clearLocalAlias`: after the field is cleared they show the group's own name again (`displayName` is the alias or the profile name, C/model/ChatModel.kt:2515) | — | — |
+| Action buttons by role | top row | V/chat/group/GroupChatInfoView.kt:599-619 | `groupInfo_actionButtonsByRole` | Owner/admin: search, «Invite», mute. Member: search, mute | P | bob is the CLI host for the member case |
+| Search | «search» | V/chat/group/GroupChatInfoView.kt:394 | `groupInfo_searchButton` | Opens chat search; disabled when the chat has no items (GroupChatInfoView.kt:401): a new group already has feature items, so the disabled case clears the chat first | — | — |
+| Mute cycle | «Unmute» / «Mute all» / «Mute» | V/chat/group/GroupChatInfoView.kt:419; C/model/SimpleXAPI.kt:5437 | `groupInfo_muteCycleWithMentions` | All → Mentions → None → All; the row's mute icon follows (core behaviour: testMuteGroup, H/Direct.hs:1854) | — | — |
+| Send receipts | «Send receipts» | V/chat/group/GroupChatInfoView.kt:733-738,1057-1085 | `groupInfo_sendReceiptsOption` | Yes/No/default dropdown (testConfigureGroupDeliveryReceipts, H/Groups.hs:4429) | — | — |
+| Send receipts, large group | «Send receipts» | V/chat/group/GroupChatInfoView.kt:733-738 | `groupInfo_sendReceiptsDisabledOver20Members` | Above 20 members the row shows «disabled»; clicking it shows the alert «Receipts are disabled» (GroupChatInfoView.kt:1072-1084) | P ×21, SLOW | Only current (joined) members count (`memberCurrent`, GroupChatInfoView.kt:734; `MemInvited -> false`, C/model/ChatModel.kt:2918), so this needs 21 joined CLI members |
+| Chat theme | «Chat theme» | V/chat/group/GroupChatInfoView.kt:740 | `groupInfo_chatThemeOpensEditor` | Wallpaper editor opens | — | Theme details are in catalogue 04 |
+| Delete-after (TTL) | «Delete messages after» | V/chat/group/GroupChatInfoView.kt:749,946 | `groupInfo_setChatTTL` | Confirmation alert «Enable automatic message deletion?» / «Delete messages» (ChatInfoView.kt:1417-1425), then the chosen value is selected; the progress spinner lasts only for the API call and one reload, so it is not asserted | — | — |
+| Developer tools | — | V/chat/group/GroupChatInfoView.kt:848 | `groupInfo_developerToolsRows` | Local name and Database ID rows | DT | — |
+| Prefs footer | Group info | V/chat/group/GroupChatInfoView.kt:726-729 | `groupInfo_prefsFooterForGroup` | «Only group owners can change group preferences.» | — | The channel and business footers are tested by `channelInfo_ownerRows` (§18) and `businessInfo_rowsForBusinessSide` (§20) |
+| Members section | «%1$s members» | V/chat/group/GroupChatInfoView.kt:754-773 | `groupInfo_membersSectionCountAndSelfRow` | Count includes self; self row reads «you: %1$s» (runtime-formatted with alice's name) | P | — |
+
+### 4. Group profile and welcome message (14 tests)
+
+| Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|
+| Edit profile | «Edit group profile» | V/chat/group/GroupProfileView.kt:32-207 | `editGroupProfile_renameNotifiesMembers`, `editGroupProfile_shortDescription` | «Save group profile». CLI after a rename: `alice updated group #team: (signed)` / `changed to #my_team`. CLI after setting «Short description:»: `alice updated group #team: (signed)` / `description changed to: <text>` (testUpdateGroupProfile, H/Groups.hs:1594) | P ×2 | «Group full name:» only shows when it already differs from the name |
+| Edit profile image | «Edit group profile» ▸ edit image | V/chat/group/GroupProfileView.kt:93-98, 120-127 | `editGroupProfile_changeImage` | New avatar in Group info; each CLI member prints `alice updated group #team: (signed)` / `profile image updated` | P ×2, FD | — |
+| Edit profile, local checks | «Edit group profile» | V/chat/group/GroupProfileView.kt:32-207 | `editGroupProfile_unsavedChangesAlert`, `editGroupProfile_descriptionTooLarge` | Unsaved-changes alert on close after a valid edit (an over-long description closes without it, GroupProfileView.kt:73-75,103,209-210): «Save preferences?» with «Save and notify group members» / «Exit without saving» (GroupProfileView.kt:215-222); the «Short description:» field becomes invalid above 160 bytes (WelcomeView.kt:54-57), an info icon opens «Description too large», and save is disabled | — | — |
+| Edit profile as a member | Group info | V/chat/group/GroupChatInfoView.kt:714-717 | `editGroupProfile_hiddenForNonOwner` | No «Edit group profile» row for a member | P | bob is the CLI host |
+| Welcome message, members | «Add welcome message» / «Welcome message» | V/chat/group/WelcomeMessageView.kt:37-197 | `welcomeMessage_addNotifiesMembers`, `welcomeMessage_newMemberReceivesItFirst` | «Save and update group profile». CLI: `welcome message changed to:`. A new member joining a group with no messages gets `#team alice> Welcome to the team!` as the first item (testGroupDescription, H/Groups.hs:1712); the order after history items is tested in §16 (`history_welcomeAfterHistory`) | P ×2 | — |
+| Welcome message, editor | «Add welcome message» | V/chat/group/WelcomeMessageView.kt:37-197 | `welcomeMessage_previewRendersMarkdown`, `welcomeMessage_tooLongDisablesSave`, `welcomeMessage_unsavedChangesAlert`, `welcomeMessage_clearRemovesIt` | `welcomeMessage_previewRendersMarkdown`: «Enter welcome message…», then «Preview» shows the text rendered as markdown, with «Copy» (V/chat/group/WelcomeMessageView.kt:137-157); `welcomeMessage_tooLongDisablesSave`: over 1200 bytes shows «Message too large» and disables «Save and update group profile» (:111-113,130-132); `welcomeMessage_unsavedChangesAlert`: leaving with changes shows «Save welcome message?» with «Save and update group profile» / «Exit without saving», or, when the text is too long, «Welcome message is too long» with «Exit without saving» (:61-66,199-214); `welcomeMessage_clearRemovesIt`: clearing removes the message from the profile | — | — |
+| Welcome message as a member | Group info ▸ «Welcome message» | V/chat/group/WelcomeMessageView.kt:97,135-139 | `welcomeMessage_readOnlyForMember` | Read-only view showing bob's text, with the «Copy» icon (WelcomeMessageView.kt:135-139,191) | P | bob is the CLI host and first runs `/set welcome #team <text>` (`Library/Commands.hs:6294`; `H/Groups.hs:1730`): a non-owner sees «Welcome message» only when the group has one (GroupChatInfoView.kt:718) |
+| Welcome message received | alice joins a group whose host set a welcome message | — (core: the host sends the description as a message on join, testGroupDescription H/Groups.hs:1746-1749) | `welcomeMessage_receivedAsFirstItem` | alice's group chat shows bob's welcome message as a received message right after joining, before any later messages (history items, if any, come before it) (testGroupDescription, H/Groups.hs:1712, roles swapped) | P | bob is the CLI host |
+
+### 5. Group preferences (19 tests, 1 ignored)
+
+Group info ▸ «Group preferences»; `V/chat/group/GroupPreferences.kt:36-360`.
+
+On every save, CLI members print `alice updated group #team: (signed)` / `updated group preferences:` / `<Feature>: …`, and alice's chat gets a matching event item.
+
+| Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|
+| «Disappearing messages» + «Delete after» | Group info ▸ «Group preferences» | :109-118,292-303 | `groupPrefs_disappearingOnWithTtl`, `groupPrefs_disappearingMessageExpires`, `groupPrefs_disappearingOff` | `groupPrefs_disappearingOnWithTtl`: bob prints `alice updated group #team: (signed)`, `updated group preferences:`, `Disappearing messages: on (3 sec)` (testEnableTimedMessagesGroup, H/Profiles.hs:3584-3595); `groupPrefs_disappearingMessageExpires`: GUI groups start with it off (as for `groupPrefs_disappearingOff` below), so alice first turns it on (3 s) and saves; with bob started with `--mark-read`, `hi` is gone from bob's `/tail #team 1` after 3 s (the real CLI prints no deletion line, `src/Simplex/Chat/View.hs:937`); `groupPrefs_disappearingOff`: GUI groups start with it off (V/newchat/AddGroupView.kt:160-162; `defaultGroupPrefs`, `src/Simplex/Chat/Types/Preferences.hs:569-586`), so alice first turns it on (3 s) and saves; after turning it off and saving, bob prints `alice updated group #team: (signed)`, `updated group preferences:`, `Disappearing messages: off`, and a later `hey` is still in his `/tail #team 1` after 3 s (H/Profiles.hs:3608-3620) | P | Use the custom time picker for a short TTL; bob runs with `--mark-read` (plan §8.1 `PeerFlags`) so his received item starts its timer |
+| «Direct messages» + «Enabled for» | Group info ▸ «Group preferences» | :119-125,304-313 | `groupPrefs_directMessagesOff_memberInfoProhibited`, `groupPrefs_directMessagesForOwnersOnly` | alice-created groups start with «Direct messages» off (V/newchat/AddGroupView.kt:160-162; `defaultGroupPrefs`, `src/Simplex/Chat/Types/Preferences.hs:573`). `groupPrefs_directMessagesOff_memberInfoProhibited`: alice first turns it on and saves (CLI `Direct messages: on`), then turns it off and saves: `Direct messages: off`; `groupPrefs_directMessagesForOwnersOnly`: from the default, alice turns it on, sets «Enabled for» to owners and saves: `Direct messages: on for owners`. In both cases the CLI member's `@cath hi` gets `bad chat command: direct messages not allowed`. Only with off does alice's member-info message button show «Can't message group member»; with on-for-owners alice (owner) keeps an active message button (testProhibitDirectMessages H/Profiles.hs:3483; testGroupPrefsDirectForRole :3683) | P ×2 | The member must not be alice's contact (cath joins via the group link): for a known contact member info opens the contact instead (V/chat/group/GroupMemberInfoView.kt:497-534) |
+| «Delete for everyone» | Group info ▸ «Group preferences» | :126-131 | `groupPrefs_fullDeleteOn` | `Full deletion: on` (testUpdateGroupPrefs, H/Profiles.hs:3391) | P | — |
+| «Message reactions» | Group info ▸ «Group preferences» | :132-137 | `groupPrefs_reactionsOff_hidesReactionMenu` | CLI `Message reactions: off`; the reaction row and the reaction items of the item menu are absent (V/chat/item/ChatItemView.kt:157,404). A CLI `+1 #team hi` is rejected with `bad chat command: feature not allowed Message reactions` (src/Simplex/Chat/Library/Commands.hs:1004-1005) | P | — |
+| «Voice messages» off | Group info ▸ «Group preferences» | :138-144; V/chat/SendMsgView.kt:142-148,585-594 | `groupPrefs_voiceOff_showsNotAllowed` | alice (owner) saves «Voice messages» off and the CLI prints `Voice messages: off`. alice's microphone button gets the disabled look, and tapping it shows «Voice messages prohibited!» / «Only group owners can enable voice messages.» | P | «Voice messages not allowed» appears only while editing a voice item (ComposeView.kt:1737-1746) |
+| «Voice messages» for admins | Group info ▸ «Group preferences» | :138-144; V/chat/SendMsgView.kt:142-148,585-594 | `groupPrefs_voiceForAdminsOnly` | The CLI host bob runs `/set voice #team on admin`; once alice's (member) «Group preferences» show «Enabled for» «admins» under «Voice messages» (the CLI prints the change when it is queued, `sendGroupMessage … XGrpInfo`, src/Simplex/Chat/Library/Commands.hs:4156, and alice applies it on receipt, src/Simplex/Chat/Library/Subscriber.hs:1119), she sees the disabled microphone and the same alert | P | bob is the CLI host and alice a member |
+| «Files and media» + role | Group info ▸ «Group preferences» | :145-151 | `groupPrefs_filesForOwnersOnly` | `Files and media: on for owners`; CLI member `bad chat command: feature not allowed Files and media` (testGroupPrefsFilesForRole, H/Profiles.hs:3752) | P, XFTP | — |
+| «SimpleX links» + role | Group info ▸ «Group preferences» | :152-158 | `groupPrefs_simplexLinksForOwnersOnly` | `SimpleX links: on for owners`; a CLI member's message with a SimpleX link gets `bad chat command: feature not allowed SimpleX links` (testGroupPrefsSimplexLinksForRole, H/Profiles.hs:3787) | P | — |
+| «Member reports» | Group info ▸ «Group preferences» | :159-164 | `groupPrefs_reportsToggleDisabled` | Toggle is shown disabled | — | Hard-coded `disabled = true` |
+| «Visible history» | Group info ▸ «Group preferences» | :165-170 | `groupPrefs_historyOff_newMemberGetsNoHistory` | `Recent history: off`; new member gets no `[>>]` items (testGroupHistoryPreferenceOff, H/Groups.hs:6040) | P ×2 | — |
+| «Chat with admins» | Group info ▸ «Group preferences» | :217 | `groupPrefs_supportToggleDisabledInGroups` | Toggle is shown disabled for groups | — | — |
+| «Sign messages» | Group info ▸ «Group preferences» | :219-221 | `groupPrefs_signMessages` | — | IGNORE: commented-out code ("Sign messages", GroupPreferences.kt:219-221; plan §11.3) | — |
+| Reset / save / unsaved | Group info ▸ «Group preferences» | :241-251,352 | `groupPrefs_resetRestoresSaved`, `groupPrefs_unsavedChangesAlert` | `groupPrefs_resetRestoresSaved`: after a preference is toggled, «Reset» restores its saved value, «Reset» and «Save and notify group members» turn disabled again (:248), and the command log has no `/_group_profile`; `groupPrefs_unsavedChangesAlert`: «Save preferences?» / «Save and notify group members» / «Exit without saving» | — | — |
+| Read-only for members | Group info ▸ «Group preferences» | :314-327 | `groupPrefs_readOnlyForMember`, `groupPrefs_receivedUpdateShownAsEvent` | `groupPrefs_readOnlyForMember`: each preference shows its value as text with no toggle, and «Reset» / «Save and notify group members» are absent (GroupPreferences.kt:241-251,282,314-327); `groupPrefs_receivedUpdateShownAsEvent`: alice sees a `Voice messages: off` item after the CLI host runs `/set voice #team off` | P | bob is the CLI host |
+
+### 6. Member admission and review (16 tests, 2 ignored)
+
+| Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|
+| Admission setting | «Group preferences» ▸ «Member admission» ▸ «Review members» off/all | V/chat/group/MemberAdmission.kt:27-156 | `memberAdmission_enableReviewAll`, `memberAdmission_readOnlyForNonOwner` | CLI: `alice updated group #team: (signed)` / `changed member admission rules` (testGLinkReviewMember, H/Groups.hs:3684); `memberAdmission_readOnlyForNonOwner`: for a member «Review members» shows its value as text with no dropdown, and there are no «Reset» / save buttons (V/chat/group/MemberAdmission.kt:91-98,117-131) | P | bob is the CLI host for the read-only case |
+| Admission setting, unsaved | «Member admission» | V/chat/group/MemberAdmission.kt:27-156 | `memberAdmission_unsavedChangesAlert` | «Save admission settings?» / «Save and notify group members» / «Exit without saving» (MemberAdmission.kt:148-155) | — | — |
+| alice as host reviews a CLI joiner | «Chats with members» ▸ pending row ▸ compose «Reject»/«Accept» | V/chat/group/MemberSupportView.kt:88-96,166-290; V/chat/ComposeContextPendingMemberActionsView.kt:25-126; V/chat/ComposeView.kt:1715-1729 | `review_pendingMemberListedInChatsWithMembers`, `review_hostChatsWithPendingMember`, `review_acceptAsMember`, `review_acceptAsObserver`, `review_rejectPendingMember`, `review_acceptFromLongPressMenu` | `review_pendingMemberListedInChatsWithMembers`: bob is listed first with status «pending review» and the flag icon on the row (V/chat/group/MemberSupportView.kt:91,174-175,254-258); the group row in alice's chat list shows the primary-colour flag (moderator side, V/chatlist/ChatPreviewView.kt:390-391); `review_hostChatsWithPendingMember`: clicking the row opens the chat with bob, and a message alice sends there reaches only him: `bob <# "#team (support) alice> hi"` (as eve's lines in testGLinkReviewMember, H/Groups.hs:3740-3743); `review_acceptAsMember`: «Accept» opens «Accept member» / «Member will join the group, accept member?»; «Accept as member» leads to CLI `#team: you joined the group` plus history; `review_acceptAsObserver`: «Accept as observer» leads to the same CLI lines, and bob's role in Group info is «observer»; `review_rejectPendingMember`: «Reject» opens «Reject member?», and confirming leads to CLI `#team: alice removed you from the group (signed)` / `use /d #team to delete the group` (the removal lines follow the pattern of testGLinkDeletePendingApprovalMember :3986-3988); `review_acceptFromLongPressMenu`: right-click on the pending row in «Chats with members» offers «Accept», which opens the same «Accept member» alert; «Accept as member» leads to CLI `#team: you joined the group` (MemberSupportView.kt:147,272-276; V/chat/ComposeContextPendingMemberActionsView.kt:84-110). Review flow: testGLinkReviewMember H/Groups.hs:3678-3785 | P | bob is the CLI joiner |
+| alice as moderator reviews | as above | same | `review_moderatorAcceptsMember` | CLI host: `#team: alice accepted cath to the group (will introduce remaining members)` (H/Groups.hs:3775, names substituted) | P ×2 | bob is the CLI host, cath the joiner |
+| alice as joiner pending review | «Paste link» with the link of a CLI group that has review on ▸ «Open group» ▸ «Join group» | V/newchat/NewChatView.kt:673-675; V/chat/ChatView.kt:246-256; C/model/ChatModel.kt:1711,1746 | `joinerPendingReview_supportChatAutoOpens`, `joinerPendingReview_messagesAdmins`, `joinerPendingReview_acceptedByAdmin`, `joinerPendingReview_rejected` | Support chat opens automatically; main compose shows «reviewed by admins»; the group row shows the grey (pending) flag. CLI host sees `#team (support: alice) alice> hello`; after `/accept member #team @alice` (`Library/Commands.hs:6274`) history appears for alice and the main compose field is enabled («reviewed by admins» gone, C/model/ChatModel.kt:1711-1713); after `/rm team alice` alice's compose shows «removed from group» (testGLinkDeletePendingApprovalMember H/Groups.hs:3985-3988, roles swapped) | P, CB | bob is the CLI host; review applies only to members who join by link (src/Simplex/Chat/Library/Commands.hs:2881-2886) |
+| Host "pending approval" | — | H/Groups.hs:3614 (testGLinkApproveMember) | `admission_hostPendingApproval` | — | IGNORE: host "pending approval" needs Haskell `chatHooks` (plan §11.3) | — |
+| Join rejected by host hook | — | H/Groups.hs:3585 (testGLinkRejectBlockedName) | `admission_joinRejectedByHook` | — | IGNORE: "join rejected" needs Haskell `chatHooks` (plan §11.3) | — |
+
+### 7. Group link (14 tests)
+
+| Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|
+| Create | Group info ▸ «Create group link» | V/chat/group/GroupLinkView.kt:30-169 | `groupLink_createdAutomatically` | «Group link» opens and creates the link by itself: QR code, «Initial role», «Share link», «Delete link» | — | — |
+| Full/short toggle | «Group link» ▸ «Full link»/«Short link» | V/chat/group/GroupLinkView.kt:232-239; V/newchat/NewChatView.kt:585-596 | `groupLink_toggleFullShortLink` | The toggle switches the QR code between the short and full link. It is shown for groups with a short link, not for channels, and only with developer tools on | DT | — |
+| Share link | «Share link» | V/chat/group/GroupLinkView.kt:255-262 | `groupLink_shareCopiesShortLink` | «Share link» copies the short link to the clipboard | CB | — |
+| CLI joins (short link) | CLI `/c <link>` | V/chat/group/GroupLinkView.kt:250-265 | `groupLink_cliJoinsViaShortLink` | CLI `/c` gives `connection request sent!`, `#team: joining the group...`, `#team: you joined the group`; alice gets «invited via your group link» (testGroupLink, H/Groups.hs:3086) | P | — |
+| CLI joins (full link) | «Full link» toggle ▸ CLI `/c <full link>` | V/chat/group/GroupLinkView.kt:250-265 | `groupLink_cliJoinsViaFullLink` | CLI `/c` gives `connection request sent!`, `#team: joining the group...`, `#team: you joined the group`; alice gets «invited via your group link» (testGroupLink, H/Groups.hs:3086) | P, DT | The «Full link»/«Short link» toggle is visible only with developer tools (NewChatView.kt:585) |
+| Initial role | «Initial role» member/observer | V/chat/group/GroupLinkView.kt:133-145,305-320 | `groupLink_initialRoleObserver`, `groupLink_changeInitialRoleBackToMember` | `groupLink_initialRoleObserver`: observer joiner: `#team: you don't have permission to send messages` (testGroupLinkMemberRole, H/Groups.hs:3350,3384-3385); `groupLink_changeInitialRoleBackToMember`: after «Initial role» is set back to «member» (`apiGroupLinkMemberRole`, V/chat/group/GroupLinkView.kt:133-145), the next CLI joiner joins as a member: its `#team hi` is delivered and shows in alice's group (as bob's `#team hey now` after promotion, H/Groups.hs:3391-3392) | P | — |
+| Delete link | «Delete link» | V/chat/group/GroupLinkView.kt:146-162 | `groupLink_deleteKeepsMembers`, `groupLink_deletedLinkRejectsJoin` | `groupLink_deleteKeepsMembers`: «Delete link?» / «All group members will remain connected.»; the member who joined stays and still gets alice's messages; `groupLink_deletedLinkRejectsJoin`: the CLI first repeats `/_connect plan 1 <link>` until it prints `error: connection authorization failed - …` (the GUI's deletion reaches the server later, in a background thread, simplexmq `Agent.hs:1013-1015`; the plan reads the link from the server, `Library/Commands.hs:4546`), then a CLI connecting with the deleted link gets `error: connection authorization failed - this could happen if connection was deleted, secured with different credentials, or due to a bug - please re-create the connection` (`src/Simplex/Chat/View.hs:2922-2924`; same as with a deleted address, H/Profiles.hs:1835-1841), and alice's group gets no new member | P | — |
+| Creation step | Incognito group creation (§1) ▸ «Continue» | V/chat/group/GroupLinkView.kt:119-123,279-296 | `groupLink_creationStepContinue` | After the link is created by itself, «Continue» closes the step and leaves the group chat open; this step has no «Delete link» | — | The step opens only from incognito group creation; opening it is tested by `createGroupIncognito_opensGroupLinkStep` |
+| Rejoin / merge | CLI `/c <link>` | V/chat/group/GroupLinkView.kt:250-265 | `groupLink_memberRejoinsAfterDeletingGroup`, `groupLink_existingContactMergedWithMember` | Rejoin: CLI `/l team`, `/d #team`, then `/c <link>` again gives `connection request sent!` … `#team: you joined the group`, and alice sees bob as a member again (testGroupLinkDeleteGroupRejoin, H/Groups.hs:2793). Merge: bob, already alice's contact, joins via the link; CLI `contact and member are merged: alice, #team alice_1` / `use @alice <message> to send messages`, and alice's member row for bob opens the existing contact (testGroupLinkExistingContactMerged, H/Groups.hs:3542) | P | — |
+| Upgrade old link | «Upgrade group link» | V/chat/group/GroupLinkView.kt:57-88,241-249 | `groupLink_upgradeOldLink` | «Upgrade group link» opens «Upgrade group link?»; «Upgrade» adds a short link, and the «Upgrade group link» row disappears | FIXTURE (group link without short-link data) | Only shown for links without short-link data; the fixture database is created by a pre-short-link CLI release on the GUI database path |
+| Share old link | «Share link» ▸ «Upgrade group link?» ▸ «Share old link» | V/chat/group/GroupLinkView.kt:72-117,255-258 | `groupLink_shareOldLink` | «Share old link» puts the existing link, not upgraded, on the clipboard (the full link in `https://simplex.chat/` form when there is no short link, C/model/SimpleXAPI.kt:7342-7351) | FIXTURE (group link without short-link data), CB | — |
+
+### 8. Joining (alice as joiner), connect-plan states, invitations (24 tests)
+
+| Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|
+| Short link → prepared group | New chat ▸ «Paste link» ▸ alert «Open group» ▸ «Join group» | V/newchat/ConnectPlan.kt:249-263,750-805; V/chat/ComposeView.kt:1767-1774,693 | `joinGroup_pasteShortLinkPrepareAndJoin`, `joinGroup_preparedShowsWelcomeBeforeJoin`, `joinGroup_preparedJoinIncognito`, `joinGroup_preparedChangeProfile` | Banner «Tap Join group». `joinGroup_preparedShowsWelcomeBeforeJoin`: with the host's `/set welcome #team Welcome!`, the prepared group chat already shows "Welcome!" before «Join group» (testGroupShortLinkWelcome H/Profiles.hs:4611-4628). CLI host: `<name>: accepting request to join group #team...`, `#team: <name> joined the group`, where `<name>` is `alice`, the incognito name for `joinGroup_preparedJoinIncognito`, and the second profile's name for `joinGroup_preparedChangeProfile` (testShortLinkPrepareGroup H/Profiles.hs:4538; testGroupShortLinkWelcome :4611; testShortLinkConnectPreparedGroupIncognito :4870; testShortLinkChangePreparedGroupUser :4908) | P, CB | Incognito comes from the app pref or the profile picker (ComposeContextProfilePickerView); `joinGroup_preparedChangeProfile` needs a second chat profile, picked in the profile picker |
+| Full link alert | paste full link | V/newchat/ConnectPlan.kt:264-276,448-504,408-437 | `joinGroup_fullLinkCurrentProfile`, `joinGroup_fullLinkIncognito`, `joinGroup_cancelAlert` | `joinGroup_fullLinkCurrentProfile`: «Join group?»; «Use current profile» → «Connection request sent!»; the host prints `alice: accepting request to join group #team...` then `#team: alice joined the group` (`src/Simplex/Chat/View.hs:536`); `joinGroup_fullLinkIncognito`: «Use new incognito profile» → the host sees a random name: `<rand>: accepting request to join group #team...` (testGroupLinkInviteeIncognito, H/Groups.hs:3483-3500); `joinGroup_cancelAlert`: «Cancel» closes the alert without connecting: no group appears in alice's list and the host prints nothing (V/newchat/ConnectPlan.kt:493-498) | P, CB | The current-build host is started with `--show-full-links` (`src/Simplex/Chat/Options.hs:435`) so it prints the full group link |
+| Retry after server error | prepared group ▸ «Join group» while smp1 is stopped | V/chat/ComposeView.kt:693; C/model/SimpleXAPI.kt:842-869,891-901 | `joinGroup_retryAfterServerError` | Alert «Connection error» with «Retry»; start smp1, «Retry» → CLI host bob: `alice: accepting request to join group #team...`, `#team: alice joined the group` (core behaviour: testShortLinkGroupRetry, H/Profiles.hs:4645) | P, SRVCTL, CB | The app's agent caches a failed server connection for 3 s (`persistErrorInterval`, 3 s in the app and in `testAgentCfg`; only some Haskell tests set it to 0, e.g. `H/Profiles.hs:253`), so «Retry» comes more than 3 s after the failure, after smp1 is started again |
+| Plan: known | paste again | V/newchat/ConnectPlan.kt:322-336,645-688 | `connectPlan_knownGroupOpensGroup`, `connectPlan_knownGroupShowsRole` | `connectPlan_knownGroupOpensGroup`: the alert names "team" and «Open group» opens the group chat; `connectPlan_knownGroupShowsRole`: alice joined through the link with its default role member, so the alert reads «You are a member» (with an observer role it would read «You are an observer») (V/newchat/ConnectPlan.kt:645-688) (testPlanGroupLinkKnown, H/Groups.hs:4094) | P, CB | — |
+| Plan: own link | paste own link | V/newchat/ConnectPlan.kt:277-285,553-643 | `connectPlan_ownGroupLinkOpenGroup`, `connectPlan_ownGroupLinkJoinAsSecondMember` | «Join your group?» ▸ «Open group» opens the group; «Join your group?» ▸ «Use current profile» → a second "team" group appears in the chat list (testPlanGroupLinkOwn, H/Groups.hs:2931) | CB | — |
+| Plan: connecting | — | V/newchat/ConnectPlan.kt:286-321 | `connectPlan_connectingAllowsReconnect`, `connectPlan_connectingProhibit` | Host bob stopped. `connectPlan_connectingAllowsReconnect`: paste bob's full link, «Use current profile», paste it again → «Repeat join request?» with «Use current profile» / «Use new incognito profile» in red (ConnectPlan.kt:286-297; testPlanGroupLinkConnecting, H/Groups.hs:4132). `connectPlan_connectingProhibit`: paste the short link, «Open group», «Join group», then paste bob's full link → «Group already exists!» (ConnectPlan.kt:302-306; the group is found by `via_group_link_uri_hash`, stored at src/Simplex/Chat/Store/Shared.hs:964 and read at src/Simplex/Chat/Store/Groups.hs:2867; membership not yet active, src/Simplex/Chat/Library/Commands.hs:4715-4716). Pasting the short link again gives the known-group alert instead (Commands.hs:4537,4584-4588) | P, PEERCTL, CB | The current-build host is started with `--show-full-links` (`src/Simplex/Chat/Options.hs:435`) so it prints the full group link. CLI host stopped. «Already joining the group!» needs the deprecated pre-`x.grp.link.inv` host protocol and is not tested |
+| Plan: rejoin | — | V/newchat/ConnectPlan.kt:249-276 (`GroupLinkPlan.Ok`) | `connectPlan_rejoinAfterLeaving` | Plan is OK again after leaving (testPlanGroupLinkLeaveRejoin, H/Groups.hs:2973) | P, CB | — |
+| Plan: newer version required | bob (CLI channel owner) changes the channel's stored type: `/sql chat UPDATE group_profiles SET group_type='group' WHERE group_profile_id=(SELECT group_profile_id FROM groups WHERE local_display_name='team')` (`/sql chat` is unguarded in the CLI, src/Simplex/Chat/Library/Commands.hs:676, 6097), then `/gp team team <new description>` republishes the link data with that type (:4154); alice types the link into the chat-list search field, which plans typed links (`ChatListView.kt:833-845`) | V/newchat/ConnectPlan.kt:364-380 | `connectPlan_groupLinkRequiresNewerVersion` | Any link type other than channel gives `GLPUpdateRequired` (Commands.hs:4549, 4582); the GUI shows the open-chat alert with the subtitle «This group requires a newer version of the app. Please update the app to join.» | P, RELAY | — |
+| Invitation item and row (compatibility) | invitation item in the direct chat with bob; group row in the chat list | V/chat/item/CIGroupInvitationView.kt:26,75-118; V/chatlist/ChatListNavLinkView.kt:196-199,902-917 | `groupInvitation_tapToJoin`, `groupInvitation_tapRowShowsJoinAlert` | Item in the direct chat: «You are invited to group» / «Tap to join»; tapping it joins. Tapping the group row opens the «Join group?» alert; «Join» joins. CLI host: `#team: alice joined the group` (createGroup2', H/Utils.hs:815) | P, S | bob is the CLI host |
+| Sent invitation item | alice invites bob from her group | V/chat/item/CIGroupInvitationView.kt:75-118 | `groupInvitation_hostSeesSentInvitationItem` | In alice's direct chat with bob: «You sent group invitation»; bob's CLI prints `#team: alice invites you to join the group as member` | P, S | alice is the host |
+| Invitation menu, delete | group row menu | V/chatlist/ChatListNavLinkView.kt:303-336,475-483,486-506; V/chat/group/GroupChatInfoView.kt:212-234 | `groupInvitation_joinFromChatListMenu`, `groupInvitation_deleteInvitation` | Row menu «Join»/«Delete»; `groupInvitation_joinFromChatListMenu`: «Join» joins, and the CLI host prints `#team: alice joined the group` (`apiJoinGroup`, V/chatlist/ChatListNavLinkView.kt:488-510); `groupInvitation_deleteInvitation`: «Delete» → «Delete group?» («Group will be deleted for you - this cannot be undone!») → «Delete» removes the invitation (testGroupDeleteWhenInvited H/Groups.hs:882) | P | bob is the CLI host |
+| Invitation joining state | row tap after accepting | V/chatlist/ChatListNavLinkView.kt:196-200,944-950 | `groupInvitation_tapAfterAcceptShowsJoiningAlert` | bob is stopped once alice's chat list shows the invitation row (`/a team alice` prints its line when the invitation is queued, before delivery); alice accepts; a tap on the row shows «Joining group»; start bob → `#team: alice joined the group` | P, PEERCTL | bob is the CLI host |
+| Incognito invitation | invitation from a contact connected incognito | V/chat/item/CIGroupInvitationView.kt:75-118 | `groupInvitation_incognitoContactJoinsIncognito` | Item label «Tap to join incognito»; alice joins with her incognito profile; the host sees the incognito name | P | bob is the CLI host, connected to alice incognito |
+| Invitation removed by the host | bob deletes the group (or the invitation) before alice joins; the invitation's queue is deleted on the server later, in a background thread (`deleteMembersConnections'` / `deleteMemberConnection'`, src/Simplex/Chat/Library/Internal.hs:2173-2185; simplexmq `Agent.hs:1013-1015`), so bob repeats `/get servers summary 1` until its JSON shows `"_connDeleted":1` (counted when the server confirms the deletion, simplexmq `Agent/Client.hs:2122-2124`); then alice taps «Tap to join» / «Join» | C/model/SimpleXAPI.kt:2436-2438 | `groupInvitation_joinAfterHostDeleted_showsExpiredAlert` | Joining fails with SMP AUTH: alert «Invitation expired!» / «Group invitation is no longer valid, it was removed by sender.»; the group is deleted from alice's chat list. (The «Group invitation expired» item label is unreachable: the core never sets `CIGISExpired`, src/Simplex/Chat/Messages/CIContent.hs:282.) | P | bob is the CLI host |
+
+### 9. Member list and multi-select (10 tests)
+
+| Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|
+| Rows | Group info member list | V/chat/group/GroupChatInfoView.kt:778-811,1099-1176 | `memberList_rolesAndStatuses` | alice creates #team and invites bob as «admin», then cath as «member» (picked in «New member role»); after both `/j team`: alice's own row reads «you: creator» with «owner» (GroupChatInfoView.kt:772,1150-1152); bob «connected» with «admin»; cath «connected» with no role text, as only owner, admin, moderator and observer are shown (GroupChatInfoView.kt:1104-1107; the host sees both invitees as connected, `/ms team` in H/Groups.hs:437-442); after alice blocks cath for herself (member info «Block member» → «Block member?» / «Block»), cath's row shows «blocked» (GroupChatInfoView.kt:1102-1103; `blocked`, C/model/ChatModel.kt:2857) | P ×2 | — |
+| Search | search row (over 8 members) | V/chat/group/GroupChatInfoView.kt:766 | `memberList_searchOver8Members` | Filters by name | P ×9 | Members may be invited-only, which avoids 9 joins |
+| Right-click menu as admin | member row | V/chat/group/GroupChatInfoView.kt:1184-1230 | `memberList_contextMenuAsAdmin` | «Block for all», «Remove member», «Select» | P | alice is the owner |
+| Right-click menu as member | member row | V/chat/group/GroupChatInfoView.kt:1184-1230 | `memberList_contextMenuAsMember` | «Block member» | P ×2 | bob is the CLI host, cath another member |
+| Multi-select toolbar | «Select» ▸ bottom toolbar | V/chat/group/GroupChatInfoView.kt:861-943; V/chat/group/GroupMembersToolbar.kt:23 | `memberSelection_removeMultiple`, `memberSelection_blockForAllMultiple`, `memberSelection_unblockForAllMultiple`, `memberSelection_changeRoleToObserver`, `memberSelection_selectAllExcludesModerators` | `memberSelection_removeMultiple`: «Remove members?» → «Remove» (the other button is «Remove and delete messages», GroupChatInfoView.kt:362-389); each removed member's CLI prints `#team: alice removed you from the group (signed)` and their rows leave the member list; `memberSelection_blockForAllMultiple`: «Block members for all?» / «Block for all»; the unselected member prints `#team: alice blocked bob (signed)` and `#team: alice blocked cath (signed)` (testBlockForAllMultipleMembers, H/Groups.hs:7681-7683); `memberSelection_unblockForAllMultiple`: with both blocked members selected, the toolbar's block button unblocks: «Unblock members for all?» / «Unblock for all»; the unselected member prints `#team: alice unblocked bob (signed)` and `#team: alice unblocked cath (signed)` (H/Groups.hs:7697-7700); `memberSelection_changeRoleToObserver`: «Change role?» / «Change»; each selected member prints `#team: alice changed your role from member to observer (signed)` (V/chat/group/GroupMembersToolbar.kt:80; V/chat/group/GroupMemberInfoView.kt:993-1005); `memberSelection_selectAllExcludesModerators`: with dan made a moderator first, the select-all button selects only bob and cath (members below moderator, V/chat/group/GroupChatInfoView.kt:925-935) | P ×3 | Toolbar icons have null content descriptions; found by their keys |
+| Member inactive | alice is in group `team` with bob; `restart(fixture)` sets `quota_err_counter = 5` on alice's connection to bob (`/sql chat UPDATE connections SET quota_err_counter=5 WHERE group_member_id=<bob's local group_member_id>`, the row id, not the MemberId) | H/Groups.hs:7743; V/chat/group/GroupChatInfoView.kt:1117-1118; C/model/ChatModel.kt:2057 | `memberList_memberInactive` | `connInactive` is true at 5 or more, and the member list shows bob as "inactive" | P, FIXTURE, RESTART | The real state needs five slow-retry quota warnings (about 41 minutes: 5 min growing ×1.5, simplexmq Env/SQLite.hs:213-218), so a fixture sets it |
+
+### 10. Member info (28 tests)
+
+Click a member row; `V/chat/group/GroupMemberInfoView.kt`.
+
+| Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|
+| Sections | Group info ▸ member row | :474-731,749 | `memberInfo_openShowsSections` | Header, «Member» section with «Group» and «Change role» (alice is the owner), «Servers» | P | — |
+| Change role | Group info ▸ member row | :149-158,607-611,906,968-991 | `memberInfo_changeRoleToAdmin`, `memberInfo_changeRoleDismissRestores`, `memberInfo_changeRoleOfInvitedMember` | `memberInfo_changeRoleToAdmin`: «Change role?» / «Change». CLI: `#team: alice changed your role from member to admin (signed)`; `memberInfo_changeRoleDismissRestores`: dismissing «Change role?» puts the role picker back to the current role, and the CLI prints nothing (V/chat/group/GroupMemberInfoView.kt:149-155,986-988); `memberInfo_changeRoleOfInvitedMember`: for an invited member: `#team: alice invites you to join the group as member` (testUpdateMemberRole, H/Groups.hs:1641-1664) | P | For `memberInfo_changeRoleOfInvitedMember` alice invites bob with «New member role» admin, then changes him to member before he joins (choosing the current role does nothing, :150); the CLI also prints `use /j team to accept` |
+| Role of a higher member | Group info ▸ member row | :605-612; C/model/ChatModel.kt:2939-2955 | `memberInfo_roleReadOnlyForHigherRole` | The role row is read-only for a member with a higher role | P | bob is the CLI owner, alice an admin; bob invites her as admin (`/a team alice admin`, src/Simplex/Chat/Library/Commands.hs:6272), so she is an admin when she joins (a later `/mr` would print before it reached her, and as a plain member her role row is read-only too); open bob's member info |
+| Block for me (alice is a plain member) | Group info ▸ member row | :456-472,1022-1048 | `memberInfo_blockForMeHidesMessages`, `memberInfo_unblockForMe` | `memberInfo_blockForMeHidesMessages`: «Block member?» / «Block»; that member's later messages show as «blocked» (V/chat/item/FramedItemView.kt:277-278; V/chat/item/MarkedDeletedItemView.kt:105-106; testMuteGroup, H/Direct.hs:1920); `memberInfo_unblockForMe`: «Unblock member» → «Unblock member?» / «Unblock»; that member's messages sent afterwards show normally (V/chat/group/GroupMemberInfoView.kt:1034-1043); the CLI prints nothing either way | P ×2 | Moderators and above can't block for self (:695-698) |
+| Block for all | Group info ▸ member row | :431-453,1064-1127 | `memberInfo_blockForAllNotifiesMembers`, `memberInfo_unblockForAll`, `memberInfo_blockedByAdminShownToMember` | `memberInfo_blockForAllNotifiesMembers`: «Block member for all?» / «Block for all». cath's CLI: `#team: alice blocked bob (signed)`; bob's CLI prints nothing; bob's later messages print nothing on cath's CLI (src/Simplex/Chat/View.hs:399-402,613); cath's `/tail #team 1` shows `#team bob> <text> [blocked by admin]` (View.hs:777-779; testBlockForAllMarkedBlocked, H/Groups.hs:7259); `memberInfo_unblockForAll`: «Unblock member for all?» / «Unblock for all»; cath's CLI: `#team: alice unblocked bob (signed)`, and bob's next message prints on cath's CLI again (H/Groups.hs:7697-7705); `memberInfo_blockedByAdminShownToMember` (alice a member, bob the CLI host blocks cath): cath's member info shows the disabled «Blocked by admin» row | P ×2 | — |
+| Remove | Group info ▸ member row | :253-365,843-865 | `memberInfo_removeMember`, `memberInfo_removeMemberWithMessages`, `memberInfo_deleteMessagesOfLeftMember`, `memberInfo_reAddRemovedMember` | `memberInfo_removeMember`: «Remove member?» «Remove». CLI: `#team: alice removed you from the group (signed)`; `memberInfo_removeMemberWithMessages`: «Remove and delete messages». CLI: `#team: alice removed you from the group with all messages (signed)`; `memberInfo_deleteMessagesOfLeftMember`: for a member who left: «Delete member messages» → «Delete member messages?» / «Delete messages»; `memberInfo_reAddRemovedMember`: the removed member's contact is offered again in «Invite members» (V/chat/group/AddGroupMembersView.kt:96-110); inviting him prints `#team_1: alice invites you to join the group as member` / `use /j team_1 to accept`, and after `/j team_1` he is back in alice's member list (testGroupRemoveAdd :1102-1135; testDeleteMemberWithMessages :2011; testDeleteMemberMessagesLeftRemoved :2114) | P ×2 | — |
+| Message / call buttons | Group info ▸ member row | :485-543,734-746 | `memberInfo_messageOpensKnownContact`, `memberInfo_callButtonsShowSendMessageAlert` | «message» opens the existing direct chat with bob; for a member who is not a contact, «call»/«video» show «Can't call group member» / «Send message to enable calls.» | P | For `memberInfo_messageOpensKnownContact` bob is alice's contact; for `memberInfo_callButtonsShowSendMessageAlert` bob joins through alice's group link, and alice first turns «Direct messages» on in «Group preferences» (alice-created groups start with it off, V/newchat/AddGroupView.kt:160-162; with it off the buttons show «Direct messages between members are prohibited in this group.», V/chat/group/GroupMemberInfoView.kt:535-543) |
+| Call buttons, direct messages off | Group info ▸ member row | :535-540 | `memberInfo_callButtonsDirectMessagesProhibitedAlert` | Direct messages off: «call»/«video» show «Can't call group member» / «Direct messages between members are prohibited in this group.» | P | The member is not alice's contact; the message button's alert is tested by `groupPrefs_directMessagesOff_memberInfoProhibited` |
+| Verify security code | Group info ▸ member row | :213-243,555-565 | `memberInfo_verifyCodeMatchesCli`, `memberInfo_markVerifiedShowsShield`, `memberInfo_clearVerification` | The code on screen with whitespace and line breaks removed equals the code line of CLI `/code #team alice` with spaces removed (the screen splits it into 24-character lines, V/chat/VerifyCodeView.kt:65,132-136) (the real CLI prints `#team alice security code:`, the code, then a hint, `src/Simplex/Chat/View.hs:2021-2023`); `memberInfo_markVerifiedShowsShield`: «Mark verified» closes the code screen (V/chat/VerifyCodeView.kt:40-45); bob's member info header is `verified` (plan §4; V/chat/group/GroupMemberInfoView.kt:775) and his row becomes «View security code», which reopens the screen showing «bob is verified», its status line `verified` (V/chat/VerifyCodeView.kt:66-72; V/chat/ChatInfoView.kt:1208-1215); `memberInfo_clearVerification`: «Clear verification» turns it back to «bob is not verified» and the row to «Verify security code» (V/chat/VerifyCodeView.kt:105-106) (testMarkGroupMemberVerified, H/Direct.hs:3152) | P | — |
+| Connection stats | Group info ▸ member row | :633-680 | `memberInfo_connectionStatsShowServers`, `memberInfo_networkStatusAlert` | «Receiving via» / «Sending via» show the local server address; clicking the status row opens the «Network status» alert (:637-643) | P | — |
+| Connection failed section | Group info ▸ member row: bob (host) and cath run with `-s <smp2>`, alice on smp1; alice joins `team` first; smp1 is stopped; cath joins by bob's link: she receives `XGrpMemIntro` about alice and creates her invitation on smp2, and bob's `XGrpMemFwd` to alice waits for smp1 (`Library/Subscriber.hs:3337-3394`); after bob has received cath's `x.grp.mem.inv` and forwarded it (no CLI line marks it; resetting smp2 earlier would delete the undelivered message, so P1's run of the recipe picks the sync point, e.g. a read of a copy of bob's database, since §6 rules out sleeps), `servers.reset("smp2")` deletes cath's queue, then smp1 starts; alice's `joinAgentConnectionAsync` (`Subscriber.hs:3394`) secures the deleted queue and gets a permanent AUTH (agent `cmdError` → `ERR`, simplexmq `Agent.hs:2430-2439`), and the core marks the connection failed (`Subscriber.hs:179`, `CEvtGroupMemberUpdated` :1315-1319) | `GroupMemberInfoView.kt:682-688`, `C/model/ChatModel.kt:2060-2064` | `memberInfo_connectionFailedSection` | cath's member info shows the "Connection failed" section | P ×2, SMP2, SRVCTL | bob and cath use `cli(…, servers = PeerServers(smp = "smp2"))` (plan §9.2). cath is started (ready) before smp1 is stopped. The smp1 outage spans cath's join, bob's forwarding and the sync point, so it can exceed 10 s; alice's resubscription to smp1 and bob's `XGrpMemFwd` delivery retries back off ×1.5 after 10 s, so the final wait for the section passes an explicit timeout of about half the outage plus 5 s (plan §11.1 Server control). The recipe follows the core and agent code; P1 runs it once (plan §12) |
+| Change receiving address | Group info ▸ member row | :159-192,647-656 | `memberInfo_switchAddress` | CLI: `#team: alice started changing address for you` → `…changed address for you` (testSwitchGroupMember H/Direct.hs:3067) | P | — |
+| Abort address change | Group info ▸ member row | :647-656 | `memberInfo_abortSwitchAddress` | Stop smp1; «Change receiving address» → «Change receiving address?»; «Abort changing address» is enabled (switch still in `RSSwitchStarted`) → «Abort changing address?» / «Abort»; start smp1; the row is gone and messages flow (core: testAbortSwitchGroupMember H/Direct.hs:3085 uses an older agent version for the same reason) | P, SRVCTL | Server stopped before the switch starts |
+| Fix connection | Group info ▸ member row | :72-86,566-567 | `memberInfo_fixConnectionAfterDesync` | Copy alice's database, exchange messages with bob, restart alice on the old copy; after bob sends, «Fix connection» (runs at once, no confirmation, :72-86,566-567; the «Fix connection?» alert belongs only to the «message» button of a non-contact member, :124-126); bob's CLI: `#team alice: connection synchronization agreed`, `#team alice: connection synchronized`; alice's chat shows the synchronisation event items and messages flow (testGroupSyncRatchet H/Groups.hs:4235, roles swapped) | P, RESTART, FIXTURE (alice's own database copy restored between restarts) | alice's database is the desynchronised side |
+| Member address | Group info ▸ member row | :576-591 | `memberInfo_memberAddressConnect` | QR, «Share address», «Connect» → address plan | P | Peer has an address in its profile. strings.xml defines `share_address` twice (:572 «Share address…», :1957 «Share address»); a moko 0.27.1 desktop build with the same duplicate bundles `share_address = Share address` |
+| Developer tools | Group info ▸ member row | :701-729 | `memberInfo_debugDeliveryQueueInfo` | «Message queue info» alert | P, DT | — |
+
+### 11. Member contacts (5 tests)
+
+| Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|
+| Create | member info «message» ▸ compose «Send direct message to connect» | V/chat/group/GroupMemberInfoView.kt:108-139; V/chat/ComposeView.kt:638,1781-1793 | `memberContact_createAndSendInvitation`, `memberContact_incognitoMemberSharesIncognitoProfile` | The peer first runs `/set accept member contacts on` (as testMemberContactMessage does, H/Groups.hs:4818). CLI: `#team alice is creating direct contact alice with you`, `alice> hi`, `alice: you can send messages to contact`, `alice: contact is connected` (testMemberContactMessage H/Groups.hs:4814); `memberContact_incognitoMemberSharesIncognitoProfile`: in a group alice created with «Incognito» (§1), the same lines carry alice's incognito name instead of `alice` (`#team <incognito name> is creating direct contact <incognito name> with you`, `<incognito name>> hi`; testMemberContactIncognito :5028, :5079-5083). Without auto-accept the peer prints `#team alice requests to create direct contact with you` (View.hs:1559-1567) | P | bob joins through alice's group link, so he is not alice's contact; alice first turns «Direct messages» on in «Group preferences» (alice-created groups start with it off, V/newchat/AddGroupView.kt:160-162; with it off member info has no «message» button that creates a contact, and the core refuses with `direct messages not allowed`, `Library/Commands.hs:3355`) |
+| Accept / reject | compose «Accept» / «Reject» | V/chat/ComposeContextGroupDirectInvitationActionsView.kt:25-160; V/chat/ComposeView.kt:1830-1838 | `memberContact_acceptRequest`, `memberContact_rejectRequest`, `memberContact_acceptIncognito` | CLI sends `@#team @alice <text>` (`SendMemberContactMessage`, `Library/Commands.hs:6336`, :2617-2630: creates the member contact and sends the invitation; the real CLI prints no ids, only "contact for member #team alice is created", `View.hs:279`). `memberContact_acceptRequest`: after «Accept», the CLI prints `alice: contact is connected` (testMemberContactAccept :5268); `memberContact_rejectRequest`: «Reject» ▸ «Reject contact request» («The sender will NOT be notified.») ▸ «Reject» closes the chat and removes it from the chat list, and the CLI prints nothing (`notify = false`, V/chat/ComposeContextGroupDirectInvitationActionsView.kt:127-149); `memberContact_acceptIncognito`: with alice a member incognito (her group created with «Incognito»; bob's command names her incognito name instead of `alice`), after «Accept» the CLI prints `<alice's incognito name>: contact is connected` (testMemberContactAcceptIncognito :5311) | P | bob is not alice's contact (he joins through alice's group link), and the group has «Direct messages» on: alice-created groups start with it off (V/newchat/AddGroupView.kt:160-162), so alice turns it on in «Group preferences» first, or bob hosts with `/g` and alice joins through bob's group link; with it off the CLI's `@#team @alice` fails with `direct messages not allowed` (`Library/Commands.hs:2624`) |
+
+The "requested connection" event item and its «Open» button are tested in catalogue 02 (§U).
+
+### 12. Support chats, «Chats with members» / «Chat with admins» (13 tests)
+
+| Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|
+| Member side | Group info ▸ «Chat with admins» | V/chat/group/GroupChatInfoView.kt:478-509,636; V/chat/group/MemberSupportChatView.kt:159 | `supportChat_memberSendsToAdmins`, `supportChat_memberReceivesAdminReply`, `supportChat_unreadBannerInGroupChat`, `supportChat_hiddenWhenDisabledWithoutChat`, `supportChat_search` | CLI host sees `#team (support: alice) alice> hello`; the host's reply appears in alice's support chat; the «%d messages» banner (runtime-formatted, e.g. "2 messages"; V/chat/ChatView.kt:1730) (testSupportPreferenceGroup H/Groups.hs:9092; testScopedSupportSingleModerator :8150). `supportChat_search`: the support chat's «Search» icon opens a search field, and typing "hello" leaves only alice's "hello" and hides the host's reply, a text without "hello" (V/chat/group/MemberSupportChatView.kt:106-108,119-121). After bob runs `/set support #team off` and alice's «Group preferences» show «Chat with admins» «off» (the CLI prints the change when it is queued, `sendGroupMessage … XGrpInfo`, src/Simplex/Chat/Library/Commands.hs:4156; alice applies it on receipt, src/Simplex/Chat/Library/Subscriber.hs:1119), Group info has no «Chat with admins» row while alice has no support chat; if she already has one, the row stays (GroupChatInfoView.kt:634-636; testSupportPreferenceGroup H/Groups.hs:9108-9126) | P | — |
+| Admin side | Group info ▸ «Chats with members» | V/chat/group/MemberSupportView.kt:34-332; V/chat/group/GroupMemberInfoView.kt:408 | `chatsWithMembers_listSearchAndOpen`, `chatsWithMembers_markRead`, `chatsWithMembers_deleteChat`, `chatsWithMembers_bannerInGroupChat`, `supportChat_adminOpensFromMemberInfo`, `chatsWithMembers_removedMemberChatGone` | `chatsWithMembers_listSearchAndOpen`: bob's row is listed; typing part of his name keeps it, other text hides it (V/chat/group/MemberSupportView.kt:99-103); clicking it opens bob's support chat with his message (:134-145); `chatsWithMembers_markRead`: the row menu's «Mark read» (shown only while the chat has unread items) removes the unread badge from bob's row (:182-212,277-282); `chatsWithMembers_bannerInGroupChat`: with one unread support chat the group chat shows the banner «1 chat with a member», and clicking it opens «Chats with members» (V/chat/ChatView.kt:1706-1731); `supportChat_adminOpensFromMemberInfo`: bob's member info «Chat with member» opens his support chat (V/chat/group/GroupMemberInfoView.kt:408-424). `chatsWithMembers_deleteChat`: after «Delete chat» (row menu, then the «Delete chat with member?» alert, MemberSupportView.kt:284,295), the member's chat disappears from «Chats with members» (core behaviour: testScopedSupportSingleModerator, H/Groups.hs:8172-8173). A member who left or was removed is no longer listed in «Chats with members» (MemberSupportView.kt:89) | P | — |
+| Admin side, empty | Group info ▸ «Chats with members» | V/chat/group/MemberSupportView.kt:118-121 | `chatsWithMembers_emptyState` | «No chats with members» | — | — |
+| Admin side, disabled | Group info ▸ «Chats with members» | V/chat/group/MemberSupportView.kt:118-121 | `chatsWithMembers_disabledState` | bob (CLI owner) runs `/set support #team off`; alice (moderator) sees «Chats with members are disabled» | P | alice can't turn support off herself (`groupPrefs_supportToggleDisabledInGroups`) |
+
+### 13. Reports, moderator side (9 tests)
+
+The member side (composing a report, reasons, sent alert, not offered, preference off, not visible to other members) is in catalogue 02 (§O).
+
+| Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|
+| alice as moderator handles reports | chat banner «1 report»; Group info «Member reports»; chat-list menu «Archive reports» | V/chat/ChatView.kt:1680-1705; V/chat/group/GroupReportsView.kt:31-94; V/chat/item/ChatItemView.kt:391-400,1045; V/chatlist/ChatListNavLinkView.kt:338-342 | `reports_moderatorBannerAndCounts`, `reports_openReportsView`, `reports_archiveForMe`, `reports_archiveForAllModerators`, `reports_deleteReport`, `reports_archiveAllFromChatList`, `reports_moderateReportedMessageMarksReport` | `reports_moderatorBannerAndCounts`: CLI reporter: `/report #team spam <text>`; the chat shows the banner «1 report», «2 reports» after a second one (V/chat/ChatView.kt:1678-1703), and the chat-list row shows the red flag (V/chatlist/ChatPreviewView.kt:388-389); `reports_openReportsView`: clicking the banner opens «Member reports» with the reports (V/chat/group/GroupReportsView.kt:49); `reports_archiveForMe`: «Archive report?» «For me»: the report shows «archived report» (V/chat/item/MarkedDeletedItemView.kt:93-100) and the banner count drops; `reports_archiveForAllModerators`: «For all moderators»: a CLI moderator prints `#team (support: <reporter>) <reporter>> [marked deleted by alice] report spam`, while the reporter's copy is unchanged (`/_delete reports … broadcast`, H/Groups.hs:7958-7963); `reports_deleteReport`: the report's «Delete report» → «Delete message?» offers only «Delete for me» (reports are never deleted for everyone, V/chat/item/ChatItemView.kt:394-397,1391); the report disappears and the banner count drops; `reports_archiveAllFromChatList`: «Archive all reports?»; `reports_moderateReportedMessageMarksReport`: moderating the reported message also archives its report: the report shows «archived report» and the banner goes (H/Groups.hs:7876-7890, report `[marked deleted by you]`). testGroupMemberReports, H/Groups.hs:7815 | P ×2 | — |
+| alice as moderator selects reports and jumps to a reported message | Group info «Member reports» ▸ report menu «Select» ▸ select a second report ▸ toolbar delete icon (archives when every selected item is an active received report); report ▸ click its quoted message | V/chat/item/ChatItemView.kt:392-400; V/chat/SelectableChatItemToolbars.kt:95-102,158,167; V/chat/ChatView.kt:1063-1090,3472-3481; V/chat/item/ChatItemView.kt:1056-1090; V/chat/item/FramedItemView.kt:294-301; V/chat/ChatView.kt:1900-1909 | `reports_selectMultipleArchive`, `reports_tapReportJumpsToReportedMessage` | Two CLI reports (bob and cath each `/report #team spam <text>` on different messages). Select both → delete icon → «Archive 2 reports?» with «For me» / «For all moderators»; «For me» removes both from «Member reports» and the banner count drops to 0. Clicking the quoted message inside a report in «Member reports» sets `scrollToItemId`; the main group chat (no secondary filter, :1900-1909) scrolls to the reported message while the reports pane stays open on desktop (it closes only on Android, :1903-1905) (testGroupMemberReports, H/Groups.hs:7815) | P ×2 | The toolbar icon is the delete icon in both modes; `canArchiveReports` (SelectableChatItemToolbars.kt:158) switches its action to archiving |
+
+### 14. Moderation (6 tests)
+
+| Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|
+| Moderate | message menu «Moderate»; selection toolbar for several messages | V/chat/item/ChatItemView.kt:489-492,918 | `moderate_markDeletedForAll`, `moderate_fullDeleteWhenEnabled`, `moderate_multipleSelected`, `moderate_notOfferedForHigherRole` | `moderate_markDeletedForAll`: «Delete member message?» / «The message will be marked as moderated for all members.» CLI: `#team cath> [marked deleted by alice] hi` (testGroupModerate H/Groups.hs:1788); `moderate_fullDeleteWhenEnabled`: with full deletion on, the alert says «The message will be deleted for all members.» and the CLI prints `#team cath> [deleted by alice] hi` (…FullDelete :1871, lines :1901-1905); `moderate_multipleSelected`: the selection toolbar's flag button opens «Delete 2 messages of members?»; each message prints `[marked deleted by alice]` on the CLI (…Multiple :1835-1864; V/chat/item/ChatItemView.kt:1473-1479); `moderate_notOfferedForHigherRole`: with alice a moderator (the CLI host invites her as moderator, `/a team alice moderator`, so the role is hers when she joins; a plain member gets no «Moderate» on any message), a message from a member with a higher role (e.g. the owner host) has no «Moderate» in its menu (`memberToModerate`, C/model/ChatModel.kt:3480-3484; V/chat/item/ChatItemView.kt:489-492) | P ×2 | — |
+| Received moderation, own delete | — | — | `moderate_receivedModerationShown`, `groupMessage_deleteOwnForEveryone` | `moderate_receivedModerationShown`: «moderated by %s» on the moderated item; `groupMessage_deleteOwnForEveryone`: «Delete» ▸ «For everyone» on alice's message: each CLI prints `#team alice> [marked deleted] <text>` (testGroupMessageDelete, H/Groups.hs:1395, :1466-1469, cath's role) | P ×2 | — |
+
+### 15. Mentions, notification side (2 tests)
+
+Composing mentions (picker, filter, limit of 3, received highlight) is in catalogue 02 (§B).
+
+| Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|
+| Mentions-only mute, blocked member | group muted to mentions; member blocked for all | C/model/ChatModel.kt:1794-1801 (`ntfsEnabled`) | `mentions_mentionsOnlyMuteStillNotifies`, `mentions_blockedMemberMentionIgnored` | A mention from a CLI member still notifies under mentions-only mute; a mention from a blocked member is ignored, checked once its item shows «blocked by admin» and the app is idle (`UiIdle`; the notification decision runs in the same background job, `SimpleXAPI.kt:3012-3037`; the CLI prints the message when it is sent, before it reaches alice) (testMuteGroup; testBlockForAllMentionsIgnored H/Groups.hs:7347) | P ×2, NTF | — |
+
+### 16. Group events and history (8 tests)
+
+| Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|
+| Event items | group chat | V/chat/item/ChatItemView.kt:608-619; CIEventView | `groupEvents_memberConnectedMerged`, `groupEvents_roleChangeItems`, `groupEvents_memberLeftAndRemoved`, `groupEvents_groupProfileUpdated`, `groupEvents_expandCollapsed` | `groupEvents_memberConnectedMerged`: one merged item «cath and bob connected» (newest first, `C/model/ChatModel.kt:1164-1181`, V/chat/item/ChatItemView.kt:605-622); `groupEvents_roleChangeItems`: «changed your role to %s» with the new role; `groupEvents_memberLeftAndRemoved`: bob's leaving adds a received «left» event (on its own, or inside a merged row of adjacent received events after «Expand», C/model/ChatModel.kt:3462-3470), and removing cath adds «you removed cath»; `groupEvents_groupProfileUpdated`: «updated group profile»; `groupEvents_expandCollapsed`: «%d group events» with «Expand»/«Hide» | P ×2 | alice is the host (bob and cath join) for `groupEvents_memberConnectedMerged`, `groupEvents_memberLeftAndRemoved`, `groupEvents_expandCollapsed`; bob is the CLI host for `groupEvents_roleChangeItems` and `groupEvents_groupProfileUpdated`; cath joins only after bob prints `#team: you joined the group` and alice's chat shows bob's «connected» item, so the merged names come in a fixed order; cath is unused in `groupEvents_roleChangeItems` and `groupEvents_groupProfileUpdated` |
+| History for new members | group chat | — | `history_newCliMemberReceivesHistory`, `history_guiJoinerReceivesHistory`, `history_welcomeAfterHistory` | CLI: `#team alice> hello [>>]` (testGroupHistory H/Groups.hs:5948; …GroupLink :5992); `history_guiJoinerReceivesHistory`: alice, joining bob's group through its link after bob's "hello" and cath's "hey!", sees both in the group chat (testGroupHistoryGroupLink :5992-6028, alice in cath's role); with a welcome message the new member gets the history items first, then `#team alice> <welcome>` (testGroupHistoryWelcomeMessage :6692) | P ×2 | — |
+
+### 17. Leave, delete, clear (8 tests)
+
+| Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|
+| Leave | «Leave group» / chat-list «Leave» | V/chat/group/GroupChatInfoView.kt:253-276,828-838 | `leaveGroup_notifiesMembers`, `leaveGroup_thenDeleteLocalCopy`, `leaveGroup_fromChatListMenu` | `leaveGroup_notifiesMembers`: «Leave group?» → «Leave» … CLI: `#team: alice left the group (signed)`; compose shows «you left»; `leaveGroup_thenDeleteLocalCopy`: after leaving, Group info offers «Delete group» (`canDelete`, C/model/ChatModel.kt:2524-2525); «Delete group?» with «Group will be deleted for you - this cannot be undone!» → «Delete» removes the group from the chat list, and the CLI prints nothing (V/chat/group/GroupChatInfoView.kt:212-251); `leaveGroup_fromChatListMenu`: the chat-list «Leave» opens the same «Leave group?», and the CLI prints `#team: alice left the group (signed)` | P | — |
+| Delete | «Delete group» / chat-list «Delete» | V/chat/group/GroupChatInfoView.kt:212-251 | `deleteGroup_ownerDeletesForAll`, `deleteGroup_memberSeesGroupDeleted`, `deleteGroup_fromChatListMenu` | «Delete group?» → «Delete»: «Group will be deleted for all members - this cannot be undone!». CLI: `#team: alice deleted the group (signed)` / `use /d #team to delete the local copy of the group` (testGroupDelete H/Groups.hs:834). When bob (CLI host) runs `/d #team`, alice's compose shows «group is deleted»; `deleteGroup_fromChatListMenu`: the group row's menu «Delete» opens the same «Delete group?» alert, and «Delete» removes the row with the same CLI lines (V/chatlist/ChatListNavLinkView.kt:475-484) | P ×2 | — |
+| Clear / removed | «Clear chat» | V/chat/ChatInfoView.kt:497-505 | `clearChat_removesLocalItemsOnly`, `removedFromGroup_composeDisabled` | «Clear chat?» → «Clear»: the items are gone from alice's chat, the group stays in the chat list, and bob's `/tail #team` still shows them; compose «removed from group» | P | — |
+
+### 18. Channels: alice as owner, with relays and CLI subscribers (58 tests, 1 ignored)
+
+| Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|
+| Create channel without relays | New chat ▸ «Create public channel» | V/newchat/AddChannelView.kt:41-586 | `createChannel_noRelaysBlocksCreation` | «Enable at least one chat relay to create a channel.» | — | No relay configured |
+| Create channel, one relay | «Create public channel» ▸ «Creating channel» | V/newchat/AddChannelView.kt:41-586 | `createChannel_singleRelayCompletesAndShowsLink` | «Creating channel» progress step; once the relay is active, on desktop the channel opens with the «Channel link» modal automatically (core behaviour: prepareChannel' H/Groups.hs:9374) | RELAY | — |
+| Create channel, cancel or relay error | «Create public channel» ▸ «Creating channel» | V/newchat/AddChannelView.kt:358-536 | `createChannel_cancelAndDelete`, `createChannel_relayAddressDeletedShowsError` | «Cancel and delete channel» ▸ «Cancel creating channel?»: «Wait» keeps the step, «Cancel» deletes the channel; «Error creating channel» when the relay address was deleted (core behaviour: testChannelCreateDeletedRelay H/Groups.hs:12055) | RELAY, PEERCTL | cancel: the relay is stopped after registration, so the step stays at "0/1 relays active" (runtime-formatted from «%1$d/%2$d relays active», AddChannelView.kt:440); error: the relay runs `/da` as in §0 before alice creates the channel |
+| Create channel with image | «Create public channel» ▸ image | V/newchat/AddChannelView.kt:41-586 | `createChannel_withImage` | The channel avatar shows in the chat list and Group info | RELAY, FD | — |
+| Create channel, two relays | «Create public channel» ▸ «Creating channel» | V/newchat/AddChannelView.kt:395-445 | `createChannel_twoRelaysProgress` | The progress step counts «%1$d/%2$d relays active» out of 2; when both relays are active it closes and the channel opens with «Channel link»; «Chat relays» then shows both relays as «active» (prepareChannel2Relays H/Groups.hs:9400) | RELAY ×2 | Both relays registered by the harness |
+| Create channel, partial relays | «Creating channel» with one relay stopped | V/newchat/AddChannelView.kt:41-586 | `createChannel_continueWithPartialRelays` | «Not all relays connected»; continuing creates the channel with one active relay | RELAY ×2, PEERCTL | The second relay is stopped before creation |
+| Owner info rows | Group info | V/chat/group/GroupChatInfoView.kt:607-610,640-681,818-846,999-1009 | `channelInfo_ownerRows`, `channelInfo_subscriberCountUpdates`, `channelInfo_leaveHiddenForSoleOwner` | `channelInfo_ownerRows`: «Link» action button, «Channel link», «Subscribers», «Chat relays», «Delete channel», «Advanced options», and the footer «Only channel owners can change channel preferences.» (GroupChatInfoView.kt:726-729); `channelInfo_subscriberCountUpdates`: «%1$d subscribers» shows 3 after the two CLI subscribers join (the owner is counted; core behaviour: H/Groups.hs:9293, 4 with three subscribers); `channelInfo_leaveHiddenForSoleOwner`: there is no «Leave channel» while alice is the only owner (V/chat/group/GroupChatInfoView.kt:828-838) | RELAY, P ×2 | — |
+| Channel SimpleX name | Group info ▸ «Get SimpleX name (BETA)» ▸ «Set SimpleX name» | V/chat/group/GroupChatInfoView.kt:670-680; V/usersettings/SetSimplexNameView.kt:182-190 | `channelName_setSimplexName`, `channelName_removeSimplexName` | After saving, the row shows the name under «Channel SimpleX name»; «Remove name» then «Save» restores «Get SimpleX name (BETA)» | RELAY, NAMES | Name registered in the mock registry for the channel link |
+| Channel link | «Channel link» ▸ «Share link» | V/chat/group/GroupLinkView.kt:219,250-262 | `channelLink_shareCopiesLink` | The channel link is on the clipboard | RELAY, CB | No role picker, no delete |
+| Channel link via chat, CLI join | «Share via chat»; CLI `/c` | V/chat/group/GroupLinkView.kt:266-278 | `channelLink_shareViaChatToContactSigned`, `channelLink_shareViaChatToGroup`, `channelLink_cliSubscriberJoins` | CLI: direct `alice> link to join channel #team (signed):` (testShareChannelDirect H/ChatRelays.hs:244); group `#<group> alice> link to join channel #team:` (unsigned, testShareChannelGroup :295); `/c` lines from testConnectChannelCLI H/Groups.hs:9206 | RELAY, P | — |
+| Broadcast | compose placeholder «Broadcast» | V/chat/ComposeView.kt:1843-1846 | `channel_broadcastPlaceholderAndDelivery`, `channel_editBroadcast`, `channel_deleteBroadcast`, `channel_receiveSubscriberReaction`, `channel_ownerModeratesContributorMessage` | `channel_broadcastPlaceholderAndDelivery`: compose placeholder «Broadcast»; subscribers: `#team> hi [>>]`; `channel_editBroadcast`: after an edit `#team> [edited] <new text>` (:12139); `channel_deleteBroadcast`: after a delete `#team> [marked deleted] hi` (:12160); `channel_receiveSubscriberReaction`: after the subscriber runs `+1 #team hi`, alice's «hi» shows a 👍 reaction (the owner gets it, as in testChannels1RelayDeliver H/Groups.hs:9275-9281); `channel_ownerModeratesContributorMessage`: after alice moderates the contributor bob's message, bob's CLI shows `#team bob> [marked deleted by alice] <text>` (:13525-13528) (testChannels1RelayDeliver H/Groups.hs:9262; …MessageUpdate :12121; …MessageDelete :12142; …ModerationDeleteSign :13494) | RELAY, P | — |
+| Broadcast a file | attach in the channel | V/chat/ComposeView.kt:1841-1847 | `channel_broadcastFile` | The CLI subscriber prints `#team> sends file <name> (<size> / <bytes> bytes) [>>]` and `use /fr <n> … to receive it [>>]` (the elided part is `[<dir>/` or-bar `<path>]`) (testChannelMessageFile H/Groups.hs:12193, 12215-12216; View.hs:2508,2513) | RELAY, P, XFTP, FD | — |
+| Owner relay bar | compose relay bar, expanded | V/chat/ComposeView.kt:1890-1985 | `channel_ownerRelayBarStates` | After both relays are removed, expanding the compose relay bar shows «Add relays to restore message delivery.» | RELAY ×2 | alice removes both relays in «Chat relays» ▸ «Remove relay» |
+| Chat relays view | «Chat relays» ▸ «Add relay» ▸ «Add relays»; right-click «Remove relay» | V/chat/group/ChannelRelaysView.kt:27-207; V/chat/group/AddGroupRelayView.kt:33-240; V/chat/group/GroupMemberInfoView.kt:613-632 | `channelRelays_listShowsActive`, `channelRelays_addRelay`, `channelRelays_noAvailableRelays`, `channelRelays_removeRelay`, `channelRelays_removeLastRelayWarning`, `channelRelays_relayMemberInfo` | The list shows each relay's status («active» for relay1, V/chat/group/ChannelRelaysView.kt:178-193); an added relay becomes «active»; with both relays in the channel, «Add relay» opens «Add relays» showing «No available relays» (AddGroupRelayView.kt:114); a removed relay leaves the list; removing the last active relay shows «Remove relay?» / «This is the last active relay. Removing it will prevent message delivery to subscribers.» (GroupChatInfoView.kt:284); relay member info has «Relay link», «Share relay address» (core behaviour: testChannelAddRelay H/Groups.hs:11244; …RemoveRelay :11621) | RELAY ×2 | The channel is created with relay1 only; the harness registers relay2 in alice's servers after creation (`channelRelays_addRelay` adds it; `channelRelays_noAvailableRelays` runs after it is added) |
+| Relay leaves or rejects | the relay runs `/leave #team` (stopped, `-e`, restarted) | V/chat/group/ChannelRelaysView.kt:27-207 | `channelRelays_relayLeftShowsRemovedByOperator`, `channelRelays_rejectedRelayStatus` | The relay's status shows «removed by operator»; after alice removes the relay that left («Remove relay») and adds it again («Add relay»), it shows «rejected» (testChannelRelayLeave H/Groups.hs:10997; testRelayRejectAfterLeave :11816) | RELAY ×2, P, PEERCTL | Relay commands as in §0 |
+| Subscribers | «Subscribers» ▸ member info | V/chat/group/ChannelMembersView.kt:27-166; C/model/ChatModel.kt:2944-2962 | `channelSubscribers_listAndCount`, `channelSubscribers_promoteToContributor`, `channelSubscribers_demoteToSubscriber`, `channelSubscribers_blockForAll`, `channelSubscribers_removeSubscriber`, `channelSubscribers_verifyCodeViaMembershipKeys` | `channelSubscribers_listAndCount`: «Subscribers» lists alice and both CLI subscribers under «3 subscribers» (V/chat/group/ChannelMembersView.kt:60-75); `channelSubscribers_promoteToContributor`: the role picker offers «subscriber» and «contributor» only; «contributor» → CLI `#team: alice changed your role from observer to member (signed)` (promoteChannelMember H/Groups.hs:9308-9317); `channelSubscribers_demoteToSubscriber`: back to «subscriber» → CLI `#team: alice changed your role from member to observer (signed)`; `channelSubscribers_blockForAll`: «Block subscriber for all?» → the other subscriber prints `#team: alice blocked <name> (signed)` (testChannelBlockMemberSigned :10263-10268); `channelSubscribers_removeSubscriber`: «Remove subscriber?» → CLI `#team: alice removed you from the group (signed)` / `use /d #team to delete the group` (testChannelRemoveMemberSigned :10741-10751); `channelSubscribers_verifyCodeViaMembershipKeys`: «Verify security code» shows the same code the subscriber's CLI prints for `/code #team alice`, and «Mark verified» marks the subscriber verified (testChannelMemberSecurityCode :9329-9353) | RELAY, P ×2 | — |
+| Profile / welcome | «Edit channel profile», «Add welcome message» | V/chat/group/GroupProfileView.kt:110-174 | `channelProfile_editNotifiesSubscribers`, `channelProfile_linkWorksAfterUpdate`, `channelWelcome_setNotifiesSubscribers`, `channelWelcome_newSubscriberSeesWelcome` | `channelProfile_editNotifiesSubscribers`: `alice updated group #team: (signed)` (testChannelUpdateProfileSigned H/Groups.hs:9982); `channelProfile_linkWorksAfterUpdate`: after a name change the subscribers print `alice updated group #team: (signed)` / `changed to #<new name> …`, and a new CLI subscriber can still join with the channel link (testChannelLinkAfterProfileUpdate :10014-10047); `channelWelcome_setNotifiesSubscribers`: subscribers print `alice updated group #team: (signed)`, `welcome message changed to:`, `<text>` (H/Groups.hs:9991-10010); `channelWelcome_newSubscriberSeesWelcome`: a new CLI subscriber (dan) joins with the channel link after the welcome was set (testChannelLinkAfterWelcomeUpdate :10049); its `/show welcome #team` prints `Welcome message:` / `<text>` (View.hs:2157) — the joined profile carries the welcome | RELAY, P | — |
+| Channel preferences | «Channel preferences» | V/chat/group/GroupPreferences.kt:218-240 | `channelPrefs_fullDeleteOn`, `channelPrefs_reactionsOff`, `channelPrefs_historyOff`, `channelPrefs_enableChatWithAdminsConfirm`, `channelPrefs_enableChatWithAdminsDismissReverts`, `channelPrefs_groupOnlyRowsAbsent` | `channelPrefs_fullDeleteOn`: «Delete for everyone» on, «Save and notify channel subscribers» → subscribers print `alice updated group #team: (signed)`, `updated group preferences:`, `Full deletion: on` (testChannelUpdatePrefsSigned H/Groups.hs:10143-10165); `channelPrefs_reactionsOff`: the same lines ending `Message reactions: off`; `channelPrefs_historyOff`: the same lines ending `Recent history: off` (`groupFeatureNameText`, `src/Simplex/Chat/Types/Preferences.hs:250-263`); `channelPrefs_enableChatWithAdminsConfirm`: «Enable chats with admins?» / «Enable», then saving prints `Chat with admins: on` after the update lines (toggledSupport, H/Groups.hs:12115-12119; testSupportPreferenceChannel :9140); `channelPrefs_enableChatWithAdminsDismissReverts`: dismissing «Enable chats with admins?» turns the toggle back off (V/chat/group/GroupPreferences.kt:230-238); `channelPrefs_groupOnlyRowsAbsent`: «Channel preferences» has only «Disappearing messages», «Delete for everyone», «Message reactions», «Visible history» and «Chat with admins»: no «Member admission», «Direct messages», «Voice messages», «Files and media», «SimpleX links» or reports row (V/chat/group/GroupPreferences.kt:192-240) | RELAY, P | — |
+| Channel support | «Chats with members» | V/chat/group/GroupChatInfoView.kt:658-661,1014-1029 | `channelSupport_ownerRepliesToSubscriber` | bob's `#team (support) hi` appears under «Chats with members»; alice's reply reaches only bob: `#team (support) alice> hello [>>]` (testChannelSupportScope H/Groups.hs:12082) | RELAY, P ×2 | alice first enables "Chat with admins" in «Channel preferences» («Enable chats with admins?» ▸ «Enable») |
+| Channel webpage without a web relay | «Advanced options» ▸ «Channel webpage» | V/chat/group/ChannelWebPageView.kt:32-186 | `channelWebPage_noWebRelayMessage` | «Used chat relays do not support webpages.» | RELAY | Relay started without the web flags |
+| Channel webpage | «Advanced options» ▸ «Channel webpage» | V/chat/group/ChannelWebPageView.kt:32-186 | `channelWebPage_embedCodeWithWebRelay`, `channelWebPage_saveUrlShowsInHeader`, `channelWebPage_allowEmbeddingToggle`, `channelWebPage_unsavedChangesAlert`, `channelWebPage_relayWritesPreviewJson` | `channelWebPage_embedCodeWithWebRelay`: «Webpage code» shows the embed code for the web relay (core behaviour: H/ChatRelays.hs:399-401); `channelWebPage_saveUrlShowsInHeader`: a URL entered under «Enter webpage URL» and saved shows as a link under the channel name in Group info (V/chat/group/GroupChatInfoView.kt:987-997; V/chat/group/ChannelWebPageView.kt:47-66); `channelWebPage_allowEmbeddingToggle`: «Allow anyone to embed» switches the footer from «Only your page above can show the preview.» to «Any webpage can show the preview.» (:153-157); `channelWebPage_unsavedChangesAlert`: leaving with changes shows «Save preferences?» with «Save and notify channel subscribers» / «Exit without saving» (:68-80); `channelWebPage_relayWritesPreviewJson`: a JSON preview file appears in the relay's web dir, read by the harness (H/ChatRelays.hs:453) | RELAY (web flags) | — |
+| Copy embed code | «Copy code» | V/chat/group/ChannelWebPageView.kt:130-138 | `channelWebPage_copyEmbedCode` | The embed code is on the clipboard | RELAY (web flags), CB | — |
+| External embed script | — | V/chat/group/ChannelWebPageView.kt:173-186 | `channelWebPage_externalEmbedScriptLoads` | — | IGNORE: external resource, the channel-webpage embed script loaded from simplex.chat (plan §11.3) | — |
+| Owner leaving with a second owner | alice owns channel `team` with subscriber bob; `restart(fixture)` sets bob's `member_role='owner'` on alice's database | V/chat/group/GroupChatInfoView.kt:828-838 | `channelOwner_leaveWithSecondOwner` | With another owner present the channel info offers "Leave channel" to alice; leaving works (`APILeaveGroup` has no last-owner check, src/Simplex/Chat/Library/Commands.hs:3197-3217) | P, RELAY, FIXTURE, RESTART | Neither the UI (C/model/ChatModel.kt:2948-2952) nor the core ("owner role can't be assigned in channels", Commands.hs:2959) can assign a second owner, so a fixture sets it |
+| Delete channel | «Delete channel» | V/chat/group/GroupChatInfoView.kt:212-234 | `deleteChannel_ownerDeletesForAll` | «Delete channel?» («Channel will be deleted for all subscribers - this cannot be undone!») → «Delete»; then `#team: alice deleted the group (signed)` / `use /d #team to delete the local copy of the group` (H/Groups.hs:10808, :10821-10822) | RELAY, P | — |
+
+### 19. Channels: alice as subscriber, with a CLI owner and relays (26 tests)
+
+| Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|
+| Join | «Paste link» ▸ «Open channel» ▸ «Join channel» | V/newchat/ConnectPlan.kt:337-363,762-805; V/chat/ComposeView.kt:1767-1774,1987-2110 | `joinChannel_pasteLinkOpenChannel`, `joinChannel_joinViaRelay`, `joinChannel_incognito`, `joinChannel_noActiveRelays`, `joinChannel_receivesHistory` | `joinChannel_pasteLinkOpenChannel`: «Open channel» shows «Tap Join channel»; `joinChannel_joinViaRelay`: CLI owner: `#team: relay1 introduced alice in the channel` (src/Simplex/Chat/View.hs:1394; memberJoinChannel' H/Groups.hs:9446); `joinChannel_incognito`: the CLI owner prints the incognito name instead of `alice` (memberJoinChannelIncognito :9481); `joinChannel_noActiveRelays`: «Channel has no active relays. Please try to join later.»; `joinChannel_receivesHistory`: after joining, the channel shows the CLI owner's earlier broadcast (a late subscriber gets it as history, testChannelMessageDeleteFromHistory H/Groups.hs:12190-12191) | P, RELAY, CB | For `joinChannel_noActiveRelays` the CLI owner removes its relay (`/rm #team <relay>`) before alice pastes the link; `/rm` prints before the new link data (no relays) reaches the server (`updatePublicGroupData` → `setGroupLinkDataAsync`, src/Simplex/Chat/Library/Internal.hs:1618-1626, 1598-1604), so while the plan still shows «Open channel» alice taps «Cancel» (nothing is prepared before «Open channel», V/newchat/ConnectPlan.kt:777-781) and pastes again until it shows «Channel has no active relays. Please try to join later.» (`GLPNoRelays` for link data without relays, src/Simplex/Chat/Library/Commands.hs:4550) |
+| Join via two relays | «Join channel» | V/chat/ComposeView.kt:1987-2110 | `joinChannel_twoRelaysBothConnect` | The relay bar shows «%1$d/%2$d relays connected» out of 2 while joining and disappears once both relays are connected; «Chat relays» then shows both relays as «connected» | P, RELAY ×2, CB | — |
+| Join from a shared card | the owner shares the channel card in the direct chat | V/newchat/ConnectPlan.kt:762-805 | `joinChannel_viaSharedSignedCard` | «Link signature verified.» then join (H/ChatRelays.hs:244) | P, RELAY | — |
+| Signature failure | bob owns channel `team` and runs `/share chat #team @alice`, then re-sends the card tampered, as in 01 `planOwnerSignatureFailed` (the binding of the direct connection is kept, `src/Simplex/Chat/Library/Subscriber.hs:1931-1938`) | V/newchat/ConnectPlan.kt:809 | `joinChannel_signatureVerificationFailed` | Tapping the card shows "⚠️ Signature verification failed: %s." (`verifyLinkOwner`, `src/Simplex/Chat/Library/Commands.hs:4751-4760`) | P, RELAY | — |
+| Read / post | — | C/model/ChatModel.kt:1714-1718 | `subscriber_receivesBroadcast`, `subscriber_receivesEditAndDelete`, `subscriber_composeDisabled`, `subscriber_canReact`, `subscriber_promotedToContributorCanPost` | `subscriber_receivesBroadcast`: the CLI owner's `#team hi` shows in alice's channel as a message from the channel; `subscriber_receivesEditAndDelete`: after the owner edits it, the item shows the new text with the edit icon; after the owner deletes it, it shows «marked deleted» (as the subscribers' `[edited]` / `[marked deleted]` lines, H/Groups.hs:12139,12160); `subscriber_composeDisabled`: «you are subscriber»; `subscriber_canReact`: alice's 👍 on the owner's «hi» reaches the owner: `#team alice> > hi`, `    + 👍` (as cath's reaction in testChannels1RelayDeliver, H/Groups.hs:9275-9281); `subscriber_promotedToContributorCanPost`: after promotion, once alice's compose field no longer reads «you are subscriber» (the owner's `/mr` prints before the role change reaches her), she posts and the CLI owner sees `#team alice> member post [>>]` (testChannelObserverCannotPost H/Groups.hs:11518) | P, RELAY | The CLI owner is started with `--reactions` (`cli(…, flags = PeerFlags(reactions = true))`), without which it prints no received reactions (`View.hs:985-987`) |
+| Subscriber info | Group info | V/chat/group/GroupChatInfoView.kt:645-669,818-838 | `subscriberInfo_rows`, `subscriberInfo_ownersAndContributorsList`, `subscriberInfo_relaysView`, `subscriberInfo_shareViaChat`, `subscriber_leaveChannel`, `subscriber_channelDeletedByOwner`, `subscriber_chatWithAdmins`, `subscriber_verifyOwnerCode` | `subscriberInfo_rows`: Group info shows the channel QR code with «Share link», «Share via chat», «Owners & contributors», the footer «You can share a link or a QR code - anybody will be able to join the channel.» and «Leave channel» (V/chat/group/GroupChatInfoView.kt:640-669,828-838); `subscriberInfo_ownersAndContributorsList`: «Owners & contributors» lists the CLI owner; `subscriberInfo_relaysView`: «Chat relays» lists the relay with its status (V/chat/group/ChannelRelaysView.kt:62-105); `subscriberInfo_shareViaChat`: «Share via chat» closes Group info and opens the chat picker «Share channel…» (V/chatlist/ShareListView.kt:152); `subscriber_leaveChannel`: «Leave channel?» → CLI owner sees `#team: alice left the group (signed)` (testChannelSubscriberLeave H/Groups.hs:10891); `subscriber_channelDeletedByOwner`: compose «group is deleted»; `subscriber_chatWithAdmins`: Group info shows «Chat with admins»; a message alice sends there reaches the owner: `#team (support: alice) alice> hello [>>]` (as bob's in testSupportPreferenceChannel, H/Groups.hs:9162-9164); `subscriber_verifyOwnerCode`: «Verify security code» on the owner shows the same code the owner's CLI prints for `/code #team alice` (testChannelMemberSecurityCode H/Groups.hs:9329-9353) | P, RELAY | For `subscriber_chatWithAdmins` the CLI owner first runs `/set support #team on` (testChannelSupportScope H/Groups.hs:12082) |
+| Relay bar | — | V/chat/ComposeView.kt:1987-2110 | `subscriber_relayBarAfterRelayRemoved`, `subscriber_relayBarWaitingForOwner` | After the CLI owner removes the only relay (`/rm #team <relay>`, testChannelRemoveRelay H/Groups.hs:11621), the relay bar appears; expanding it shows «Waiting for channel owner to add relays.» | P, RELAY | — |
+| Plans | paste the channel link | V/newchat/ConnectPlan.kt:322-336,664 | `connectPlan_knownChannelSubscriber` | «You are a subscriber», «Open channel» | P, RELAY, CB | — |
+| Plans (own channel, relay address) | paste alice's own channel link or a relay address | V/newchat/ConnectPlan.kt:35-42,566-597 | `connectPlan_ownChannelLink`, `connectPlan_relayAddressRejected` | «Your channel» ▸ «Open channel»; «Relay address» alert | RELAY, CB | alice creates the channel herself (as in §18) |
+
+### 20. Business chats (16 tests)
+
+Enabling the business address is a catalogue-01 setting; here the address is set up by the harness through that flow.
+
+| Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|
+| alice as business | CLI customer connects to alice's business address | V/usersettings/UserAddressView.kt:571,625-648 | `business_customerConnectsCreatesBusinessChat`, `business_autoReplyWelcome`, `business_customerProfileUpdateRenamesChat` | CLI customer: `#alice: joining the group...`, then the welcome message from alice; customer `/p <new name>` followed by a message renames the business chat on alice's side (testBusinessAddress H/Profiles.hs:1950; testBusinessUpdateProfiles :2014, names substituted) | P | bob is the customer |
+| Business-side info | Group info | V/chat/group/GroupChatInfoView.kt:684,714,759-763; V/chat/group/AddGroupMembersView.kt:144,190 | `businessInfo_rowsForBusinessSide`, `business_addTeamMember`, `business_promoteCustomerToAdmin`, `business_removeMemberChatWording`, `business_deleteChat` | No link / «Chats with members» / edit profile; «Chat preferences», «Add team members», «Invite to chat»; `businessInfo_rowsForBusinessSide` also checks the footer «Only chat owners can change preferences.» (GroupChatInfoView.kt:726-729). Team member CLI: `#bob: alice invites you to join the group as member`; the customer CLI is told that the team member was added (testBusinessAddress, names substituted); `business_promoteCustomerToAdmin`: «admin» in bob's member info shows «Change role?» / «The role will be changed to "admin". Everyone in the chat will be notified.» (GroupMemberInfoView.kt:968-985); after «Change» bob's CLI prints a line ending `changed your role from member to admin (signed)` (View.hs:1421-1429); `business_removeMemberChatWording`: «Remove member» shows «Remove member?» / «Member will be removed from chat - this cannot be undone!» (GroupMemberInfoView.kt:305-311); `business_deleteChat`: «Delete chat» shows «Delete chat?» / «Chat will be deleted for all members - this cannot be undone!», and «Delete» removes the chat (GroupChatInfoView.kt:212-227,822-826) | P ×2 | bob is the customer, cath the team member |
+| alice as customer, connecting | paste business address ▸ «Open new chat» ▸ send request | V/newchat/ConnectPlan.kt:700-748; V/chat/ComposeView.kt:1775-1780 | `customer_connectToBusinessAddress`, `customer_connectWithRequestMessage` | Banner «Business connection». CLI business: `#alice: accepting business address request...`; with a request message, `#alice alice_1> Hello!` comes first, then the accepting line (H/Profiles.hs:4426,4490, names substituted) | P, CB | bob is the business |
+| alice as customer, known business | paste the business address again after connecting | V/newchat/ConnectPlan.kt:322-336,645-690 | `customer_knownBusinessPlan` | «Open chat» with the known business chat | P, CB | bob is the business |
+| alice as customer, still connecting | paste the business address again while the join is pending | V/newchat/ConnectPlan.kt:322-336,645-690 | `connectPlan_businessPendingOpensKnownChat` | The known-chat alert with «Open chat» opens the pending business chat (the core returns the known prepared group for the short link, src/Simplex/Chat/Library/Commands.hs:4536) | P, PEERCTL, CB | bob (business, auto-accept) is stopped before alice sends the request (after she opens the prepared chat), so the join stays pending: the request waits in his address queue on the SMP server, while a running bob would accept it within milliseconds (H/Profiles.hs:1955 `/auto_accept on business`) |
+| alice as customer, in the chat | business chat | V/chat/group/GroupChatInfoView.kt:253-262,759-763,829-838 | `customer_seesTeamMemberAdded`, `customer_chatInfoRows`, `customer_addFriendsWhenPromoted`, `customer_leaveChat` | `customer_seesTeamMemberAdded`: team member added event; `customer_chatInfoRows`: Group info shows «Chat preferences» with the footer «Only chat owners can change preferences.», the members list without «Add friends», and «Leave chat» (V/chat/group/GroupChatInfoView.kt:719-729,752-763,829-838; adding needs admin, C/model/ChatModel.kt:2527-2528); `customer_addFriendsWhenPromoted`: «Add friends» after promotion; `customer_leaveChat`: «Leave chat?» | P ×2 | bob is the business, cath a team member |
+
+"Owner contact on connect plan" is read as the owner-signature check on shared channel cards (`joinChannel_viaSharedSignedCard`).
+
+By Needs: 83 tests need a chat relay (`RELAY`: 82 in §18–§19 and `connectPlan_groupLinkRequiresNewerVersion` in §8); 2 need `NAMES`; 12 need a peer, relay or server stopped or restored (`PEERCTL` ×9, `SRVCTL` ×3); 1 needs `SMP2`; 5 need a `FIXTURE`; 3 need `RESTART`; 1 is `SLOW`; 6 have `S`: they live in the `InviteMembersCompatTest` and `JoiningCompatTest` classes and run again with a stable-release peer in their subclasses `InviteMembersCompatStableTest` and `JoiningCompatStableTest`.
+
+## Count
+
+| Section | Tests | Ignored |
+|---|---|---|
+| 1 Create group | 12 | 0 |
+| 2 Invite members | 11 | 0 |
+| 3 Group info rows | 13 | 0 |
+| 4 Profile / welcome | 14 | 0 |
+| 5 Group preferences | 19 | 1 |
+| 6 Admission / review | 16 | 2 |
+| 7 Group link | 14 | 0 |
+| 8 Joining / connect plan / invitations | 24 | 0 |
+| 9 Member list / selection | 10 | 0 |
+| 10 Member info | 28 | 0 |
+| 11 Member contacts | 5 | 0 |
+| 12 Support chats | 13 | 0 |
+| 13 Reports (moderator side) | 9 | 0 |
+| 14 Moderation | 6 | 0 |
+| 15 Mentions (notification side) | 2 | 0 |
+| 16 Events / history | 8 | 0 |
+| 17 Leave / delete / clear | 8 | 0 |
+| 18 Channels — owner | 58 | 1 |
+| 19 Channels — subscriber | 26 | 0 |
+| 20 Business chats | 16 | 0 |
+| **Total** | **312** | **4** |
diff --git a/plans/ui-tests/catalogue/04-settings-database-remote.md b/plans/ui-tests/catalogue/04-settings-database-remote.md
new file mode 100644
index 0000000000..955e5c2453
--- /dev/null
+++ b/plans/ui-tests/catalogue/04-settings-database-remote.md
@@ -0,0 +1,327 @@
+# UI test catalogue 4: settings, database, migration, remote desktop, misc
+
+Every settings and non-chat screen of the desktop app, mapped to UI test cases: **232 test cases** (**20** of them `@Ignore`) in 13 groups. One group is the remote-desktop flow, where a CLI plays the mobile as in `tests/RemoteTests.hs`. Rows follow `00-legend.md` (paths, `Test case(s)` format, Needs codes, users, ownership). None of these tests is written yet.
+
+## Path prefixes, legend and harness facts
+
+**Path prefixes** (repo-relative; `C/`, `D/`, `H/` as in `00-legend.md`):
+- `US/` = `C/views/usersettings/`
+- `NS/` = `US/networkAndServers/`
+- `T/` = `tests/`
+
+**Legend:**
+- **Picker** means clicking your own avatar in the chat list top bar, which opens UserPicker (`C/views/chatlist/UserPicker.kt:46`).
+- **Settings** means Picker > "Settings" (`UserPicker.kt:381`).
+- **Pref**: see `00-legend.md`.
+- **Log**: see `00-legend.md`.
+- **Needs** codes are the shared set in `00-legend.md`.
+
+**Harness facts that affect these tests:**
+1. **File dialogs.** Complete `simplexWindowState.openDialog` / `saveDialog` / `openMultipleDialog` (`D/DesktopApp.kt:273-275`, awaited in `D/platform/Files.desktop.kt:68-101`).
+2. **Esc.** The real handler is `Window(onKeyEvent)` (`DesktopApp.kt:125-130`), which isn't rendered in tests. For modals the harness's `escape()` runs the same `simplexWindowState.backstack` logic; alerts register no back handler, so a test closes an alert with `press(Key.Escape)` on the dialog root (plan §7.4).
+3. **Settings storage.** Settings go to `<configPath>/settings.properties` (`D/platform/Resources.desktop.kt:39-40`). Theme overrides (wallpapers, colours, imported themes) go to `<configPath>/themes.yaml` (`C/platform/Files.kt:127-161`). `themes.properties` (`Resources.desktop.kt:41-42`) holds only the legacy `Themes` map.
+   - On desktop the Cryptor is a passthrough (`D/platform/Cryptor.desktop.kt:3-10`), and `SharedPreference`-backed secrets are stored Base64-encoded (`C/views/helpers/DatabaseUtils.kt:29-32`). So `EncryptedAppPassphrase`, `EncryptedSelfDestructPassphrase` and `EncryptedDBPassphrase` hold the Base64 of the plain value; tests decode and compare.
+4. **Fresh state per test.** Each test starts with a fresh database, default prefs plus the harness pre-sets, and cleared in-memory state (plan §7.3). "Restart within test" (`RESTART`) is `restart()`; plan §7.3 gives the exact sequence (start as desktop startup does, `initChatControllerOnStart()`, `C/platform/Core.kt:59`, with `AppScreen()` composed at once so start-up alerts such as "Start chat?" can show).
+   - Notices checked once at first composition (the SimpleX Lock notice, `C/App.kt:94-103`; the app-update notice, desktop `Main.kt:79-87`; What's New is catalogue 01's) are tested by clearing their pre-set pref, creating the conditions (more than 3 chats), and restarting (plan §11.1).
+5. **Platform object.** `platform = object: PlatformInterface{…}` is set in `apps/multiplatform/desktop/src/jvmMain/kotlin/chat/simplex/desktop/Main.kt:65-90`. The harness installs an equivalent, or the update notice never shows.
+6. **Servers.** Preset operators (SimpleX Chat, Flux) point to public servers, which are unreachable in the test network namespace (plan §8.3). The harness sends `/_servers <userId> [json]` (a JSON array, `Library/Commands.hs:6201`) with the preset operator groups disabled and one custom group with the local servers (plan §8.2).
+   - "Your servers" is listed only when an operator-less server group exists (`NS/NetworkAndServers.kt:233-260`).
+7. **Lock and window focus.** The lock uses the window focus listener (`DesktopApp.kt:184-206`), which doesn't fire in tests. Simulate it with `AppLock.appWasHidden()` and `AppLock.recheckAuthState()` (`C/AppLock.kt:271-290`).
+8. **Desktop DB defaults.** A fresh desktop DB gets a random passphrase stored in settings: `InitialRandomDBPassphrase=true` (`C/views/helpers/DatabaseUtils.kt:51-71`). This blocks Export and Migrate until a passphrase is set.
+
+---
+
+### A. Settings root and global keys (7 tests)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Root | Desktop item list | Settings | `US/SettingsView.kt:81-144` | `settingsRoot_listsDesktopItems` | "Your settings" title; "Appearance", "Your privacy", "Help & support", "Chat data", "Migrate to another device", "Supporter perks"; under "Advanced settings": "Network & servers", "Audio & video calls", version row "<DESKTOP_VERSION_NAME> (<DESKTOP_VERSION_CODE>)" (e.g. "7.1-beta.6 (167)", no "v" prefix); NO "Notifications" item (Android-only, :124) and no shutdown item | — | – |
+| Root | Disabled when stopped | Settings | `SettingsView.kt:103-127,213` | `settingsRoot_itemsDisabledWhenChatStopped` | After `/_stop`: privacy, migrate, network and calls are disabled; Chat data shows the "Chat is stopped" red icon (contentDescription) | — | Stop the chat via Chat data first |
+| Root | Crowdfunding | Settings > "Crowdfunding on Wefunder" | `SettingsView.kt:132-141` | `settingsRoot_crowdfundingOpensGetStake` | GetStakeView opens (`C/views/onboarding/WhatsNewView.kt:1173`; title "Invest in\nSimpleX Chat", a hard-coded literal with a line break at `WhatsNewView.kt:1200`, joined into one line when the page is in the centre of the window (`WhatsNewView.kt:1201`)); "Learn more on Wefunder" records `https://wefunder.com/simplex.chat?utm_source=app` in the URI stub (`WhatsNewView.kt:1232-1236`) | URI | `crowdfundingAvailable()` is true on desktop |
+| Picker | Color mode switch (click) | Picker > moon/sun icon on the Settings row | `US/Appearance.kt:738-768` | `userPicker_colorModeSwitcherClick` | Pref CurrentTheme toggles LIGHT/DARK; Log `/_save app settings` | — | – |
+| Picker | Color mode switch (right-click) | Picker > right-click the moon/sun icon | `US/Appearance.kt:738-768` | `userPicker_colorModeSwitcherRightClickSystem` | Right-click, after a left click has set LIGHT/DARK, sets SYSTEM plus toast "System mode"; a second `/_save app settings` in the Log (each save runs 300 ms after its click and a newer click cancels a pending one, Appearance.kt:778-782) | TOAST | Right-click uses `onRightClick` |
+| Global keys | Esc closes modal | Settings > Appearance, press Esc | `DesktopApp.kt:125-130`, `D/platform/Back.desktop.kt:9` | `keyboard_escClosesTopModal` | The top modal pops; the next Esc closes Settings | — | Uses `escape()` (harness fact 2) |
+| Global keys | Esc dismisses alert | Settings > "Network & servers" > "Use SOCKS proxy" (alert "Use SOCKS proxy?"), press Esc | `C/views/helpers/AlertManager.kt:126-141`, `NS/NetworkAndServers.kt:101-125` | `keyboard_escDismissesAlert` | The alert is dismissed, the switch stays off, no `/_network` appears in the Log, and Network & servers stays open | — | `press(Key.Escape)` on the dialog root (harness fact 2): AlertManager registers no back handler, so `escape()` would close the modal under the alert instead |
+
+User picker rows, profile switching, profile editing (including the invalid-name and close-on-user-switch checks reached from Settings), the chat-profiles list and user chat preferences are owned by catalogue 01 (§5, §14).
+
+### B. Privacy (Your privacy, More privacy, receipts) (24 tests)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Privacy | Layout | Settings > "Your privacy" | `US/PrivacySettings.kt:55-117`, `D/views/usersettings/PrivacySettings.desktop.kt` | `privacy_sectionsAndFooter` | Sections "Device" (SimpleX Lock only), "Chats", "Files", "Auto-accept" (footer names the current profile), then an untitled section with the "More privacy" item | — | No screen-protection option on desktop |
+| Privacy | Link previews off | "Send link previews" | `PrivacySettings.kt:66-71` | `privacy_linkPreviewsOff_noPreview` | Pref PrivacyLinkPreviews=false; a link to `http://127.0.0.1:<port>/page` is sent without a preview and bob receives plain text | P (bob), HTTP | 04 owns turning the setting off; previews with the setting on are in catalogue 02 §B. `localhost` isn't parsed as a link; use 127.0.0.1 |
+| Privacy | Remove link tracking | "Remove link tracking" | `PrivacySettings.kt:72-76`, `C/views/chat/ComposeView.kt:1023-1069` | `privacy_removeLinkTracking` | Pref PrivacySanitizeLinks; with the setting on, `utm_*` parameters are removed from the URL in the compose field while typing, and bob receives the URL without them; with it off, the URL is kept as typed | P (bob) | 04 owns this setting and its effect (legend) |
+| Privacy | Auto-accept images off | "Auto-accept images" | `PrivacySettings.kt:81` | `privacy_autoAcceptImagesOff` | Pref PrivacyAcceptImages=false; bob sends an image (`/img`); once the image item is in alice's chat with bob (the CLI prints the sent image before it reaches her, so an earlier check would pass before any receipt could start), and the app is idle (`UiIdle`: the auto-download decision runs in the same background job right after the item is added, `SimpleXAPI.kt:3012-3037`), no `/freceive <fileId>` (`SimpleXAPI.kt:4304`) appears in the Log and the image stays undownloaded | P (bob), XFTP | 04 owns turning the setting off; automatic receipt with the setting on is in catalogue 02 §G |
+| Privacy | Blur media | "Blur media" (Off/Soft/Medium/Strong) | `PrivacySettings.kt:311-333` | `privacy_blurMediaOptions` | Pref PrivacyMediaBlurRadius = 0/12/24/48 | — | The blur itself is visual only; the pref is asserted |
+| Auto-accept | Group invitations | "Group invitations" | `PrivacySettings.kt:98-103,357` | `privacy_autoAcceptGroupInvitations` | Log `/_set accept group invitations <userId> on` (`SimpleXAPI.kt:4134`); bob invites, GUI joins without action (`H/Profiles.hs` testAutoAcceptGroupInvitations) | P (bob) | – |
+| Auto-accept | Member contact requests | "Contact requests in groups" | `PrivacySettings.kt:92-97,349` | `privacy_autoAcceptContactRequestsInGroups` | Log `/_set accept member contacts <userId> on` (`SimpleXAPI.kt:4133`); a member's contact request is auto-accepted | P ×2 (bob, cath) | bob hosts `team` (`/g team`, so "Direct messages" is on; alice-created groups start with it off, `AddGroupView.kt:160-162`, and with it off the request fails with "direct messages not allowed", `src/Simplex/Chat/Library/Commands.hs:2624`) and invites alice and cath. cath, who is not alice's contact, sends `@#team alice hi`: only a sender who isn't already alice's contact creates a member-contact request, an existing contact just sends a direct message (`Commands.hs:2621-2633`). alice takes no action; cath prints `alice: contact is connected` |
+| More privacy | Last messages | Settings > Your privacy > "More privacy" > "Show last messages" | `PrivacySettings.kt:125-132` | `morePrivacy_showLastMessages` | Pref PrivacyShowChatPreviews; chat list preview text disappears | P (bob) | – |
+| More privacy | Drafts off | "Message draft" | `PrivacySettings.kt:133-142` | `morePrivacy_messageDraftDisabledClears` | Pref PrivacySaveLastDraft=false; text typed in bob's chat is gone from the compose field after opening cath's chat and returning | P ×2 (bob, cath) | 04 owns turning the setting off; draft behaviour with the setting on (the default) is in catalogue 02 §S |
+| More privacy | Verify names | "Verify SimpleX names" | `PrivacySettings.kt:143-147` | `morePrivacy_verifySimplexNamesPref` | Pref PrivacyVerifySimplexNames (default off); bob's profile carries a registered SimpleX name; with the pref on, opening bob's contact info verifies the name automatically (`C/views/chat/SimplexNameView.kt:63-65`, shown at `C/views/chat/ChatInfoView.kt:760`): once bob's `contact.profile.contactDomainVerified` is true (polled, `SimplexNameView.kt:125,130`; the link is also absent while the spinner shows and after a failed verification, :38-60, 76-96) the name has no "Verify name" link (its check icon, :80-84,111-115, has no description, so it shows only in the screenshot); with it off, the name shows the "Verify name" link (`SimplexNameView.kt:89-96`) until it is clicked | P (bob), NAMES | – |
+| More privacy | Encrypt files | "Encrypt local files" | `PrivacySettings.kt:158-160` | `morePrivacy_encryptLocalFilesOn`, `morePrivacy_encryptLocalFilesOff` | Log `/_files_encrypt on/off`; the received file on disk differs from (or equals) the fixture bytes (`H/Files.hs` testXFTPFileTransferEncrypted) | P (bob), XFTP | – |
+| More privacy | Protect IP | "Protect IP address" | `PrivacySettings.kt:161-170` | `morePrivacy_protectIpAsksForUnknownXftp`, `morePrivacy_protectIpOffDownloadsSilently` | Pref PrivacyAskToApproveRelays and the footer text change (PrivacySettings.kt:164-170): on, "The app will ask to confirm downloads from unknown file servers (except .onion or when SOCKS proxy is enabled)."; off, "Without Tor or VPN, your IP address will be visible to file servers."; on: clicking bob's file shows "Unknown servers!" (`SimpleXAPI.kt:2309`); off: no alert, the Log has `/freceive <fileId> approved_relays=on …` (:2235, 4303) and the file downloads | P (bob, using the second XFTP server), XFTP2 | bob uses `cli(…, servers = PeerServers(xftp = "xftp2"))` (plan §9.2) |
+| More privacy | Show encryption | "Show encryption" | `PrivacySettings.kt:162`, `C/views/chat/item/CIMetaView.kt:82,111-114` | `morePrivacy_showEncryptionToggle` | Pref PrivacyShowEncryption; bob sends a file and the GUI receives it (the icon needs the downloaded file, `C/views/chat/item/CIFileView.kt:210`); with the setting on, the item shows the lock icon (`ItemMetaKey` `encrypted`); with it off, no lock icon | P (bob), XFTP | 04 owns this setting and the lock icon |
+| More privacy | Notification preview | "Show preview" > Message text / Contact name / Hidden | `PrivacySettings.kt:173-195`, `US/NotificationsSettingsView.kt:81` | `morePrivacy_notificationPreviewModes` | Pref NotificationPreviewMode per mode; when bob messages, the recording notification manager records a notification call | P (bob), NTF | One test iterating over the 3 modes. The preview text is built inside the desktop notification manager (`D/model/NtfManager.desktop.kt:100-102`), below the recording notification manager, so the test asserts the pref and that a notification call was recorded (plan §7.6) |
+| Receipts | Contacts toggle (no overrides) | "Send delivery receipts to" > "Contacts" | `PrivacySettings.kt:199-266,386` | `receipts_contactsToggle_noOverrides` | Log `/_set receipts contacts <userId> <on/off> clear_overrides=off` (no overrides exist, so the app passes `clearOverrides = false`, `PrivacySettings.kt:261-262`; `SimpleXAPI.kt:4127`); Pref PrivacyDeliveryReceiptsSet goes from false to true; no alert (`H/Direct.hs` testConfigureDeliveryReceipts) | P (bob) | The harness pre-set of `privacyDeliveryReceiptsSet` is cleared first (the startup prompt is checked only in `startChat`, so it does not appear without a restart) |
+| Receipts | Contacts toggle (with overrides) | "Send delivery receipts to" > "Contacts" | `PrivacySettings.kt:199-266,386` | `receipts_contactsOverrideAlert_keep`, `receipts_contactsOverrideAlert_forAll`, `receipts_contactsOverrideAlert_cancel` | Alert "Disable receipts?" with "Disable (keep overrides)" / "Disable for all" / "Cancel"; Log `/_set receipts contacts <userId> off clear_overrides=<off/on>` or nothing on cancel (`H/Direct.hs` testConfigureDeliveryReceipts) | P (bob) | bob's contact has receipts explicitly turned on first through the GUI: bob's contact info > "Send receipts" > "yes" (`C/views/chat/ChatInfoView.kt:84-87,1228-1239`). A console `/receipts @bob on` replies only `ok` and does not update the GUI's chat model, which the alert counts overrides from (`PrivacySettings.kt:248-256`), so no alert would show; an "off" override is not counted when disabling (`PrivacySettings.kt:253-264`) |
+| Receipts | Groups toggle (no overrides) | "Small groups (max 20)" | `PrivacySettings.kt:224-281,394` | `receipts_groupsToggle` | Log `/_set receipts groups <userId> <on/off> clear_overrides=off` (no contact or group overrides exist, so the app passes `clearOverrides = false`, `PrivacySettings.kt:267-279`; `SimpleXAPI.kt:4131`) (`H/Groups.hs` testConfigureGroupDeliveryReceipts) | P | A group with bob is set up first |
+| Receipts | Groups toggle (with overrides) | "Small groups (max 20)" | `PrivacySettings.kt:224-281,394` | `receipts_groupsOverrideAlert` | Alert "Disable receipts for groups?" with "Disable (keep group overrides)" / "Disable for all groups" / "Cancel"; Log `/_set receipts groups <userId> off clear_overrides=<off/on>` or nothing on cancel (`PrivacySettings.kt:452-481`; `H/Groups.hs` testConfigureGroupDeliveryReceipts) | P | A group with bob is set up first, with group receipts turned on through the GUI: group info > "Send receipts" > "yes" (`C/views/chat/group/GroupChatInfoView.kt:93-96,735`). A console `/receipts #<group> on` does not update the GUI's chat model (`PrivacySettings.kt:262-270`), so no alert would show; an "off" override is not counted when disabling (`PrivacySettings.kt:268-279`) |
+| Startup | Receipts prompt | app start with PrivacyDeliveryReceiptsSet=false | `US/SetDeliveryReceiptsView.kt:22-122`, `SimpleXAPI.kt:679-681`, `C/App.kt:371` | `deliveryReceiptsStartupView_enable`, `deliveryReceiptsStartupView_skip` | "Delivery receipts!" → "Enable" sends `/set receipts all on`; "Don't enable" shows the "Delivery receipts are disabled!" alert | RESTART | 04 owns this prompt; the harness pre-set of `privacyDeliveryReceiptsSet` is cleared, then the core restarted |
+
+### C. SimpleX Lock (desktop passcode) and self-destruct (22 tests)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Lock | Enable | Settings > Your privacy > "SimpleX Lock" > "Enable lock" | `PrivacySettings.kt:639-673`, `C/views/localauth/SetAppPasscodeView.kt:13` | `lock_enable_setsPasscode` | "New Passcode" → digits + Enter → "Confirm passcode" → alert "Passcode set!"; Pref PerformLA=true, LocalAuthenticationLockDelay=30, EncryptedAppPassphrase decodes (Base64) to the digits | — | Only PASSCODE mode on desktop (`LAMode.default`) |
+| Lock | Cancel | same > Cancel | `PrivacySettings.kt:659-663` | `lock_enable_cancelKeepsOff` | PerformLA stays false | — | – |
+| Lock | Mismatch | same, wrong confirmation | `SetAppPasscodeView.kt:27-55` | `lock_enable_confirmMismatch` | Not saved; stays on the confirm step | — | – |
+| Lock | Lock after | "Lock after" | `PrivacySettings.kt:809-842` | `lock_lockAfterOptions` | "10 seconds", "30 seconds", "1 minutes", "3 minutes", "10 minutes", "Immediately"; Pref LocalAuthenticationLockDelay | — | Lock enabled first |
+| Lock | Change passcode | "Change passcode" | `PrivacySettings.kt:588-610` | `lock_changePasscode_success`, `lock_changePasscode_wrongCurrent` | "Current Passcode" → new → "Passcode changed!"; wrong current gives "Authentication failed" | — | Lock enabled first |
+| Lock | Disable | toggle off | `PrivacySettings.kt:670-672`, `C/AppLock.kt:185` | `lock_disable_requiresPasscode` | Passcode prompt, then PerformLA=false | — | Lock enabled first |
+| Lock | Startup screen | restart with lock on | `App.kt:210-224`, `C/views/localauth/LocalAuthView.kt:18-49` | `lock_screenOnStartup_correct`, `lock_screenOnStartup_wrong_showsUnlock` | "Enter Passcode" / "Submit"; `lock_screenOnStartup_correct`: the right passcode and "Submit" close the passcode screen and show the chat list "Chats" (`LocalAuthView.kt:35-39`, `C/AppLock.kt:162-163`, `App.kt:210-224`); `lock_screenOnStartup_wrong_showsUnlock`: a wrong passcode shows the "Authentication failed" alert (`laFailedAlert`, `C/AppLock.kt:164-168`), then the "Unlock" button | RESTART | – |
+| Lock | Relock | after background | `AppLock.kt:271-290`, `DesktopApp.kt:184-206` | `lock_relocksAfterDelay` | With "Lock after" set to "10 seconds", an immediate `appWasHidden()` + `recheckAuthState()` leaves the chat list; after `wait(10 s)` the recheck shows "Enter Passcode" (the delay is measured with `System.nanoTime()`, `AppLock.kt:269, 277-279`, not the test clock; `DesktopApp.kt:186-192`) | — | Lock enabled first; window focus is simulated (harness fact 7) |
+| Lock | Protected actions | "Migrate to another device"; version row > "Developer tools" > "Chat console"; a profile action inside Picker > "Your chat profiles"; Chat data > "Database passphrase & export" > "Chat is running" off → "Stop chat?" → "Stop" | `SettingsView.kt:473-520`, `US/DeveloperView.kt:32`, `C/views/database/DatabaseView.kt:296-307,443-451,462-466`, `UserPicker.kt:268-297` | `lock_protectedActionsPrompt`, `profiles_actionsRequireAuthOnceWhenLocked` | Prompts "Open migration screen" / "Open chat console" / "Change chat profiles" / "Stop chat" (one test iterating over the 4 actions); opening "Your chat profiles" itself does not prompt; its first profile action prompts, and later actions in the same screen don't (stateGetOrPut "authorized", `UserPicker.kt:274-292`) | — | Lock enabled first |
+| Lock | Notice | chat list with >3 chats | `App.kt:93-104`, `AppLock.kt:36-45` | `lock_noticeOfferedWithManyChats` | "SimpleX Lock" alert → "Turn on" starts the passcode flow; Pref LANoticeShown | RESTART | 04 owns this notice. The check runs once at first composition (`App.kt:94-103`), so the pre-set of `laNoticeShown` is cleared, chats are created until `chatModel.chats.size > 3` (local groups via the console; the size counts the notes folder and the "Ask SimpleX Team" card, so two are enough), and the core restarted (harness fact 4) |
+| Lock | Keyboard entry | passcode screen | `C/views/localauth/PasscodeView.kt:34-62` | `lock_passcodeKeyboardKeys` | Digits, NumPad, Backspace, Ctrl+Backspace clears, Enter submits only when ≥4 digits | — | – |
+| Lock | On-screen keypad | Settings > Your privacy > "SimpleX Lock" > "Enable lock" → "New Passcode": click 1 2 3 4 5, backspace, the dots, clear (x), then 1 2 3 4 → "Save" → "Confirm passcode": 1 2 3 4 → "Confirm" | `C/views/localauth/PasswordEntry.kt:22-48, 50-69, 101-145`; `C/views/localauth/PasscodeView.kt:64-84, 130-131` | `lock_passcodeKeypad_digitsBackspaceClearReveal` | Five clicks show "●●●●●"; backspace leaves "●●●●"; clicking the dots shows "1234" and clicking again masks it; clear (x) empties the field and "Save" is disabled (fewer than 4 digits, PasscodeView.kt:81); after confirming, "Passcode set!" and PerformLA=true as in `lock_enable_setsPasscode` | — | Desktop always uses the vertical keypad (PasscodeView.kt:130-131). Clear and backspace have no content description and digits are plain text: K4 keys needed |
+| Self-destruct | Enable | "Enable self-destruct" | `PrivacySettings.kt:569-586,761-776` | `selfDestruct_enable`, `selfDestruct_cannotEqualAppPasscode` | "Current Passcode" → "Set passcode" ("Enable self-destruct passcode") → "Confirm passcode" → "Self-destruct passcode enabled!"; Pref LocalAuthenticationSelfDestruct=true; with the app passcode typed as the new one, "Save" stays disabled and Enter is ignored (`SetAppPasscodeView.kt:54-55`, `PasscodeView.kt:53-56,81`) | — | Lock enabled first |
+| Self-destruct | Info | info icon | `PrivacySettings.kt:745-758` | `selfDestruct_infoView` | "Self-destruct" page with 3 items | — | Lock enabled first (the section shows only with the lock on, `PrivacySettings.kt:697`) |
+| Self-destruct | Display name | "New display name:" | `PrivacySettings.kt:716-730` | `selfDestruct_displayNamePersisted` | Pref LocalAuthenticationSelfDestructDisplayName | — | Lock and self-destruct enabled first (`PrivacySettings.kt:697`) |
+| Self-destruct | Change | "Change self-destruct passcode" → "Current Passcode" (the app passcode) → new digits → "Save" → same digits → "Confirm" | `PrivacySettings.kt:612-637`; `C/views/localauth/SetAppPasscodeView.kt:13-61` | `selfDestruct_changePasscode` | "Self-destruct passcode changed!"; EncryptedSelfDestructPassphrase decodes to the new digits | — | Lock and self-destruct enabled first (`PrivacySettings.kt:697`) |
+| Self-destruct | Trigger | restart, enter the self-destruct code | `LocalAuthView.kt:26-31,51-102` | `selfDestruct_triggeredOnLockScreen` | DB deleted, new profile with that display name, bob contact gone, the app passcode becomes the self-destruct code | RESTART, P (bob) | – |
+| Self-destruct | Disable | toggle off → "Current Passcode" (the app passcode) | `PrivacySettings.kt:569-583,511-514` | `selfDestruct_disable` | Pref LocalAuthenticationSelfDestruct=false; prefs EncryptedSelfDestructPassphrase and InitializationVectorSelfDestructPassphrase unset (`DatabaseUtils.kt:36-40`; the Keystore delete does nothing on desktop, `Cryptor.desktop.kt:12-14`) | — | Lock and self-destruct enabled first (`PrivacySettings.kt:697`) |
+
+### D. Appearance (24 tests)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Appearance | Language | Settings > "Appearance" > "Language" (the string is "LANGUAGE", title-cased in code: strings.xml:1566, `US/Appearance.kt:1134`) | `D/views/usersettings/Appearance.desktop.kt:43-66`, `US/Appearance.kt:1101` | `appearance_language_switch`, `appearance_language_backToSystem` | Pref AppLanguage=de / null; after `poll` for the 200 ms delayed write, Settings is closed and the Picker reopened, and it shows the localized "Settings" (screens composed before the change keep their strings: the full recomposition is the Window key at `D/DesktopApp.kt:123-124`, which tests don't render) | — | `Locale.getDefault()` is JVM-wide ("system" restores `defaultLocale`, `D/platform/AppCommon.desktop.kt:19`); the next reset restores English (`PrefStores.restore()` calls `Locale.setDefault(Locale.ENGLISH)`, plan §7.3). The test's `finally` only keeps the rest of this test and its failure report in English |
+| Appearance | One-hand UI | "Reachable app toolbars" / "Reachable chat toolbar" | `Appearance.desktop.kt:64-67` | `appearance_reachableAppToolbars`, `appearance_reachableChatToolbarVisibility` | Pref OneHandUI / ChatBottomBar; the chat toolbar row is visible only when OneHandUI is on and ChatBottomBar is off | — | On desktop ChatBottomBar is true by default and no desktop UI sets it false (`SimpleXAPI.kt:276,8722`), so the test writes `appPrefs.chatBottomBar = false` directly, checks that the row appears with OneHandUI on, and that turning it on hides the row |
+| Themes | Color mode | "Color mode" (System/Light/Dark) | `Appearance.kt:566-579,1144` | `appearance_colorMode_systemLightDark` | Pref CurrentTheme; `CurrentColors.value.base`; Log `/_save app settings` | — | – |
+| Themes | Dark mode colors | "Dark mode colors" (Dark/SimpleX/Black) | `Appearance.kt:582-591,1165` | `appearance_darkModeColors` | Pref SystemDarkTheme | — | – |
+| Themes | Wallpaper preset | preset grid | `Appearance.kt:313-440,538` | `appearance_wallpaperPreset_select` | `themes.yaml` (harness fact 3) holds the preset wallpaper for the current base theme; Pref CurrentThemeIds is updated; Log `/_save app settings` | — | – |
+| Themes | Own image | "+" tile / "Remove image" | `Appearance.kt:495-505,547-564` | `appearance_wallpaperImage_import`, `appearance_wallpaperImage_remove` | File created/deleted in the wallpapers dir; WallpaperType.Image | FD | – |
+| Themes | Per-user theme | "Apply to" | `Appearance.kt:894-950,771-788` | `appearance_themeDestination_perUser` | "Apply to" > alice, then a wallpaper preset is chosen; Log `/_set theme user <userId> {…}` (apiSetUserUIThemes, `SimpleXAPI.kt:4278`); the user's `uiThemes` is set; `themes.yaml` is unchanged | — | – |
+| Customize | Colors | "Customize theme" > "Interface colors" > "Accent"…, "Reset colors" | `Appearance.kt:613-735,952-1099` | `customizeTheme_editInterfaceColor`, `customizeTheme_resetColors` | `themes.yaml` holds the edited accent for the current base theme (`SimpleXAPI.kt:388-391`); after "Reset colors" it no longer has it | DT (hex field) | The hex field is used instead of dragging the colour picker |
+| Customize | Chat colors | "Chat colors": after choosing an image wallpaper, "Scale" (a dropdown, shown only for an image) = Fit, and hex values typed for "Wallpaper background", "Wallpaper accent", "Sent message", "Received message" | `Appearance.kt:1188-1276`, `ui/theme/Theme.kt:225-231` | `customizeTheme_wallpaperScaleAndChatColors` | `themes.yaml` holds, for the current base theme, `wallpaper.scaleType: fit` (`@SerialName("fit")`, ChatWallpaper.kt:267; written `scaleType: "fit"`), `wallpaper.background`/`tint` and the sent/received colours equal to the typed values (stored as `#ffrrggbb` in lower case, ThemeManager.kt:125) (`SimpleXAPI.kt:246, 388-391`) | FD (wallpaper image), DT | – |
+| Customize | Theme file | "Export theme" / "Import theme" | `Appearance.kt:700-732` | `customizeTheme_exportTheme`, `customizeTheme_importTheme`, `customizeTheme_importInvalidTheme` | Export: after the accent is set to `#FF0000`, the file written via saveDialog (proposed name "simplex.theme", `Appearance.kt:715`) is YAML with `base:` and `accent: "#ffff0000"` (export writes `toReadableHex()`, lower case with alpha, ThemeManager.kt:227-238, Theme.kt:204-212) and no `themeId` line (:710-714; `ui/theme/Theme.kt:184-185,304-308`); import: a file with `base: LIGHT` and `colors: {accent: "#00FF00"}` makes `themes.yaml` (harness fact 3) hold accent `#00FF00` for the light theme and logs `/_save app settings` (:718-725); invalid YAML shows "Import theme error" (`C/views/helpers/Utils.kt:157-171`) and `themes.yaml` stays byte-identical | FD | – |
+| Tray | Close to tray | (section) | `Appearance.desktop.kt:72-75,97-110` | `appearance_closeToTray_hiddenWithoutTray` | "Close to tray" absent when `trayIsAvailable`=false (headless) | — | The real tray behaviour is an `IGNORE` row in §M |
+| Toolbars | App toolbars | "App toolbars" > "Transparency" / "Blur" | `Appearance.kt:94-178` | `appearance_toolbarTransparency`, `appearance_toolbarBlur` | Pref InAppBarsAlpha / AppearanceBarsBlurRadius | — | Blur shows only if `deviceSupportsBlur` or the pref is >0. Test baseline is blur off (`AppearanceBarsBlurRadius` = 0, plan 7.2/11.1, for performance), so `appearance_toolbarBlur` starts from 0 and sets a non-zero radius |
+| Shape | Message shape | "Message shape" > "Corner" slider, "Tail" | `Appearance.kt:181-208` | `appearance_messageShapeCornerAndTail` | Pref ChatItemRoundness / ChatItemTail | — | – |
+| Images | Profile images | "Profile images" slider | `Appearance.kt:62-92` | `appearance_profileImageCornerRadius` | Pref ProfileImageCornerRadius | — | – |
+| Font | Font size | "Font size" box/slider | `Appearance.kt:211-268` | `appearance_fontSize_sliderAndReset` | Pref FontScale; tapping the box resets to 1 | — | – |
+| Zoom | Zoom | "Zoom" | `Appearance.desktop.kt:112-153` | `appearance_zoom_sliderAndReset` | Pref DensityScale in 1.0..2.0 | — | – |
+| Persistence | Restart | restart after changing settings | – | `appearance_settingsPersistAcrossRestart` | Theme, font and zoom restored | RESTART | – |
+
+### E. Network & servers (43 tests)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Root | Layout | Settings > "Network & servers" | `NS/NetworkAndServers.kt:158-317` | `network_rootLayout` | "Preset servers" (operator rows), "Messages and files": "Your servers", "Use SOCKS proxy", "SOCKS proxy settings", "Advanced network settings", "Save servers" (disabled), "Calls": "WebRTC ICE servers"; no connection-status section (Android-only) | — | – |
+| Operators | Toggle | operator row > "Use servers" | `NS/OperatorView.kt:47-168,547-600,878` | `operators_enableDisableOperator` | Turning "Use servers" on opens "Use SimpleX Chat" (`use_servers_of_operator_x`, "Use %s" with the operator name; conditions are not accepted in a fresh DB, `OperatorView.kt:571-583`); "Accept conditions" sends `/_accept_conditions <conditionsId> <operatorId>` and turns the switch on (`OperatorView.kt:614-623`). Unsaved indicator appears; "Save servers" sends `/_servers` and reads the servers back. Turning it off needs no conditions (`/_operators <json>` is used only by onboarding) (`H/Direct.hs` testOperators) | — | Toggling only; preset servers are unreachable in the namespace |
+| Operators | Conditions | "Review conditions" / "Accepted conditions" | `NetworkAndServers.kt:188-228,726-830` | `operators_reviewAcceptConditions` | "Accept conditions" sends `/_accept_conditions <conditionsId> <operatorIds>` (`SimpleXAPI.kt:4228`); conditions text comes from core | RESTART | The harness disables both operators, so the button is hidden. The UI can't enable an operator without accepting its conditions (`OperatorView.kt:571-583`), after which reopening shows "Accepted conditions". So the console sends `/_servers <userId> <json>` with the SimpleX Chat operator `enabled: true`, then the core is restarted, because `chatModel.conditions` is reloaded only in `initChatController` (`C/platform/Core.kt:143`) or after "Save servers" (`conditionsAction` is also read once when the screen opens, `NS/NetworkAndServers.kt:169,219`). "Review conditions" then shows; after accepting, reopening shows "Accepted conditions". After the restart What's New with "View updated conditions" opens by itself (01 `whatsNewShowsViewUpdatedConditions`); the test closes it first |
+| Operators | Roles | "Use for messages", "To receive", "For private routing", "To resolve names", "Use for files", "To send" | `OperatorView.kt:246-460`, `NetworkAndServers.kt:950-993` | `operators_roleToggles_validation` | With the operator enabled first (conditions accepted in the "Use SimpleX Chat" sheet; role sections show only for an enabled operator, `OperatorView.kt:242`) and smp1's "To receive" set to "no" in its server view (`ProtocolServerView.kt:215`; otherwise smp1 keeps receiving by default, `src/Simplex/Chat/Operators.hs:190-193`): turning off the operator's "To receive" shows the footer "No servers to receive messages." and disables "Save servers" (`SimpleXAPI.kt:4922-4923`; `T/OperatorTests.hs`) | — | – |
+| Operators | Info | operator info | `OperatorView.kt:503` | `operators_infoView` | "Network operator" page | — | – |
+| Servers | Add SMP | "Your servers" > "Add server" > "Enter server manually" | `NS/ProtocolServersView.kt:32-300`, `NS/NewServerView.kt:15-154` | `yourServers_addSmpManually` | "New server" → address → "Test server" ✓ → back (adds it to "Your servers", `NS/NewServerView.kt:26-36`) → "Save servers" on Network & servers; Log `/_servers <uid> […]` (a JSON array of operator groups, `SimpleXAPI.kt:4224`); reopening shows it (testGetSetSMPServers) | SMP2 | Adds the second local SMP server |
+| Servers | Add XFTP | same | same | `yourServers_addXftpManually` | Listed under "Media & file servers" (testGetSetXFTPServers) | XFTP2 | – |
+| Servers | Test all | "Test servers" | `ProtocolServersView.kt:237-260,382-410` | `yourServers_testServers_allPass` | Log `/_server test`; all local servers pass (testTestSMPServerConnection, testTestXFTPServer) | — | – |
+| Servers | Test all (failure) | "Test servers" | `ProtocolServersView.kt:237-260,349-380` | `yourServers_testServers_someFail` | Alert "Server test failed!" whose text starts "Some servers failed the test:" and names the failed server (testTestSMPServerConnection) | — | A server address on an unused port from the JVM's port block (plan §8.2) is added first |
+| Servers | Invalid | NewServerView | `NewServerView.kt:101-154` | `newServer_invalidAddress` | "Invalid server address!" | — | – |
+| Servers | Preset host | NewServerView | `NewServerView.kt:130-140` | `newServer_presetHostAddedToOperator` | "Operator server" / "Server added to operator %s." | — | – |
+| Servers | Server view | tap server | `NS/ProtocolServerView.kt:35-293` | `serverView_toggleUseAndSave`, `serverView_deleteServer` | `serverView_toggleUseAndSave`: "Use for new connections" off (`ProtocolServerView.kt:258-265`), back, "Save servers": the Log's `/_servers <uid> […]` (a JSON array, pretty-printed: `json`, `SimpleXAPI.kt:4224,6546-6551`) has that server with `"enabled": false`, and reopening shows the toggle off; `serverView_deleteServer`: "Delete server" removes the row from "Your servers" (`OperatorView.kt:108-115`; `ProtocolServersView.kt:106,474-483`), and after "Save servers" the Log's `/_servers <uid> […]` has the server with `"deleted": true` (`UserServer`, `SimpleXAPI.kt:5001-5009`) | — | Both act on a second SMP server added by address (host `127.0.0.1`, not tested) and saved first: with smp1 the only enabled message server, turning it off or deleting it blocks "Save servers" (`noServersErrs`, `src/Simplex/Chat/Operators.hs:543-548`), and an unsaved server is dropped without `"deleted"` (`ProtocolServersView.kt:484-491`); the second server is unreachable and never contacted, so this is not `SMP2` |
+| Servers | Per-server roles | "Your servers" > tap smp1 > "Use for messages": "To receive" / "For private routing" / "To resolve names" | `NS/ProtocolServerView.kt:197-242` | `serverView_perServerRoles` | Shown for an enabled SMP server (`ProtocolServerView.kt:199`); options "default (yes)" / "yes" / "no" ("To resolve names": "default (no)") (`ProtocolServerView.kt:228-234`); after "Save servers" the Log `/_servers <userId> […]` (a JSON array) carries the server's roles and reopening shows them; "To receive" = "no" on smp1, the only enabled SMP server, shows the footer "No servers to receive messages." in "Your servers" (`ProtocolServersView.kt:116-120`) | — | – |
+| Servers | QR | "Your servers" > tap smp1 | `ProtocolServerView.kt:203-207` | `serverView_addToAnotherDeviceQr` | Section "Add to another device" with a QR image (contentDescription `image_descr_qr_code`, `QRCode.kt:83`; shown only for a valid address) | — | Display only |
+| Servers | Unsaved | back with changes | `NetworkAndServers.kt:61-80,899` | `network_unsavedServersAlert_save`, `network_unsavedServersAlert_exit` | "Save servers?" offers "Save" / "Exit without saving"; "Save": Log `/_servers <uid> […]` (`SimpleXAPI.kt:4224`) and reopening shows the change; "Exit without saving": no `/_servers <uid> […]` (only the plain `/_servers <uid>` read on reopening), and the change is gone | — | – |
+| Servers | Validation | remove all receive servers | `NetworkAndServers.kt:282-298` | `servers_validationErrorsBlockSave` | Deleting the only message server (smp1) in "Your servers" shows the footer "No message servers."; "Save servers" is disabled ("Errors in servers configuration." appears only for errors without their own text, e.g. two servers with the same host, `NetworkAndServers.kt:281-291`) | — | – |
+| Relays | Add/test | "Add server" > "Chat relay" > "New chat relay" | `NS/ChatRelayView.kt:66-110,346-408` | `chatRelays_addAndTest` | Address + name → "Test relay" ✓ → added to the unsaved list on going back (`ChatRelayView.kt:92-104`), sent in `/_servers` after "Save servers" (`H/ChatRelays.hs` testGetSetChatRelays, testChatRelayTest) | RELAY | The relay's address is the link its headless process prints after "Chat relay address is created:" on first start (plan §8.1); the harness does not pre-register this relay in the GUI's servers |
+| Relays | Invalid input | same | `ChatRelayView.kt:38-60,80-90` | `chatRelays_invalidNameOrAddress` | "Invalid relay name!" / "Invalid relay address!" | — | Input validation only |
+| Relays | Test fails | same | `ChatRelayView.kt:295` | `chatRelays_testFails` | The relay's address is entered, then the relay deletes it (`RelayPeer.run("/da")`, plan §8.1); "Test relay" shows "Relay test failed!" (`H/ChatRelays.hs` testChatRelayTest, scenario 3, RTSGetLink) | RELAY, PEERCTL | A contact address is not a relay link, so "Test relay" stays disabled for it (`ChatRelayView.kt:58-64,302`) |
+| Relays | Relay view | tap relay | `ChatRelayView.kt:111-320` | `chatRelays_toggleUseAndDelete` | On the custom relay in "Your servers": the "Use for new channels" switch (the only one, under the "Use relay" section header, `ChatRelayView.kt:286,311-317`) off, back: the relay row shows the do-not-disturb icon and its name in the secondary colour (`ChatRelayView.kt:331,337-341`); "Save servers": the Log's `/_servers <uid> […]` has the relay with `"enabled": false`; reopen the relay → "Delete relay": the view closes with no alert and the relay row is gone (`OperatorView.kt:150-153`; deleted relays are skipped, `ProtocolServersView.kt:93`) | RELAY | – |
+| SOCKS | Toggle | "Use SOCKS proxy" | `NetworkAndServers.kt:97-153,336` | `socks_enable_confirm`, `socks_disable_confirm` | "Use SOCKS proxy?" / "Use direct Internet connection?" → "Confirm"; Log `/_network {…}` with `"socksProxy"` on enable and without it on disable (`explicitNulls = false`, `SimpleXAPI.kt:6550`; JSON arguments are pretty-printed over several lines, :6547); timeouts still at the direct defaults switch to the proxy defaults on enable, and back on disable | — | – |
+| SOCKS | Validation | "SOCKS proxy settings" > "Host"/"Port" | `NetworkAndServers.kt:365-458,654-664` | `socks_settings_validation` | Save disabled for an invalid host or port | — | – |
+| SOCKS | Auth | "Proxy authentication" > "Use random credentials", "Username", "Password" | `NetworkAndServers.kt:503-530,557` | `socks_settings_authModes` | Footer text per mode; Pref NetworkProxyHostPort JSON | — | – |
+| SOCKS | Onion | "Use .onion hosts": No / When available / Required | `NetworkAndServers.kt:574-612` | `socks_onionHostsOptions` | Enabled only with SOCKS on and random credentials; Pref NetworkHostMode / NetworkRequiredHostMode | — | Option persistence only; real Tor is an `IGNORE` row in §M |
+| SOCKS | Save/reset | "Save and reconnect" (+ "Update network settings?") / "Reset to defaults" | `NetworkAndServers.kt:534-551` | `socks_saveAndReconnect`, `socks_resetToDefaults` | Log `/_network`; fields reset to localhost:9050 | — | "Use SOCKS proxy" is enabled first; with it off the button is "Save" and only the pref is written, with no `/_network` (`NetworkAndServers.kt:428-430,546-549`) |
+| SOCKS | Core reject | same | `NetworkAndServers.kt:430-441,666` | `socks_wrongConfigAlert` | "Error saving proxy" / "Make sure proxy configuration is correct." (`showWrongProxyConfigAlert`, `NetworkAndServers.kt:666-671`); prefs rolled back (`:437-439`) | — | "Use SOCKS proxy" is enabled first (the core is called only then, `NetworkAndServers.kt:428`); the test enters the host `proxy.example`, which passes `validHost` (only `@` is rejected, `:654-655`), but the core accepts only IPv4/IPv6 SOCKS hosts ("SOCKS5 host should be IPv4 or IPv6 address", simplexmq `ee66dd68` `Transport/Client.hs:263`), so `apiSetNetworkConfig` fails |
+| SOCKS | Unsaved | back | `NetworkAndServers.kt:459-470,563` | `socks_unsavedAlert` | "Update network settings?" with "Save" while "Use SOCKS proxy" is off ("Save and reconnect" while it is on, `NetworkAndServers.kt:465`) / "Exit without saving"; with the proxy off, after a host or port edit: "Save" writes Pref NetworkProxyHostPort with the new host and port, sends no `/_network`, and "SOCKS proxy settings" stays open with "Save" disabled (it closes only after a successful `/_network`, `:428-434`); "Exit without saving" closes it and the pref keeps its old value | — | – |
+| SOCKS | Real proxy | enable + send | – | `socks_trafficRoutedThroughProxy` | The SOCKS stub (on a non-9050 loopback port) sees the CONNECT to the local SMP server; bob receives the message | P (bob), SOCKS | The stub must support RFC 1929 username/password auth (default mode isolates by credentials) and domain-name addressing |
+| Advanced | Private routing | "Advanced network settings" > "Private routing" / "Allow downgrade" | `NS/AdvancedNetworkSettings.kt:233-238,350-417` | `advNet_privateRoutingMode`, `advNet_privateRoutingFallback` | Options Always / Unknown servers / Unprotected / Never and Yes / When IP hidden / No; `advNet_privateRoutingMode`: "Never", then "Save and reconnect" opens "Update network settings?" (`AdvancedNetworkSettings.kt:190-193,556-563`), and its "Update" logs `/_network` with `"smpProxyMode": "never"` (default `"always"`; `encodeDefaults = true` puts the key in every `/_network`, `SimpleXAPI.kt:5356-5364,6546-6551`), Pref NetworkSMPProxyMode=Never, and "Allow downgrade" is disabled (`AdvancedNetworkSettings.kt:235`); `advNet_privateRoutingFallback`: "No", then "Save and reconnect" → "Update" logs `"smpProxyFallback": "prohibit"` (default `"allowProtected"`, `SimpleXAPI.kt:5368-5375`), Pref NetworkSMPProxyFallback=Prohibit (enum name, :364-366, 3881-3882) | — | – |
+| Advanced | Message status | "Show message status" | `AdvancedNetworkSettings.kt:236` | `advNet_showMessageStatus_sentViaProxy` | Pref showSentViaProxy (applies at once); with the setting on, a message to bob (whose queue is on the second SMP server, so it goes via private routing) shows the proxy icon (`ItemMetaKey` `sentViaProxy`); with it off, no icon | P (bob on the second SMP server), SMP2 | 04 owns this setting and the proxy icon. bob uses `cli(…, servers = PeerServers(smp = "smp2"))` (plan §9.2) |
+| Advanced | Isolation | "Transport isolation" | `AdvancedNetworkSettings.kt:241-243`, `NetworkAndServers.kt:615-652` | `advNet_transportIsolation` | Options "Chat profile" / "App session" / "Server" (`TransportSessionMode.safeValues`, `SimpleXAPI.kt:5404`); Pref NetworkSessionMode; `/_network` sessionMode | — | "Connection" appears only with developer tools (§I) |
+| Advanced | Web port | "TCP port for messaging" > "Use web port" | `AdvancedNetworkSettings.kt:245-255` | `advNet_webPort` | Footer text; Pref NetworkSMPWebPortServers | — | – |
+| Advanced | Timeouts | "TCP connection timeout", "TCP connection bg timeout", "Protocol timeout", "Protocol background timeout", "Protocol timeout per KB", "PING interval", "PING count" | `AdvancedNetworkSettings.kt:258-307` | `advNet_timeoutsSaved` | Matching Network* prefs (e.g. `networkTCPTimeoutPerKb`, `SimpleXAPI.kt:463`, for "Protocol timeout per KB"); `/_network` JSON | — | One test iterating over the 7 fields |
+| Advanced | Keep-alive | "Enable TCP keep-alive" | `AdvancedNetworkSettings.kt:308-331,419` | `advNet_keepAlive` | TCP_KEEPIDLE / INTVL / CNT enabled or disabled; prefs | — | – |
+| Advanced | Reset/unsaved | "Reset to defaults" / back | `AdvancedNetworkSettings.kt:144,337-344,565` | `advNet_resetToDefaults`, `advNet_unsavedChangesAlert` | `advNet_resetToDefaults`: after a value is changed, "Reset to defaults" puts every field back to the defaults (`NetCfg.defaults`, or `NetCfg.proxyDefaults` with SOCKS on) and is then disabled; nothing is applied until "Save and reconnect" (`AdvancedNetworkSettings.kt:144-148,187,337-340`); `advNet_unsavedChangesAlert`: leaving with changes shows "Update network settings?" with "Save and reconnect" / "Exit without saving" | — | – |
+| Advanced | Persist | restart | `C/model/SimpleXAPI.kt:666` | `advNet_persistAcrossRestart` | `/_network` re-sent on start with the saved values | RESTART | – |
+| Remote | Hidden when remote | with a remote host connected | `NetworkAndServers.kt:262-269`, `AdvancedNetworkSettings.kt:232` | `network_remoteHostHidesLocalSettings` | SOCKS and advanced sections hidden | P (mobile host) | Pairing as in §K |
+
+### F. Audio & video calls (6 tests)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Calls | Layout | Settings > "Audio & video calls" | `US/CallSettings.kt:24-62` | `calls_screenLayout_noLockScreenOption` | "Your calls", "WebRTC ICE servers", "Always use relay"; no "Calls on lock screen:" option (Android-only) | — | – |
+| Calls | Relay | "Always use relay" | `CallSettings.kt:50-58` | `calls_alwaysUseRelayToggle` | Pref WebrtcPolicyRelay (default true); footer text switches | — | The call effect is covered only by the WebRTC `IGNORE` row in catalogue 02 (`call_webrtcSession_connects`) |
+| ICE | Edit | "WebRTC ICE servers" > "Configure ICE servers" switch on > type one server per line > "Save"; "Edit" reopens the editor | `US/RTCServers.kt:29-209` | `iceServers_saveCustom`, `iceServers_invalidRejected`, `iceServers_resetToDefaults` | Pref WebrtcICEServers; an invalid or duplicate line gives "Error saving ICE servers"; switching "Configure ICE servers" off gives "Use SimpleX Chat servers?" → "Confirm" and sets the pref to null | — | – |
+| ICE | 2nd entry | Settings > Network & servers > "WebRTC ICE servers" | `NetworkAndServers.kt:302-304` | `iceServers_openFromNetworkScreen` | The ICE screen opens: "Your ICE servers" with the switch "Configure ICE servers" (`US/RTCServers.kt:103,111`), absent on Network & servers, whose entry row has the same label "WebRTC ICE servers" | — | – |
+
+### G. Chat data, database, encryption, startup DB errors (35 tests, 3 ignored)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Chat data | Layout | Settings > "Chat data" | `C/views/database/DatabaseView.kt:107-179` | `chatData_layout` | "Messages" > "Delete messages after", "Database passphrase & export", "Files & media" | — | – |
+| TTL | Change | "Delete messages after" | `DatabaseView.kt:73-84,330-375,810-850` | `chatData_ttlIncrease_noAlert`, `chatData_ttlDecrease_alertConfirm`, `chatData_ttlDecrease_alertCancel` | `chatData_ttlIncrease_noAlert`: a longer period is applied with no alert (the alert shows only when the period gets shorter, `DatabaseView.kt:79`) and Log `/_ttl <uid> <secs>`; decrease: "Enable automatic message deletion?" → "Delete messages"; Log `/_ttl <uid> <secs>`; cancel reverts (testSetChatItemTTL) | — | Setting or lowering the TTL expires older items at once (plan §11.1, TTL expiry) |
+| TTL | Custom | console `/_ttl <uid> 30`, then restart | `DatabaseView.kt:353-359` | `chatData_ttlCustomSecondsShown` | Extra seconds option listed | RESTART | The picker's value is reloaded only on profile switch or start (`SimpleXAPI.kt:770`), so the console change needs a restart |
+| TTL | Per profile | switch user | `DatabaseView.kt:49,131-139` | `chatData_ttlPerProfile` | Footer names the user; value per user (testUsersDifferentCIExpirationTTL) | — | A second user profile is created first |
+| TTL | Expiry | seconds TTL | – | `chatData_ttlExpiresMessages` | After the expiration thread's first run, reopening bob's chat no longer shows the backdated items: the test reopens it until they are gone, with a deadline (background expiration deletes rows without a UI event, `Library/Commands.hs:5781-5792, 5965-5998`, so items already on screen and the chat-list preview stay until reloaded) | P (bob), FIXTURE (backdated items), RESTART, SLOW | Expiry on startup (plan §11.1, TTL expiry): the TTL is set while the items are still new, the core is stopped, bob's items are backdated (`item_ts` and `created_at` by more than the TTL), the core restarted, and the test waits for the expiration thread's first run 30 s after start |
+| Files | Delete | "Delete all files" | `DatabaseView.kt:157-176,854-870` | `chatData_deleteFilesAndMedia` | "%d file(s) with total size of %s" → "Delete files and media?" → "Delete"; `/_stop`, files removed, `/_start main=on` (`SimpleXAPI.kt:4140`); "No received or sent files" | P (bob), XFTP | – |
+| Files | Label | with 2 users | `DatabaseView.kt:164` | `chatData_deleteFilesLabelForMultipleProfiles` | "Delete files for all chat profiles" | — | A second user profile is created first |
+| DB mgmt | Layout | "Database passphrase & export" | `DatabaseView.kt:181-328` | `dbMgmt_layout` | "Chat database": "Database passphrase", "Open database folder", "Export database", "Import database", "Delete database"; "Run chat" | — | – |
+| DB mgmt | Run chat | "Chat is running" toggle | `DatabaseView.kt:378-512` | `dbMgmt_stopChat`, `dbMgmt_startChat` | "Stop chat?" → "Stop"; Log `/_stop` / `/_start main=on` (`SimpleXAPI.kt:4140`); Pref ChatStopped (testStopStartChat) | — | – |
+| DB mgmt | Stopped restart | restart while stopped | `Core.kt:59-66` | `dbMgmt_stoppedStatePersistsRestart` | Start-chat-after-restart alert | RESTART | – |
+| DB mgmt | Export blocked | "Export database" on a fresh DB | `DatabaseView.kt:251-255,455` | `dbMgmt_exportProhibitedWithRandomPassphrase` | "Set passphrase to export" and the "Database passphrase" screen (`DatabaseEncryptionView`, DatabaseView.kt:251-255; `DatabaseEncryptionView.kt:120`) | — | Desktop default (harness fact 8) |
+| DB mgmt | Export | same, after a passphrase is set | `DatabaseView.kt:606-660` | `dbMgmt_exportArchive` | Log `/_db export {…}`; zip at the saveDialog path; Pref ChatArchiveName/Time; the chat stays stopped afterwards ("Chat is stopped" toggle off; `exportArchive` returns false, `DatabaseView.kt:630`) (testMaintenanceMode, …WithFiles) | FD | – |
+| DB mgmt | Import | "Import database" | `DatabaseView.kt:202-210,675-756` | `dbMgmt_importArchive_restoresData` | The export leaves the chat stopped (`exportArchive` returns false, `DatabaseView.kt:630`), so after it alice turns the "Chat is stopped" switch on (it then reads "Chat is running", `DatabaseView.kt:384-394`) before bob sends a message, which she receives; then "Import chat database?" → "Import"; `/_db import`; "Chat database imported"; then "Encrypted database" / "Enter passphrase…" (the import removes the stored key, `DatabaseView.kt:724`) → type the exported database's passphrase → "Save passphrase and open chat"; a message from bob received after the export is gone | FD, P (bob) | – |
+| DB mgmt | Import (invalid) | "Import database" | `DatabaseView.kt:202-210,675-756` | `dbMgmt_importInvalidArchive` | "Error importing chat database" for a bad zip | IGNORE: known app bug: the import error alert is never shown (plan §11.3) | `apiImportArchive` throws `Exception` (`SimpleXAPI.kt:1128`) but `importArchive` catches only `Error` (`DatabaseView.kt:740,745`), so the alert never shows and the chat restarts on storage `/_db delete` already removed (`DatabaseView.kt:718`). Confirm in the real app and report it when the test is written |
+| DB mgmt | Settings import | same | `DatabaseView.kt:723`, `Core.kt:144-152` | `dbMgmt_importRestoresAppSettings` | The archive is exported with Pref PrivacyLinkPreviews=false ("Send link previews" off; the export saves the app settings into the database first, `DatabaseView.kt:645`), then the pref is set back to true; after the import and the passphrase prompt ("Save passphrase and open chat"), `initChatController` applies the archive's settings (`DatabaseView.kt:723`, `Core.kt:144-152`), so PrivacyLinkPreviews is false again and ShouldImportAppSettings is false (testAppSettings) | FD | – |
+| DB mgmt | Delete | "Delete database" | `DatabaseView.kt:783-808` | `dbMgmt_deleteDatabase` | "Delete chat profile?" → "Delete"; "Chat database deleted"; the onboarding welcome screen with "Link a mobile" and "Create your profile" appears without a restart (`Core.kt:153-166`) | — | – |
+| DB mgmt | Folder | "Open database folder" | `DatabaseView.kt:239-246`, `D/platform/Files.desktop.kt:33-48` | `dbMgmt_openDatabaseFolder` | The OS file manager opens the data dir | IGNORE: OS folder opener (`desktopOpenDir`), until the seam in plan §13 is approved (plan §11.3) | `Desktop.isDesktopSupported()` is false headless, so the call silently does nothing |
+| DB mgmt | Remote | with a mobile connected | `DatabaseView.kt:217-229,297-301` | `dbMgmt_disconnectMobilesWhenRemote` | "Disconnect mobiles" row; run toggle disabled | P (mobile host) | Pairing as in §K |
+| Encryption | First passphrase | "Database passphrase" | `C/views/database/DatabaseEncryptionView.kt:42-215,423-487`, `D/views/database/DatabaseEncryptionView.desktop.kt` | `dbEncrypt_setFirstPassphrase` | "New passphrase…", "Confirm new passphrase…", "Update database passphrase" (`DatabaseEncryptionView.kt:197`; "Set passphrase" is used only in migration) → "Change database passphrase?" → "Update" (the current key is pre-filled with the random key, `DatabaseEncryptionView.kt:49`); Log `/_db encryption` (obfuscated); "Database encrypted!"; Pref InitialRandomDBPassphrase=false (testDatabaseEncryption) | — | – |
+| Encryption | Change | same | `DatabaseEncryptionView.kt:147-200,444-450` | `dbEncrypt_changePassphrase`, `dbEncrypt_wrongCurrentPassphrase` | "Current passphrase…" → "Update database passphrase" → "Update"; "Wrong passphrase!" | — | – |
+| Encryption | Store | "Save passphrase in settings" | `DatabaseEncryptionView.desktop.kt:22-56,105-112` | `dbEncrypt_removeFromSettings`, `dbEncrypt_saveToSettings` | "Remove passphrase from settings?" → "Remove"; Pref StoreDBPassphrase / EncryptedDBPassphrase (Base64) | — | A passphrase is set first (harness fact 8: the switch is disabled with the random passphrase, `DatabaseEncryptionView.kt:130`). Turning the switch on sets StoreDBPassphrase=true; EncryptedDBPassphrase (Base64) is written by the next "Update database passphrase" |
+| Encryption | Footers | – | `DatabaseEncryptionView.desktop.kt:58-83` | `dbEncrypt_footerStates` | Random passphrase, stored: "The passphrase is stored in settings as plaintext." and "Database is encrypted using a random passphrase, you can change it." (:69-72); own passphrase set with "Save passphrase in settings" on: the first line and "Please note: you will NOT be able to recover or change passphrase if you lose it." (:69-70,73-74); after the switch is turned off and "Remove" confirmed: "You have to enter passphrase every time the app starts - it is not stored on the device." and the same note (:79-81); switch turned on again, not yet stored: "The passphrase will be stored in settings as plaintext after you change it or restart the app." (:76-77); the unencrypted branch (:66-67) is `dbEncrypt_footerUnencrypted` | — | – |
+| Encryption | Unencrypted DB | "Database passphrase" on an unencrypted DB | `DatabaseEncryptionView.desktop.kt:66-67,95-101`, `DatabaseEncryptionView.kt:165-175` | `dbEncrypt_footerUnencrypted` | The footer "Your chat database is not encrypted - set passphrase to protect it." (`DatabaseEncryptionView.desktop.kt:66-67`); setting a passphrase shows "Encrypt database?" → "Encrypt" (:85-91), after which that footer is gone | FIXTURE (unencrypted DB) | A desktop DB always gets a random key and the UI can't set an empty one (`DatabaseEncryptionView.kt:180`) |
+| Startup DB | Passphrase prompt | restart with the passphrase not stored | `C/views/database/DatabaseErrorView.kt:37-120,290-340`, `App.kt:150-155` | `dbError_enterPassphraseOnStartup_open`, `dbError_wrongPassphrase` | "Encrypted database" / "Enter passphrase…" / "Open chat"; wrong gives "Wrong passphrase!" | RESTART | – |
+| Startup DB | Save and open | restart with StoreDBPassphrase=true and no stored key (EncryptedDBPassphrase cleared before the restart) | `DatabaseErrorView.kt:98-104` | `dbError_saveAndOpen` | "Encrypted database" / "Save passphrase and open chat"; after the passphrase is typed and that button clicked, Pref EncryptedDBPassphrase (cleared before the restart) is non-empty again (`ksDatabasePassword.set`, `DatabaseErrorView.kt:53`) and the chat list "Chats" appears | RESTART | – |
+| Startup DB | Upgrade confirm | restart with developer tools + "Confirm database upgrades" | `DatabaseErrorView.kt:107-120`, `Core.kt:79-104` | `dbError_upgradeConfirmation` | "Database upgrade", "Migrations: 20260925_badge_bindings" (the migration whose down-SQL the fixture applied, the last in `src/Simplex/Chat/Store/SQLite/Migrations.hs:356`; `DatabaseErrorView.kt:77-78,115`), "Upgrade and open chat" | FIXTURE (latest migration's down-SQL applied, its `migrations` row deleted), RESTART, DT | The fixture deletes the `migrations` row in the same `/sql chat` call, because the down-SQL only drops a table and two columns (M20260925_badge_bindings.hs:28-36) and the row would otherwise leave nothing to upgrade |
+| Startup DB | Downgrade | restart | `DatabaseErrorView.kt:146-152,281-287` | `dbError_incompatibleDowngrade` | "Incompatible database version" / "database version is newer than the app, but no down migration for: %s" | FIXTURE (extra fake row in `migrations`), RESTART | – |
+| Startup DB | Restore backup | restart | `DatabaseErrorView.kt:184-210,256-279` | `dbError_restoreBackup` | "Restore database backup" → "Restore database backup?" → "Restore"; the button disappears and EncryptionStartedAt is cleared; entering the backup's passphrase then opens the chat | FIXTURE (EncryptionStartedAt set, `*.bak` files that open with the stored key, main files encrypted with another key), RESTART | If the main DB opens, `initChatController` clears EncryptionStartedAt (`Core.kt:140`) and the error screen never shows; `restoreDb` only copies the backup (`DatabaseErrorView.kt:268-279`). The button shows only if both `.bak` files exist and each one's mtime is at least EncryptionStartedAt − 10 s, evaluated when the screen is composed (`DatabaseErrorView.kt:45, 256-267`), so the fixture sets EncryptionStartedAt before copying the `.bak` files |
+| Startup DB | Folder | "Open database folder" on a startup database error screen | `DatabaseErrorView.kt:118-177,322-332`, `D/platform/Files.desktop.kt:33-48` | `dbError_openDatabaseFolder` | The OS file manager opens the data dir | IGNORE: OS folder opener (`desktopOpenDir`), until the seam in plan §13 is approved (plan §11.3) | The button is shown on the migration, SQL, keychain, invalid-confirmation and unknown-error screens (`DatabaseErrorView.kt:118-177`), not on the passphrase screens ("Wrong passphrase!" / "Encrypted database", `:83-104`); `Desktop.isDesktopSupported()` is false headless, so `desktopOpenDir` silently does nothing |
+
+The onboarding passphrase step is owned by catalogue 01 §1.
+
+### H. Migrate to/from device (15 tests, 6 ignored)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| From | Start | Settings > "Migrate to another device" | `C/views/migration/MigrateFromDevice.kt:107-210` | `migrateFrom_stopsChatAndAuth` | "Migrate device"; Log `/_stop`; then the passphrase step (random DB → "Set passphrase", harness fact 8) | — | `ChatStopFailed` can't be driven: `apiStopChat` can't be made to fail on demand (`MigrateFromDevice.kt:447-465`) |
+| From | No passphrase | random-passphrase DB | `MigrateFromDevice.kt:209-217,453` | `migrateFrom_passphraseNotSetRedirect` | "Chat is stopped", "New passphrase…", "Confirm new passphrase…", "Set passphrase"; after setting it, "Archive and upload" appears | — | – |
+| From | Verify | "Verify database passphrase" / "Verify passphrase" | `MigrateFromDevice.kt:220-256,468-480` | `migrateFrom_verifyPassphraseWrong` | "Verify database passphrase" with a wrong passphrase → "Verify passphrase" → "Wrong passphrase!" / "Enter correct passphrase." (`MigrateFromDevice.kt:472-473`) | — | A passphrase is set first (otherwise the passphrase-not-set step is shown) |
+| From | Upload | "Archive and upload" | `MigrateFromDevice.kt:257-310,482-610` | `migrateFrom_uploadAndShowLink` | "Archiving database" → `/_db export`; "Uploading archive" → `/_upload`; "Creating archive link"; QR + "Or securely share this file link" | IGNORE: destinations on public servers (the migration upload goes to the preset XFTP servers of a temporary user): unreachable in the namespace (plan §11.3) | The temporary database's user is created with preset operators (`SimpleXAPI.kt:722`), so the archive never reaches the local XFTP server |
+| From | Failure | stop XFTP before the upload starts | `MigrateFromDevice.kt:313-325,585-605` | `migrateFrom_uploadFailedRetry` | "Upload failed" → "Repeat upload" | IGNORE: destinations on public servers (the migration upload goes to the preset XFTP servers of a temporary user): unreachable in the namespace (plan §11.3) | The temporary database's user is created with preset operators (`SimpleXAPI.kt:722`), so the archive never reaches the local XFTP server; a stopped server would only give temporary errors, which the agent retries without `SndFileError` |
+| From | Cancel | "Cancel migration" | `MigrateFromDevice.kt:339-345,612-620` | `migrateFrom_cancelMigration` | apiCancelFile; chat restarted | IGNORE: destinations on public servers (the migration upload goes to the preset XFTP servers of a temporary user): unreachable in the namespace (plan §11.3) | The temporary database's user is created with preset operators (`SimpleXAPI.kt:722`), so the archive never reaches the local XFTP server |
+| From | Finish / start | "Finalize migration" → "Start chat" | `MigrateFromDevice.kt:351-395,654-670` | `migrateFrom_finalize_startChatWarning` | "Remove archive?", "Migration complete", "Start chat?" warning | IGNORE: destinations on public servers (the migration upload goes to the preset XFTP servers of a temporary user): unreachable in the namespace (plan §11.3) | The temporary database's user is created with preset operators (`SimpleXAPI.kt:722`), so the archive never reaches the local XFTP server |
+| From | Finish / delete | "Delete database from this device" | `MigrateFromDevice.kt:401-420` | `migrateFrom_finalize_deleteDatabase` | "Delete chat profile?" → app goes to onboarding | IGNORE: destinations on public servers (the migration upload goes to the preset XFTP servers of a temporary user): unreachable in the namespace (plan §11.3) | The temporary database's user is created with preset operators (`SimpleXAPI.kt:722`), so the archive never reaches the local XFTP server |
+| To | From CLI archive | a CLI peer started with `--key <k>` (`cli(…, flags = PeerFlags(key = <k>))`, plan §8.1; src/Simplex/Chat/Options/SQLite.hs:40) first connects with a second peer (bob), then runs `/_stop`, `/_db export {"archivePath":"<zip>"}`, `/_start`, `/_upload 1 <zip>` and is then stopped; alice, in onboarding, "Migrate from another device" > "Migrate here", pastes the link | `C/views/WelcomeView.kt:201-224`, `C/views/migration/MigrateToDevice.kt:122-791` | `migrateTo_fromCliArchive_chatMigrated` | Paste link → "Preparing download" → "Downloading archive" → "Importing archive" (fixed archive file names, src/Simplex/Chat/Archive.hs:40-47) → "Enter passphrase" `<k>` → "Chat migrated!" (MigrateToDevice.kt:702); afterwards alice messages the peer's contacts as that peer | P ×2, XFTP, CB, ONBOARD, PEERCTL | The GUI's own upload goes to the preset XFTP servers of a temporary user and stays `IGNORE` (the "From" rows) |
+| To | Bad link | paste non-link text | `MigrateToDevice.kt:547-550` | `migrateTo_invalidLink` | "Invalid link" | CB, ONBOARD | – |
+| To | Deleted file | paste a link from a CLI peer's `/_upload 1 <archive>`, after the XFTP store is reset | `MigrateToDevice.kt:604-609` | `migrateTo_deletedFile` | "Download failed" alert "File was deleted or link is invalid", then the "Download failed" section with "Repeat download" | P, XFTP, SRVCTL, CB, ONBOARD | The peer prints "file 1 (<name>) upload complete. download with:" and the links (`View.hs:2497`) (testXFTPStandaloneSmall, `H/Files.hs:1266-1279`); `servers.reset("xftp1")` deletes the file, so the download gets a permanent AUTH error |
+| To | Wrong passphrase | Passphrase step | same | `migrateTo_wrongPassphrase` | "Enter passphrase" step, wrong passphrase → "Open chat" → "Wrong passphrase!" / "Enter correct passphrase."; stays on the step | P, XFTP, CB, ONBOARD | Link from a CLI peer: `/_stop`, `/_db export {"archivePath":"<zip>"}`, `/_start`, `/_upload 1 <zip>` (`/db encrypt` and `/_db export` need the chat stopped, and after `/db encrypt` `/_start` refuses until a restart, `Library/Commands.hs:594`, :3755-3764; `H/Files.hs:1266-1279`). The unencrypted archive reaches the step (the import always moves to `Passphrase`, `MigrateToDevice.kt:652`; "Open chat" is only disabled while the field is empty, :438), and a non-empty wrong passphrase fails with `ErrorNotADatabase` → "Wrong passphrase!" (`DatabaseErrorView.kt:243-244`) |
+| To | Network confirm | paste a CLI peer's `/_upload` link with `MigrationFileLinkData {networkConfig: {networkProxy, hostMode, requiredHostMode}}` added | `MigrateToDevice.kt:286-303,527-534` | `migrateTo_networkSettingsConfirm` | "Confirm network settings" → "Apply" | P, XFTP, CB, ONBOARD | The link data is added as `MigrateFromDevice.kt:575-583` does |
+| To | Resume | restart mid-migration | `MigrateToDevice.kt:55-82`, Pref MigrationToStage | `migrateTo_resumeAfterRestart` | Restart at the "Enter passphrase" step → after restart "Migrate here" reopens at "Enter passphrase" (a restart during "Downloading archive" drops the migration) | P, XFTP, CB, RESTART, ONBOARD | Migrate-to is reachable only from onboarding (`WelcomeView.kt:206-212`) |
+| From | Resume | restart mid-migration | Pref MigrationFromStage (`SimpleXAPI.kt:209`) | `migrateFrom_resumeAfterRestart` | – | IGNORE: unused code — `migrationFromStage` is declared but never read or written, so there is no resume to test (plan §11.3) | – |
+
+### I. App version, update checker, developer tools (15 tests)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Version | Info | Settings > version row (§A) | `US/VersionInfoView.kt:24-55` | `version_screenShowsVersions` | "App version" screen: "App version: v%s", "App build: %s", "Core version: v%s", "simplexmq: v%s (%2s)"; `/version` in Log | — | – |
+| Updates | Channel | "Check for updates" (Disabled/Stable/Beta) | `D/views/usersettings/SettingsView.desktop.kt:14-26`, `D/views/helpers/AppUpdater.kt:161-200` | `updates_channelDropdown` | Pref AppUpdateChannel | — | The network check is an `IGNORE` row in §M. Selecting Stable/Beta starts a 24 h `withLongRunningApi` job, so the test ends by selecting "Disabled" (`setupUpdateChecker` cancels the job, `AppUpdater.kt:162-165`): the job is untracked (`idle = false`, plan §6) and would otherwise outlive the test in this JVM |
+| Updates | Notice | after onboarding, once there are more than 3 chats | `apps/multiplatform/desktop/src/jvmMain/kotlin/chat/simplex/desktop/Main.kt:67-89`, `AppUpdater.kt:127-158` | `updates_noticeDialog` | "Check for updates" alert with "Stable"/"Beta"/"Disable"; Pref AppUpdateNoticeShown. Shown only when AppUpdateNoticeShown=false, onboarding is complete, more than 3 chats exist and no call invitation is active (`Main.kt:69-73`) | RESTART | 04 owns this notice. The check runs once at startup (desktop `Main.kt:79-87`), so the pre-set of `appUpdateNoticeShown` is cleared, chats are created until `chatModel.chats.size > 3` (local groups via the console; the size counts the notes folder and the "Ask SimpleX Team" card, so two are enough), and the core restarted (harness fact 4); the platform object comes from harness fact 5. The test ends by selecting "Disabled" in Settings, which cancels the 24 h update job: it is untracked (`idle = false`, plan §6) and would otherwise outlive the test in this JVM |
+| Dev | Console | version > "Developer tools" > "Chat console" | `US/DeveloperView.kt:32`, `C/views/TerminalView.kt:37-66` | `console_sendCommand` | Type `/v` + send; cmd and response items rendered | — | The console's line list is volatile in screenshots (wall-clock times, core events in arrival order; plan §7.7) |
+| Dev | /sql guard | console | `TerminalView.kt:46-53` | `console_sqlBlockedWithoutLockAndDevTools` | The response line reads `< error chat` (SimpleXAPI.kt:6597, 7786); clicking it opens the details, `error chat commandError Failed reading: empty` (TerminalView.kt:177-193, SimpleXAPI.kt:6602, 7769, 7872) | — | The console's line list is volatile in screenshots (plan §7.7) |
+| Dev | Hints | "Reset all hints" | `SettingsView.kt:328-347`, `SimpleXAPI.kt:278-291` | `dev_resetAllHints` | Enabled at start (the harness pre-sets change hint prefs, `SimpleXAPI.kt:278-293`); after tapping, all hint prefs are defaults and the row is disabled | — | – |
+| Dev | Dev options | "Show developer options" | `DeveloperView.kt:37-64` | `dev_showDeveloperOptionsSection` | Pref DeveloperTools; "Developer options" section and footer | — | – |
+| Dev | Logs | "Enable logs" | `DeveloperView.kt:44-49` | `dev_enableLogs` | Pref LogLevel DEBUG/WARNING | DT | – |
+| Dev | Confirm upgrades | "Confirm database upgrades" | `DeveloperView.kt:50` | `dev_confirmDbUpgradesPref` | Pref ConfirmDBUpgrades (functional check is in §G) | DT | – |
+| Dev | Console window | "Show console in new window" | `DeveloperView.kt:51-60`, `DesktopApp.kt:210-232` | `dev_showConsoleInNewWindow_requiresAuth` | Passcode prompt when locked; Pref TerminalAlwaysVisible | DT | Lock enabled first; the second Window itself is an `IGNORE` row in §M |
+| Dev | Errors / slow calls | "Show internal errors" / "Show slow API calls" | `DeveloperView.kt:61-62` | `dev_showInternalErrors`, `dev_showSlowApiCalls` | Prefs ShowInternalErrors / ShowSlowApiCalls | DT | – |
+| Dev | Link mode | "Deprecated options" > "SimpleX links" (Description/Full link) | `DeveloperView.kt:66-73`, `PrivacySettings.kt:288-309` | `dev_simplexLinksMode` | Pref PrivacySimplexLinkMode; a link from bob renders as description vs full | P (bob) | – |
+| Dev | Terminal link | "Install SimpleX Chat for terminal" | `SettingsView.kt:316` | `dev_installTerminalLink` | "Open external link?" with the GitHub URL → "Open" (`C/views/helpers/Utils.kt:613-624`); URI stub gets `https://github.com/simplex-chat/simplex-chat` | URI | – |
+| Dev | Extra modes | Transport isolation with developer tools | `NetworkAndServers.kt:622-626` | `dev_devToolsExtraSessionModes` | With developer tools on, "Connection" (`TransportSessionMode.Entity`) is added to "Chat profile" / "App session" / "Server" | DT | – |
+
+### J. Help & support (8 tests, 2 ignored)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Help | Layout | Settings > "Help & support" | `SettingsView.kt:146-185` | `help_layout` | "How to use it", "What's new", "About SimpleX Chat", "Follow SimpleX Network News", "Send questions and ideas", "Send us email", "Contribute", "Star on GitHub" (no "Rate the app") | — | What's New itself is owned by catalogue 01 §2 |
+| Help | How to | "How to use it" | `US/HelpView.kt:18`, `C/views/chatlist/ChatHelpView.kt:26` | `help_howToUse` | "Welcome <name>!" + help text | — | – |
+| About | About | "About SimpleX Chat" | `C/views/onboarding/SimpleXInfo.kt:44` | `help_aboutSimplex` | Onboarding-style info without action buttons | — | – |
+| Contact | SimpleX links | "Follow SimpleX Network News" / "Send questions and ideas" | `SettingsView.kt:74-78,166-169` | `help_followNews_opensSimplexUri`, `help_chatWithFounder_opensSimplexUri` | The channel / address opens | IGNORE: destination on public servers, unreachable in the namespace (plan §11.3) | `openVerifiedSimplexUri` connects straight to the public servers (`C/views/helpers/Utils.kt:599-600`), bypassing the `LocalUriHandler` stub |
+| Contact | Email | "Send us email" | `SettingsView.kt:170` | `help_sendEmail_mailto` | URI stub gets `mailto:chat@simplex.chat` | URI | – |
+| Support | Links | "Contribute" / "Star on GitHub" | `SettingsView.kt:255-293` | `help_contributeAndStar` | Each shows "Open external link?" → "Open"; URI stub gets `https://github.com/simplex-chat/simplex-chat#contribute` (`SettingsView.kt:256`) / `https://github.com/simplex-chat/simplex-chat` | URI | – |
+| Help | Stopped | chat stopped | `SettingsView.kt:159-169` | `help_disabledItemsWhenStopped` | How to / What's new / contact links disabled | — | – |
+
+### K. Remote desktop: "Link a mobile" (the desktop GUI is the controller, the CLI is the mobile host) (17 tests)
+
+The desktop app controls a mobile: the GUI runs `/start remote host new` (`SimpleXAPI.kt:4311`) and shows an invitation; the CLI acts as the mobile host and connects to it with `/connect remote ctrl`. CLI sequence, mirroring `T/RemoteTests.hs:624-711` (`startRemote`, `verifyRemoteCtrl`):
+1. CLI: `/set device name Mobile`, then `/connect remote ctrl <invitation>`; it prints `connecting new remote controller: <desktop name>, v…`, then `new remote controller connected`.
+2. CLI reads `Compare session code with controller and use:` / `/verify remote ctrl <code>`, then sends `/verify remote ctrl <code>`; it prints `remote controller 1 session started with <desktop name> (with compression)` or `… (no compression)` (`src/Simplex/Chat/View.hs:309-311`).
+3. Stopping from the CLI: `/stop remote ctrl` (the desktop side reports the host stopped). Stopping from the desktop: the CLI prints `remote controller stopped`.
+
+The invitation reaches the test through "Share link" into the CB stub (needs developer tools on, `ConnectMobileView.kt:207-213`) or from the `/start remote host new` response in the Log. Pairing works over loopback in the test namespace: simplexmq keeps 127.x addresses as candidates (listed last), and `ConnectMobileView.kt:526` keeps `127.0.0.1` when it is the first address, which it is in the namespace (plan §8.3). The mobile host is a current-build CLI (`mobileHost(…)`, plan §9.2): a stable CLI can't be a remote host (`minRemoteHostVersion` 7.1.0.9), so no row in this section has `S`.
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Remote | Layout | Picker > "Link a mobile" | `C/views/remote/ConnectMobileView.kt:45-149` | `linkMobile_layout` | "This device name" field, "Discoverable via local network", "Devices": "This device" ✓, "Link a mobile" (with a "+" icon) | — | – |
+| Remote | Device name | name field | `ConnectMobileView.kt:59-66,152-167` | `linkMobile_deviceNameChange` | Log `/set device name X`; Pref DeviceNameForRemoteAccess; the CLI prints "connecting new remote controller: X, v…" | P (mobile host) | – |
+| Remote | Multicast pref | toggle | `ConnectMobileView.kt:98-100` | `linkMobile_multicastToggle` | Pref OfferRemoteMulticast; reconnecting a stored host sends `/start remote host 1 multicast=<on/off>` (`multicast=` is only sent for stored hosts, `SimpleXAPI.kt:4311`) | P (mobile host) | – |
+| Remote | Pair | "Link a mobile" (the "+" row) | `ConnectMobileView.kt:262-348,170-246` | `linkMobile_newPairing_verifyAndConnect` | QR + "Waiting for mobile to connect:"; after connect: "Verify connection", section "Connected mobile" showing "New mobile device" (italic; the host's name isn't known before verification, `ConnectMobileView.kt:221-223`), and the "Verify code on mobile" code shown by the GUI is the first 23 characters of the CLI's session code (`ConnectMobileView.kt:234`); then the GUI switches to the remote host (`startRemote`) | P (mobile host), CB, DT | – |
+| Remote | Use remote | chat list | `UserPicker.kt:493-547` | `linkMobile_remoteChatsVisible_sendMessage` | The mobile's chats are shown; send to bob → bob receives (remoteMessageTest) | P ×2 (mobile host, bob) | – |
+| Remote | Switch | DevicePill "This device" / "Mobile" | `UserPicker.kt:660-679` | `linkMobile_switchLocalRemote` | After "Mobile" the list shows the mobile's contact bob and none of alice's chats; after "This device" alice's chats return and bob's row is gone (`switchUIRemoteHost(null)`, `UserPicker.kt:660-664`; `UserPicker.kt:513-539`; switchRemoteHostTest, `tests/RemoteTests.hs:507-531`) | P ×2 (mobile host, bob) | – |
+| Remote | Disconnect (desktop) | pill wifi button / "Connected to mobile" > "Disconnect" | `ConnectMobileView.kt:430-453`, `UserPicker.kt:607-618` | `linkMobile_disconnectFromDesktop` | The CLI prints "remote controller stopped" (stopDesktop) | P (mobile host) | – |
+| Remote | Disconnect (mobile) | CLI `/stop remote ctrl` | – | `linkMobile_mobileStopsSession` | GUI back to local; host not connected (stopMobile) | P (mobile host) | – |
+| Remote | Stored pairing | tap the stored "Mobile" row | `ConnectMobileView.kt:350-428` | `linkMobile_reconnectStoredPairing` | With a stored host the user-picker row and the screen title read "Linked mobiles" (`UserPicker.kt:370`, `ConnectMobileView.kt:94`); "Scan from mobile" QR; reconnect works; the CLI prints "connecting remote controller 1: …" (`startRemoteStored`) | P (mobile host) | – |
+| Remote | Delete host | right-click > "Delete" | `ConnectMobileView.kt:70-77,126-138` | `linkMobile_deleteHost` | Log `/delete remote host <id>`; row removed | P (mobile host) | The host is paired and stored first |
+| Remote | Port | port field ("Random"), info icon | `ConnectMobileView.kt:455-520` | `linkMobile_customPortRefreshQr`, `linkMobile_openPortInfo` | QR marked stale → "Refresh" restarts with that port; "Open port in firewall" alert | — | The custom port is taken from the JVM's port block (plan §8.2), so parallel JVMs don't collide |
+| Remote | Multicast connect | after the first pairing and the CLI's `/stop remote ctrl`, once alice's GUI is back to local chats (as in `linkMobile_mobileStopsSession`: the CLI's `ok` follows its own cancel, `Library/Commands.hs:3657`, `src/Simplex/Chat/Remote.hs:666-687`, before the desktop sees the session end), alice taps the stored host's row (this starts the host with multicast on, `ConnectMobileView.kt:364-367`, as `/start remote host 1 multicast=on` in `tests/RemoteTests.hs:661`); then CLI `/find remote ctrl` (`ok`, `remote controller 1 found: <desktop name>, v…`, `use /confirm remote ctrl 1 to connect`), `/confirm remote ctrl 1`, and the §K verification step (`tests/RemoteTests.hs:661-677`) | – | `linkMobile_multicastDiscovery` | After a first pairing (stored host), the CLI reconnects through multicast discovery (`startRemoteDiscover`) | P (mobile host), MCAST | The controller refuses new hosts over multicast (simplexmq RemoteControl/Client.hs:118), so the test pairs and stores the host first, as `remoteHandshakeDiscoverTest` does; multicast on loopback is set up in the namespace (plan §8.3) |
+| Remote | Close pairing | close modal before the mobile connects | `ConnectMobileView.kt:335-347` | `linkMobile_closePairingStopsHost` | `/stop remote host new` in Log | — | – |
+| Remote | Files | send/receive while remote | – | `linkMobile_remoteFiles` | While connected to the mobile host, attach `tests/fixtures/test.jpg` as a file (FD) and send to bob → `bob <# "alice> sends file test.jpg (136.5 KiB / 139737 bytes)"`, and after `/fr 1` `bob <## "completed receiving file 1 (test.jpg) from alice"`; a file bob sends (`/f @alice tests/fixtures/test.pdf`) appears in the desktop chat as "test.pdf"; clicking it on the desktop logs `/get remote file <rhId> {…}`, the file appears in the desktop's remote-hosts store and the save dialog opens (`C/views/chat/item/CIFileView.kt:108-118`; remoteStoreFileTest, `T/RemoteTests.hs:286-300`) | P ×2 (mobile host, bob), FD, XFTP | – |
+| Remote | File missing on host | click a received file whose copy on the host was deleted | `C/views/chat/item/CIFileView.kt:108-121`, `C/model/ChatModel.kt:4581-4603`, `src/Simplex/Chat/Remote.hs:590-604` | `linkMobile_remoteFileNotFound` | bob sends `tests/fixtures/test.pdf` to the mobile host (`/f @<host> tests/fixtures/test.pdf`), which accepts it with `/fr 1` and completes the download; the test deletes the received file from the host's `$HOME/Downloads`; then, connected to the host, the desktop clicks the item, which has never been loaded on the desktop: `/get remote file <rhId> {…}` fails on the host (`handleGetFile` can't read the file, `Remote.hs:598-599`), no save dialog opens and the toast "File not found" is recorded | P ×2 (mobile host, bob), XFTP, TOAST, FD | A PDF is used because images are loaded on display; the toast is the only result (`CIFileView.kt:119-120`); 02 §G (`rcvFile_missingOnDisk_clickDoesNothing`) covers the local case (`FD` here asserts that no save dialog is awaiting, as in 02 `rcvFile_missingOnDisk_clickDoesNothing`) |
+| Remote | No-user desktop | onboarding "Link a mobile" | `C/views/onboarding/LinkAMobileView.kt:24`, `D/views/onboarding/SimpleXInfo.desktop.kt` | `linkMobile_onboardingLinkAMobile` | "Link a mobile" first opens the passphrase step while the random passphrase is in use (`SimpleXInfo.desktop.kt:19`, Step2_5_SetupDatabasePassphrase); after the CLI's `/verify remote ctrl` (steps 1-2 above) the onboarding screen closes and the stage is OnboardingComplete, because currentRemoteHost is set (`LinkAMobileView.kt:77-83`; `ConnectMobileView.kt:335-339`) | ONBOARD, P (mobile host) | 04 owns pairing from onboarding; catalogue 01 §1 covers only the screen |
+
+### L. Supporter perks (badge-display screens excluded) (8 tests, 1 ignored)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Badges | Support screen | Settings > "Supporter perks" | `SettingsView.kt:113-118`, `C/views/badges/BadgesView.kt:13`, `BadgesSupportSimplexView.kt:35-132` | `badges_supportScreenLayout` | "Support SimpleX", "How badges protect your privacy", "Redeem badge code", "Get your code" | — | Shown only when no badge is held |
+| Badges | How it works | "How badges protect your privacy" | `BadgesHowItWorksView.kt:17` | `badges_howItWorks` | The screen shows the first paragraph "A badge is an anonymous credential stored in your profile on your device. This credential is never sent to anyone." and two more (`BadgesHowItWorksView.kt:30-32`; its title "How badges protect your privacy", :24, equals the entry button's label, so it proves nothing); the blog link shows "Open external link?" → "Open"; URI stub gets `https://simplex.chat/blog/20260919-simplex-supporter-badges.html` | URI | – |
+| Badges | Get code | "Get your code" | `BadgesSupportSimplexView.kt:126-131` | `badges_getYourCodeLink` | "Open external link?" → "Open"; URI `https://simplex.chat/badges/` | URI | – |
+| Redeem | Formatting | "Redeem badge code" > field ("SB-XXXXX-…") | `BadgesRedeemCodeView.kt:40-75,190-246` | `badges_redeemCodeFormatting`, `badges_redeemDisabledUntilValid` | Typed text regrouped; "Redeem" enabled only when `chatParseBadgeCode` returns a code (`C/platform/Core.kt:36`) | — | `parseBadgeCode` (`src/Simplex/Chat/Badges/Code.hs`) only checks the format and the Luhn mod-32 check character, offline, so a valid code is computed in the test (19 payload characters + check character); no badge service is needed |
+| Redeem | Paste | "Paste" | `BadgesRedeemCodeView.kt:227-235` | `badges_pasteButton` | Field filled from CB | CB | – |
+| Redeem | Service unreachable | "Redeem" with a valid code | `BadgesRedeemCodeView.kt:76-118`, `SimpleXAPI.kt:579-600,842-911` | `badges_redeemOfflineError` | The badge service is configured (`src/Simplex/Chat.hs:74`) but unreachable in the namespace, so the network failure shows the retry alert of `sendCmdWithRetry` (`SimpleXAPI.kt:842-911`) | — | Not in Log (`log=false`); check via the alert only |
+| Redeem | Service-side errors | "Redeem" | `BadgesRedeemCodeView.kt:76-118` | `badges_redeemInvalidCode` | The service's answers ("This code has already been used." and the other "Cannot redeem code" reasons) | IGNORE: destinations on public servers (e.g. badge-code redemption): unreachable in the namespace (plan §11.3) | "This code is not valid." can't be reached from the UI either: "Redeem" is enabled only when the same parse succeeds (`BadgesRedeemCodeView.kt:73,167`) |
+
+### M. Out of reach in-process (8 tests, all ignored)
+
+These rows keep the features traceable. Each name gets a `@Test` method carrying `@Ignore` with the reason (plan §11.3).
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Tray | Tray, "Close to tray", close-behavior dialog, Show/Quit tray items | tray | `D/DesktopTray.kt:33-121`, `DesktopApp.kt:237-257` | `tray_closeToTrayBehaviour`, `tray_showQuitItems` | – | IGNORE: tray and window chrome are not rendered (plan §11.3) | Needs AWT SystemTray and an ApplicationScope; only the hidden section is asserted (§D) |
+| Window | Window size/position persistence, crash-restart loop, crash alert | main window | `DesktopApp.kt:34-120,237-257` | `window_statePersistence`, `window_crashRestartLoop` | – | IGNORE: window size/position persistence and the crash-restart loop need a real `Window` (plan §11.3) | `storeWindowState` can be unit-tested |
+| Window | Floating chat console window | Developer tools | `DesktopApp.kt:210-232` | `window_floatingConsole` | – | IGNORE: the floating console window is a second `Window`, not rendered (plan §11.3) | The pref is asserted in §I |
+| Updates | Update check, download and install | Check for updates | `AppUpdater.kt:179-490` | `updates_checkDownloadInstall` | – | IGNORE: the app-update download uses a hard-coded GitHub URL and a private HTTP client (plan §11.3) | Public hosts are also unreachable in the namespace |
+| Network | Real Tor / .onion routing | SOCKS settings | `NetworkAndServers.kt` | `socks_realTorOnionRouting` | – | IGNORE: real Tor and onion services are external resources (plan §11.3) | Proxying is tested with the SOCKS stub (§E) |
+| Visual | Visual-only rendering of blur, toolbar alpha, corners, bubble tail, wallpaper, colours, font and zoom, icon tints | Appearance, Privacy | `US/Appearance.kt` | `appearance_visualRendering` | – | IGNORE: pixel-level visual settings; only the persisted prefs are asserted (plan §11.3) | The persisted prefs are tested in §B and §D |
+
+Android-only features are not desktop features and simply have no rows (and no `IGNORE` rows): Notifications mode screen, "Calls on lock screen:", screen protection, System lock mode, network connection status, App shutdown, "Rate the app", and "Scan server QR code" (`NS/ProtocolServersView.kt:281`). Badge-display screens (BadgesYourBadgeView, BadgesLedgerView, BadgesYourLevelView, BadgeUserPreview, SupportSimpleXBanner, BadgesPayView) are excluded by the plan and have no rows.
+
+## Count
+
+| Section | Tests | Ignored |
+|---|---|---|
+| A. Settings root and global keys | 7 | 0 |
+| B. Privacy | 24 | 0 |
+| C. SimpleX Lock and self-destruct | 22 | 0 |
+| D. Appearance | 24 | 0 |
+| E. Network & servers | 43 | 0 |
+| F. Audio & video calls | 6 | 0 |
+| G. Chat data / database | 35 | 3 |
+| H. Migration | 15 | 6 |
+| I. Version / developer tools | 15 | 0 |
+| J. Help & support | 8 | 2 |
+| K. Remote desktop | 17 | 0 |
+| L. Supporter perks | 8 | 1 |
+| M. Out of reach in-process | 8 | 8 |
+| **Total** | **232** | **20** |
\ No newline at end of file
diff --git a/plans/ui-tests/catalogue/05-android-carryover.md b/plans/ui-tests/catalogue/05-android-carryover.md
new file mode 100644
index 0000000000..6f94f7fddb
--- /dev/null
+++ b/plans/ui-tests/catalogue/05-android-carryover.md
@@ -0,0 +1,429 @@
+# UI test catalogue 5a: what changes on Android for the rows of 01–04
+
+Companion to `05-android-only.md` (paths `A/`, `APP/`, `MAN`, `C/`, `D/`, `US/`, `NS/` as defined there and in `00-legend.md`; line numbers of master `d72f68e6d` at `~/wt-uitest-ref`). Every test of catalogues 01–04 runs on Android unless this map lists it. Each of the 1,177 test names of 01–04 was checked against its row's entry path, expected cells and the code it touches; a name is listed only when its Android behaviour or the harness mechanism differs from desktop.
+
+## Summary
+
+| Catalogue | Tests | Listed | REPLACED | DESKTOP-ONLY | ADAPT | Unchanged on Android |
+|---|---|---|---|---|---|---|
+| 01 | 352 | 91 | 10 | 7 | 74 | 261 |
+| 02 | 281 | 105 | 12 | 11 | 82 | 176 |
+| 03 | 312 | 59 | 0 | 0 | 59 | 253 |
+| 04 | 232 | 102 | 11 | 32 | 59 | 130 |
+| **Total** | **1,177** | **357** | **33** | **50** | **274** | **820** |
+
+The Android run of 01–04 is therefore the 820 unchanged tests plus the 274 ADAPT tests; the 33 REPLACED and 50 DESKTOP-ONLY tests don't run there (9 of the DESKTOP-ONLY tests and the REPLACED `call_webrtcSession_connects` are `IGNORE` on desktop too: `dragDrop_files_attach`, `dbMgmt_openDatabaseFolder`, `dbError_openDatabaseFolder`, the five tray and window tests of 04 §M and `updates_checkDownloadInstall`). Each REPLACED row names the 05 test that runs instead. The first cell gives the line of the test's row in its catalogue.
+
+## Classes
+
+- **REPLACED**: the desktop assertion is wrong on Android and a 05 test covers the Android behaviour instead; the named 05 test replaces it in the Android run.
+- **DESKTOP-ONLY**: the feature or the asserted state does not exist on Android, or cannot be reached there; the test does not run on Android.
+- **ADAPT**: the test runs on Android with the change stated (driver action, label, path, count, layout or assertion).
+
+## General rules
+
+Rules used by many rows; the tables name every row they apply to, as `R<n>` plus what is specific to the row.
+
+- **R1 Right-click.** `Modifier.onRightClick` does nothing on Android (`A/platform/Modifier.android.kt:16`; desktop `D/platform/Modifier.desktop.kt:80`). Every `onRightClick` in shared code sits next to a `combinedClickable(onLongClick = …)` with the same action, so a "right-click" entry is driven with `longClick()` (01 setup item 8). Rows whose entry only says "row menu" or "long-press" already use the long press and are not listed.
+- **R2 Message field keys.** The Android message field is an `EditText` with no key listener: `onDone`, `onUpArrow` and `onFilesPasted` are never called (`A/platform/PlatformTextField.android.kt:60-63`). Enter inserts a line break, and only the send button ("Send Message", `C/views/chat/SendMsgView.kt:452-490`) sends; Shift+Enter, Up, Ctrl+V and typed file paths (`D/platform/PlatformTextField.desktop.kt:97-110,123-150`) don't exist. A file is attached through the 05 §6 "File" stub (`attachFile_getContent_sendsFile`, `A/views/chat/ComposeView.android.kt:44,74-77`).
+- **R3 File dialogs.** `FD` becomes `INTENTS`: open dialogs are `ACTION_GET_CONTENT`, save dialogs `ACTION_CREATE_DOCUMENT` (`A/platform/Files.android.kt:36-52`); "Image"/"Video" attachments are `ACTION_PICK` on the gallery (`A/views/chat/ComposeView.android.kt:40-73`). There is no directory chooser and no typed path.
+- **R4 Onboarding.** The welcome screen has only "Get started" (`A/views/onboarding/SimpleXInfo.android.kt:11-16`); "Your profile" is the mobile layout with "Migrate" in its app bar (`C/views/WelcomeView.kt:200-300`); there is no passphrase step (`C/views/WelcomeView.kt:400`); "Your network" also has "Setup notifications", and its "Continue" applies the notification mode (default Instant), which starts the service and shows the "Instant notifications" alert (onboarding boots keep the notice prefs at their defaults), dismissed with "OK" (`C/views/onboarding/YourNetwork.kt:58-125`; `APP/SimplexApp.kt:217-244`; `APP/SimplexService.kt:430-448`). After onboarding, while the user has no conversations and `addressCreationCardShown` is false, the chat-list area shows the onboarding cards instead of the rows (`C/views/chatlist/ChatListView.kt:449-454`; `C/views/newchat/OnboardingCards.kt:52-56`); the toolbar with "Chats" stays.
+- **R5 Share.** `shareText` opens the system chooser (`ACTION_CHOOSER` wrapping `ACTION_SEND`, `EXTRA_TEXT`) instead of copying and showing "Copied" (`A/platform/Share.android.kt:30-49`; desktop `D/platform/Share.desktop.kt:20-23`); `shareFile` opens the chooser with `EXTRA_STREAM` (`A/platform/Share.android.kt:51-89,112-114`). The assertion is the recorded intent (`INTENTS`), as in 05 §6.
+- **R6 New chat entry.** The entry is labelled "Paste link / Scan" and opens the connect screen with the camera section at once ("Or scan QR code"; `CAMERA` is pre-granted by the runner, 05 setup item 2) (`C/views/newchat/NewChatSheet.kt:61,194`; `C/views/chatlist/ChatListView.kt:417,437,440`; `C/views/newchat/NewChatView.kt:652-668`). Pasting a link hides the scanner (`NewChatView.kt:679,684`).
+- **R7 Notifications.** `NTF` assertions read the real notifications (`SYSNTF`, 05 §3).
+- **R8 SimpleX Lock.** "Lock mode" is set to "Passcode" first (System is the default, `C/views/usersettings/PrivacySettings.kt:38-52`; 05 §10); the passcodes are stored Keystore-encrypted, so a pref check reads `DatabaseUtils.ksAppPassword.get()` / `ksSelfDestructPassword.get()` instead of Base64-decoding the pref (`C/views/helpers/DatabaseUtils.kt:15-19`; `A/platform/Cryptor.android.kt`; desktop passthrough `D/platform/Cryptor.desktop.kt:3-17`); backgrounding is the real activity lifecycle (`BG`, `APP/MainActivity.kt:70-89`) instead of the simulated focus events of 04 harness fact 7.
+- **R9 Esc.** There is no Esc key on Android; the same `BackHandler`s run on the system Back key (`BACK`, `A/platform/Back.android.kt:5-8`; desktop window `onKeyEvent`, `apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/DesktopApp.kt:125-130`).
+- **R10 Recorder and player seams.** `REC` and `AV` rows (recording, voice and video playback, video previews, the incoming-call ringtone) need Android actuals of the plan §11.2 seams: `A/platform/RecAndPlay.android.kt` (`MediaRecorder`/`MediaPlayer`), `A/platform/VideoPlayer.android.kt` (ExoPlayer) and `A/helpers/SoundPlayer.kt`, as the desktop seams replace VLC (`D/platform/RecAndPlay.desktop.kt`, `D/platform/VideoPlayer.desktop.kt`). The test steps are unchanged.
+- **R11 Toasts.** Android `showToast` is the system `Toast.makeText(…).show()` (`A/platform/UI.android.kt:23`; every Android toast goes through it), so there is no in-process list to read as on desktop (`simplexWindowState.toasts`, `D/platform/UI.desktop.kt:7-9`). Without app changes, the instrumented test registers `UiAutomation.setOnAccessibilityEventListener` and records the `TYPE_NOTIFICATION_STATE_CHANGED` events whose package is the app's and whose class is `android.widget.Toast`, with the toast text from the event's text; a `TOAST` step ("toast X is recorded", "no toast is recorded") reads this recorder. Text toasts of an app targeting API 30+ (the app targets 36, `android/build.gradle.kts:18`) are drawn by System UI, which sends the event with the app's package (`ToastPresenter.trySendAccessibilityEvent`, SDK `android/widget/ToastPresenter.java:311-335`; before Android 11 the class was `android.widget.Toast$TN`). To be confirmed in the Android P1 (05 open question 13); the fallback is an app-side `showToast` hook, which needs the user's approval like the desktop seams.
+- **R12 Typing leaves the cursor at the end.** `EditText.setText`, which Espresso `replaceText` calls, resets the selection to 0 (`TextView.setText` runs `mMovement.initialize` before `sendOnTextChanged`, SDK `android/widget/TextView.java:7504,7519`; `ArrowKeyMovementMethod.initialize` → `Selection.setSelection(text, 0)`, `android/text/method/ArrowKeyMovementMethod.java:364`), and the app forwards that selection into the compose state (`onSelectionChanged` and `doOnTextChanged`, `A/platform/PlatformTextField.android.kt:123-128,160-167`). The mention picker reads the selection (`C/views/chat/group/GroupMentions.kt:104-137,291-310`), so with the cursor at 0, 02 `mention_editAddsMention` would show no picker and `mention_maxReached_showsLimit` would select the first mention instead of the limit state. The Android `type()` therefore puts the cursor at the end after setting the text (05 setup item 5), as desktop `performTextInput` does; with that, compose and mention rows carry over unchanged.
+- **R13 Links and clipboard.** The Android test composes the real root (`MainActivity.onCreate` → `setContent { AppScreen() }`, `APP/MainActivity.kt:57-59`; 05 setup item 1), so there is no `TestRoot` and none of its composition-local stubs: nothing in `android/` or `androidMain` provides `LocalUriHandler` or `LocalClipboardManager`. `URI` therefore becomes `INTENTS`: `LocalUriHandler` is Compose's `AndroidUriHandler`, whose `openUri` calls `startActivity(Intent(ACTION_VIEW, Uri.parse(uri)))` and rethrows `ActivityNotFoundException` as `IllegalArgumentException` (Compose `ui-android` 1.8.2, `gradle.properties:35`); the test records the outgoing `ACTION_VIEW` with Espresso-Intents and stubs it with `respondWith`, so nothing launches, and "the URI stub records X" becomes "an `ACTION_VIEW` intent with data X is recorded". `CB` is the real system `ClipboardManager` behind Compose's `AndroidClipboardManager`, read and written in-process while the app is in the foreground; the clip persists across tests (and apps), so the Android reset clears it (`ClipboardManager.clearPrimaryClip()`, 05 setup item 4), and "the test puts X on the clipboard stub" means setting the system clip. The 90 `CB` tests of 01–04 carry over with this mechanism and are not listed for it; every `URI` test of 01–04 is listed, as R13 or, for the call rows, with its own Android behaviour.
+
+**Not listed (carry over unchanged at test level):**
+- One pane: Android shows either the chat list or a chat, and info screens, settings and modals cover the screen (`C/App.kt:313-360`; `C/views/helpers/ModalView.kt:253-258`). Screen objects own the navigation (05 setup item 6), so a row that asserts a chat-list row while a chat or its info is open, or opens a modal over a chat, is not listed for that reason alone.
+- The message field is typed with Espresso `replaceText` on the `EditText`, followed by `setSelection(editText.length())` (05 setup item 5, R12); only key-driven steps are listed (R2). The clear-text (x) button shows at `EditText.lineCount >= 4`, which counts wrapped lines, where desktop counts newlines (`A/platform/PlatformTextField.android.kt:196`; `D/platform/PlatformTextField.desktop.kt:204`); 02 `compose_clearTextButton_clears` carries over as long as the lines it types are short enough not to wrap. Reads of the field (its text and placeholder) go through `ChatScreen.messageText`/`placeholder`, which read the `EditText` in an Espresso `ViewAction` (05 setup item 5), so rows that read it are not listed for that reason alone.
+- Rows whose entry is "row menu" or "long-press" (R1 note), and rows that only need a runtime permission the runner pre-grants (05 setup item 2: `POST_NOTIFICATIONS`, `CAMERA`, `RECORD_AUDIO`).
+- `CB` tests (90 in 01–04): the clipboard is the real system one, cleared by the reset (R13), so a `CB` test is not listed for that reason alone.
+- 04 `privacy_linkPreviewsOff_noPreview` (04:53) runs unchanged, but until the debug-only network-security-config of the 02:44 rows is approved it passes vacuously: with the setting on, no preview could be fetched either.
+- `RESTART` tests (48 in 01–04; 45 run on Android, 3 are DESKTOP-ONLY or REPLACED) carry over once `restart()` has an Android mechanism (05 open question 14); they are listed only where the Android startup differs.
+- `FIXTURE` tests (38 in 01–04) carry over once fixtures have an Android mechanism (05 open question 16); listed only where the fixture differs on Android (04:199, the key).
+- Screenshot-only checks (01 `createListDuplicateNameError`, `unreadCounterGrayWhenMuted`, `planBotAddressShowsBotIcon`, 04 `morePrivacy_verifySimplexNamesPref`): their semantic assertions run on Android unchanged, and the part checked only in the screenshot waits for 05 open question 17, since Android writes no §7.7 shots until then; they are not listed for that reason alone (01:187 is listed for R6).
+- Layout-only differences that no row asserts (paddings, the tags row scrolling horizontally instead of wrapping, `A/views/chatlist/ChatListView.android.kt:33-43`; the user picker drawn as a bottom sheet).
+
+---
+
+## 01 onboarding, chat list, connecting, profiles, address, contact info
+
+| Catalogue row (file:line) | Test name | Class | Android behaviour / replacement | Code ref |
+|---|---|---|---|---|
+| 01:27 | `onboardingWelcomeShowsDesktopActions` | REPLACED | 05 §1 `androidOnboardingWelcomeShowsGetStarted`: only "Get started" and "Why SimpleX is built." | `A/views/onboarding/SimpleXInfo.android.kt:11-16`; `D/views/onboarding/SimpleXInfo.desktop.kt:16-23` |
+| 01:28 | `onboardingCreateProfileValidName` | ADAPT | R4: entry "Get started" (no "Create your profile"); mobile "Your profile"; success moves to "Your network", not "Setup database passphrase" | `C/views/WelcomeView.kt:236-300,399-405` |
+| 01:28 | `onboardingCreateProfileButtonDisabledForEmptyName` | ADAPT | R4: entry "Get started" | `A/views/onboarding/SimpleXInfo.android.kt:13` |
+| 01:28 | `onboardingCreateProfileInvalidNameShowsCorrectionAlert` | ADAPT | R4: entry "Get started" | `A/views/onboarding/SimpleXInfo.android.kt:13` |
+| 01:28 | `onboardingCreateProfileBackReturnsToWelcome` | ADAPT | R4: entry "Get started"; the back arrow of the mobile screen returns to the welcome screen (system Back: 05 §13 `back_onboardingProfile_returnsToWelcome`) | `C/views/WelcomeView.kt:227-242` |
+| 01:29 | `onboardingMigrateFromAnotherDeviceOpensMigrationScreen` | REPLACED | 05 §1 `androidOnboardingMigrateButtonOpensScanAndPaste`: the button reads "Migrate" and the screen leads with "Scan QR code" | `C/views/WelcomeView.kt:221`; `C/views/migration/MigrateToDevice.kt:206-216` |
+| 01:30 | `onboardingSetDatabasePassphrase` | DESKTOP-ONLY | The passphrase step exists only on desktop; Android stores a random passphrase in the Keystore (05 §1 `androidOnboardingNoPassphraseStepAfterProfile`) | `C/views/WelcomeView.kt:400` |
+| 01:30 | `onboardingSetPassphraseMismatchDisablesButton` | DESKTOP-ONLY | As above | `C/views/WelcomeView.kt:400` |
+| 01:30 | `onboardingUseRandomPassphraseAlert` | DESKTOP-ONLY | As above | `C/views/WelcomeView.kt:400` |
+| 01:31 | `onboardingPassphrasePersistsAcrossRestart` | DESKTOP-ONLY | As above; the Android path to the startup passphrase prompt is 05 §11 `keystore_removed_restartAsksPassphrase` | `C/views/WelcomeView.kt:400` |
+| 01:32 | `onboardingYourNetworkShowsSetupRouters` | ADAPT | R4: reached right after the profile; the screen also shows "Setup notifications" (05 §1 `androidYourNetworkShowsSetupNotifications`) | `C/views/onboarding/YourNetwork.kt:58-133` |
+| 01:32 | `onboardingContinueGoesToConditions` | ADAPT | R4: after "Continue" the "Instant notifications" alert appears; "OK", then "Network commitments" | `C/views/onboarding/YourNetwork.kt:118-125`; `APP/SimplexApp.kt:217-244` |
+| 01:33 | `onboardingChooseOperatorsToggle` | ADAPT | R4: reached without the passphrase step ("Setup routers" on the mobile "Your network") | `C/views/onboarding/YourNetwork.kt:98-103` |
+| 01:33 | `onboardingChooseOperatorsCannotDeselectAll` | ADAPT | R4: as above | `C/views/onboarding/YourNetwork.kt:98-103` |
+| 01:33 | `onboardingHowItHelpsPrivacyInfo` | ADAPT | R4: as above | `C/views/onboarding/YourNetwork.kt:98-103` |
+| 01:34 | `onboardingAcceptConditionsCompletesOnboarding` | ADAPT | R4: no passphrase step; "OK" on the "Instant notifications" alert after "Continue"; after "Accept" the toolbar shows "Chats" and the list area shows the onboarding cards | `C/views/chatlist/ChatListView.kt:449-454` |
+| 01:34 | `onboardingConditionsLinkOpensConditionsText` | ADAPT | R4: as above | `C/views/onboarding/YourNetwork.kt:118-125` |
+| 01:35 | `onboardingAcceptButtonDisabledWithNoOperators` | ADAPT | R4: as above | `C/views/onboarding/YourNetwork.kt:118-125` |
+| 01:36 | `onboardingNoNotificationsStepOnDesktop` | REPLACED | 05 §1 `androidYourNetworkShowsSetupNotifications` (and the `onboardingNotifications_*` rows): the notifications step exists on Android | `C/views/onboarding/YourNetwork.kt:58,105-109` |
+| 01:37 | `onboardingThenConnectToCliPeerViaLocalServers` | ADAPT | R4: no passphrase step, "OK" on the notifications alert; the chat-list area then shows the onboarding cards, so the 1-time link is created from "Start new chat" › "Create 1-time link" (or the card "Let someone connect to you" › "Invite someone privately") | `C/views/newchat/OnboardingCards.kt:357-404` |
+| 01:38 | `onboardingLinkAMobileShowsQrAndDeviceName` | DESKTOP-ONLY | No "Link a mobile" on the Android welcome screen (05 §1 `androidOnboardingWelcomeShowsGetStarted`) | `A/views/onboarding/SimpleXInfo.android.kt:11-16` |
+| 01:39 | `onboardingLinkAMobileBackReturnsToWelcome` | DESKTOP-ONLY | As above | `A/views/onboarding/SimpleXInfo.android.kt:11-16` |
+| 01:40 | `onboardingCreateProfileWhenOnlyHiddenUsersExist` | ADAPT | R4: "Get started"; the next screen is always "Your network" (no passphrase step); the no-user startup sets the welcome stage without `startChatWithoutUser` | `C/views/WelcomeView.kt:398-405`; `C/platform/Core.kt:153-167` |
+| 01:48 | `whatsNewPaginationPrevNext` | ADAPT | R13: "Open" on the "Open external link?" alert of "Read more" fires `ACTION_VIEW` with the URL, recorded and stubbed with `INTENTS`, instead of the URI stub | `C/views/onboarding/WhatsNewView.kt:261`; `C/views/helpers/Utils.kt:613-624` |
+| 01:49 | `whatsNewNotShownForNewUser` | ADAPT | R4: onboarding path ("Get started", no passphrase step, notifications alert) | `C/views/WelcomeView.kt:399-405` |
+| 01:70 | `createListWithEmoji` | REPLACED | 05 §14 `tagListAndroid_emojiPickerViewSetsEmoji`: the emoji comes from a full-screen `EmojiPickerView`, not a single-emoji text field | `A/views/chatlist/TagListView.android.kt:22-81`; `D/views/chatlist/TagListView.desktop.kt:24-72` |
+| 01:73 | `editListNameAndEmoji` | ADAPT | R1 (long-press the chip); changing the emoji goes through the `EmojiPickerView` (`VIEW`) | `C/views/chatlist/ChatListView.kt:1331`; `A/views/chatlist/TagListView.android.kt:22-81` |
+| 01:73 | `deleteListConfirm` | ADAPT | R1 (long-press the chip) | `C/views/chatlist/ChatListView.kt:1331` |
+| 01:73 | `reorderListsDrag` | ADAPT | R1 (long-press the chip); the drag is a touch drag | `C/views/chatlist/ChatListView.kt:1331` |
+| 01:84 | `contactMenuMarkRead` | ADAPT | R1 (long-press the row) | `A/views/chatlist/ChatListNavLinkView.android.kt:26-27` |
+| 01:84 | `contactMenuMarkUnread` | ADAPT | R1 | `A/views/chatlist/ChatListNavLinkView.android.kt:26-27` |
+| 01:84 | `contactMenuFavoriteUnfavorite` | ADAPT | R1 | `A/views/chatlist/ChatListNavLinkView.android.kt:26-27` |
+| 01:84 | `contactMenuMuteUnmute` | ADAPT | R1 | `A/views/chatlist/ChatListNavLinkView.android.kt:26-27` |
+| 01:84 | `contactMenuClearChat` | ADAPT | R1 | `A/views/chatlist/ChatListNavLinkView.android.kt:26-27` |
+| 01:84 | `contactMenuRightClickOpens` | ADAPT | R1: tests the long press of the same handler | `A/views/chatlist/ChatListNavLinkView.android.kt:26-27` |
+| 01:90 | `pendingAcceptedRowIcon` | ADAPT | R6: the full link is pasted through the connect screen ("Paste link / Scan") | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 01:90 | `pendingConnectionMenuDeleteAccepted` | ADAPT | R6: as above | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 01:98 | `connectBannerCardOpensPasteLink` | ADAPT | R6: the banner's second half reads "Paste link / Scan" and opens the connect screen with the camera section | `C/views/chatlist/ChatListView.kt:414-440` |
+| 01:101 | `centerConnectOnboardingCardsWithNoConversations` | REPLACED | 05 §1 `androidOnboardingCards_inChatList`, `androidOnboardingCards_swipeBetweenPages`: the cards fill the chat-list area (no centre pane) | `C/views/chatlist/ChatListView.kt:449-475`; `C/App.kt:389-418` |
+| 01:101 | `centerCardsInviteSomeone` | ADAPT | The cards are in the chat-list area, not a centre pane; "Let someone connect to you" animates the pager to "Create your link"; "Invite someone privately" opens NewChatView full screen | `C/views/chatlist/ChatListView.kt:453,465-475`; `C/views/newchat/OnboardingCards.kt:343-349,394-404` |
+| 01:101 | `centerCardsCreatePublicAddress` | ADAPT | As above: the card is in the chat-list area; the address screen opens full screen | `C/views/newchat/OnboardingCards.kt:405-418` |
+| 01:101 | `centerCardsConnectViaLink` | REPLACED | 05 §1 `androidOnboardingCards_connectViaLinkShowsScanner`: the connect screen shows the camera section (desktop asserts no scanner) | `C/views/newchat/OnboardingCards.kt:376-381` |
+| 01:102 | `noSelectedChatPlaceholder` | DESKTOP-ONLY | "No selected chat" is drawn only in the desktop centre pane; Android's one-pane screen has no placeholder | `C/App.kt:313-360,407-416` |
+| 01:111 | `serversSummaryFilesTabShowsXftp` | ADAPT | R2: no typed-path attach; alice attaches the file through the 05 §6 "File" stub (`INTENTS`) | `A/platform/PlatformTextField.android.kt:60-63`; `A/views/chat/ComposeView.android.kt:44,74-77` |
+| 01:112 | `serversSummaryShareJson` | ADAPT | R5: the share button opens the chooser with `EXTRA_TEXT` = the JSON (`INTENTS`), not the clipboard | `C/views/chatlist/ChatListView.kt:641-652`; `A/platform/Share.android.kt:30-49` |
+| 01:118 | `userPickerOpensAndShowsCurrentUser` | ADAPT | The picker is a bottom sheet whose first section is one horizontally scrolling row of all visible profiles; the current user is the box with the bold name (no separate current-profile row); it closes on a tap on the dimmed area or a swipe down | `C/views/chatlist/UserPicker.kt:201-215`; `A/views/chatlist/UserPicker.android.kt:34-106,127-201` |
+| 01:118 | `userPickerCurrentUserOpensProfileEditor` | ADAPT | Tapping the current user's box opens "Your current profile" | `C/views/chatlist/UserPicker.kt:161-175`; `A/views/chatlist/UserPicker.android.kt:72-106` |
+| 01:119 | `userPickerSwitchProfile` | ADAPT | Inactive profiles are boxes in the same scrolling row (desktop: a grid of avatars under the divider); 05 §14 `userPickerAndroid_profilesRowSwitchesUser` covers the row itself | `A/views/chatlist/UserPicker.android.kt:34-70`; `D/views/chatlist/UserPicker.desktop.kt:27-87` |
+| 01:120 | `userPickerUnreadBadgePerUser` | ADAPT | The unread badge is on the avatar inside each inactive profile's box of the scrolling profiles row (desktop: on the avatars of the grid); the count is the same `userUnreadBadge` | `A/views/chatlist/UserPicker.android.kt:90-96`; `C/views/chatlist/UserPicker.kt:639` |
+| 01:120 | `userPickerMutedUserGrayBadge` | ADAPT | The muted user's grey badge is likewise on the avatar inside its box of the scrolling profiles row (desktop: on the avatars of the grid) | `A/views/chatlist/UserPicker.android.kt:90-96`; `C/views/chatlist/UserPicker.kt:639` |
+| 01:121 | `userPickerLinkAMobileRow` | REPLACED | 05 §12 `useFromDesktop_pickerRowOpensConnectScreen`: the row is "Use from desktop" | `C/views/chatlist/UserPicker.kt:354-366` |
+| 01:121 | `userPickerDisabledWhenChatStopped` | ADAPT | The disabled items are the profile boxes, the address row, "Chat preferences", "Your chat profiles" and "Use from desktop" (no "Link a mobile"); "Settings" stays enabled | `C/views/chatlist/UserPicker.kt:201-210,354-366`; `A/views/chatlist/UserPicker.android.kt:45-48,81-84` |
+| 01:124 | `profilesHideProfileWithPassword` | ADAPT | R1 (long-press the profile row) | `C/views/usersettings/UserProfilesView.kt:220`; `C/views/chatlist/UserPicker.kt:410-418` |
+| 01:124 | `profilesHidePasswordMismatchDisabled` | ADAPT | R1 | `C/views/usersettings/UserProfilesView.kt:220`; `C/views/chatlist/UserPicker.kt:410-418` |
+| 01:124 | `profilesRevealHiddenByPasswordInSearch` | ADAPT | R1 | `C/views/usersettings/UserProfilesView.kt:220`; `C/views/chatlist/UserPicker.kt:410-418` |
+| 01:124 | `profilesActivateHiddenViaSearchPassword` | ADAPT | R1 | `C/views/usersettings/UserProfilesView.kt:220`; `C/views/chatlist/UserPicker.kt:410-418` |
+| 01:124 | `profilesUnhideActiveRequiresPassword` | ADAPT | R1 | `C/views/usersettings/UserProfilesView.kt:220`; `C/views/chatlist/UserPicker.kt:410-418` |
+| 01:124 | `profilesHideOnlyWhenMoreThanOneVisible` | ADAPT | R1 | `C/views/usersettings/UserProfilesView.kt:220`; `C/views/chatlist/UserPicker.kt:410-418` |
+| 01:128 | `profilesDeleteLastVisibleShowsCreateChatProfile` | REPLACED | 05 §15 `profilesAndroid_deleteLastVisibleReturnsToOnboarding`: the core stops and the welcome screen shows | `C/views/usersettings/UserProfilesView.kt:353-361` |
+| 01:131 | `editProfileImageSetAndDelete` | ADAPT | R3: "Edit image" opens the bottom sheet "Camera" / "From Gallery"; the image comes from the gallery stub (as 05 §6 `profileImage_galleryStub_setsImage`, `INTENTS`) instead of a file dialog; "Delete image" is unchanged | `A/views/helpers/GetImageView.android.kt:142-216`; `C/views/usersettings/UserProfileView.kt:178-186` |
+| 01:138 | `newChatSheetShowsActions` | ADAPT | R6: the second action reads "Paste link / Scan" | `C/views/newchat/NewChatSheet.kt:194` |
+| 01:140 | `newChatSheetContactMenuDelete` | ADAPT | R1 (long-press the contact row) | `C/views/contacts/ContactListNavView.kt:31-140` |
+| 01:152 | `oneTimeLinkShareButton` | REPLACED | 05 §6 `shareText_oneTimeLink_firesChooser` (R5) | `C/views/newchat/NewChatView.kt:758-763`; `A/platform/Share.android.kt:30-49` |
+| 01:158 | `oneTimeLinkUsedNoAlert` | ADAPT | R5: use the copy icon, or assert the chooser when the link is shared; closing then shows no alert as on desktop | `C/views/newchat/NewChatView.kt:719-721,751-763` |
+| 01:159 | `oneTimeLinkQrClickSavesPng` | ADAPT | R5: tapping the QR code fires the chooser with `ACTION_SEND`, `EXTRA_STREAM` = a `FileProvider` URI of `IMG_<ts>.png`, type `image/png`, in place of the two save dialogs; closing the sheet still shows no "Keep unused invitation?" alert | `C/views/newchat/QRCode.kt:89-99`; `A/platform/Share.android.kt:51-89,112-114` |
+| 01:170 | `pasteLinkInvalidTextAlert` | ADAPT | R6: entry "Paste link / Scan" | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 01:170 | `pasteLinkClipboardEmptyNoop` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 01:172 | `planInvitationShortLinkOpenNewChat` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 01:173 | `planInvitationFullLinkUseCurrentProfile` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 01:173 | `planInvitationFullLinkUseIncognito` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 01:173 | `planInvitationFullLinkCancel` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 01:174 | `planOwnInvitationConnectToYourself` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 01:175 | `planInvitationAlreadyConnectingFullLink` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 01:176 | `planInvitationKnownContactOpenChat` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 01:177 | `planInvitationConnectingPreparedOpensKnown` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 01:178 | `planInvitationDeletedLinkError` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 01:179 | `planAddressShortLinkOpenNewChat` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 01:180 | `planAddressFullLinkConnectAlert` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 01:181 | `planOwnAddressConnectToYourself` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 01:182 | `planAddressRepeatConnectionRequest` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 01:183 | `planAddressConnectingProhibitOpensKnown` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 01:184 | `planAddressKnownContactOpenChat` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 01:185 | `planAddressContactViaAddressOpensChat` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 01:186 | `planAddressDeletedContactReconnect` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 01:187 | `planBotAddressShowsBotIcon` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 01:211 | `pendingInfoInvitedShowsLinkQrShare` | ADAPT | R5: "Share 1-time link" opens the chooser (05 §6 `shareText_pendingConnection_firesChooser`) instead of filling the clipboard | `C/views/newchat/ContactConnectionInfoView.kt:159-166` |
+| 01:224 | `addressQrAndShareAddress` | ADAPT | R5: "Share address" opens the chooser (05 §6 `shareText_address_firesChooser`) | `C/views/usersettings/UserAddressView.kt:115,343-366` |
+| 01:241 | `simplexNameRegisterLinkOpensBrowser` | ADAPT | R13: opening the link from the "Open web link?" alert fires `ACTION_VIEW` with `https://simplex.domains/#testing` (`INTENTS`) | `C/views/usersettings/SetSimplexNameView.kt:178`; `C/views/chat/item/TextItemView.kt:533-585` |
+| 01:250 | `contactInfoHeaderShowsNameBioCopy` | ADAPT | R11: "Copied to clipboard" is a system toast, asserted through the toast recorder; the clipboard check is unchanged | `C/views/chat/ChatInfoView.kt:745-748`; `A/platform/UI.android.kt:23` |
+| 01:251 | `contactInfoSearchButton` | ADAPT | "search" closes the info screen first, then opens the chat's search field (05 §14 `chatInfo_searchButtonClosesInfoAndSearches`) | `C/views/chat/ChatInfoView.kt:883-899` |
+| 01:252 | `contactInfoCallButtonsStubbed` | REPLACED | 05 §9 `call_outgoingAudio_invitationReachesPeer` (video: as far as 05 §9 `callPermissions_videoCallNeedsCamera`): calls start `CallActivity`, not the URI handler | `C/App.kt:227-235`; `APP/SimplexApp.kt:319-330`; `D/views/call/CallView.desktop.kt:158-167` |
+
+## 02 chat view, messages, chat item info
+
+| Catalogue row (file:line) | Test name | Class | Android behaviour / replacement | Code ref |
+|---|---|---|---|---|
+| 02:25 | `notes_opens_showsSearchAndContentFilterIcons` | REPLACED | 05 §14 `toolbar_notes_filterInMenuAndroid`: notes show "Search" and the ⋮ button; the content filters are in the ⋮ menu, not a bar icon | `C/views/chat/ChatView.kt:1339-1340,1377-1400` |
+| 02:28 | `toolbarMenu_direct_items` | ADAPT | With calls available the direct chat's ⋮ menu also lists the content filters after a divider (at least "Images" and "Links"; 05 §14 `toolbar_directChat_filterInMenuWhenCallsAvailable`) | `C/views/chat/ChatView.kt:1377-1400` |
+| 02:30 | `toolbarCall_audio_opensCallLink` | REPLACED | 05 §9 `call_outgoingAudio_invitationReachesPeer`: the call opens `CallActivity`, not the URI handler | `C/App.kt:227-235`; `APP/SimplexApp.kt:319-330` |
+| 02:31 | `callStart_browserUnavailable_showsAlertAndEnds` | DESKTOP-ONLY | No browser is opened on Android, so "Error opening browser" can't appear | `D/views/call/CallView.desktop.kt:157-174`; `C/App.kt:227-235` |
+| 02:36 | `sendText_enter_peerReceives` | ADAPT | R2: sends with the send button (the same steps as `sendText_sendButton_peerReceives`; the row still runs for its `S` variant) | `A/platform/PlatformTextField.android.kt:60-63` |
+| 02:39 | `multiline_shiftEnter_peerReceivesTwoLines` | REPLACED | 05 §14 `compose_enterKeyInsertsNewline_sendButtonSends`: Enter inserts the line break, the send button sends | `A/platform/PlatformTextField.android.kt:60-63,99-132` |
+| 02:40 | `groupSend_allMembersReceive` | ADAPT | R2: sends with the send button | `A/platform/PlatformTextField.android.kt:60-63` |
+| 02:43 | `link_click_showsOpenWebLinkAlert` | ADAPT | R13: "Open" fires `ACTION_VIEW` with `http://127.0.0.1/page`, recorded and stubbed with `INTENTS` so no browser launches | `C/views/chat/item/TextItemView.kt:533-585` |
+| 02:43 | `link_openClean_opensSanitizedUri` | ADAPT | R13: "Open clean link" fires `ACTION_VIEW` whose data is the URL without `utm_source` (`INTENTS`) | `C/views/chat/item/TextItemView.kt:533-585` |
+| 02:44 | `linkPreview_firstTimeAlert_enable_fetchesPreview` | ADAPT | Cleartext HTTP to 127.0.0.1 is blocked: the app targets API 36 and its manifest sets neither `usesCleartextTraffic` nor `networkSecurityConfig`, so the platform default forbids cleartext, with no loopback exemption; jsoup's `HttpURLConnection` fetch fails with "Cleartext HTTP traffic to 127.0.0.1 not permitted" and `getLinkPreview` catches it and returns null (no preview card, the content type stays text). The test needs a debug-only network-security-config allowing cleartext to 127.0.0.1, a build change that needs the user's approval (05 open question 15), and `adb reverse` of the HTTP stub's port like the other servers; until it is approved the test fails | `android/build.gradle.kts:18`; `MAN:40-50`; `common/build.gradle.kts:74`; SDK `com/android/okhttp/HttpHandler.java:121-128`, `android/security/net/config/NetworkSecurityConfig.java:200-202`, `android/security/net/config/ManifestConfigSource.java:73-79`; `C/views/helpers/LinkPreviews.kt:96-140` |
+| 02:44 | `linkPreview_sent_peerReceivesLinkContent` | ADAPT | As above: without the debug-only config no preview is attached, so bob's content types print `text`, not `link` | `C/views/helpers/LinkPreviews.kt:96-140` |
+| 02:44 | `linkPreview_cancel_sendsPlainText` | ADAPT | As above: without the debug-only config there is no preview to cancel | `C/views/helpers/LinkPreviews.kt:96-140` |
+| 02:57 | `liveMessage_menuStart_alertConfirm_peerSeesStarted` | ADAPT | R1: long-press the send button for its menu | `C/views/chat/SendMsgView.kt:452-490` |
+| 02:57 | `liveMessage_typingUpdates_peerSeesUpdates` | ADAPT | R1 | `C/views/chat/SendMsgView.kt:452-490` |
+| 02:57 | `liveMessage_finish_peerSeesEnded` | ADAPT | R1 | `C/views/chat/SendMsgView.kt:452-490` |
+| 02:61 | `liveMessage_group_membersSeeLive` | ADAPT | R1: "Same, in a group" starts from the send-button menu, so the send button is long-pressed | `C/views/chat/SendMsgView.kt:452-490` |
+| 02:68 | `timed_send30s_bothSidesDelete` | ADAPT | R1 | `C/views/chat/SendMsgView.kt:452-490` |
+| 02:69 | `timed_menuOptions_listed` | ADAPT | R1 | `C/views/chat/SendMsgView.kt:452-490` |
+| 02:69 | `timed_customTime_sendsWithChosenTtl` | REPLACED | 05 §14 `timedCustom_androidWheelPickerSetsTtl`: "Delete after" shows two wheels instead of two dropdowns | `A/views/helpers/CustomTimePicker.android.kt:14-106`; `D/views/helpers/CustomTimePicker.desktop.kt:11-81` |
+| 02:70 | `timed_menuHidden_whenFeatureOff` | ADAPT | R1 | `C/views/chat/SendMsgView.kt:452-490` |
+| 02:71 | `timed_chatPref_receivedMessagesDisappear` | ADAPT | R1 (long-press the feature row → "Expand") | `C/views/chat/item/CIChatFeatureView.kt:30-35` |
+| 02:71 | `timed_meta_showsTimerAndTtl` | ADAPT | R1 (long-press the feature row → "Expand") | `C/views/chat/item/CIChatFeatureView.kt:30-35` |
+| 02:76 | `voice_record_send_peerReceivesVoice` | ADAPT | R10 (`REC`) | `A/platform/RecAndPlay.android.kt:17-98` |
+| 02:77 | `voice_tapToRecord_stopButton_addsPreview` | ADAPT | R10 (`REC`) | `A/platform/RecAndPlay.android.kt:17-98` |
+| 02:77 | `voice_tooShort_discarded` | ADAPT | R10 (`REC`) | `A/platform/RecAndPlay.android.kt:17-98` |
+| 02:77 | `voice_preview_cancel_deletesTmpFile` | ADAPT | R10 (`REC`) | `A/platform/RecAndPlay.android.kt:17-98` |
+| 02:80 | `voice_disabledWhileRecording_cancels` | ADAPT | R10 (`REC`) | `A/platform/RecAndPlay.android.kt:17-98` |
+| 02:82 | `voice_playback_playPauseProgress` | ADAPT | R10 (`AV`) | `A/platform/RecAndPlay.android.kt:101-296` |
+| 02:83 | `voice_preview_playPauseAndSeek` | ADAPT | R10 (`REC`, `AV`) | `A/platform/RecAndPlay.android.kt` |
+| 02:84 | `voice_notes_recordAndSave` | ADAPT | R10 (`REC`) | `A/platform/RecAndPlay.android.kt:17-98` |
+| 02:89 | `attach_sheet_showsImageVideoFile` | REPLACED | 05 §6 `attachSheet_androidShowsCameraImageVideoFile`: four buttons, "Camera" first | `A/views/helpers/ChooseAttachmentView.android.kt:13-30`; `D/views/helpers/ChooseAttachmentView.desktop.kt:13-26` |
+| 02:90 | `attachFile_send_peerReceivesOffer` | ADAPT | R3: "File" fires `ACTION_GET_CONTENT` `*/*`, answered by the stub (as 05 §6 `attachFile_getContent_sendsFile`) | `A/views/chat/ComposeView.android.kt:44,74-77` |
+| 02:90 | `attachFile_withText_peerReceivesTextAndFile` | ADAPT | R3: as above | `A/views/chat/ComposeView.android.kt:44,74-77` |
+| 02:91 | `attachFile_cancelPreview_nothingSent` | ADAPT | R3: as above | `A/views/chat/ComposeView.android.kt:44,74-77` |
+| 02:92 | `attachImage_send_peerReceivesCompressedImage` | ADAPT | R3: "Image" fires `ACTION_PICK` on the gallery, answered by the stub (as 05 §6 `attachGallery_twoImages_sendsEach`) | `A/views/chat/ComposeView.android.kt:40,58-65` |
+| 02:92 | `attachImages_multiple_sentAsSeparateMessages` | ADAPT | R3: the stub returns several URIs in `ClipData` | `A/views/helpers/GetImageView.android.kt:218-242` |
+| 02:92 | `attachImage_textOnLastImageOnly` | ADAPT | R3: as above | `A/views/helpers/GetImageView.android.kt:218-242` |
+| 02:93 | `attachImage_cancelPreview` | ADAPT | R3 | `A/views/chat/ComposeView.android.kt:40,58-65` |
+| 02:94 | `attachGif_sentUncompressedAnimated` | ADAPT | R3: the gallery stub returns the GIF; the coil animation runs in real time even under blur and modals (`A/views/chat/item/CIImageView.android.kt:22-57`), so the image node is volatile in screenshots | `A/views/chat/ComposeView.android.kt:40,58-65` |
+| 02:95 | `attachVideo_send_peerReceivesVideo` | ADAPT | R3: "Video" fires `ACTION_PICK` for videos (as 05 §6 `attachGallery_video_sendsVideo`); R10 (`AV`) | `A/views/chat/ComposeView.android.kt:42,66-73` |
+| 02:96 | `attachVideo_undecodable_showsAlert` | ADAPT | R3 and R10, as above | `A/views/chat/ComposeView.android.kt:42,66-73` |
+| 02:97 | `paste_filePathText_attachesFile` | DESKTOP-ONLY | R2: the Android field doesn't turn typed paths into attachments | `A/platform/PlatformTextField.android.kt:60-63`; `D/platform/PlatformTextField.desktop.kt:97-110` |
+| 02:98 | `ctrlV_clipboardFiles_attaches` | DESKTOP-ONLY | R2: no Ctrl+V handling | `D/platform/PlatformTextField.desktop.kt:141-145` |
+| 02:99 | `pasteFileList_webmAudio_sentAsFile` | DESKTOP-ONLY | R2: no Ctrl+V handling | `D/platform/PlatformTextField.desktop.kt:144-145` |
+| 02:100 | `ctrlV_clipboardImage_attachesPng` | DESKTOP-ONLY | R2: no Ctrl+V handling (`IMGCB`); a keyboard-committed image is 05 §6 `compose_imeCommitImage_attachesToOpenChat` | `D/platform/PlatformTextField.desktop.kt:146-150`; `A/platform/PlatformTextField.android.kt:108-121` |
+| 02:101 | `dragDrop_files_attach` | DESKTOP-ONLY | `desktopOnExternalDrag` returns the modifier unchanged on Android (`IGNORE` on desktop too) | `A/platform/Modifier.android.kt:8-14` |
+| 02:102 | `attachFile_tooLarge_showsLargeFileAlert` | ADAPT | R3: the `GET_CONTENT` stub returns the sparse file | `A/views/chat/ComposeView.android.kt:44,74-77` |
+| 02:104 | `attachImage_withQuote_peerSeesQuote` | ADAPT | R3: the image comes from the gallery stub | `A/views/chat/ComposeView.android.kt:40,58-65` |
+| 02:105 | `attachImage_group_allMembersReceive` | ADAPT | R3: as above | `A/views/chat/ComposeView.android.kt:40,58-65` |
+| 02:115 | `sndFile_revoke_peerSeesCancelled` | ADAPT | R2: alice attaches `test.pdf` through the "File" stub, not a typed path (`rcvFile_senderRevoked_showsCancelled` of the same row is bob's `/f` + `/fc` and is unchanged) | `A/views/chat/ComposeView.android.kt:44,74-77` |
+| 02:116 | `sndFile_stopDuringUpload` | ADAPT | R2: as above | `A/views/chat/ComposeView.android.kt:44,74-77` |
+| 02:118 | `sndFile_xftpResetDuringUpload_showsFileError` | ADAPT | R2: the 150 MB file is attached through the "File" stub | `A/views/chat/ComposeView.android.kt:44,74-77` |
+| 02:122 | `rcvFile_clickCompleted_opensSaveDialog` | REPLACED | 05 §6 `rcvFile_tapLoaded_showsOpenWithAndSave` and `rcvFile_save_createDocumentWritesDecrypted`: a click on a loaded file opens the "Open with…" / "Save" menu, and "Save" fires `ACTION_CREATE_DOCUMENT` | `C/views/chat/item/CIFileView.kt:183-200`; `A/views/chat/item/CIFileView.android.kt:14-57` |
+| 02:123 | `rcvFile_missingOnDisk_clickDoesNothing` | ADAPT | R3: "no save dialog awaiting" becomes "no intent recorded" (`INTENTS`); with the file missing, `getLoadedFilePath` is null, so no menu opens either | `C/views/chat/item/CIFileView.kt:183-200` |
+| 02:125 | `rcvVideo_previewAndDownload` | ADAPT | R10 (`AV`) | `A/platform/VideoPlayer.android.kt` |
+| 02:131 | `reply_menu_sendQuoted_peerSeesQuote` | ADAPT | R1 (long-press the item) | `C/views/chat/item/ChatItemView.kt:327-335` |
+| 02:131 | `reply_cancelContext` | ADAPT | R1 | `C/views/chat/item/ChatItemView.kt:327-335` |
+| 02:139 | `edit_menu_updatesPeer` | ADAPT | R2: the edit is sent with the send button | `A/platform/PlatformTextField.android.kt:60-63` |
+| 02:139 | `edit_unchanged_noUpdate` | ADAPT | R2: as above | `A/platform/PlatformTextField.android.kt:60-63` |
+| 02:139 | `edit_metaShowsEditedIcon` | ADAPT | R2: as above | `A/platform/PlatformTextField.android.kt:60-63` |
+| 02:140 | `edit_upArrow_editsLastMessage` | DESKTOP-ONLY | R2: no Up-arrow handling | `D/platform/PlatformTextField.desktop.kt:138-140` |
+| 02:143 | `edit_ownImage_previewWithoutCancel` | ADAPT | R3: the image comes from the gallery stub; R2: the edit is sent with the send button | `A/views/chat/ComposeView.android.kt:40,58-65` |
+| 02:143 | `edit_ownFile_previewWithoutCancel` | ADAPT | R3: the file comes from the "File" stub; R2: as above | `A/views/chat/ComposeView.android.kt:44,74-77` |
+| 02:144 | `edit_notOffered_forReceivedVoiceForwarded` | ADAPT | R10 (`REC`) for alice's recorded voice message | `A/platform/RecAndPlay.android.kt:17-98` |
+| 02:168 | `forwarded_goToSource_opensOriginalChat` | ADAPT | No hover: the arrow button is always composed (faded until activated) and is tapped directly; tapping the forwarded bubble toggles it to full visibility | `C/views/chat/item/ChatItemView.kt:243-302,330-332` |
+| 02:179 | `reaction_chipMenu_direct_showsNames` | ADAPT | R1 (long-press the chip) | `C/views/chat/item/ChatItemView.kt:200-207` |
+| 02:180 | `reaction_chipMenu_group_membersAndOpenInfo` | ADAPT | R1 | `C/views/chat/item/ChatItemView.kt:200-207` |
+| 02:186 | `copy_text_toClipboardAndToast` | REPLACED | 05 §6 `copyAndroid_text_noToast`: the clipboard gets the text with no toast | `A/views/chat/item/ChatItemView.android.kt:47-49`; `D/views/chat/item/ChatItemView.desktop.kt:54-71` |
+| 02:187 | `copy_fileItem_copiesPath` | REPLACED | 05 §6 `copyAndroid_fileItem_copiesCaptionOnly`: the item's text, not the path, and no toast | `A/views/chat/item/ChatItemView.android.kt:47-49` |
+| 02:188 | `share_text_copiesToClipboard` | REPLACED | 05 §6 `shareText_itemMenu_firesChooser` (R5) | `C/views/chat/item/ChatItemView.kt:425-434`; `A/platform/Share.android.kt:30-49` |
+| 02:189 | `share_file_savesViaDialog` | REPLACED | 05 §6 `shareFile_itemMenu_firesChooserWithStream`: "Share" of a file fires the chooser with `EXTRA_STREAM`, no save dialog | `A/platform/Share.android.kt:112-114`; `D/platform/Share.desktop.kt:24-42` |
+| 02:190 | `save_image_writesFile` | REPLACED | 05 §6 `rcvImage_save_insertsIntoGallery`: "Save" of an image inserts it into MediaStore with the toast "Image saved to Gallery", no picker | `A/views/chat/item/ChatItemView.android.kt:28-45`; `A/platform/Share.android.kt:145-181` |
+| 02:190 | `save_encryptedFile_decrypts` | ADAPT | R3: "Save" fires `ACTION_CREATE_DOCUMENT`; the stub's URI receives the decrypted bytes (as 05 §6 `rcvFile_save_createDocumentWritesDecrypted`) | `A/views/chat/item/ChatItemView.android.kt:40`; `A/platform/Files.android.kt:36-43` |
+| 02:192 | `textSelection_dragAcrossItems_copyButton` | DESKTOP-ONLY | `SelectionManager` exists only on desktop | `C/views/chat/ChatView.kt:166,1056,2383` |
+| 02:192 | `textSelection_ctrlC_copies` | DESKTOP-ONLY | As above | `C/views/chat/ChatView.kt:166,2383` |
+| 02:209 | `info_historyBubble_copy` | ADAPT | R1 (long-press the version) | `C/views/chat/ChatItemInfoView.kt:80-85,132-137` |
+| 02:211 | `info_delivery_liveUpdatesOnReceipt` | ADAPT | R1 (long-press the item → "Info" → "Delivery") | `C/views/chat/item/ChatItemView.kt:327-335` |
+| 02:214 | `info_share_copiesText` | ADAPT | R5: the info screen's share button opens the chooser with `EXTRA_TEXT` = the info text (`INTENTS`), not the clipboard | `C/views/chat/ChatView.kt:731-734`; `A/platform/Share.android.kt:30-49` |
+| 02:215 | `info_closesOnChatSwitch` | ADAPT | The info covers the whole screen, so the other chat is opened from outside it, preferably with `openChat` from test code, which exercises the info's own close on the chat change (`KeyChangeEffect`, `ChatView.kt:753-755`); tapping cath's message notification (`SYSNTF`) closes it earlier through `clearOverlays` → `closeAllModalsEverywhere` instead; Back would close the info itself | `C/views/chat/ChatView.kt:731,753-755`; `C/platform/NtfManager.kt:80`; `C/App.kt:111-115`; `C/views/helpers/ModalView.kt:253-258` |
+| 02:221 | `unreadFab_top_rightClick_markRead` | ADAPT | R1: tests the long press of the top button | `C/views/chat/ChatView.kt:2852` |
+| 02:223 | `pagination_scrollUp_loadsOlder` | ADAPT | The chat opens with the newest 75 messages (`INITIAL_COUNT` is 100 only on desktop); older pages are still 100 | `C/model/SimpleXAPI.kt:4609-4610` |
+| 02:232 | `contentFilter_menu_listsAvailableTypes` | ADAPT | In the direct chat with bob (calls available) there is no filter icon in the bar: the filters are opened from the ⋮ menu (after the divider), or from the filter icon of the search field once search is open | `C/views/chat/ChatView.kt:1339-1340,1377-1442` |
+| 02:232 | `contentFilter_files` | ADAPT | As above | `C/views/chat/ChatView.kt:1377-1400` |
+| 02:232 | `contentFilter_images` | ADAPT | As above | `C/views/chat/ChatView.kt:1377-1400` |
+| 02:232 | `contentFilter_allMessages_resets` | ADAPT | As above; "All messages" is the last ⋮ item while a filter is active | `C/views/chat/ChatView.kt:1401-1418` |
+| 02:233 | `contentFilter_links_showsOnlyLinks` | ADAPT | As above | `C/views/chat/ChatView.kt:1377-1400` |
+| 02:233 | `contentFilter_withSearchText` | ADAPT | As above | `C/views/chat/ChatView.kt:1377-1442` |
+| 02:239 | `draft_withAttachment_restored` | ADAPT | R2: the file is attached through the "File" stub instead of Ctrl+V | `A/views/chat/ComposeView.android.kt:44,74-77` |
+| 02:240 | `draft_voiceRecording_finishedOnSwitch` | ADAPT | R10 (`REC`) | `A/platform/RecAndPlay.android.kt:17-98` |
+| 02:260 | `featureItem_contactChangesPref_shown` | ADAPT | R1 (long-press the feature row → "Expand") | `C/views/chat/item/CIChatFeatureView.kt:28-48` |
+| 02:261 | `featureItems_merged_iconRowExpandHide` | ADAPT | R1 | `C/views/chat/item/CIChatFeatureView.kt:28-48` |
+| 02:263 | `callItem_incoming_answerButton` | ADAPT | "Answer call" starts `CallActivity` instead of the URI handler: the test asserts that `CallActivity` opens (found through `ComposeRootRegistry`) with bob's name and that `chatModel.activeCall` holds bob's call, before any media, as 05 §9 `call_outgoingAudio_invitationReachesPeer` does for an outgoing call (media is 05 §9 `call_answer_mediaConnects`, `IGNORE`); R10 (`AV`) for the ringtone | `C/views/call/CallManager.kt:27-58`; `C/App.kt:227-235`; `APP/SimplexApp.kt:319-330` |
+| 02:263 | `callItem_endedStates` | ADAPT | R10 (`AV`, the ringtone through `SoundPlayer`) | `A/helpers/SoundPlayer.kt` |
+| 02:264 | `callAlert_incoming_acceptRejectIgnore` | ADAPT | "Accept" closes the alert and starts `CallActivity` instead of recording the call link with the URI stub; it is asserted before any media, as in `callItem_incoming_answerButton` (`C/App.kt:227-235`; media is 05 §9 `call_answer_mediaConnects`, `IGNORE`); "Reject" and "Ignore" are unchanged (the in-app alert shows in the foreground, 05 §9 `call_incomingForeground_inAppAlertNoSystemNotification`); R10 for the ringtone | `C/views/call/IncomingCallAlertView.kt:27-46`; `APP/model/NtfManager.android.kt:160-169` |
+| 02:265 | `callItem_answerEnded_showsAlert` | ADAPT | R10 (`AV`); the "Call already ended!" alert comes before any call screen, as on desktop | `C/views/chat/ChatView.kt:616-627` |
+| 02:266 | `events_merged_deleteRange` | ADAPT | R1 (long-press the collapsed events) | `C/views/chat/item/ChatItemView.kt:327-335` |
+| 02:277 | `notes_attachImage_storedLocally` | ADAPT | R3: the gallery stub | `A/views/chat/ComposeView.android.kt:40,58-65` |
+| 02:277 | `notes_attachFile_storedLocally` | ADAPT | R3: the "File" stub | `A/views/chat/ComposeView.android.kt:44,74-77` |
+| 02:277 | `notes_delete_removesFile` | ADAPT | R3: the file is attached through the "File" stub | `A/views/chat/ComposeView.android.kt:44,74-77` |
+| 02:277 | `notes_contentFilterImages` | ADAPT | R3 for the attachments; "Images" is chosen from the ⋮ menu, as in 05 §14 `toolbar_notes_filterInMenuAndroid` | `C/views/chat/ChatView.kt:1377-1400` |
+| 02:282 | `contextMenu_rightClick_opens` | DESKTOP-ONLY | R1: right-click does nothing; the long press is `contextMenu_longPress_opens` | `A/platform/Modifier.android.kt:16` |
+| 02:283 | `contextMenu_itemsMatrix_byItemType` | ADAPT | R1: each menu is opened by long press ("Right-click each item type"); R10 (`AV`) for the ringtone of the incoming call that produces the call item | `C/views/chat/item/ChatItemView.kt:327-335` |
+| 02:284 | `enter_whenSendDisabled_noop` | DESKTOP-ONLY | R2: no Enter handling | `D/platform/PlatformTextField.desktop.kt:123-137` |
+| 02:284 | `escape_closesItemInfoModal` | ADAPT | R9: Back closes the item-info modal (`BACK`) | `C/views/helpers/ModalView.kt:40-42`; `A/platform/Back.android.kt:5-8` |
+| 02:289 | `call_webrtcSession_connects` | REPLACED | 05 §9 `call_answer_mediaConnects`, `call_connectedControls_micSpeakerVideoFlip` (`IGNORE` on Android too: the call page runs in a `WebView`) | `A/views/call/CallView.android.kt:691-790` |
+
+## 03 groups, channels, business chats
+
+| Catalogue row (file:line) | Test name | Class | Android behaviour / replacement | Code ref |
+|---|---|---|---|---|
+| 03:33 | `createGroup_withProfileImage` | ADAPT | R3: the edit-image button opens the sheet "Camera" / "From Gallery"; the image comes from the gallery stub (`INTENTS`) | `C/views/newchat/AddGroupView.kt:92-125`; `A/views/helpers/GetImageView.android.kt:142-216` |
+| 03:33 | `createGroup_removeImageBeforeCreate` | ADAPT | R3: as above, before the delete-image button is used | `C/views/newchat/AddGroupView.kt:117-124` |
+| 03:57 | `groupInfo_headerShowsProfileAndCopiesName` | ADAPT | R11: the toast «Copied to clipboard» is asserted through the toast recorder; the clipboard check is unchanged | `C/views/chat/group/GroupChatInfoView.kt:970-973`; `A/platform/UI.android.kt:23` |
+| 03:60 | `groupInfo_searchButton` | ADAPT | «search» closes Group info first, then opens the chat search (05 §14 `chatInfo_searchButtonClosesInfoAndSearches`) | `C/views/chat/group/GroupChatInfoView.kt:404-414` |
+| 03:75 | `editGroupProfile_changeImage` | ADAPT | R3: the image comes from the gallery stub through the "Camera" / "From Gallery" sheet | `C/views/chat/group/GroupProfileView.kt:93-100`; `A/views/helpers/GetImageView.android.kt:142-216` |
+| 03:91 | `groupPrefs_disappearingOnWithTtl` | ADAPT | The short TTL is set in the custom time picker, which on Android is two wheels (number, unit) instead of two dropdowns (as 05 §14 `timedCustom_androidWheelPickerSetsTtl`) | `C/views/helpers/CustomTimePicker.kt:62`; `A/views/helpers/CustomTimePicker.android.kt:14-106` |
+| 03:91 | `groupPrefs_disappearingMessageExpires` | ADAPT | As above | `A/views/helpers/CustomTimePicker.android.kt:14-106` |
+| 03:91 | `groupPrefs_disappearingOff` | ADAPT | As above | `A/views/helpers/CustomTimePicker.android.kt:14-106` |
+| 03:112 | `review_acceptFromLongPressMenu` | ADAPT | R1 (long-press the pending row) | `C/views/helpers/Section.kt:270-278` |
+| 03:114 | `joinerPendingReview_supportChatAutoOpens` | ADAPT | R6 entry; the support chat covers the group chat on Android and closing it returns to the chat list (05 §13 `pendingReview_closeSupportChat_returnsToChatList`), so «reviewed by admins» in the group's own compose is not displayed: it is asserted in the semantics tree under the support chat, or left to 05 §13 | `C/views/chat/group/MemberSupportChatView.kt:33-47`; `C/views/chat/ChatView.kt:246-256` |
+| 03:114 | `joinerPendingReview_messagesAdmins` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:114 | `joinerPendingReview_acceptedByAdmin` | ADAPT | R6; after the accept the support chat stays over the group chat, and Back now returns to the group's chat (`memberPending` is false), where the history and the enabled compose are asserted | `C/views/newchat/NewChatSheet.kt:61,194`; `C/views/chat/group/MemberSupportChatView.kt:33-47` |
+| 03:114 | `joinerPendingReview_rejected` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:124 | `groupLink_shareCopiesShortLink` | ADAPT | R5: «Share link» opens the chooser with the short link (`INTENTS`), not the clipboard | `C/views/chat/group/GroupLinkView.kt:250-262`; `A/platform/Share.android.kt:30-49` |
+| 03:132 | `groupLink_shareOldLink` | ADAPT | R5: «Share old link» opens the chooser with the full link | `C/views/chat/group/GroupLinkView.kt:255-258` |
+| 03:138 | `joinGroup_pasteShortLinkPrepareAndJoin` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:138 | `joinGroup_preparedShowsWelcomeBeforeJoin` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:138 | `joinGroup_preparedJoinIncognito` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:138 | `joinGroup_preparedChangeProfile` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:139 | `joinGroup_fullLinkCurrentProfile` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:139 | `joinGroup_fullLinkIncognito` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:139 | `joinGroup_cancelAlert` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:140 | `joinGroup_retryAfterServerError` | ADAPT | R6 (the prepared group comes from a pasted link) | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:141 | `connectPlan_knownGroupOpensGroup` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:141 | `connectPlan_knownGroupShowsRole` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:142 | `connectPlan_ownGroupLinkOpenGroup` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:142 | `connectPlan_ownGroupLinkJoinAsSecondMember` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:143 | `connectPlan_connectingAllowsReconnect` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:143 | `connectPlan_connectingProhibit` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:144 | `connectPlan_rejoinAfterLeaving` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:159 | `memberList_contextMenuAsAdmin` | ADAPT | R1 (long-press the member row) | `C/views/helpers/Section.kt:270-278` |
+| 03:160 | `memberList_contextMenuAsMember` | ADAPT | R1 | `C/views/helpers/Section.kt:270-278` |
+| 03:201 | `chatsWithMembers_bannerInGroupChat` | ADAPT | The moderator's banner reads «%d chat(s)» ("1 chat(s)"), not «1 chat with a member» (05 §14 `toolbar_supportBanner_shortCountOnAndroid`) | `C/views/chat/ChatView.kt:1721-1730` |
+| 03:212 | `reports_tapReportJumpsToReportedMessage` | ADAPT | «Member reports» closes when the quoted message is clicked (it stays open only on desktop); the group chat then scrolls to the reported message | `C/views/chat/ChatView.kt:1900-1909`; `C/views/chat/item/ChatItemView.kt:1372-1376` |
+| 03:227 | `mentions_mentionsOnlyMuteStillNotifies` | ADAPT | R7: the notification is read with `SYSNTF` (app in the background, or another chat open) | `C/platform/NtfManager.kt:39-50`; `A/platform/Notifications.android.kt:3` |
+| 03:227 | `mentions_blockedMemberMentionIgnored` | ADAPT | R7: no system notification is posted | `C/platform/NtfManager.kt:39-50` |
+| 03:249 | `createChannel_singleRelayCompletesAndShowsLink` | ADAPT | When the relay is active the creation screen turns into the «Channel link» step itself (no modal over the opened channel); its close button opens the channel chat | `C/views/newchat/AddChannelView.kt:59-77,557-586` |
+| 03:251 | `createChannel_withImage` | ADAPT | R3: the image comes from the gallery stub through the "Camera" / "From Gallery" sheet | `C/views/newchat/AddChannelView.kt:252-260`; `A/views/helpers/GetImageView.android.kt:142-216` |
+| 03:252 | `createChannel_twoRelaysProgress` | ADAPT | As `createChannel_singleRelayCompletesAndShowsLink`: the link step replaces the progress step; «Chat relays» is checked after closing it | `C/views/newchat/AddChannelView.kt:59-77,557-586` |
+| 03:253 | `createChannel_continueWithPartialRelays` | ADAPT | As above: continuing shows the link step, then the channel | `C/views/newchat/AddChannelView.kt:59-77,495-524` |
+| 03:256 | `channelLink_shareCopiesLink` | ADAPT | R5: «Share link» opens the chooser with the channel link (`INTENTS`) | `C/views/chat/group/GroupLinkView.kt:250-262` |
+| 03:259 | `channel_broadcastFile` | ADAPT | R3: the file comes from the "File" stub | `A/views/chat/ComposeView.android.kt:44,74-77` |
+| 03:260 | `channel_ownerRelayBarStates` | ADAPT | R1: «Remove relay» is in the relay row's long-press menu | `C/views/chat/group/ChannelRelaysView.kt:83-94` |
+| 03:261 | `channelRelays_removeRelay` | ADAPT | R1 | `C/views/chat/group/ChannelRelaysView.kt:83-94` |
+| 03:261 | `channelRelays_removeLastRelayWarning` | ADAPT | R1 (the same menu) | `C/views/chat/group/ChannelRelaysView.kt:83-94` |
+| 03:262 | `channelRelays_rejectedRelayStatus` | ADAPT | R1: the relay that left is removed through the long-press menu | `C/views/chat/group/ChannelRelaysView.kt:83-94` |
+| 03:278 | `joinChannel_pasteLinkOpenChannel` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:278 | `joinChannel_joinViaRelay` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:278 | `joinChannel_incognito` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:278 | `joinChannel_noActiveRelays` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:278 | `joinChannel_receivesHistory` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:279 | `joinChannel_twoRelaysBothConnect` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:285 | `connectPlan_knownChannelSubscriber` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:286 | `connectPlan_ownChannelLink` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:286 | `connectPlan_relayAddressRejected` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:296 | `customer_connectToBusinessAddress` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:296 | `customer_connectWithRequestMessage` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:297 | `customer_knownBusinessPlan` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+| 03:298 | `connectPlan_businessPendingOpensKnownChat` | ADAPT | R6 | `C/views/newchat/NewChatSheet.kt:61,194` |
+
+## 04 settings, database, migration, remote desktop, misc
+
+| Catalogue row (file:line) | Test name | Class | Android behaviour / replacement | Code ref |
+|---|---|---|---|---|
+| 04:38 | `settingsRoot_listsDesktopItems` | REPLACED | 05 §15 `settingsAndroid_rootListsAndroidItems`: Android lists "Notifications" and "Shutdown" and its own version row | `C/views/usersettings/SettingsView.kt:121-128`; `A/views/usersettings/SettingsView.android.kt:31-34` |
+| 04:39 | `settingsRoot_itemsDisabledWhenChatStopped` | ADAPT | "Notifications" is disabled too (05 §2 `ntfSettings_rootItemIconAndStoppedState`); "Shutdown" stays enabled | `C/views/usersettings/SettingsView.kt:121-128` |
+| 04:40 | `settingsRoot_crowdfundingOpensGetStake` | ADAPT | R13: "Learn more on Wefunder" fires `ACTION_VIEW` with `https://wefunder.com/simplex.chat?utm_source=app` (`INTENTS`) | `C/views/onboarding/WhatsNewView.kt:1232-1236` |
+| 04:42 | `userPicker_colorModeSwitcherRightClickSystem` | ADAPT | R1: tests the long press of the switch | `C/views/usersettings/Appearance.kt:738-768` |
+| 04:43 | `keyboard_escClosesTopModal` | REPLACED | 05 §13 `back_closesModalsOneByOne`: the same `BackHandler`s run on the system Back key (R9) | `apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/DesktopApp.kt:125-130`; `A/platform/Back.android.kt:5-8` |
+| 04:44 | `keyboard_escDismissesAlert` | ADAPT | R9: the system Back key (`BACK`) goes to the alert's dialog window, whose `onDismissRequest` hides only the alert; the switch stays off and "Network & servers" stays open | `C/views/helpers/AlertManager.kt:139-141` |
+| 04:52 | `privacy_sectionsAndFooter` | ADAPT | "Device" has "SimpleX Lock" and "Protect app screen" (05 §10 `androidPrivacy_deviceSectionShowsLockAndProtectScreen`) | `A/views/usersettings/PrivacySettings.android.kt:13-31` |
+| 04:65 | `morePrivacy_notificationPreviewModes` | ADAPT | R7: per mode the real notification's title and text are asserted (as 05 §3 `sysNtf_previewContactName`, `sysNtf_previewHidden`); the Android notification manager builds them | `APP/model/NtfManager.android.kt:102-158` |
+| 04:76 | `lock_enable_setsPasscode` | ADAPT | R8: "Lock mode" > "Passcode" first; `EncryptedAppPassphrase` holds Keystore ciphertext, so the check is `DatabaseUtils.ksAppPassword.get()` = the digits | `C/views/helpers/DatabaseUtils.kt:17-28`; `C/views/usersettings/PrivacySettings.kt:38-52` |
+| 04:77 | `lock_enable_cancelKeepsOff` | ADAPT | R8: "Passcode" mode first | `C/views/usersettings/PrivacySettings.kt:38-52` |
+| 04:78 | `lock_enable_confirmMismatch` | ADAPT | R8 | `C/views/usersettings/PrivacySettings.kt:38-52` |
+| 04:79 | `lock_lockAfterOptions` | ADAPT | R8 | `C/views/usersettings/PrivacySettings.kt:38-52` |
+| 04:80 | `lock_changePasscode_success` | ADAPT | R8 | `C/views/usersettings/PrivacySettings.kt:38-52` |
+| 04:80 | `lock_changePasscode_wrongCurrent` | ADAPT | R8 | `C/views/usersettings/PrivacySettings.kt:38-52` |
+| 04:81 | `lock_disable_requiresPasscode` | ADAPT | R8 | `C/views/usersettings/PrivacySettings.kt:38-52` |
+| 04:82 | `lock_screenOnStartup_correct` | ADAPT | R8 | `C/views/usersettings/PrivacySettings.kt:38-52` |
+| 04:82 | `lock_screenOnStartup_wrong_showsUnlock` | ADAPT | R8 | `C/views/usersettings/PrivacySettings.kt:38-52` |
+| 04:83 | `lock_relocksAfterDelay` | REPLACED | 05 §10 `androidLock_passcodeRelocksAfterRealBackground`: the real background (`BG`) replaces the simulated `appWasHidden()`, with the same 10 s delay | `APP/MainActivity.kt:70-89` |
+| 04:84 | `lock_protectedActionsPrompt` | ADAPT | R8: "Passcode" mode first, then the four prompts as on desktop | `C/views/usersettings/SettingsView.kt:106,473-520` |
+| 04:84 | `profiles_actionsRequireAuthOnceWhenLocked` | ADAPT | R8 | `C/views/chatlist/UserPicker.kt:268-297` |
+| 04:85 | `lock_noticeOfferedWithManyChats` | REPLACED | 05 §10 `androidLock_noticeOffersModeChoice`, `androidLock_noticePasscodeEntry_setsPasscodeMode`: "Turn on" first offers "Passcode entry" / "System authentication" | `C/AppLock.kt:34-78` |
+| 04:86 | `lock_passcodeKeyboardKeys` | ADAPT | R8; the keys are injected into the Compose passcode view as on desktop (a hardware keyboard; the soft keyboard is not used there) | `C/views/localauth/PasscodeView.kt:34-62` |
+| 04:87 | `lock_passcodeKeypad_digitsBackspaceClearReveal` | ADAPT | R8; portrait shows the same vertical keypad (landscape: 05 §10 `passcodeAndroid_landscapeShowsSubmit`) | `C/views/localauth/PasscodeView.kt:130-134` |
+| 04:88 | `selfDestruct_enable` | ADAPT | R8; Enter is injected as in 04:86 | `C/views/usersettings/PrivacySettings.kt:38-52` |
+| 04:88 | `selfDestruct_cannotEqualAppPasscode` | ADAPT | R8; Enter is injected as in 04:86 | `C/views/usersettings/PrivacySettings.kt:38-52` |
+| 04:89 | `selfDestruct_infoView` | ADAPT | R8 | `C/views/usersettings/PrivacySettings.kt:38-52` |
+| 04:90 | `selfDestruct_displayNamePersisted` | ADAPT | R8 | `C/views/usersettings/PrivacySettings.kt:38-52` |
+| 04:91 | `selfDestruct_changePasscode` | ADAPT | R8 | `C/views/usersettings/PrivacySettings.kt:38-52` |
+| 04:92 | `selfDestruct_triggeredOnLockScreen` | ADAPT | R8: "the app passcode becomes the self-destruct code" is read with `ksAppPassword.get()` | `C/views/helpers/DatabaseUtils.kt:17-28` |
+| 04:93 | `selfDestruct_disable` | ADAPT | R8 ("Passcode" mode first); the prefs-unset check runs as on desktop, and unlike desktop the Keystore entry `selfDestructPassword` is deleted too | `C/views/helpers/DatabaseUtils.kt:19,36-40`; `A/platform/Cryptor.android.kt:69-72` |
+| 04:99 | `appearance_language_switch` | REPLACED | 05 §14 `appearanceAndroid_languageRecreatesActivity`: the language selector is in the "Interface" section and the activity is recreated in the new language | `A/views/usersettings/Appearance.android.kt:81-105`; `D/views/usersettings/Appearance.desktop.kt:49-63` |
+| 04:99 | `appearance_language_backToSystem` | REPLACED | 05 §14 `appearanceAndroid_languageRecreatesActivity` ("System" restores English and recreates the activity again) | `A/views/usersettings/Appearance.android.kt:91-105` |
+| 04:100 | `appearance_reachableAppToolbars` | ADAPT | The switch is in the "Interface" section; turning "Reachable app toolbars" on also sets `chatBottomBar = true` | `A/views/usersettings/Appearance.android.kt:108-110` |
+| 04:100 | `appearance_reachableChatToolbarVisibility` | REPLACED | 05 §14 `appearanceAndroid_interfaceSectionToolbars`: "Reachable chat toolbar" shows whenever "Reachable app toolbars" is on, whatever `chatBottomBar` is | `A/views/usersettings/Appearance.android.kt:111-113`; `D/views/usersettings/Appearance.desktop.kt:65-67` |
+| 04:103 | `appearance_wallpaperPreset_select` | ADAPT | The presets are one horizontally scrolling row (81 dp tiles), not a 4-column grid; the driver scrolls the row to the preset | `C/views/usersettings/Appearance.kt:416-440` |
+| 04:104 | `appearance_wallpaperImage_import` | ADAPT | R3: the "+" tile (at the end of the scrolling row) fires `ACTION_GET_CONTENT`, answered by the stub | `C/views/usersettings/Appearance.kt:534`; `A/platform/Files.android.kt:36-43` |
+| 04:104 | `appearance_wallpaperImage_remove` | ADAPT | R3: the image is imported through the stub first | `C/views/usersettings/Appearance.kt:534,596` |
+| 04:105 | `appearance_themeDestination_perUser` | ADAPT | The wallpaper preset is chosen in the horizontally scrolling preset row (81 dp tiles), which the driver scrolls to the preset, as in `appearance_wallpaperPreset_select` | `C/views/usersettings/Appearance.kt:416-440` |
+| 04:107 | `customizeTheme_wallpaperScaleAndChatColors` | ADAPT | R3: the wallpaper image comes from the `GET_CONTENT` stub; the "+" tile is the last tile of the horizontally scrolling preset row (81 dp tiles), which the driver scrolls to, as in `appearance_wallpaperImage_import` | `C/views/usersettings/Appearance.kt:416-440,522,596,635`; `A/platform/Files.android.kt:36-43` |
+| 04:108 | `customizeTheme_exportTheme` | ADAPT | R3: "Export theme" fires `ACTION_CREATE_DOCUMENT` with the title "simplex.theme"; the YAML is read back from the stub's URI | `C/views/usersettings/Appearance.kt:702-718` |
+| 04:108 | `customizeTheme_importTheme` | ADAPT | R3: "Import theme" fires `ACTION_GET_CONTENT`, answered by the stub | `C/views/usersettings/Appearance.kt:719-732` |
+| 04:108 | `customizeTheme_importInvalidTheme` | ADAPT | R3: as above, with the invalid YAML | `C/views/usersettings/Appearance.kt:719-732` |
+| 04:109 | `appearance_closeToTray_hiddenWithoutTray` | DESKTOP-ONLY | The tray section exists only in the desktop layout; Android has no tray | `D/views/usersettings/Appearance.desktop.kt:72-75`; `A/views/usersettings/Appearance.android.kt:73-159` |
+| 04:113 | `appearance_fontSize_sliderAndReset` | ADAPT | The slider runs from 0.75 to 1.25 with `steps = 11`, rounded to 0.05 (desktop 0.7–1.5, `steps = 9`, rounded to 0.1); "Aa" still resets to 1 (05 §14 `appearanceAndroid_fontSizeSlider`) | `C/views/usersettings/Appearance.kt:231-265` |
+| 04:114 | `appearance_zoom_sliderAndReset` | DESKTOP-ONLY | "Zoom" (`DensityScaleSection`) is only in the desktop layout; `densityScale` is read only on desktop | `D/views/usersettings/Appearance.desktop.kt:90,112-153`; `C/views/helpers/Utils.kt:661` |
+| 04:115 | `appearance_settingsPersistAcrossRestart` | ADAPT | Theme and font only: there is no zoom on Android | `C/views/helpers/Utils.kt:661` |
+| 04:121 | `network_rootLayout` | ADAPT | The screen ends with the section "Network connection" (network type and status dot; 05 §15 `networkAndroid_connectionStatusOnline`) | `C/views/usersettings/networkAndServers/NetworkAndServers.kt:306-316` |
+| 04:157 | `network_remoteHostHidesLocalSettings` | DESKTOP-ONLY | Needs the app connected to a mobile host as controller (§K), which only the desktop is | `C/views/chatlist/UserPicker.kt:354-366` |
+| 04:163 | `calls_screenLayout_noLockScreenOption` | REPLACED | 05 §9 `callSettings_androidLockScreenOptions`: Android shows "Calls on lock screen:" | `C/views/usersettings/CallSettings.kt:45-49` |
+| 04:179 | `dbMgmt_layout` | ADAPT | No "Open database folder" row | `C/views/database/DatabaseView.kt:239-246` |
+| 04:183 | `dbMgmt_exportArchive` | ADAPT | R3: after export `ACTION_CREATE_DOCUMENT` fires with `simplex-chat.<timestamp>.zip`; the zip is read from the stub's URI and the toast "File saved" is recorded through the toast recorder (R11; 05 §11 `dbExport_androidCreateDocument`); the Log, prefs and stopped state as on desktop | `C/views/database/DatabaseView.kt:190-201,606-660`; `A/platform/Files.android.kt:36-43` |
+| 04:184 | `dbMgmt_importArchive_restoresData` | ADAPT | R3: "Import database" fires `ACTION_GET_CONTENT` (`application/zip`), answered by the stub (05 §11 `dbImport_androidGetContent`); the rest as on desktop | `C/views/database/DatabaseView.kt:202-214` |
+| 04:186 | `dbMgmt_importRestoresAppSettings` | ADAPT | R3: as above | `C/views/database/DatabaseView.kt:202-214` |
+| 04:187 | `dbMgmt_deleteDatabase` | ADAPT | R4: the welcome screen that appears is the Android one ("Get started", no "Create your profile" or "Link a mobile"); with no user the Android branch only sets the welcome stage, without `startChatWithoutUser` | `C/platform/Core.kt:153-167`; `A/views/onboarding/SimpleXInfo.android.kt:11-16` |
+| 04:188 | `dbMgmt_openDatabaseFolder` | DESKTOP-ONLY | No "Open database folder" on Android (`desktopOpenDatabaseDir` is empty there) | `C/views/database/DatabaseView.kt:239-246`; `A/platform/Files.android.kt:32` |
+| 04:189 | `dbMgmt_disconnectMobilesWhenRemote` | DESKTOP-ONLY | Needs a connected mobile host (§K) | `C/views/chatlist/UserPicker.kt:354-366` |
+| 04:190 | `dbEncrypt_setFirstPassphrase` | ADAPT | The confirmation is the Keystore variant: "Database encryption passphrase will be updated and stored in the Keystore." (05 §11 `keystore_changePassphrase_storedAlert`); "Database encrypted!" and `InitialRandomDBPassphrase = false` as on desktop | `A/views/database/DatabaseEncryptionView.android.kt:95-103` |
+| 04:192 | `dbEncrypt_removeFromSettings` | REPLACED | 05 §11 `keystore_removePassphrase_alertAndFooter`: the switch is "Save passphrase in Keystore" and the alert "Remove passphrase from Keystore?" | `A/views/database/DatabaseEncryptionView.android.kt:22-55,105-113` |
+| 04:192 | `dbEncrypt_saveToSettings` | REPLACED | 05 §11 `keystore_reEnable_footerUntilRestart` | `A/views/database/DatabaseEncryptionView.android.kt:76-78` |
+| 04:193 | `dbEncrypt_footerStates` | REPLACED | 05 §11 `keystore_freshDb_randomPassphraseFooter` (random), `keystore_changePassphrase_storedAlert` (stored), `keystore_removePassphrase_alertAndFooter` (not stored), `keystore_reEnable_footerUntilRestart`: the footers name the Keystore | `A/views/database/DatabaseEncryptionView.android.kt:57-83`; `D/views/database/DatabaseEncryptionView.desktop.kt:57-83` |
+| 04:196 | `dbError_saveAndOpen` | ADAPT | "EncryptedDBPassphrase non-empty again" is checked with `DatabaseUtils.ksDatabasePassword.get()` returning the typed passphrase (the pref holds Keystore ciphertext) | `C/views/helpers/DatabaseUtils.kt:17-28` |
+| 04:199 | `dbError_restoreBackup` | ADAPT | The fixture's `*.bak` files are encrypted with the key `ksDatabasePassword.get()` returns (the Keystore holds the stored key) | `C/views/helpers/DatabaseUtils.kt:17-28,51-60` |
+| 04:200 | `dbError_openDatabaseFolder` | DESKTOP-ONLY | The error screens show the folder button only on desktop | `C/views/database/DatabaseErrorView.kt:323-332` |
+| 04:216 | `migrateTo_fromCliArchive_chatMigrated` | ADAPT | R4: "Get started" → "Your profile" → "Migrate" (app bar); "Migrate here" shows "Scan QR code" (camera section) above "Or paste archive link", where the link is pasted | `C/views/WelcomeView.kt:200-225`; `C/views/migration/MigrateToDevice.kt:200-216` |
+| 04:217 | `migrateTo_invalidLink` | ADAPT | As above | `C/views/migration/MigrateToDevice.kt:200-216` |
+| 04:218 | `migrateTo_deletedFile` | ADAPT | As above | `C/views/migration/MigrateToDevice.kt:200-216` |
+| 04:219 | `migrateTo_wrongPassphrase` | ADAPT | As above | `C/views/migration/MigrateToDevice.kt:200-216` |
+| 04:220 | `migrateTo_networkSettingsConfirm` | ADAPT | As above | `C/views/migration/MigrateToDevice.kt:200-216` |
+| 04:221 | `migrateTo_resumeAfterRestart` | ADAPT | As above ("Migrate" reopens "Migrate here" at "Enter passphrase") | `C/views/WelcomeView.kt:200-225` |
+| 04:228 | `version_screenShowsVersions` | ADAPT | "App version: v%s" / "App build: %s" carry `ANDROID_VERSION_NAME` / `ANDROID_VERSION_CODE` (05 §15 `versionAndroid_showsAndroidBuildAndDevTools`) | `C/views/usersettings/VersionInfoView.kt:36-42` |
+| 04:229 | `updates_channelDropdown` | DESKTOP-ONLY | "Check for updates" exists only in the desktop `AdvancedSettingsAppSection` | `D/views/usersettings/SettingsView.desktop.kt:14-26`; `A/views/usersettings/SettingsView.android.kt:22-29` |
+| 04:230 | `updates_noticeDialog` | DESKTOP-ONLY | The update notice is shown by the desktop `Main.kt` platform object | `apps/multiplatform/desktop/src/jvmMain/kotlin/chat/simplex/desktop/Main.kt:67-89` |
+| 04:237 | `dev_showConsoleInNewWindow_requiresAuth` | DESKTOP-ONLY | "Show console in new window" is desktop-only (05 §15 `devToolsAndroid_noConsoleWindowOption`) | `C/views/usersettings/DeveloperView.kt:50-60` |
+| 04:240 | `dev_installTerminalLink` | ADAPT | R13: "Open" fires `ACTION_VIEW` with `https://github.com/simplex-chat/simplex-chat` (`INTENTS`) | `C/views/usersettings/SettingsView.kt:316-317`; `C/views/helpers/Utils.kt:613-624` |
+| 04:247 | `help_layout` | ADAPT | "Support the project" also lists "Rate the app" (05 §15 `helpAndroid_rateTheAppOpensMarket`) | `C/views/usersettings/SettingsView.kt:173-181` |
+| 04:251 | `help_sendEmail_mailto` | ADAPT | R13: "Send us email" fires `ACTION_VIEW` with `mailto:chat@simplex.chat` (`INTENTS`) | `C/views/usersettings/SettingsView.kt:170` |
+| 04:252 | `help_contributeAndStar` | ADAPT | R13: each "Open" fires `ACTION_VIEW` with `https://github.com/simplex-chat/simplex-chat#contribute` / `https://github.com/simplex-chat/simplex-chat` (`INTENTS`) | `C/views/usersettings/SettingsView.kt:255-256,283-284`; `C/views/helpers/Utils.kt:613-624` |
+| 04:266 | `linkMobile_layout` | DESKTOP-ONLY | Android is never the controller: its picker row is "Use from desktop" (05 §12 is the host side) | `C/views/chatlist/UserPicker.kt:354-366` |
+| 04:267 | `linkMobile_deviceNameChange` | DESKTOP-ONLY | As above | `C/views/chatlist/UserPicker.kt:354-366` |
+| 04:268 | `linkMobile_multicastToggle` | DESKTOP-ONLY | As above | `C/views/chatlist/UserPicker.kt:354-366` |
+| 04:269 | `linkMobile_newPairing_verifyAndConnect` | DESKTOP-ONLY | As above | `C/views/chatlist/UserPicker.kt:354-366` |
+| 04:270 | `linkMobile_remoteChatsVisible_sendMessage` | DESKTOP-ONLY | As above | `C/views/chatlist/UserPicker.kt:354-366` |
+| 04:271 | `linkMobile_switchLocalRemote` | DESKTOP-ONLY | As above | `C/views/chatlist/UserPicker.kt:354-366` |
+| 04:272 | `linkMobile_disconnectFromDesktop` | DESKTOP-ONLY | As above | `C/views/chatlist/UserPicker.kt:354-366` |
+| 04:273 | `linkMobile_mobileStopsSession` | DESKTOP-ONLY | As above | `C/views/chatlist/UserPicker.kt:354-366` |
+| 04:274 | `linkMobile_reconnectStoredPairing` | DESKTOP-ONLY | As above | `C/views/chatlist/UserPicker.kt:354-366` |
+| 04:275 | `linkMobile_deleteHost` | DESKTOP-ONLY | As above | `C/views/chatlist/UserPicker.kt:354-366` |
+| 04:276 | `linkMobile_customPortRefreshQr` | DESKTOP-ONLY | As above | `C/views/chatlist/UserPicker.kt:354-366` |
+| 04:276 | `linkMobile_openPortInfo` | DESKTOP-ONLY | As above | `C/views/chatlist/UserPicker.kt:354-366` |
+| 04:277 | `linkMobile_multicastDiscovery` | DESKTOP-ONLY | As above | `C/views/chatlist/UserPicker.kt:354-366` |
+| 04:278 | `linkMobile_closePairingStopsHost` | DESKTOP-ONLY | As above | `C/views/chatlist/UserPicker.kt:354-366` |
+| 04:279 | `linkMobile_remoteFiles` | DESKTOP-ONLY | As above | `C/views/chatlist/UserPicker.kt:354-366` |
+| 04:280 | `linkMobile_remoteFileNotFound` | DESKTOP-ONLY | As above | `C/views/chatlist/UserPicker.kt:354-366` |
+| 04:281 | `linkMobile_onboardingLinkAMobile` | DESKTOP-ONLY | No "Link a mobile" on the Android welcome screen | `A/views/onboarding/SimpleXInfo.android.kt:11-16` |
+| 04:288 | `badges_howItWorks` | ADAPT | R13: "Open" fires `ACTION_VIEW` with `https://simplex.chat/blog/20260919-simplex-supporter-badges.html` (`INTENTS`) | `C/views/badges/BadgesHowItWorksView.kt:33`; `C/views/onboarding/HowItWorks.kt:80`; `C/views/helpers/Utils.kt:613-624` |
+| 04:289 | `badges_getYourCodeLink` | ADAPT | R13: "Open" fires `ACTION_VIEW` with `https://simplex.chat/badges/` (`INTENTS`) | `C/views/badges/BadgesSupportSimplexView.kt:130`; `C/views/helpers/Utils.kt:613-624` |
+| 04:301 | `tray_closeToTrayBehaviour` | DESKTOP-ONLY | No tray on Android (`IGNORE` on desktop too) | `apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/DesktopTray.kt:33-121` |
+| 04:301 | `tray_showQuitItems` | DESKTOP-ONLY | As above | `apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/DesktopTray.kt:33-121` |
+| 04:302 | `window_statePersistence` | DESKTOP-ONLY | No desktop window on Android (`IGNORE` on desktop too) | `apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/DesktopApp.kt:34-120` |
+| 04:302 | `window_crashRestartLoop` | DESKTOP-ONLY | As above | `apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/DesktopApp.kt:34-120,237-257` |
+| 04:303 | `window_floatingConsole` | DESKTOP-ONLY | As above | `apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/DesktopApp.kt:210-232` |
+| 04:304 | `updates_checkDownloadInstall` | DESKTOP-ONLY | The app updater is desktop-only (`IGNORE` on desktop too) | `D/views/helpers/AppUpdater.kt:179-490` |
diff --git a/plans/ui-tests/catalogue/05-android-only.md b/plans/ui-tests/catalogue/05-android-only.md
new file mode 100644
index 0000000000..586186348a
--- /dev/null
+++ b/plans/ui-tests/catalogue/05-android-only.md
@@ -0,0 +1,473 @@
+# UI test catalogue 5: Android-only UI
+
+Rows follow `00-legend.md` (row format, `Test case(s)` cells, Needs, users and CLI output, ownership), with the additions below. This catalogue covers only UI that exists on Android and not on desktop, or that behaves materially differently on Android. Every row of catalogues 01–04 that is not desktop-only also runs on Android (research doc `20261012-android-ui-test-automation.md` §5.3), unchanged unless `05-android-carryover.md` lists it, so 01–05 together cover the Android app. Totals: **252 test cases, 20 of them `@Ignore`**, in 15 sections (details in `## Count` at the end).
+
+## Paths, runtime and runner
+
+- Paths as in `00-legend.md` (`C/` = commonMain), plus:
+  - `A/` = `apps/multiplatform/common/src/androidMain/kotlin/chat/simplex/common/`
+  - `APP/` = `apps/multiplatform/android/src/main/java/chat/simplex/app/`
+  - `MAN` = `apps/multiplatform/android/src/main/AndroidManifest.xml`
+  - `US/` = `C/views/usersettings/`, `NS/` = `US/networkAndServers/` (as in 04)
+- Line numbers are those of master `d72f68e6d` at `~/wt-uitest-ref`, as in 01–04.
+- **Runtime:** Waydroid (LineageOS 20, Android 13 / API 33, x86_64 with libndk arm64 translation) through `~/waydroid/wd.sh`; one instance per host, so every test in this file runs serially. The APK is the default `foss` flavor, debug build (flavors at `android/build.gradle.kts:40-50`); its package is `chat.simplex.app.debug` only with `application_id.suffix=.debug` in `local.properties` (root `build.gradle.kts:23-25`, default empty; `android/build.gradle.kts:55`), as `local.properties.example` and `~/build/android.md` set it; without it the debug package is `chat.simplex.app`.
+- **Runner:** instrumented tests in the app process (`createEmptyComposeRule()`, with `MainActivity` launched by `ActivityScenario.launch` after the reset, setup item 4), sharing the desktop plan's `UiDriver`, screen objects and `Ui` keys; CLI peers, relays and `uitest-servers` run on the host and are reached through the peer bridge over `adb reverse` (research doc §5.1). `ComposeRootRegistry` sees every Compose root in the process, so `CallActivity` (a second activity) is found by the same queries.
+- **Package:** `chat.simplex.app.ui.android` (proposed; its class map lives with the Android harness, not in `00-legend.md`, whose class map covers 01–04 only).
+
+## Needs codes added by this file
+
+The shared codes of `00-legend.md` keep their meaning (`P`, `XFTP`, `RESTART`, `FIXTURE`, `ONBOARD`, `TOAST`, `DT`, `MCAST`, `SLOW`, `REC`, `AV`, …); `restart()` for `RESTART` still needs an Android mechanism (open question 14). `URI` and `CB` have no `TestRoot` stubs on Android, since the test composes the real root (setup item 1), so they change mechanism (carry-over rule R13): `URI` is `INTENTS` (Compose's `AndroidUriHandler` calls `startActivity` with an `ACTION_VIEW` intent, which Espresso-Intents records and stubs so nothing launches), and `CB` is the real system `ClipboardManager`, which persists across tests and which the reset clears (setup item 4). `NTF` (the recording notification manager of the desktop harness) is not used here: Android rows read the real system notifications (`SYSNTF`). `FD` is replaced by `INTENTS`. `MCAST (bridge)` is the cross-bridge variant of `MCAST`: the multicast announcement goes from the host-side CLI controller to Android across the Waydroid bridge (`waydroid0`), not over loopback; like every row here it runs serially (one Waydroid instance), and the legend's loopback `MCAST` rows don't run on Android (Notes). `TOAST` on Android is the toast recorder of carry-over rule R11: `showToast` is the system `Toast.makeText(…).show()` (`A/platform/UI.android.kt:23`), with no in-process list as on desktop, so the test registers `UiAutomation.setOnAccessibilityEventListener` and records the `TYPE_NOTIFICATION_STATE_CHANGED` events from the app's package whose class is `android.widget.Toast`, with the toast text from the event; "no toast is recorded" means none arrives within the step's wait. To be confirmed in the Android P1 (open question 13).
+
+| Code | Meaning |
+|---|---|
+| `PERM` | runtime-permission state set by the runner before `am instrument` (`pm grant` / `pm revoke` / `pm clear-permission-flags`), written as `PERM (<permission> granted\|denied)`. A revoke kills the app process, which is also the instrumentation process, so tests that need a permission denied are grouped into their own `am instrument` invocation; a grant inside a test uses `UiAutomation.grantRuntimePermission` |
+| `SYSUI` | UiAutomator (`UiDevice`) acts on system UI outside the app: the runtime-permission dialog ("Allow" / "Don't allow"), the device-credential screen of `BiometricPrompt`, the notification shade |
+| `SYSNTF` | the app's real notifications, read in-process with `NotificationManager.getActiveNotifications()` (title, text, actions, channel, group) and acted on with `contentIntent.send()` / `actions[i].actionIntent.send()` |
+| `INTENTS` | Espresso-Intents: outgoing activity intents (system pickers, camera, share chooser, settings screens, `ACTION_VIEW`) are recorded and stubbed with an `ActivityResult`; replaces the desktop `FD` |
+| `INTENT` | an inbound intent delivered to an app activity: to `MainActivity` with `startActivity(intent.addFlags(FLAG_ACTIVITY_NEW_TASK))` while the setup's `MainActivity` runs, which reaches the `singleTask` activity's `onNewIntent` (`APP/MainActivity.kt:64-68`), or with `ActivityScenario.launch(intent)` only in place of the setup's plain launch, which reaches `onCreate` (:44-48; `ActivityScenario` tracks only an activity whose `getIntent()` matches its start intent, and `onNewIntent` doesn't call `setIntent`); to `CallActivity` the way the full-screen call notification starts it (`APP/model/NtfManager.android.kt:177-180`). The intent is explicit (component set), so the manifest's host and path filters don't apply; `appLink_intentFilter_matchesOnlyConnectionPaths` checks them |
+| `BG` | the app goes to the background and back inside the test: `UiDevice.pressHome()` (lifecycle `ON_STOP`, `isAppOnForeground = false`, `APP/SimplexApp.kt:138`) and the launcher intent to return (`ON_START`/`ON_RESUME`) |
+| `BACK` | the system Back key (`UiDevice.pressBack()` or `Espresso.pressBack()`), which runs Compose `BackHandler`s and then `MainActivity.onBackPressed` (`APP/MainActivity.kt:91-118`); the desktop harness's `escape()` covers only the `BackHandler` part |
+| `IME` | the real soft keyboard of the runtime (AOSP keyboard on Waydroid) and the `WindowInsets.ime` state the app reads (`A/platform/UI.android.kt:46-55`) |
+| `VIEW` | Espresso on Android Views embedded through `AndroidView`, which Compose semantics don't reach: the message field is an `EditText` (`A/platform/PlatformTextField.android.kt:99-197`), and the emoji picker, video player and camera preview are Views too |
+| `SHELL` | a device shell command run in-process through `UiAutomation.executeShellCommand`: battery-optimisation allow-list (`dumpsys deviceidle whitelist +/-<pkg>`), background restriction (`cmd appops set <pkg> RUN_ANY_IN_BACKGROUND ignore\|allow`), device PIN (`locksettings set-pin` / `clear`), airplane mode (`cmd connectivity airplane-mode enable\|disable`), running a scheduled job (`cmd jobscheduler run -f`) |
+| `ROT` | a configuration change: `UiDevice.setOrientationLeft()`/`Natural()`, or `ActivityScenario.recreate()` where only recreation matters. Rotation on Waydroid's fixed-size output is unverified (open question 3) |
+
+## IGNORE reasons added by this file
+
+Plan §11.3 lists desktop reasons. These Android reasons are proposed as new §11.3 bullets; each `IGNORE` cell below uses one of them verbatim, or the existing "real WebRTC calls" / "code that is unused" bullets.
+
+| Reason (the `@Ignore` text) | Why |
+|---|---|
+| `no camera on the test runtime: QR scanning needs live camera frames` | Waydroid has no camera device (`~/waydroid/README.md`, "Media"); `QRCodeScanner` decodes CameraX frames with BoofCV (`A/views/newchat/QRCodeScanner.android.kt:89-128`) and has no frame seam. The UI before scanning (permission, "Tap to scan") is tested in §4 |
+| `real WebRTC calls (the call WebView and its media)` | as plan §11.3 "Real WebRTC calls"; on Android the page runs in a `WebView` (`A/views/call/CallView.android.kt:691-790`) and needs a microphone and camera. The call UI before media starts is tested in §9 |
+| `the action ends the app process, which is the instrumentation process` | "Shutdown", "Restart" and the critical-error "Restart" call `Runtime.exit` or ProcessPhoenix (`A/views/usersettings/SettingsView.android.kt:36-45`, `A/views/database/DatabaseView.android.kt:5-7`) |
+| `OS events that end or replace the app process (reboot, package update, removal from Recents)` | `StartReceiver`, `AppUpdateReceiver`, `AutoRestartReceiver` and `onTaskRemoved` (`APP/SimplexService.kt:210-281`) run only after the instrumented process is gone |
+| `a real lock screen and screen-off state, which the test runtime keeps disabled` | `wd.sh up` keeps the screen on and the container unfrozen; the full-screen call intent fires only when the keyguard is locked or the screen is off (`APP/model/NtfManager.android.kt:174-181`) |
+| `biometric sensors are not available on the test runtime` | `BiometricPrompt` falls back to the device credential, which is tested (§10) |
+| `Play Store build: the test APK is the foss flavor and the runtime has no Google Play services` | the `google` flavor hides "Contribute", gates crowdfunding by the Play country and buys badges through Play Billing (`C/views/usersettings/SettingsView.kt:174-176`, `C/views/onboarding/WhatsNewView.kt:1073-1085`) |
+| `device-brand text shown only on Xiaomi, Redmi and POCO devices` | `androidIsXiaomiDevice()` reads `Build.BRAND` (`APP/SimplexApp.kt:345`) |
+| `code that is unused or unreachable, where a visible string remains in the source` | plan §11.3 "commented out or unused" |
+
+## Setup every test needs
+
+1. **Compose the real root** through `MainActivity.onCreate` → `setContent { AppScreen() }` (`APP/MainActivity.kt:57-59`); alerts, the user picker and full-screen modals are composed there (`C/App.kt:203-207, 254-255`). `MainActivity` is `singleTask` (`MAN:57`).
+2. **Pre-set prefs** as on desktop (plan §11.1), plus Android prefs that change what every test sees:
+   - `notificationsMode = OFF` and `backgroundServiceNoticeShown = backgroundServiceBatteryNoticeShown = true`, so neither the foreground service nor the background-service alerts (§2) appear in tests that are not about them (`C/model/SimpleXAPI.kt:105-114`; `APP/SimplexService.kt:430-468`).
+   - `privacyProtectScreen = false` for screenshot capture (failure screenshots; §7.7 shots once open question 17 is settled): it is `true` by default and sets `FLAG_SECURE` on the window (`C/model/SimpleXAPI.kt:123`, `APP/MainActivity.kt:49-55`); §10 tests it with the default restored (open question 4).
+   - `canAskToEnableNotifications` is left at its default (except rows that pre-set it to false: §2 `ntfMode_serviceNotStartedWithoutNotificationPermission`, §3 `sysNtf_permissionDenied_nothingPosted`, §4 `notificationPermission_grantedLater_reenablesAsking`); `POST_NOTIFICATIONS` is granted by the runner (`PERM`) except in §2–§4 rows that say otherwise, so the chat list does not open the system permission dialog on first composition (`C/views/chatlist/ChatListView.kt:276-283`, `A/views/onboarding/SetNotificationsMode.android.kt:13-33`).
+   - `CAMERA` and `RECORD_AUDIO` are granted by the runner too, except in the `PERM (… denied)` groups: on Android the new-chat entry "Paste link / Scan" opens the connect screen with the camera section, whose scanner requests the camera at once (`C/views/newchat/NewChatSheet.kt:61`, `A/views/newchat/QRCodeScanner.android.kt:139-143`), and the voice button requests the microphone (`A/views/chat/SendMsgView.android.kt:7-17`), so carried-over rows (01 §8, 02 §E) would otherwise meet the system dialog (Notes).
+3. **Network validation.** The app reports the network as offline when Android hasn't validated it (`NET_CAPABILITY_VALIDATED`, `A/helpers/NetworkObserver.kt:56-66`) and passes that to the core (`apiSetNetworkInfo`, `:75-92`). With `wd.sh net isolate` the captive-portal check can't reach the internet, so the runner sets `settings put global captive_portal_mode 0` before the run; open question 2 asks to verify that the network then counts as validated.
+4. **Reset.** In-process `resetForTest` as on desktop (research doc §3.2), run before `MainActivity` is launched: the reset's pre-set prefs and `clearUiState` (plan §7.3, including file-level UI state such as the chat list's saved scroll position, read when the list is first composed, `C/views/chatlist/ChatListView.kt:240,907`) must be in place before `onCreate` reads `privacyProtectScreen` (`APP/MainActivity.kt:49-55`) and composes the root, so the test uses `createEmptyComposeRule()` and calls `ActivityScenario.launch(MainActivity::class.java)` after `app(…)`, instead of an activity rule that launches before the test body; at its end each test finishes every app activity (every `MainActivity` and `CallActivity` instance, found through `ActivityLifecycleMonitorRegistry`; a notification tap replaces `MainActivity` through `TaskStackBuilder`, `APP/model/NtfManager.android.kt:270-286`, so closing the scenario alone can leave an instance alive) and waits until they are destroyed, before the next reset, because `MainActivity` is `singleTask` and a live instance would be reused through `onNewIntent` with no fresh composition, and its later `onDispose` handlers would run after the reset (`C/views/chatlist/ChatListView.kt:978-980`, `C/views/chat/ComposeView.kt:1447-1462`). Once per process, before the first reset, a boot step handles the app's own startup: `SimplexApp.onCreate` already started `initChatControllerOnStart()` in the instrumentation process (`APP/SimplexApp.kt:83-87`, `C/platform/Core.kt:59-74, 188`), which after `pm clear` creates the first database (~45 s under translation), longer than the reset's 10 s wait for `ctrlInitInProgress` (plan §7.2); the boot step waits for it (`chatDbStatus != null && !ctrlInitInProgress`, 120 s bound; `initChatControllerOnStart` only launches a coroutine, `C/platform/Core.kt:59-67`, so the flag alone can still be false at first), stops and closes that core, undoes init's pref writes the way `deleteChatDatabaseFilesAndState` does (`C/views/database/DatabaseView.kt:577-580`: `ksDatabasePassword.remove()`, `newDatabaseInitialized = false`, and `storeDBPassphrase = true` as it also sets, and the `initialRandomDBPassphrase`, `privacyDeliveryReceiptsSet` and `onboardingStage` keys removed; init wrote them at `C/views/helpers/DatabaseUtils.kt:56-59`, `C/platform/Core.kt:128,154,168`; otherwise every reset would restore the boot database's key and fixture databases would be opened with it), sets `AppearanceBarsBlurRadius` to 0 (toolbar blur off in every test, for performance, as on desktop, plan §7.2; devices on API 32+ default it to 50), and only then takes the plan's `ModelSnapshot`/`PrefStores` captures (plan §7.3), with no user in that state because the runner runs `pm clear` before every `am instrument` except the second half of a test split by a process restart (open question 14), which runs alone in its invocation; after `pm clear`, which revokes all runtime permissions and clears all notifications (SDK `android/app/ActivityManager.java:3544-3550`), the runner applies that invocation's `pm grant`/`pm revoke` (setup item 2, the `PERM` groups) and only then runs `am instrument`. The captured `ChatModel` state is the post-init state, so the boot step first sets the fields init wrote (`chatDbStatus` to null, `chatDbEncrypted` to false, `conditions`, `currentUser`, …; `chatRunning` and `localUserCreated` are reset too, harmlessly) back to their declared initial values before capturing (`ChatModel` is an object, so the list of fields init writes is fixed by P1 and checked against the desktop snapshot, which is taken before any init), as plan §7.3's reset and `restartCore`'s wait for `chatDbStatus` need; Android's `PrefStores` captures the app's two `SharedPreferences` files and restores them through `SharedPreferences.Editor` (clear, put, commit), not by rewriting the XML files, which the per-process cache would not see (`ContextImpl.java:635-646`, `MODE_PRIVATE`); the files are the `SHARED_PREFS_ID` and `SHARED_PREFS_THEMES_ID` preferences (`A/platform/Resources.android.kt:40-41`, wrapped at :43-44) instead of the desktop properties files, and `themes.yaml`, a plain file in `shared_prefs` (`A/platform/Files.android.kt:21`), as on desktop. A process that continues a test split across two `am instrument` runs (open question 14) skips the boot step's stop, undo and capture and the per-test reset (no `resetForTest`; it launches `MainActivity` as soon as init's wait completes), since its state is the first half's and must be kept; `pm clear` (1 s; the first database after it takes ~45 s under translation) only as above. The system clipboard is cleared (`ClipboardManager.clearPrimaryClip()`; it persists across tests, carry-over rule R13). Notifications are cancelled (`NotificationManager.cancelAll()`), `WorkManager` work is cancelled and the battery/background shell state is restored at the end of every test that changes them.
+5. **Message field.** On Android the compose field is an `EditText` inside `AndroidView` (`A/platform/PlatformTextField.android.kt:99-197`), not a Compose text field, so `performTextInput` can't type into it. The shared `UiNode.type()` (plan §7.4) uses Espresso `replaceText` on that `EditText` on Android and then puts the cursor at the end (`setSelection(editText.length())` on the `EditText`; or it types with `typeText`): `EditText.setText` resets the selection to 0 (SDK `android/widget/TextView.java:7504,7519`, `android/text/method/ArrowKeyMovementMethod.java:364`) and the app forwards the selection into the compose state (`A/platform/PlatformTextField.android.kt:123-128,160-167`), where the mention picker reads it (`C/views/chat/group/GroupMentions.kt:104-137,291-310`; carry-over rule R12). With the cursor at the end, carried-over compose and mention rows need no other change. Reads of the message field also go to the `EditText` through Espresso, since Compose semantics don't reach it: its `text` and its `hint`, the placeholder (`editText.hint = placeholder`, `A/platform/PlatformTextField.android.kt:140,177`; e.g. 03 `channel_broadcastPlaceholderAndDelivery` «Broadcast», 02 `compose_clearTextButton_clears`, the 02 draft rows, 02 `mention_picker_select_insertsAndSends`). Shared tests therefore read the field only through `ChatScreen.messageText` and `ChatScreen.placeholder` (plan §9.1), which the Android driver answers by reading `EditText.text` / `.hint` in an Espresso `ViewAction` on the `EditText` (`withText`/`withHint` are matchers that need the expected value, so they can't return it) and the desktop driver from semantics; they don't use `assert(…)` or a text lookup of the placeholder on the field, because a `SemanticsMatcher` can't be re-run on a View and no Compose node carries the hint (on desktop the placeholder is a Compose `Text`, `D/platform/PlatformTextField.desktop.kt:186-191`). The disabled-state overlay text ("you are subscriber", "contact deleted") is a Compose `Text` (:200-212) and is read as on desktop. Rows below that test the field itself have `VIEW`.
+6. **One pane.** Android shows either the chat list or a chat (`C/App.kt:313-360`), and modals share one manager (`C/views/helpers/ModalView.kt:253-258`), so screen objects own navigation (research doc §5.3).
+7. **Battery state.** On API 33 both Instant and Periodic modes need the app exempt from battery optimisation (`A/helpers/Extensions.kt:8-16`). The runner allow-lists the app before the run (`dumpsys deviceidle whitelist +chat.simplex.app.debug`) and allows background work; §2 rows that need the optimised or restricted state change it with `SHELL` and restore it.
+8. **Notification taps recreate the activity.** Notification intents are built with `TaskStackBuilder` (`APP/model/NtfManager.android.kt:270-286`), which clears the task, so `MainActivity.onCreate` runs again and handles the action (`APP/MainActivity.kt:44-48,121-142`); queries keep working through `ComposeRootRegistry`, but tests must not hold references to the old activity.
+
+---
+
+### 1. Onboarding and first-run screens on Android (15 tests)
+
+Catalogue 01 §1 owns the shared onboarding rows (profile name rules, operators, conditions, What's New). This section covers what differs on Android.
+
+| Area | Feature | Entry path (labels) | Main file:line | Test case(s) | Verification (GUI / CLI) | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Onboarding | Welcome screen (Android) | First launch, stage `Step1_SimpleXInfo` | `C/views/onboarding/SimpleXInfo.kt:44-58,104-160`; `A/views/onboarding/SimpleXInfo.android.kt:11-16` | `androidOnboardingWelcomeShowsGetStarted` | "Get started" and "Why SimpleX is built."; no "Link a mobile" and no "Create your profile" (desktop labels); "Get started" opens "Your profile" | ONBOARD | Desktop counterpart: 01 `onboardingWelcomeShowsDesktopActions` |
+| Onboarding | Create profile (mobile layout) | "Get started" → "Your profile" | `C/views/WelcomeView.kt:236-300` | `androidOnboardingCreateProfileMobileLayout` | Title "Your profile", "On your phone, not on servers.", "No account. No phone. No email. No ID.…", field "Enter profile name…", button "Create profile"; the soft keyboard opens on the field and the image shrinks while it is open (`WelcomeView.kt:245-248`) | ONBOARD, IME | Name validation rows are 01's |
+| Onboarding | "Migrate" button | "Your profile" app bar → "Migrate" | `C/views/WelcomeView.kt:201-225,242`; `C/views/migration/MigrateToDevice.kt:200-216` | `androidOnboardingMigrateButtonOpensScanAndPaste` | The button reads "Migrate" (desktop: "Migrate from another device"); the migration screen shows "Scan QR code" (camera section, §4) above "Or paste archive link" and "Or import archive file" | ONBOARD, PERM (CAMERA granted) | The scan itself is `qrScan_migrationLink` (§5) |
+| Onboarding | No passphrase step | "Create profile" | `C/views/WelcomeView.kt:399-405`; `C/views/helpers/DatabaseUtils.kt:51-60` | `androidOnboardingNoPassphraseStepAfterProfile` | After "Create profile" the next screen is "Your network", never "Setup database passphrase"; prefs: `storeDBPassphrase = true`, `initialRandomDBPassphrase = true`, and `DatabaseUtils.ksDatabasePassword.get()` returns the random key from the Keystore | ONBOARD | Desktop goes to the passphrase step (01 setup item 6) |
+| Onboarding | Your network (Android) | "Your network" | `C/views/onboarding/YourNetwork.kt:58-133,200-226` | `androidYourNetworkShowsSetupNotifications` | "Your network", "Setup routers" (operator logos) and "Setup notifications" with the bolt icon (mode Instant), "Continue" | ONBOARD | Desktop has no notifications button (01 `onboardingNoNotificationsStepOnDesktop`) |
+| Onboarding | Notifications mode screen | "Setup notifications" | `C/views/onboarding/SetNotificationsMode.kt:24-62` | `onboardingNotifications_cardsAndDefault` | Title "Private notifications", link "How it affects battery", cards "Instant" ("App always runs in background"), "Periodic" ("Check messages every 10 minutes"), "When app is running" ("No background service"), button "OK"; "Instant" is selected (`NotificationsMode.default = SERVICE`, `C/model/SimpleXAPI.kt:8588-8594`) | ONBOARD | – |
+| Onboarding | Select a mode | tap "Periodic" → "OK" | `SetNotificationsMode.kt:39-57`; `YourNetwork.kt:56,105-109,201-206` | `onboardingNotifications_selectPeriodicReturns` | "Periodic" is highlighted; "OK" returns to "Your network", whose "Setup notifications" icon is now the timer; the pref is unchanged until "Continue" | ONBOARD | The choice is kept in `rememberSaveable` until "Continue" |
+| Onboarding | Battery info page | "How it affects battery" | `SetNotificationsMode.kt:33-36,106-119` | `onboardingNotifications_batteryInfoPage` | Page "Notifications and battery" with the three mode headings and their long descriptions; closed with its close button | ONBOARD | – |
+| Onboarding | Continue applies Instant | "Continue" with Instant | `YourNetwork.kt:118-125`; `US/NotificationsSettingsView.kt:146-149`; `APP/SimplexApp.kt:217-244`; `APP/SimplexService.kt:430-502` | `onboardingNotifications_continueAppliesInstant` | Pref `notificationsMode = SERVICE`; the alert "Instant notifications" ("To improve privacy, SimpleX runs in background instead of using push notifications." / "It can be disabled via settings – notifications will still be shown while the app is running.", "OK") appears at once, and `backgroundServiceNoticeShown` becomes true; the foreground-service notification "SimpleX Chat service" / "Receiving messages…" is active (id 6789, channel "SimpleX Chat service", `APP/SimplexService.kt:108-118,309-311`); `StartReceiver` and `AppUpdateReceiver` are enabled (`PackageManager.getComponentEnabledSetting`) | ONBOARD, SYSNTF | The info variant of the alert needs the app allow-listed for battery use (setup item 7); onboarding boots keep the notice prefs at their defaults. Without `POST_NOTIFICATIONS` the service is not started (`APP/SimplexService.kt:349-352`, §2) |
+| Onboarding | Continue applies Periodic | "Continue" with Periodic | `APP/SimplexApp.kt:217-244`; `APP/MessagesFetcherWorker.kt:15-40`; `APP/SimplexService.kt:430-502` | `onboardingNotifications_continueAppliesPeriodic` | Pref `notificationsMode = PERIODIC`; the alert "Periodic notifications" with "The app fetches new messages periodically — it uses a few percent of the battery per day.…" and "OK"; no service notification; `WorkManager` has the unique work `chat.simplex.app.debug.UNIQUE_MESSAGES_FETCHER` enqueued (`schedulePeriodicWakeUp`, `APP/SimplexApp.kt:178-184`, from the next `MainActivity.onCreate` or the notice's allowed branch, `APP/SimplexService.kt:463-467`) | ONBOARD, SYSNTF | The test polls `WorkManager.getWorkInfosForUniqueWork`; if nothing schedules it before the chat list, the row asserts it after `ActivityScenario.recreate()` |
+| Onboarding | Continue applies Off | "Continue" with "When app is running" | `APP/SimplexApp.kt:217-244`; `APP/SimplexService.kt:435` | `onboardingNotifications_continueAppliesOff` | Pref `notificationsMode = OFF`; no alert (the notice returns early for OFF); no service notification, no fetcher work; both receivers disabled | ONBOARD, SYSNTF | – |
+| Chat list | Onboarding cards in the chat list | Chat list of a new user (only the notes folder and the "Ask SimpleX Team" card) | `C/views/chatlist/ChatListView.kt:449-475`; `C/views/newchat/OnboardingCards.kt:52-56,332-420` | `androidOnboardingCards_inChatList`, `androidOnboardingCards_swipeBetweenPages` | The chat-list area shows "Talk to someone" with "Let someone connect to you" and "Connect via link or QR code"; swiping left shows "Create your link" with "Invite someone privately" and "Create your public address" (the pager scrolls by touch on Android, `OnboardingCards.kt:355`) | — | The test clears the pre-set `addressCreationCardShown` (01 setup item 2). Desktop shows the same cards in the centre pane (01 `centerConnectOnboardingCardsWithNoConversations`) |
+| Chat list | "Connect via link or QR code" | card → "Connect via link or QR code" | `OnboardingCards.kt:375-381`; `C/views/newchat/NewChatView.kt:628-668` | `androidOnboardingCards_connectViaLinkShowsScanner` | Opens the connect screen with "Paste the link you received" and "Or scan QR code"; the camera section is shown at once (`showQRCodeScanner = appPlatform.isAndroid`) | PERM (CAMERA granted) | Camera preview content is black on the runtime (no camera) |
+| What's New | Android-only feature line | Settings > "Help & support" > "What's new", paged to v6.0 | `C/views/onboarding/WhatsNewView.kt:735-756` | `whatsNewAndroid_v60ShowsReachableChatToolbar` | The v6.0 page lists "Reachable chat toolbar" ("Use the app with one hand.") and not "Upgrade app automatically" (desktop-only, `show = appPlatform.isDesktop`) | — | Page through with the previous-version link (01 `whatsNewPaginationPrevNext`) |
+
+### 2. Notification service modes and background-service alerts (21 tests, 1 ignored)
+
+Notifications in SimpleX on Android come only from the app's own process: there is no push (FCM) mode (`NotificationsMode` has `OFF`, `PERIODIC`, `SERVICE`; `INSTANT` is commented out, `C/model/SimpleXAPI.kt:8588-8594`). Rows that test the alerts clear `backgroundServiceNoticeShown`/`backgroundServiceBatteryNoticeShown` (pre-set to true, setup item 2) and set the mode they need.
+
+| Area | Feature | Entry path (labels) | Main file:line | Test case(s) | Verification (GUI / system) | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Settings | "Notifications" item | Settings | `US/SettingsView.kt:122-126` | `ntfSettings_rootItemIconAndStoppedState` | Under "Advanced settings": "Notifications" between "Network & servers" and "Audio & video calls"; its icon is the bolt, or bolt-off in mode OFF; disabled after the chat is stopped (Chat data) | — | 04 `settingsRoot_listsDesktopItems` asserts it is absent on desktop |
+| Settings | Notifications screen | Settings > "Notifications" | `US/NotificationsSettingsView.kt:23-63` | `ntfSettings_layoutShowsCurrentMode` | Title "Notifications"; row "Notification service" with the current mode's title in grey ("Always on" for SERVICE, "Starts periodically", "Runs when app is open") | — | – |
+| Settings | Mode picker | "Notification service" | `US/NotificationsSettingsView.kt:28-34,65-117` | `ntfSettings_modePickerOptions` | Page "Notification service" lists "Runs when app is open" ("App can receive notifications only when it's running, no background service will be started"), "Starts periodically" ("Checks new messages every 10 minutes for up to 1 minute"), "Always on" ("Background service is always running – notifications will be shown as soon as the messages are available."); the current one is checked | — | – |
+| Settings | Switch to OFF | picker > "Runs when app is open" | `US/NotificationsSettingsView.kt:146-149`; `APP/SimplexApp.kt:217-244` | `ntfMode_switchToOff_stopsServiceAndReceivers` | From SERVICE: Pref `notificationsMode = OFF`; the "SimpleX Chat service" notification disappears (`SimplexService.isServiceStarted` false); `StartReceiver`/`AppUpdateReceiver` disabled; unique work `SimplexAutoRestartWorkerPeriodic` cancelled; the Settings icon turns to bolt-off; no alert | SYSNTF | The test starts in SERVICE mode with the service running |
+| Settings | Switch to Periodic | picker > "Starts periodically" | `APP/SimplexApp.kt:217-244,178-184`; `APP/MessagesFetcherWorker.kt:15-40` | `ntfMode_switchToPeriodic_schedulesFetcher` | From SERVICE: Pref `notificationsMode = PERIODIC`; service notification gone; receivers disabled; the fetcher work `chat.simplex.app.debug.UNIQUE_MESSAGES_FETCHER` is enqueued (after `ActivityScenario.recreate()` if not already) | SYSNTF | – |
+| Settings | Switch to Always on | picker > "Always on" | `APP/SimplexApp.kt:217-236`; `APP/SimplexService.kt:47-62,165-204,348-361` | `ntfMode_switchToService_startsForegroundService` | From OFF: Pref `notificationsMode = SERVICE`; within a few seconds the ongoing, silent notification "SimpleX Chat service" / "Receiving messages…" with action "Hide" is active (channel id `chat.simplex.app.SIMPLEX_SERVICE_NOTIFICATION`, importance low); receivers enabled | SYSNTF | The code restarts the service once if the system destroyed it within 2 s (`SimplexApp.kt:226-232`) |
+| Service | "Hide" action | service notification > "Hide" | `APP/SimplexService.kt:193-201` | `serviceNotification_hideOpensChannelSettings` | Sending the action's `PendingIntent` fires `Settings.ACTION_CHANNEL_NOTIFICATION_SETTINGS` with `EXTRA_APP_PACKAGE` = the app and `EXTRA_CHANNEL_ID` = `chat.simplex.app.SIMPLEX_SERVICE_NOTIFICATION` (recorded and stubbed) | SYSNTF, INTENTS | A `PendingIntent.send()` from the test process goes through the system, so whether Espresso-Intents records it is open question 5; if it doesn't, this row asserts the system settings screen with `SYSUI` instead |
+| Service | Tap the service notification | service notification body | `APP/SimplexService.kt:178-188` | `serviceNotification_tapOpensApp` | With the app backgrounded from the chat list, sending the content intent brings `MainActivity` back to the chat list (a plain `getActivity` intent, `APP/SimplexService.kt:179-181`, so `MainActivity` gets `onNewIntent` and is not recreated) | SYSNTF, BG | – |
+| Service | No service without notification permission | SERVICE mode with `POST_NOTIFICATIONS` denied | `APP/SimplexService.kt:348-352`; `APP/model/NtfManager.android.kt:288` | `ntfMode_serviceNotStartedWithoutNotificationPermission` | Switching to "Always on" sets the pref, but no service starts (`isServiceStarted` false) and no notification is posted | PERM (POST_NOTIFICATIONS denied), SYSNTF | `canAskToEnableNotifications` is pre-set to false, as in §4 `notificationPermission_grantedLater_reenablesAsking`: after `pm clear` the chat list would otherwise launch the system permission dialog on first composition (`C/views/chatlist/ChatListView.kt:276-283`) |
+| Service | Stop and start chat | Settings > "Chat data" > "Database passphrase & export" > "Chat is running" off → "Stop chat?" → "Stop"; then the toggle on again (no alert) | `C/views/database/DatabaseView.kt:302-307,392-396,443-451`; `C/views/database/DatabaseView.kt:433,493`; `APP/SimplexApp.kt:246-259` | `ntfService_stopChatStopsService_startRestartsIt` | In SERVICE mode, stopping the chat removes the service notification and cancels the restart worker; starting it again brings the notification back | SYSNTF | Chat stop/start UI is 04 §G |
+| Service | Passphrase notification | SERVICE mode, passphrase not stored, core restarted | `APP/SimplexService.kt:128-163,381-414`; `APP/SimplexApp.kt:246-249` | `ntfService_passphraseNeededNotification` | After "Save passphrase in Keystore" is turned off (§11) and `restart()`, the database stays locked and the service posts "Passphrase is needed" / "To receive notifications, please, enter the database passphrase" (id 1535); entering the passphrase on the start screen ("Save passphrase and open chat" or "Open chat") cancels it | SYSNTF, RESTART, BG | With an in-process `restart()` (open question 14) the process lifecycle stays RESUMED, so the test backgrounds and resumes the app: `ON_RESUME` starts the service (`APP/SimplexApp.kt:128-136`), which finds `chatDbStatus != OK`; the passphrase screen cancels the notification through `androidChatStartedAfterBeingOff` (`C/views/database/DatabaseErrorView.kt:230-233`) |
+| Notice | Instant, battery allowed | resume after onboarding with SERVICE | `APP/SimplexApp.kt:118-122`; `APP/SimplexService.kt:430-448,470-502` | `bgNotice_instant_allowed_showsInfoOnce` | On the next resume (`BG`): alert titled "Instant notifications" with the two texts and "OK"; both notice prefs become true; after another background/foreground cycle no alert appears | BG | Also shown when the chat starts after onboarding (`androidChatInitializedAndStarted`, `APP/SimplexApp.kt:261-270`) |
+| Notice | Periodic, battery allowed | same with PERIODIC | `APP/SimplexService.kt:470-502` | `bgNotice_periodic_allowed_showsInfo` | Alert "Periodic notifications" with the periodic description and "OK" | BG | – |
+| Notice | Battery optimised: Allow | SERVICE mode, app not allow-listed, resume | `APP/SimplexService.kt:443-445,505-563,697-706` | `bgNotice_batteryOptimized_allowOpensSystemDialog` | Alert "Instant notifications!" with "To improve privacy, SimpleX runs in background…" and "Allow it in the next dialog to receive notifications instantly.", buttons "Disable notifications" (red) and "Allow"; "Allow" fires `Settings.ACTION_REQUEST_IGNORE_BATTERY_OPTIMIZATIONS` with data `package:chat.simplex.app.debug` (stubbed); the mode stays SERVICE | BG, SHELL, INTENTS | `SHELL`: `dumpsys deviceidle whitelist -<pkg>` before, `+<pkg>` after |
+| Notice | Battery optimised: Disable | same > "Disable notifications" | `APP/SimplexService.kt:518-522,650-679,722-732` | `bgNotice_batteryOptimized_disableTurnsOff` | The alert "Instant notifications are disabled!" ("Battery optimization is active, turning off background service and periodic requests for new messages. You can re-enable them via settings.", "OK"); Pref `notificationsMode = OFF`; service notification gone; receivers disabled | BG, SHELL, SYSNTF | – |
+| Notice | Battery optimised: dismiss | same, tap outside the alert | `APP/SimplexService.kt:523-524` | `bgNotice_batteryOptimized_dismissDisables` | Dismissing counts as "Disable notifications": Pref `notificationsMode = OFF` and the "…are disabled!" alert | BG, SHELL | – |
+| Notice | Background restricted | SERVICE mode, `RUN_ANY_IN_BACKGROUND` ignored, resume | `APP/SimplexService.kt:441-442,565-606,688-695,708-720` | `bgNotice_systemRestricted_openAppSettings`, `bgNotice_systemRestricted_disable` | Alert "Instant notifications!" with "SimpleX can't run in background. You will receive the notifications only when the app is running." and "To enable notifications, please choose App battery usage / Unrestricted in the app settings."; "Open app settings" fires `Settings.ACTION_APPLICATION_DETAILS_SETTINGS` for the package (stubbed); "Disable notifications" sets `OFF` and shows "Instant notifications are disabled!" | BG, SHELL, INTENTS | `SHELL`: `cmd appops set <pkg> RUN_ANY_IN_BACKGROUND ignore`, restored with `allow` |
+| Notice | Seen before, optimisation turned back on | SERVICE mode, notice prefs true, app removed from the allow-list, resume | `APP/SimplexService.kt:456-462` | `bgNotice_shownBefore_optimizedAgain_reprompts` | The "Allow" alert appears again on resume although the notice was shown before | BG, SHELL | – |
+| Notice | Mode change while optimised | Settings > "Notifications" > "Notification service" > "Always on" while not allow-listed | `APP/SimplexApp.kt:217-221,243` | `ntfMode_changeWhileOptimized_noOffAlert` | `backgroundServiceNoticeShown` is reset and the "Allow" alert appears at once; choosing "Disable notifications" sets `OFF` without the "…are disabled!" alert (`showOffAlert = false`) | SHELL | – |
+| Service | Restart after reboot, update or removal from Recents | SERVICE mode; reboot; app update; swipe the app away in Recents | `APP/SimplexService.kt:210-281`; `MAN:200-228`; `APP/SimplexApp.kt:156-176` | `ntfService_restartsAfterRebootUpdateOrTaskRemoval` | – | IGNORE: OS events that end or replace the app process (reboot, package update, removal from Recents) | The receivers' enabled state is tested in §1 and §2; the periodic `ServiceStartWorker` (every 3 h) only restarts a service that was running |
+
+### 3. System notifications: messages, requests and calls (19 tests)
+
+Which items notify is shared logic (`notifyMessageReceived`, `C/platform/NtfManager.kt:39-50`); on Android a notification is shown for every chat while the app is in the background, and only for chats other than the open one while it is in the foreground (`allowedToShowNotification() = !isAppOnForeground`, `A/platform/Notifications.android.kt:3`). These rows assert the real Android notifications. Peers are current-build CLIs; messages are sent with `@alice <text>` / `#team <text>`.
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification (system / GUI / CLI) | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Messages | Background message | app in background; bob `@alice hello` | `APP/model/NtfManager.android.kt:102-158` | `sysNtf_message_backgroundShowsTitleAndText` | One notification on channel "SimpleX Chat messages" (`chat.simplex.app.MESSAGE_NOTIFICATION`) with title "bob" and text "hello", in group `chat.simplex.app.MESSAGE_NOTIFICATION`, plus the group summary (id 0); auto-cancel set | P, BG, SYSNTF | Channels exist once `POST_NOTIFICATIONS` is granted (`NtfManager.android.kt:55-57,297-304`) |
+| Messages | Group message | app in background; bob `#team hi all` | `C/platform/NtfManager.kt:39-50` | `sysNtf_groupMessage_titleIsGroup` | Title "team", text "hi all" (no sender prefix) | P, BG, SYSNTF | bob creates the group and invites alice, who joins before going to the background |
+| Messages | Foreground: only other chats | app open on the chat with bob; bob and cath both send | `C/platform/NtfManager.kt:40-47`; `A/platform/Notifications.android.kt:3` | `sysNtf_foreground_onlyForChatsNotOpen` | No notification for bob's message (his chat is open); one for cath's | P ×2 (bob, cath), SYSNTF | – |
+| Messages | Tap opens the chat | send the notification's content intent | `APP/model/NtfManager.android.kt:127,270-286`; `APP/MainActivity.kt:121-130`; `C/platform/NtfManager.kt:70-83`; `C/views/chat/ChatView.kt:761-765` | `sysNtf_tapOpensChat` | `MainActivity` is recreated and opens the chat with bob showing "hello"; the notification is gone once "hello" is marked read (`ntfManager.cancelNotificationsForChat`; `contentIntent.send()` is not a user click, so auto-cancel does not apply) | P, BG, SYSNTF | Setup item 8 |
+| Messages | Summary tap shows the chat list | send the summary's content intent with a chat open | `APP/model/NtfManager.android.kt:142-149`; `C/platform/NtfManager.kt:85-97` | `sysNtf_summaryTapShowsChatList` | The open chat closes and the chat list shows | P, BG, SYSNTF | – |
+| Messages | Reading cancels the notification | open the chat from the chat list instead | `C/views/chat/ChatView.kt:760-790`; `APP/model/NtfManager.android.kt:75-86` | `sysNtf_openingChatCancelsItsNotification` | After the chat is opened and its items marked read, the chat's notification and the empty group summary are cancelled (asserted with a wait: the summary check counts `activeNotifications` right after the cancel, `NtfManager.android.kt:78-85`) | P, BG, SYSNTF | – |
+| Messages | Deleted last message | bob sends, then deletes it (`\ @alice hello`) while the notification is shown | `C/model/SimpleXAPI.kt:3078-3094` | `sysNtf_deletedMessageUpdatesNotification` | The notification is replaced by one with text "marked deleted" (or "deleted" with full deletion) | P, BG, SYSNTF | `hasNotificationsForChat` returns true only on Android (desktop always returns false, `D/model/NtfManager.desktop.kt:58`) (`NtfManager.android.kt:268`) |
+| Messages | Preview "Contact name" and "Hidden" | Settings > "Your privacy" > "Show preview" | `APP/model/NtfManager.android.kt:108-115` | `sysNtf_previewContactName`, `sysNtf_previewHidden` | Contact name: title "bob", text "new message"; Hidden: title "Contact hidden:", text "new message"; in both modes the notification has no large icon (`largeIcon` is set only for notifications with actions, i.e. contact requests, `NtfManager.android.kt:111-115`) | P, BG, SYSNTF | 04 `morePrivacy_notificationPreviewModes` tests the setting itself |
+| Messages | Secret text hidden | bob sends `#secret#` markdown | `C/platform/NtfManager.kt:134-150` | `sysNtf_secretMarkdownHidden` | Text "..." in place of the secret part | P, BG, SYSNTF | – |
+| Messages | Muted chat, muted profile | chat muted (row menu "Mute"); for the profile: a second profile active, the first muted in "Your chat profiles" (menu "Mute", `UserProfilesView.kt:237-241`) | `C/model/ChatModel.kt:1794-1801, 1381-1386`; `APP/model/NtfManager.android.kt:103` | `sysNtf_mutedChat_noNotification`, `sysNtf_mutedProfile_noNotification` | No notification for a muted chat; none for messages to the muted, inactive profile (the active profile always notifies, `showNotifications` is `activeUser` or `showNtfs`) | P, BG, SYSNTF | Muting UI is 01's |
+| Messages | Message to another profile | second profile active; bob messages the first | `C/platform/NtfManager.kt:70-83` | `sysNtf_otherProfile_tapSwitchesProfile` | The notification carries the first profile's `userId`; tapping it switches the active profile and opens bob's chat | P, BG, SYSNTF | – |
+| Requests | Contact request with "Accept" | alice has an address; bob `/c <address>` (bob: "connection request sent!") | `C/platform/NtfManager.kt:28-37,52-68`; `APP/model/NtfManager.android.kt:130-141,310-329` | `sysNtf_contactRequest_acceptAction` | Notification title "bob", text "New contact request", one action "Accept", and the app icon as the large icon (bob has no profile image, `APP/model/NtfManager.android.kt:111-115`); sending the action accepts: bob prints "alice: contact is connected" and the request notification is cancelled | P, BG, SYSNTF | The action goes through `NtfActionReceiver`, without opening the app |
+| Requests | Contact connected | alice's 1-time link; bob `/c <link>` (bob: "confirmation sent!") | `C/platform/NtfManager.kt:21-26` | `sysNtf_contactConnected` | Notification title "bob", text "Connected" | P, BG, SYSNTF | – |
+| Permission | Denied: nothing posted | `POST_NOTIFICATIONS` denied | `APP/model/NtfManager.android.kt:151-157` | `sysNtf_permissionDenied_nothingPosted` | A background message posts no notification; the chat list's unread counter still updates | P, BG, PERM (POST_NOTIFICATIONS denied), SYSNTF | `canAskToEnableNotifications` is pre-set to false, as in §4 `notificationPermission_grantedLater_reenablesAsking`: after `pm clear` the chat list would otherwise launch the system permission dialog on first composition (`C/views/chatlist/ChatListView.kt:276-283`) |
+| Calls | Call invitation in background | app in background; bob `/call @alice` (bob: "ok") | `C/views/call/CallManager.kt:11-25`; `APP/model/NtfManager.android.kt:160-226` | `sysNtf_callInvitation_backgroundShowsAcceptReject` | Notification on channel "SimpleX Chat calls" (`chat.simplex.app.CALL_NOTIFICATION_2`), id -1, category call, title "bob", text "e2e encrypted video call", actions "Accept" and "Reject", insistent flag set; the in-app alert is composed in the background (`activeCallInvitation` is set, `C/App.kt:253-254`, `C/views/call/CallManager.kt:17-18`) but plays no ringtone (`sentNotification = true`, `C/views/call/IncomingCallAlertView.kt:30-34`) | P, BG, SYSNTF | `/call` sends the default type, a video call with encryption (02 `callAlert_incoming_acceptRejectIgnore`). Screen is on and unlocked, so the branch for an unlocked screen is used (`NtfManager.android.kt:176-190`; it still sets an empty full-screen intent, :183,188, which no assertion checks) |
+| Calls | Reject from the notification | send the "Reject" action | `APP/model/NtfManager.android.kt:317-322`; `C/views/call/CallManager.kt:96-110` | `sysNtf_callInvitation_rejectAction` | The call notification is cancelled; the chat with bob shows the item "rejected call"; bob prints nothing (rejection is local, `src/Simplex/Chat/Library/Commands.hs:1530-1541`) | P, BG, SYSNTF | – |
+| Calls | Accept after the caller hung up | bob `/call @alice`, then `/_call end @<alice's contact id>`; send the stale notification's "Accept" | `APP/MainActivity.kt:135-140`; `C/platform/NtfManager.kt:99-108` | `sysNtf_callInvitation_acceptAfterEnded_showsAlert` | `MainActivity` opens and shows the alert "Call already ended!"; no call screen | P, BG, SYSNTF | The test keeps the `PendingIntent` before bob ends the call, which cancels the notification |
+
+### 4. Runtime permissions (13 tests)
+
+Android 13 asks for `POST_NOTIFICATIONS`, `CAMERA` and `RECORD_AUDIO` at run time (`MAN:8-11`); `WRITE_EXTERNAL_STORAGE` is requested only below API 30 (`A/views/chat/item/ChatItemView.android.kt:28-45`), so it has no row on API 33. Each row's `PERM` state is set before the instrumentation starts (Needs table); `SYSUI` answers the system dialog.
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification (GUI / system) | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Notifications | First chat-list composition asks | finish onboarding with the permission never granted | `C/views/chatlist/ChatListView.kt:276-283`; `A/views/onboarding/SetNotificationsMode.android.kt:11-33` | `notificationPermission_requestedOnFirstChatList_allow` | When the chat list appears (chat running), the system dialog asks to allow notifications; "Allow" grants it and the app creates the channels "SimpleX Chat messages" and "SimpleX Chat calls" (`NotificationManager.getNotificationChannel`) | ONBOARD, PERM (POST_NOTIFICATIONS denied), SYSUI | The dialog is triggered by the chat list, not by the onboarding notifications screen (`SetNotificationsModeAdditions` is only called from `ChatListView`) |
+| Notifications | Denied once: not asked again | "Don't allow", then `restart()` | `A/views/onboarding/SetNotificationsMode.android.kt:15-24` | `notificationPermission_deniedRationale_notAskedAgain` | After the first "Don't allow", the next chat-list composition finds `shouldShowRationale` and sets `canAskToEnableNotifications = false`; no dialog appears again | ONBOARD, PERM (POST_NOTIFICATIONS denied), SYSUI, RESTART | – |
+| Notifications | Granted later in system settings | `canAskToEnableNotifications` pre-set false; grant with `UiAutomation`, then resume | `A/views/onboarding/SetNotificationsMode.android.kt:15-31` | `notificationPermission_grantedLater_reenablesAsking` | No system dialog before the grant (the pref is false, `:18-22`); after an in-test grant and a background/foreground cycle, `canAskToEnableNotifications` is true again and the channels exist | PERM (POST_NOTIFICATIONS denied), BG | With the default `true` the chat list would launch the system dialog first (`:24`) |
+| Camera | New-chat scanner asks on open | the "Start new chat" button > "Paste link / Scan" | `C/views/newchat/NewChatSheet.kt:55-63,194`; `A/views/newchat/QRCodeScanner.android.kt:137-144` | `qrScanner_permissionRequestedOnOpen_allowShowsPreview` | Section "Or scan QR code"; the system camera dialog opens at once; after "Allow" the camera preview (a `PreviewView`) replaces the button | PERM (CAMERA denied), SYSUI, VIEW | The preview stays black on the runtime (no camera) |
+| Camera | Denied: "Enable camera access" | same, "Don't allow" | `QRCodeScanner.android.kt:145-151` | `qrScanner_denied_showsEnableCameraAccess` | The scanner area shows the button "Enable camera access"; tapping it asks again | PERM (CAMERA denied), SYSUI | – |
+| Camera | Granted, scanner hidden: "Tap to scan" | camera granted; paste bob's 1-time link ("Tap to paste link"), cancel the plan alert | `QRCodeScanner.android.kt:152-158`; `C/views/newchat/NewChatView.kt:671-690` | `qrScanner_hiddenAfterPaste_tapToScanShowsPreview` | Pasting a link hides the scanner (`showQRCodeScanner = false`); the area shows "Tap to scan", which shows the preview again | PERM (CAMERA granted), CB, P | The connection itself is 01 §8 |
+| Camera | Photo from the attachment sheet, denied | Attach > "Camera", "Don't allow" | `A/views/chat/ComposeView.android.kt:33-39,47-57` | `attachCamera_permissionDenied_showsToast` | The system dialog appears; after "Don't allow" the toast "Permission Denied!" is recorded (R11) and nothing is attached | P, PERM (CAMERA denied), SYSUI, TOAST | – |
+| Camera | Profile image camera, denied | user picker → current user → "Edit image" → "Camera", "Don't allow" | `A/views/helpers/GetImageView.android.kt:161-168,186-196` | `profileImageCamera_permissionDenied_showsToast` | Toast "Permission Denied!" recorded (R11); the image is unchanged | PERM (CAMERA denied), SYSUI, TOAST | – |
+| Camera | Scan server QR asks for camera | Network & servers > "Your servers" > "Add server" > "Scan server QR code" | `NS/ProtocolServersView.kt:275-300`; `A/views/usersettings/networkAndServers/ScanProtocolServer.android.kt:9-16` | `scanServer_requestsCameraPermission` | The scan screen opens and the system camera dialog appears at once | PERM (CAMERA denied), SYSUI | The option exists only on Android (`ProtocolServersView.kt:281`) |
+| Microphone | Voice button without permission | open a chat with bob, tap the microphone | `C/views/chat/SendMsgView.kt:151-152,389-400`; `A/views/chat/SendMsgView.android.kt:7-17` | `voicePermission_micTapRequestsPermission`, `voicePermission_grantedShowsRecordButton` | Without `RECORD_AUDIO` the button "Record voice message" only asks for the permission (no recording starts); after "Allow" the button turns into the press-to-record button (`RecordVoiceView`) | P, PERM (RECORD_AUDIO denied), SYSUI | Recording itself is 02 §E (REC seam, which needs an Android actual) |
+| Microphone | Call needs the microphone | start an audio call to bob without `RECORD_AUDIO` | `APP/views/call/CallActivity.kt:250-279`; `A/views/call/CallView.android.kt:569-662` | `callPermissions_micDenied_showsGrantScreen` | `CallActivity` shows "Grant permissions", "Grant permission(s) to make calls", the button "Microphone" and "End call"; the system dialog opens at once; after "Don't allow", "End call" ends the call and the activity closes | P, PERM (RECORD_AUDIO denied), SYSUI | No invitation reaches bob: it is sent only after the call page reports its capabilities (§9) |
+| Microphone | Permanently denied: settings alert | the second denial, then the "Microphone" button | `A/views/call/CallView.android.kt:664-688`; `A/helpers/Permissions.kt:11-29` | `callPermissions_permanentlyDenied_showsSettingsAlert` | When no system dialog pauses the app within 2 s, the alert "Grant in settings" ("Find this permission in Android settings and grant it manually.") appears; "Open settings" fires `Settings.ACTION_APPLICATION_DETAILS_SETTINGS` for the package | P, PERM (RECORD_AUDIO denied), SYSUI, INTENTS | – |
+
+### 5. Camera: QR scanning and photo capture (13 tests, 8 ignored)
+
+QR scanning appears only on Android (`appPlatform.isAndroid` at every call site). Without a camera the scans themselves are `IGNORE` rows; the screens that host a scanner and the photo capture (an `ACTION_IMAGE_CAPTURE` intent, stubbed) are tested.
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification (GUI / CLI) | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Scan | Connect by scanning a link | "Paste link / Scan" > "Or scan QR code" | `C/views/newchat/NewChatView.kt:652-668` | `qrScan_newChat_connectsViaCamera`, `qrScan_newChat_notSimplexCodeAlert` | – | IGNORE: no camera on the test runtime: QR scanning needs live camera frames | The same connect plan runs for pasted links (01 §8); the "Invalid QR code" / "The code you scanned is not a SimpleX link QR code." alert is reachable only by scanning |
+| Scan | Verify a security code by scanning | contact info > "Verify security code" > "Scan code" | `C/views/chat/VerifyCodeView.kt:110-117`; `C/views/chat/ScanCodeView.kt:16-33` | `verifyCode_androidScanCodeButtonOpensScanner` | The "Scan code" button is shown next to "Mark verified" (desktop has only "Mark verified"); it opens "Scan code" with the camera section and text "Scan security code from your contact's app." | P, PERM (CAMERA granted) | Verifying by "Mark verified" is 01 §13 |
+| Scan | Scan a security code | same, scan | `C/views/chat/ScanCodeView.kt:19-29` | `qrScan_verifySecurityCode` | – | IGNORE: no camera on the test runtime: QR scanning needs live camera frames | "Incorrect security code!" on a wrong code is reachable only by scanning |
+| Scan | Scan a server address | "Add server" > "Scan server QR code" | `NS/ScanProtocolServer.kt:16-32` | `qrScan_serverAddress` | – | IGNORE: no camera on the test runtime: QR scanning needs live camera frames | The screen and its permission request are §4 `scanServer_requestsCameraPermission` |
+| Scan | Scan a migration link | onboarding "Migrate" > "Scan QR code" | `C/views/migration/MigrateToDevice.kt:206-213` | `qrScan_migrationLink` | – | IGNORE: no camera on the test runtime: QR scanning needs live camera frames | Pasting the link is 04 §H |
+| Scan | Scan a desktop address | "Use from desktop" > "Scan QR code from desktop" | `C/views/remote/ConnectDesktopView.kt:362-370` | `qrScan_desktopAddress` | – | IGNORE: no camera on the test runtime: QR scanning needs live camera frames | Pairing by pasted address is §12 |
+| Scan | Scan a badge code | Settings > "Supporter perks" > "Redeem badge code" | `C/views/badges/BadgesRedeemCodeView.kt:143-160` | `qrScan_badgeCode` | – | IGNORE: no camera on the test runtime: QR scanning needs live camera frames | Redemption needs public servers anyway (04 §L) |
+| Scan | "Camera not available" | scanner area | `A/views/newchat/QRCodeScanner.android.kt:159-163` | `qrScanner_cameraNotAvailableBranch` | – | IGNORE: code that is unused or unreachable, where a visible string remains in the source | The `when` reaches this branch only if the permission is neither `Denied` nor `Granted`, which accompanist's `PermissionStatus` doesn't allow (`:145-158` cover both) |
+| Photo | Take a photo for a message | Attach > "Camera" | `A/views/chat/ComposeView.android.kt:24-32,47-57`; `A/views/helpers/GetImageView.android.kt:44-79,91-98,122-139` | `attachCamera_stubbedCapture_sendsImage` | The app fires `MediaStore.ACTION_IMAGE_CAPTURE` with `EXTRA_OUTPUT` = a `FileProvider` URI of a temp file; the stub writes `tests/fixtures/test.jpg` into it and returns `RESULT_OK`; the compose area shows the image preview; sending → `bob <# "alice> sends file IMG_….jpg (…)"` | P, XFTP, PERM (CAMERA granted), INTENTS | The stub answers with `respondWithFunction`, which reads `EXTRA_OUTPUT` |
+| Photo | Capture cancelled | Attach > "Camera", stub returns `RESULT_CANCELED` | `A/views/helpers/GetImageView.android.kt:61-67` | `attachCamera_cancelled_noPreview` | Nothing is attached; the compose area is unchanged | P, PERM (CAMERA granted), INTENTS | – |
+| Photo | No camera app: fallback | no activity handles `ACTION_IMAGE_CAPTURE` | `A/views/helpers/GetImageView.android.kt:122-139` | `attachCamera_noCaptureActivity_opensStillCamera` | The fallback fires `MediaStore.INTENT_ACTION_STILL_IMAGE_CAMERA` with `FLAG_ACTIVITY_NEW_TASK` (recorded); nothing is attached | P, PERM (CAMERA granted), INTENTS | The stub makes the first intent throw `ActivityNotFoundException` (open question 11) |
+| Photo | Profile image from the camera | user picker → current user → "Edit image" → "Camera" | `A/views/helpers/GetImageView.android.kt:142-207`; `C/views/usersettings/UserProfileView.kt:178-186` | `profileImage_cameraStub_setsImage` | The bottom sheet offers "Camera" and "From Gallery"; with the same capture stub the editor shows the new image, and "Save and notify contacts" sets `chatModel.currentUser.profile.image` | PERM (CAMERA granted), INTENTS | Desktop's "Edit image" opens a file dialog (01 `editProfileImageSetAndDelete`); an image-only change prints nothing on a peer (`src/Simplex/Chat/View.hs:2330-2342`), so there is no peer |
+
+### 6. Attachments, files, media and the share chooser (22 tests)
+
+On desktop these go through file dialogs (`FD`) and the clipboard; on Android through system activities (`INTENTS`). The stub answers pickers with `content://chat.simplex.app.debug.provider/…` URIs of fixture files that the test copies into the app's files directory first (the app's own `FileProvider`, `MAN:165-173`, `apps/multiplatform/android/src/main/res/xml/file_paths.xml`): Waydroid's real picker fails with "Invalid file path" (MediaProvider bug, `~/waydroid/README.md`).
+
+Carry-over note: on desktop `ClipboardManager.shareText` copies the text and shows the toast "Copied" (`apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/platform/Share.desktop.kt:20-23`); on Android it opens the system share chooser (`A/platform/Share.android.kt:30-49`). The 01–04 tests that assert a "Share" result on the clipboard are named in `05-android-carryover.md` (rule R5) with the Android assertion of the `shareText_*` rows below.
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification (GUI / CLI / intents) | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Attach | Attachment sheet | chat with bob > attach (paperclip) | `A/views/helpers/ChooseAttachmentView.android.kt:13-30` | `attachSheet_androidShowsCameraImageVideoFile` | Four buttons: "Camera", "Image", "Video", "File" | P | Camera capture is §5 |
+| Attach | Attachment sheet above the keyboard | chat with bob; tap the message field so the soft keyboard opens, then attach (paperclip) | `C/views/chat/ChatView.kt:160,990-1000`; `C/views/helpers/ChooseAttachmentView.kt:18-37` | `attachSheet_keyboardOpen_fullyExpanded` | The sheet opens fully expanded (`skipHalfExpanded = true`): "Camera", "Image", "Video" and "File" are displayed and their bounds end above the keyboard's top edge (`WindowInsets.ime`) | P, IME, VIEW | Regression guard for PR #7570: the sheet has `imePadding()`, so with the keyboard open it is taller than half the screen and used to stop half-expanded with the buttons under the keyboard |
+| Attach | Several images from the gallery | "Image" | `A/views/chat/ComposeView.android.kt:40,58-65`; `A/views/helpers/GetImageView.android.kt:218-242` | `attachGallery_twoImages_sendsEach` | Fires `ACTION_PICK` with type `image/*` and no data (`setType` clears the `INTERNAL_CONTENT_URI` given to the constructor, SDK `Intent.java:10294-10297`), `EXTRA_ALLOW_MULTIPLE`; the stub returns two URIs in `ClipData`; two image previews; sending → bob prints `alice> sends file IMG_….jpg (…)` twice | P, XFTP, INTENTS | – |
+| Attach | More than 10 images | "Image", stub returns 11 | `A/views/helpers/GetImageView.android.kt:229-237` | `attachGallery_elevenImages_alertKeepsTen` | Alert "Too many images!" / "Only 10 images can be sent at the same time"; ten previews | P, INTENTS | – |
+| Attach | Video from the gallery | "Video" | `A/views/chat/ComposeView.android.kt:42,66-73`; `A/views/helpers/GetImageView.android.kt:245-269` | `attachGallery_video_sendsVideo` | Fires `ACTION_PICK` with type `video/*` and no data (`setType` clears the constructor's `INTERNAL_CONTENT_URI`); video preview; sending → `alice> sends file …mp4 (…)` on bob | P, XFTP, INTENTS, AV | The preview frame comes from the AV seam (plan §11.2), which needs an Android actual (`A/platform/VideoPlayer.android.kt`) |
+| Attach | More than 10 videos | "Video", stub returns 11 | `A/views/helpers/GetImageView.android.kt:256-264` | `attachGallery_elevenVideos_alert` | Alert "Too many videos!" / "Only 10 videos can be sent at the same time" | P, INTENTS, AV | – |
+| Attach | File | "File" | `A/views/chat/ComposeView.android.kt:44,74-77` | `attachFile_getContent_sendsFile` | Fires `ACTION_GET_CONTENT` with type `*/*`; the stub returns `test.pdf`; file preview; sending → `bob <# "alice> sends file test.pdf (266.0 KiB / 272376 bytes)"` | P, XFTP, INTENTS | Desktop: 02 `attachFile_send_peerReceivesOffer` |
+| Attach | No gallery app: fallback | "Image" when no activity handles `ACTION_PICK` | `A/views/chat/ComposeView.android.kt:58-65`; `A/views/helpers/GetImageView.android.kt:107-121` | `attachGallery_noPickActivity_fallsBackToGetContent` | The stub throws `ActivityNotFoundException` for `ACTION_PICK`; the app then fires `ACTION_GET_CONTENT` with `image/*` and `EXTRA_ALLOW_MULTIPLE`; its answer is attached | P, INTENTS | Open question 11 |
+| Received | Tap a loaded file: "Open with" and "Save" | bob `/f @alice tests/fixtures/test.pdf`; alice taps to receive (02 §G), then taps again | `C/views/chat/item/CIFileView.kt:183-200`; `A/views/chat/item/CIFileView.android.kt:14-57`; `A/platform/Share.android.kt:91-110` | `rcvFile_tapLoaded_showsOpenWithAndSave` | A menu instead of the save dialog: "Open with <app>" when one app resolves the MIME type, or "Open with …" when only the system chooser does, and "Save" | P, XFTP | The label depends on the runtime's apps: the test compares it with `PackageManager.resolveActivity(…)` for the same intent; without any handler there is no "Open with" (open question 10) |
+| Received | "Open with" | menu > "Open with …" | `A/platform/Share.android.kt:51-89` | `rcvFile_openWith_firesViewIntentWithReadGrant` | Fires `ACTION_VIEW` (no chooser) with `FLAG_GRANT_READ_URI_PERMISSION`, MIME `application/pdf`, data = a `FileProvider` URI of a decrypted copy in the temp directory (local files are encrypted, so `cryptoArgs` is set) | P, XFTP, INTENTS | Needs an `ACTION_VIEW` handler for `application/pdf` (open question 10) |
+| Received | "Save" a file | menu > "Save" | `C/views/chat/item/CIFileView.kt:305-326`; `A/platform/Files.android.kt:36-43`; `C/platform/Files.kt:49-63` | `rcvFile_save_createDocumentWritesDecrypted` | Fires `ACTION_CREATE_DOCUMENT` with title `test.pdf`; the stub returns a writable URI; the toast "File saved" is recorded (R11) and the written bytes equal the fixture | P, XFTP, INTENTS, TOAST | Desktop: the save dialog (02 §G) |
+| Received | Save an image to the gallery | image item menu > "Save" | `A/views/chat/item/ChatItemView.android.kt:28-45`; `A/platform/Share.android.kt:145-181` | `rcvImage_save_insertsIntoGallery` | On API 33 no permission is asked; a MediaStore image row named like the file is inserted and the toast "Image saved to Gallery" is recorded (R11) | P, XFTP, TOAST | Waydroid's MediaProvider fails some calls with a null calling package (`~/waydroid/README.md`); open question 6 |
+| Received | Swipe between images | bob sends two images; tap the first | `C/views/chat/item/ImageFullScreenView.kt:168-177` | `fullScreenImage_swipeBetweenImages` | Full-screen view of the first image; swiping left shows the second (a `HorizontalPager` only on Android); Back closes it | P, XFTP, BACK | – |
+| Share | Item menu "Share" | long-press a text item > "Share"; a file item > "Share" | `C/views/chat/item/ChatItemView.kt:418-434`; `A/platform/Share.android.kt:30-49,51-89,112-114` | `shareText_itemMenu_firesChooser`, `shareFile_itemMenu_firesChooserWithStream` | Text: `ACTION_CHOOSER` wrapping `ACTION_SEND`, type `text/plain`, `EXTRA_TEXT` = the message; file: `ACTION_SEND` with `EXTRA_STREAM` = a `FileProvider` URI and the file's MIME type, inside a chooser | P, XFTP, INTENTS | Desktop: 02 `copy_*`/share rows put the text on the clipboard |
+| Copy | "Copy" on a text item | bob `@alice hello`; long-press the item > "Copy" | `C/views/chat/item/ChatItemView.kt:419-422,444-449`; `A/views/chat/item/ChatItemView.android.kt:47-49` | `copyAndroid_text_noToast` | The clipboard holds "hello"; no toast is recorded (R11; Android `copyItemToClipboard` only sets the text) | P, CB, TOAST | Desktop also shows "Copied to clipboard" (02 `copy_text_toClipboardAndToast`, `D/views/chat/item/ChatItemView.desktop.kt:54-71`) |
+| Copy | "Copy" on a file item | alice attaches `test.pdf` ("File", stubbed as in `attachFile_getContent_sendsFile`), types "report" and sends; long-press the sent item > "Copy" | `C/views/chat/item/ChatItemView.kt:419-422,444-449`; `A/views/chat/item/ChatItemView.android.kt:47-49` | `copyAndroid_fileItem_copiesCaptionOnly` | The clipboard holds "report", not the file's path; no toast is recorded (R11) | P, XFTP, INTENTS, CB, TOAST | Desktop copies the path and shows the toast (02 `copy_fileItem_copiesPath`). "Copy" is also offered for a file without text while the file can be forwarded (`ChatItemView.kt:421`); it then copies an empty string |
+| Share | Share links | 1-time link: the share icon on the link (no description; tapping the link text shares too); address "Share address"; pending connection "Share 1-time link" | `C/views/newchat/NewChatView.kt:715-763`; `US/UserAddressView.kt:115,343-366`; `C/views/newchat/ContactConnectionInfoView.kt:159-166` | `shareText_oneTimeLink_firesChooser`, `shareText_address_firesChooser`, `shareText_pendingConnection_firesChooser` | Each fires the chooser with `EXTRA_TEXT` = the link shown on screen; no "Copied" toast | INTENTS | 01 §7, §10, §11 assert the desktop clipboard |
+| Profile | Image from the gallery | user picker → current user → "Edit image" → "From Gallery" | `A/views/helpers/GetImageView.android.kt:142-216` | `profileImage_galleryStub_setsImage` | Fires `ACTION_PICK` with type `image/*` and no data (`setType` clears the constructor's `INTERNAL_CONTENT_URI`); the stubbed image appears in the editor and the sheet closes | INTENTS | Camera variant: §5 `profileImage_cameraStub_setsImage` |
+| Compose | Image from the keyboard | the IME commits an image (`commitContent`) into the message field | `A/platform/PlatformTextField.android.kt:108-121`; `C/views/chat/ComposeView.kt:1623-1632` | `compose_imeCommitImage_attachesToOpenChat` | The field accepts `image/*`; a committed image becomes `SharedContent.Media`, which the open chat turns into an image preview; sending it reaches bob as an image | P, XFTP, VIEW | The test calls `InputConnectionCompat.commitContent` on the `EditText`'s input connection with a `FileProvider` URI |
+
+### 7. Sharing into the app from other apps (15 tests)
+
+`MainActivity` accepts `ACTION_SEND` (any type) and `ACTION_SEND_MULTIPLE` (`image/*`) (`MAN:120-130`); `processExternalIntent` closes the open chat and modals and sets `chatModel.sharedContent` (`APP/MainActivity.kt:157-212`), which replaces the chat list with the share list (`C/App.kt:376-384`, `C/views/chatlist/ShareListView.kt:25-80`). Choosing a chat moves the content into its compose area (`C/views/chat/ComposeView.kt:1623-1669`). Forwarding uses the same list and is 02 §L. Stream URIs are the app's `FileProvider` URIs of fixture files (§6 intro).
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification (GUI / CLI) | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Text | Share text to a contact | `ACTION_SEND`, `text/plain`, `EXTRA_TEXT` "hello from share" | `APP/MainActivity.kt:164-174`; `C/views/chatlist/ShareListView.kt:145-155` | `shareIn_text_toContact` | The share list titled "Share message…" lists the chats; tapping bob opens his chat with "hello from share" in the message field; sending → `bob <# "alice> hello from share"` | INTENT, P, VIEW | – |
+| Media | One image | `ACTION_SEND`, `image/jpeg`, `EXTRA_STREAM` | `APP/MainActivity.kt:176-181` | `shareIn_image_toContact` | Title "Share media…"; in bob's chat an image preview; sending → `bob <# "alice> sends file IMG_….jpg (…)"` | INTENT, P, XFTP | – |
+| Media | Several images | `ACTION_SEND_MULTIPLE`, `image/*`, two URIs | `APP/MainActivity.kt:192-204` | `shareIn_multipleImages_toContact` | Two image previews; sending → two "sends file" lines on bob | INTENT, P, XFTP | – |
+| Media | Video | `ACTION_SEND`, `video/mp4` | `APP/MainActivity.kt:176-181,211-212` | `shareIn_video_toContact` | "Share media…"; a video preview; sending → `alice> sends file …mp4 (…)` on bob | INTENT, P, XFTP, AV | – |
+| File | Any other file | `ACTION_SEND`, `application/pdf`, `EXTRA_STREAM` | `APP/MainActivity.kt:183-189` | `shareIn_file_toContact` | Title "Share file…"; a file preview "test.pdf"; sending → `bob <# "alice> sends file test.pdf (266.0 KiB / 272376 bytes)"` | INTENT, P, XFTP | – |
+| File | Text file with a stream | `ACTION_SEND`, `text/plain`, `EXTRA_STREAM` (a `.log`) and `EXTRA_TEXT` | `APP/MainActivity.kt:164-171` | `shareIn_textWithStream_sharedAsFileWithText` | "Share file…"; the compose area has the file and the text; sending → bob gets the text and `sends file …log` | INTENT, P, XFTP, VIEW | – |
+| Errors | Non-`content:` stream | `ACTION_SEND`, `image/jpeg`, `EXTRA_STREAM` = `file:///sdcard/x.jpg` | `APP/MainActivity.kt:179`; `C/views/helpers/Utils.kt:528-533` | `shareIn_fileSchemeUri_invalidPathAlert` | Alert "Invalid file path" / "You shared an invalid file path. Report the issue to the app developers."; no share list | INTENT | – |
+| Errors | Multiple non-media files | `ACTION_SEND_MULTIPLE`, `application/pdf` | `APP/MainActivity.kt:192-207` | `shareIn_sendMultipleNonMedia_onlyClosesChat` | The open chat and modals close, but no share list appears (only image and video lists are handled) | INTENT, P | The manifest declares `SEND_MULTIPLE` only for `image/*`; the explicit intent bypasses the filter (Needs table) |
+| Navigation | Share while a chat and a modal are open | chat with bob open, Settings open; deliver `ACTION_SEND` | `APP/MainActivity.kt:160-162`; `C/App.kt:111-116` | `shareIn_closesOpenChatAndModals` | Settings and the chat close and the share list shows | INTENT, P | – |
+| Prefs | File to a group with files off | group "team" where bob ran `/set files #team off`; share a file | `C/views/chatlist/ShareListNavLinkView.kt:43-75` | `shareIn_fileToGroupWithFilesOff_alert` | The "team" row is greyed; tapping it shows "Cannot send message" / "Selected chat preferences prohibit this message."; bob's direct chat is still selectable | INTENT, P | – |
+| Prefs | SimpleX link to a group with links off | `/set links #team off`; share text containing bob's 1-time link | `C/views/chatlist/ShareListView.kt:34-35,81-85`; `ShareListNavLinkView.kt:44-55` | `shareIn_simplexLinkToGroupWithLinksOff_alert` | Same alert for "team" | INTENT, P | – |
+| Navigation | Toolbar back | the back arrow in the share list (one profile) | `C/views/chatlist/ShareListView.kt:128-140` | `shareIn_toolbarBack_dropsSharedContent` | The chat list returns; opening bob's chat shows an empty message field | INTENT, P, VIEW | – |
+| Navigation | System Back | Back key in the share list | `APP/MainActivity.kt:91-118` | `shareIn_systemBack_dropsContentAndFinishes` | No `BackHandler` is active, so `onBackPressed` drops the shared content and finishes the activity (API 33); relaunching shows the chat list | INTENT, BACK | – |
+| Profiles | Choose the profile before the chat | two profiles; the toolbar profile button | `C/views/chatlist/ShareListView.kt:105-127` | `shareIn_switchProfileBeforeChoosingChat` | With more than one visible profile the toolbar shows the profile image; it opens the profile picker; choosing the second profile lists its chats; sharing to its contact cath reaches cath | INTENT, P ×2 (bob, cath) | bob is the first profile's contact, cath the second's |
+| State | Chat stopped | stop the chat, then share | `C/views/chatlist/ShareListView.kt:170-185` | `shareIn_chatStopped_showsStoppedIcon` | The share list toolbar shows the red "Chat is stopped" icon; tapping it shows "You can start chat via app Settings / Database or by restarting the app." | INTENT | – |
+
+### 8. Opening links from other apps (8 tests)
+
+`ACTION_VIEW` with a `simplex:` URI or an `https` link on the listed hosts and paths opens the app (`MAN:68-119`); `processIntent` stores the URL (`APP/MainActivity.kt:144-155`) and the main screen runs the connect plan once onboarding is complete, the chat is running and the app is unlocked (`C/App.kt:243-251`, `C/views/chatlist/ChatListView.kt:775-785`). The plans themselves are 01 §8 and 03 §8.
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification (GUI / CLI) | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Links | 1-time link | `ACTION_VIEW` with bob's short 1-time link (bob `/c`) | `APP/MainActivity.kt:146-150`; `C/App.kt:243-251` | `appLink_oneTimeLink_opensPlan` | The plan alert with bob's profile and "Open new chat"; the prepared chat opens; "Connect" → bob prints "alice: contact is connected" | INTENT, P | Same plan as 01 `planInvitationShortLinkOpenNewChat` |
+| Links | `simplex:` scheme | `ACTION_VIEW` with `simplex:/contact#/?v=…` (bob's address in full form) | `MAN:68-76` | `appLink_simplexScheme_addressOpensPlan` | The address plan alert opens; connecting sends a request (bob prints "alice wants to connect to you!") | INTENT, P | bob runs with `--show-full-links` to print the full address |
+| Links | Group link | `ACTION_VIEW` with bob's group link | `C/views/chatlist/ChatListView.kt:775-785` | `appLink_groupLink_opensJoinPlan` | The plan alert shows "team" and "Open group" (`showPrepareGroupAlert`, `C/views/newchat/ConnectPlan.kt:249-263,777`); "Open group" opens the prepared group with "Join group"; "Join group" → bob prints `alice: accepting request to join group #team...` and `#team: alice joined the group` (as 03 `joinGroup_pasteShortLinkPrepareAndJoin`) | INTENT, P | – |
+| Links | No data | `ACTION_VIEW` without data | `APP/MainActivity.kt:151` | `appLink_noData_showsInvalidLinkAlert` | Alert "Invalid link" / "Please check that SimpleX link is correct." | INTENT | – |
+| Links | Before onboarding is complete | deliver bob's short 1-time link (as `appLink_oneTimeLink_opensPlan`) on the welcome screen, then finish onboarding | `C/App.kt:243-251`; `C/views/chatlist/ChatListView.kt:777-778` | `appLink_beforeOnboarding_openedAfterCompletion` | Nothing happens during onboarding; after "Accept" on the conditions screen the plan alert with bob's profile and "Open new chat" opens | INTENT, ONBOARD, P | Onboarding then calls `useLocalServers()` before the plan connects (01 setup item 3) |
+| Links | While locked | SimpleX Lock (passcode) on, app backgrounded past the delay; deliver the link | `C/App.kt:210-251` | `appLink_whileLocked_openedAfterUnlock` | The passcode screen shows first; after the correct passcode the plan alert with bob's profile and "Open new chat" opens | INTENT, P, BG | Lock set up as 04 `lock_enable_setsPasscode` |
+| Links | While the chat is stopped | stop the chat, deliver the link, start the chat | `C/App.kt:243-249` | `appLink_whileChatStopped_openedAfterStart` | No alert while stopped; after starting the chat (Chat data) the plan alert with bob's profile and "Open new chat" opens | INTENT, P | – |
+| Manifest | Which links open the app | resolve implicit `ACTION_VIEW` intents with `PackageManager.queryIntentActivities` | `MAN:68-119` | `appLink_intentFilter_matchesOnlyConnectionPaths` | `simplex:/…`, `https://simplex.chat/contact#…`, `/invitation#…`, `/a#…`, `/c#…`, `/g#…`, `/i#…` and the `smp*.simplex.im` / `smp*.simplexonflux.com` hosts resolve to `MainActivity`; `https://simplex.chat/crowdfunding/`, `https://simplex.chat/blog/` and `https://localhost/a#…` don't | — | Path filters are exact or `/x/` prefixes (`MAN:107-118`). Verified-link (autoVerify) state is not asserted; the query uses flags 0 and an intent with no categories, because on Android 12+ a `BROWSABLE`+`DEFAULT` or `MATCH_DEFAULT_ONLY` web-intent query is filtered by domain verification, which fails offline for the debug APK |
+
+### 9. Calls on Android (19 tests, 6 ignored)
+
+Android runs the call page in a `WebView` inside `CallActivity` (`APP/views/call/CallActivity.kt:57-202`; `A/views/call/CallView.android.kt:110-272,691-790`). An outgoing call sends its invitation only after the page reports its capabilities, before any media is opened (`CallView.android.kt:139-153`), so the outgoing invitation and the call screen before an answer are tested; media is not (open question 7 asks whether the runtime's WebView loads the page). Media after answering, connected calls, PiP, proximity and audio devices are `IGNORE` rows. Incoming in-app call alerts and call items are 02's; their answer ("Answer call", "Accept") is asserted up to `CallActivity` opening, before any media (`05-android-carryover.md`, 02 `callItem_incoming_answerButton`, `callAlert_incoming_acceptRejectIgnore`).
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification (GUI / CLI / system) | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Settings | "Calls on lock screen:" | Settings > "Audio & video calls" | `US/CallSettings.kt:23-82` | `callSettings_androidLockScreenOptions` | "Your calls" shows "Calls on lock screen:" with "Show" (the default, `C/model/SimpleXAPI.kt:75-83`); the options are "Disable", "Show", "Accept"; choosing "Accept" sets `callOnLockScreen = ACCEPT` | — | 04 `calls_screenLayout_noLockScreenOption` asserts it is absent on desktop |
+| Outgoing | Audio call reaches the peer | chat with bob > call icon > "Audio call" | `C/views/chat/ChatView.kt:904-915`; `C/App.kt:227-235`; `APP/SimplexApp.kt:319-330`; `A/views/call/CallView.android.kt:139-153,329-418,467-476` | `call_outgoingAudio_invitationReachesPeer` | `CallActivity` opens on black with bob's image, "bob", "waiting for answer…", "e2e encrypted" and the buttons "Audio off", speaker, "Hang up", "Video on"; bob prints `alice wants to connect with you via WebRTC audio call (e2e encrypted)`, the "To accept the call, please open the link below in your browser…" line, an empty line and `https://simplex.chat/call#…` (`src/Simplex/Chat/View.hs:2656-2709`) | P, PERM (RECORD_AUDIO granted) | "(e2e encrypted)" assumes the WebView supports encoded transforms; otherwise "(not e2e encrypted)" and "no e2e encryption" |
+| Outgoing | Video call needs the camera | "Video call" with `CAMERA` denied | `APP/views/call/CallActivity.kt:250-279`; `A/views/call/CallView.android.kt:569-646` | `callPermissions_videoCallNeedsCamera` | The grant screen's button reads "Camera" (`RECORD_AUDIO` granted); after "Allow" the call screen replaces it | P, PERM (CAMERA denied), SYSUI | Both missing: "Camera and microphone" |
+| Outgoing | Hang up before an answer | "Hang up" | `A/views/call/CallView.android.kt:274-299`; `C/views/call/CallManager.kt:75-94` | `call_outgoing_hangUp_peerSeesEnded` | `CallActivity` closes; bob prints `call with alice ended`; alice's chat shows the outgoing call item | P, PERM (RECORD_AUDIO granted) | – |
+| Outgoing | Peer ends before answering | bob `/_call end @<alice's contact id>` | `C/model/SimpleXAPI.kt:3401-3408`; `C/views/call/CallManager.kt:75-88`; `APP/views/call/CallActivity.kt:313-318` | `call_outgoing_peerEnds_closesCallScreen` | The call screen closes and the chat list or chat shows again | P, PERM (RECORD_AUDIO granted) | – |
+| Outgoing | Back collapses the call | Back on the call screen | `APP/views/call/CallActivity.kt:130-143,214-238`; `A/views/chatlist/ChatListView.android.kt:46-72`; `C/App.kt:297-308` | `call_backCollapses_greenBarReturnsToCall` | For an audio call the call task moves back and `MainActivity` shows, with a green bar at the top showing "bob"; tapping the bar opens the call screen again | P, PERM (RECORD_AUDIO granted), BACK | No duration is shown before the call connects (`ChatListView.android.kt:102-118`) |
+| Outgoing | Call service notification | during the outgoing call | `APP/CallService.kt:80-157` | `call_serviceNotification_endCallAction` | Notification on channel "SimpleX Chat call service" (id 6788): title "bob", text "Audio call", action "End call"; the action ends the call and bob prints `call with alice ended` | P, PERM (RECORD_AUDIO granted), SYSNTF | With preview "Hidden" the title is "Contact hidden:" |
+| Outgoing | Background restricted | start a call with `RUN_ANY_IN_BACKGROUND` ignored | `A/views/call/CallView.android.kt:393-395,493-517`; `APP/SimplexApp.kt:370-379`; `APP/SimplexService.kt:608-648` | `call_backgroundRestricted_pillAndAlert` | The orange pill "No background calls" shows above the buttons; tapping it opens the alert "No background calls" / "The app may be closed after 1 minute in background." with "Open app settings", which fires `ACTION_APPLICATION_DETAILS_SETTINGS`; the pill's close icon hides it | P, PERM (RECORD_AUDIO granted), SHELL, INTENTS | – |
+| Incoming | Foreground: no system notification | app open; bob `/call @alice` | `APP/model/NtfManager.android.kt:160-169`; `C/views/call/IncomingCallAlertView.kt:27-46` | `call_incomingForeground_inAppAlertNoSystemNotification` | The in-app alert (02 `callAlert_incoming_acceptRejectIgnore`) shows; no notification on the calls channel (`notifyCallInvitation` returns false in the foreground) | P, SYSNTF | – |
+| Lock screen | "Accept" mode: Reject, Ignore | `callOnLockScreen = ACCEPT`; app in background; bob `/call @alice`; start `CallActivity` as the full-screen intent does | `APP/views/call/CallActivity.kt:326-396` | `call_lockScreenAlert_acceptMode_reject`, `call_lockScreenAlert_acceptMode_ignore` | The activity shows the incoming-call info ("e2e encrypted video call"), bob's large image and name, and "Reject", "Ignore", "Accept"; "Reject" closes it, cancels the call notification and the chat shows "rejected call" (bob prints nothing); "Ignore" closes it and cancels the notification | P, BG, INTENT, SYSNTF | Reached without a keyguard: `CallActivityView` shows this alert whenever there is an invitation and no call (`CallActivity.kt:295-304`) |
+| Lock screen | "Show" mode: Open | `callOnLockScreen = SHOW` (default); same | `APP/views/call/CallActivity.kt:350-362,397-403` | `call_lockScreenAlert_showMode_openBringsAppWithAlert` | The SimpleX logo, "Open SimpleX Chat to accept call", "Enable calls from lock screen via Settings." and "Open"; "Open" closes the activity and brings `MainActivity` to the front with the in-app incoming-call alert | P, BG, INTENT | "Open" sends `OpenChatAction` with a plain `startActivity`; a running `singleTask` `MainActivity` gets it in `onNewIntent`, which doesn't call `processNotificationIntent` (`APP/MainActivity.kt:64-68`), so bob's chat is not opened (open question 8) |
+| Lock screen | Hidden preview | `callOnLockScreen = ACCEPT`, preview "Hidden" | `APP/views/call/CallActivity.kt:382-388` | `call_lockScreenAlert_hiddenPreview_noName` | A placeholder image and no contact name above the buttons | P, BG, INTENT | – |
+| Lock screen | A real locked device | screen off or keyguard locked | `APP/model/NtfManager.android.kt:173-181`; `APP/views/call/CallActivity.kt:76-78,147-170` | `call_realLockScreen_fullScreenIntentUnlocks` | – | IGNORE: a real lock screen and screen-off state, which the test runtime keeps disabled | – |
+| Media | Answer and talk | "Accept" (in-app, notification or lock screen) | `C/views/call/CallManager.kt:27-73`; `A/views/call/CallView.android.kt:110-272` | `call_answer_mediaConnects`, `call_connectedControls_micSpeakerVideoFlip` | – | IGNORE: real WebRTC calls (the call WebView and its media) | Needs a microphone and camera in the WebView |
+| Media | Picture-in-picture, proximity, audio devices | video call in background; ear to the screen; Bluetooth headset | `APP/views/call/CallActivity.kt:100-128,145-152`; `A/views/call/CallView.android.kt:72-108,352-376`; `A/views/call/CallAudioDeviceManager.kt` | `call_pictureInPicture_videoCall`, `call_proximityScreenOff`, `call_audioDevicePicker` | – | IGNORE: real WebRTC calls (the call WebView and its media) | – |
+
+### 10. SimpleX Lock with system authentication, and screen protection (20 tests, 1 ignored)
+
+On Android the lock has two modes, "System" (the default, `LAMode.default`, `C/views/usersettings/PrivacySettings.kt:38-52`) and "Passcode"; desktop has only the passcode, whose rows (04 §C) carry over with "Lock mode" set to "Passcode" first (`05-android-carryover.md`, rule R8). System mode uses `BiometricPrompt` with `BIOMETRIC_STRONG or DEVICE_CREDENTIAL` on API 33 (`A/views/helpers/LocalAuthentication.android.kt:12-82`); without a device credential it reports "unavailable". The runtime has no PIN by default; rows that need one set it with `SHELL` (`locksettings set-pin 1234`) and clear it afterwards. The lock reacts to the real activity lifecycle (`APP/MainActivity.kt:70-89`) instead of the desktop's simulated focus events (04 harness fact 7).
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification (GUI / system) | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Privacy | "Device" section | Settings > "Your privacy" | `A/views/usersettings/PrivacySettings.android.kt:13-31` | `androidPrivacy_deviceSectionShowsLockAndProtectScreen` | Section "Device" with "SimpleX Lock" and the switch "Protect app screen" (on by default) | — | – |
+| Screen | Protection on by default | default pref after `ActivityScenario.recreate()` | `APP/MainActivity.kt:49-55`; `C/model/SimpleXAPI.kt:123` | `protectScreen_defaultOnSetsFlagSecure` | `MainActivity.window.attributes.flags` contains `FLAG_SECURE` | — | The harness pre-set (setup item 2) is removed for this test |
+| Screen | Toggle at once | "Protect app screen" off, then on | `A/views/usersettings/PrivacySettings.android.kt:21-30` | `protectScreen_toggleUpdatesFlagWithoutRestart` | Off clears `FLAG_SECURE` on the current window; on sets it again; Pref `privacyProtectScreen` follows | — | – |
+| Lock | Lock mode selector | "Your privacy" > "SimpleX Lock" | `C/views/usersettings/PrivacySettings.kt:674-683,797-807` | `androidLock_modeSelectorDefaultSystem` | Title "SimpleX Lock"; "Enable lock" off; "Lock mode" shows "System", with options "System" and "Passcode"; no "Lock after" while the lock is off | — | – |
+| Lock | Mode change while off | choose "Passcode" with the lock off | `C/views/usersettings/PrivacySettings.kt:675-682` | `androidLock_modeChangeWhileOff_noAuthentication` | `laMode = PASSCODE` at once, no prompt; "Enable lock" then opens "New Passcode" (04 `lock_enable_setsPasscode` continues from here) | — | – |
+| Lock | Enable System without a device credential | "Enable lock" on, mode System | `C/AppLock.kt:185-228`; `C/views/usersettings/PrivacySettings.kt:872-875` | `androidLock_enableSystemWithoutCredential_unavailable` | Alert "Authentication unavailable" / "Device authentication is not enabled. You can turn on SimpleX Lock via Settings, once you enable device authentication."; the switch stays off (`performLA = false`) | SHELL | `SHELL` makes sure no PIN is set |
+| Lock | Lock notice offers a mode | more than 3 chats, `laNoticeShown` cleared, `restart()`; "Turn on" | `C/App.kt:93-104`; `C/AppLock.kt:34-78` | `androidLock_noticeOffersModeChoice` | "SimpleX Lock" alert; "Turn on" shows "SimpleX Lock mode" with "Passcode entry" and "System authentication" | RESTART | Desktop goes straight to the passcode (04 `lock_noticeOfferedWithManyChats`) |
+| Lock | Notice: "Passcode entry" | same > "Passcode entry" | `C/AppLock.kt:66-71,112-139` | `androidLock_noticePasscodeEntry_setsPasscodeMode` | "New Passcode" → digits → "Confirm passcode" → alert "SimpleX Lock turned on"; `laMode = PASSCODE`, `performLA = true` | RESTART | – |
+| Lock | Notice: "System authentication", no credential | same > "System authentication" | `C/AppLock.kt:72-110`; `C/App.kt:105-109` | `androidLock_noticeSystemWithoutCredential_unavailable` | `laMode = SYSTEM`; the alert "Authentication unavailable" with the "…not enabled…" text; lock stays off | RESTART, SHELL | – |
+| Lock | Enable System with a device PIN | PIN 1234 set; "Enable lock" on | `C/AppLock.kt:194-228`; `A/views/helpers/LocalAuthentication.android.kt:36-82` | `androidLock_enableSystemWithDevicePin_turnsOn` | The system credential screen titled "Enable SimpleX Lock" / "Confirm your credential" opens; entering 1234 gives "SimpleX Lock turned on" / "You will be required to authenticate when you start or resume the app after 30 seconds in background."; `performLA = true` | SHELL, SYSUI | – |
+| Lock | Relock after background (System) | lock on, "Lock after" "Immediately"; Home, then back | `APP/MainActivity.kt:70-89`; `C/AppLock.kt:141-183,271-290` | `androidLock_systemMode_relocksAfterBackground` | On return the app content is hidden and the credential screen "Unlock" / "Log in using your credential" opens; after 1234 the chat list shows | SHELL, SYSUI, BG | – |
+| Lock | Prompt cancelled | same, cancel the credential screen | `C/AppLock.kt:162-167`; `C/App.kt:119-133,219-222` | `androidLock_systemPromptCancelled_showsUnlockButton` | The app shows only the "Unlock" button; tapping it opens the credential screen again | SHELL, SYSUI, BG | – |
+| Lock | Switch Passcode → System | lock on in Passcode mode, PIN set; "Lock mode" > "System" | `C/views/usersettings/PrivacySettings.kt:516-546` | `androidLock_switchPasscodeToSystem` | "Enter Passcode" (title) / "Change lock mode" first; then the system credential screen "Enable SimpleX Lock"; then "SimpleX Lock turned on"; `laMode = SYSTEM`, the app passcode and self-destruct passcode are removed | SHELL, SYSUI | – |
+| Lock | Switch System → Passcode | lock on in System mode; "Lock mode" > "Passcode" | `C/views/usersettings/PrivacySettings.kt:516-531,547-561` | `androidLock_switchSystemToPasscode` | The credential screen "SimpleX Lock" / "Change lock mode"; then "New Passcode" → confirm → "Passcode set!"; `laMode = PASSCODE`, `laLockDelay = 30`; "Change passcode" and the self-destruct section appear | SHELL, SYSUI | – |
+| Lock | Device credential removed | lock on in System mode, "Lock after" "Immediately" (the default is 30 s, `C/model/SimpleXAPI.kt:120`); `locksettings clear --old 1234`; Home, back | `C/AppLock.kt:174-179, 271-286` | `androidLock_credentialRemoved_turnsLockOff` | Alert "Authentication unavailable" / "Device authentication is disabled. Turning off SimpleX Lock."; `performLA = false`; the chat list shows | SHELL, BG | – |
+| Lock | Back from the chat list | Passcode lock on, delay 30 s; Back on the chat list root, relaunch at once | `APP/MainActivity.kt:102-106`; `C/App.kt:210-223` | `androidLock_backFromRootClearsAuth` | The activity finishes; on relaunch (within the delay) the app shows the "Unlock" button instead of the chats; it opens "Enter Passcode" | BACK, BG | – |
+| Lock | Real background, Passcode mode | Passcode lock, "Lock after" "10 seconds"; Home, back at once; Home, back after 10 s | `APP/MainActivity.kt:70-89`; `C/AppLock.kt:269-286` | `androidLock_passcodeRelocksAfterRealBackground` | The chat list after the first return; "Enter Passcode" after the second; the correct passcode shows the chat list | BG | Desktop simulates this with `appWasHidden()` (04 `lock_relocksAfterDelay`) |
+| Lock | Rotation does not lock | Passcode lock, "Immediately"; rotate | `C/App.kt:265-270` | `androidLock_rotationWithZeroDelay_doesNotLock` | No passcode screen after the rotation (3 s grace) | ROT | – |
+| Lock | Passcode screen in landscape | Passcode lock on, "Immediately"; Home, back to "Enter Passcode"; rotate to landscape | `C/views/localauth/PasscodeView.kt:87-134`; `C/views/localauth/LocalAuthView.kt:26`; `A/platform/Resources.android.kt:46-50` | `passcodeAndroid_landscapeShowsSubmit` | The landscape layout shows the title and keypad on the left and "Cancel" and "Submit" in a column on the right; both buttons are displayed with a non-zero width inside the window; typing the passcode and "Submit" shows the chat list | BG, ROT | Regression guard for PR #7497 (the right column was squeezed to almost no width); "New Passcode" uses the same view (`C/views/localauth/SetAppPasscodeView.kt:32`). Desktop always uses the portrait layout (`PasscodeView.kt:130`) |
+| Lock | Biometric unlock | fingerprint or face | `A/views/helpers/LocalAuthentication.android.kt:36-82` | `androidLock_biometricSensorUnlock` | – | IGNORE: biometric sensors are not available on the test runtime | The device-credential path above covers the prompt |
+
+### 11. Database passphrase in the Android Keystore, archive files (11 tests, 1 ignored)
+
+On Android a new database gets a random passphrase that is stored encrypted with an Android Keystore key (`C/views/helpers/DatabaseUtils.kt:17-41,51-60`; `A/platform/Cryptor.android.kt:19-120`), and onboarding never asks for one (§1). The texts of the "Database passphrase" screen are Android-specific (`A/views/database/DatabaseEncryptionView.android.kt`); 04 §G's desktop rows ("Save passphrase in settings") don't apply (`05-android-carryover.md` names the rows these replace). Changing a passphrase itself is shared and carries over from 04 §G.
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification (GUI / prefs) | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Keystore | Fresh database | Settings > "Chat data" > "Database passphrase & export" > "Database passphrase" | `A/views/database/DatabaseEncryptionView.android.kt:21-83`; `C/views/database/DatabaseEncryptionView.kt:120-143` | `keystore_freshDb_randomPassphraseFooter` | The switch "Save passphrase in Keystore" is on and disabled (random passphrase); footers "Android Keystore (<storage>) is used to securely store passphrase - it allows notification service to work." and "Database is encrypted using a random passphrase, you can change it."; `<storage>` is the value of `cryptor.keyStorage(…)` ("Secure element", "TEE" or "Software", `A/platform/Cryptor.android.kt:74-90`) | — | The test compares the storage label with `DatabaseUtils.ksDatabasePassword.storage()` rather than a fixed value |
+| Keystore | Set a passphrase while stored | "New passphrase…", "Confirm new passphrase…", "Update database passphrase" | `A/views/database/DatabaseEncryptionView.android.kt:95-103` | `keystore_changePassphrase_storedAlert` | Alert "Change database passphrase?" / "Database encryption passphrase will be updated and stored in the Keystore." + "Please store passphrase securely, you will NOT be able to change it if you lose it." / "Update"; afterwards the random-passphrase footer is replaced by "Please note: you will NOT be able to recover or change passphrase if you lose it." and the switch is enabled | — | Desktop wording: 04 `dbEncrypt_setFirstPassphrase` |
+| Keystore | Remove from the Keystore | switch off after a passphrase is set | `C/views/database/DatabaseEncryptionView.kt:131-139`; `A/views/database/DatabaseEncryptionView.android.kt:105-113` | `keystore_removePassphrase_alertAndFooter` | Alert "Remove passphrase from Keystore?" / "Notifications will be delivered only until the app stops!" + "Please store passphrase securely, you will NOT be able to access chat if you lose it." / "Remove"; then footers "You have to enter passphrase every time the app starts - it is not stored on the device." and the "Please note" line; prefs `storeDBPassphrase = false`, `DatabaseUtils.ksDatabasePassword.get()` is null | — | – |
+| Keystore | Restart asks for the passphrase | after removal, `restart()` | `C/views/database/DatabaseErrorView.kt:220-235,295-312` | `keystore_removed_restartAsksPassphrase` | The start screen asks for the passphrase; "Open chat" with the right one shows the chat list | RESTART | 04 `dbError_enterPassphraseOnStartup_open` owns the screen; this row checks the Android path into it |
+| Keystore | Done key submits | same screen, the keyboard's Done key | `C/views/database/DatabaseErrorView.kt:295-312` | `keystore_passphrasePrompt_imeDoneSubmits` | With the passphrase typed, the soft keyboard's Done action opens the chat (`KeyboardActions(onDone)` is set only on Android) | RESTART, IME | – |
+| Keystore | Store it again | switch on with the passphrase not stored | `C/views/database/DatabaseEncryptionView.kt:131-133,293-299`; `A/views/database/DatabaseEncryptionView.android.kt:76-78` | `keystore_reEnable_footerUntilRestart` | Pref `storeDBPassphrase = true` at once; footer "Android Keystore will be used to securely store passphrase after you restart the app or change passphrase - it will allow receiving notifications." | — | – |
+| Keystore | Key missing from the Keystore | delete the Keystore entry of the database passphrase in-process, then `restart()` | `A/platform/Cryptor.android.kt:23-35` | `keystore_keyMissing_showsNotFoundAlert` | Alert "Wrong database passphrase" / "Passphrase not found in Keystore, please enter it manually. This may have happened if you restored the app's data using a backup tool. If it's not the case, please contact developers."; the passphrase prompt follows | RESTART | The entry's alias is "databasePassword" (`C/views/helpers/DatabaseUtils.kt:13`); the alert is shown once per process (`warningShown`). A failing decryption (not a missing key) gives "Error reading database passphrase" instead and is not tested |
+| Keystore | Lock passcodes in the Keystore | set the lock passcode and a self-destruct passcode; inspect prefs | `C/views/helpers/DatabaseUtils.kt:15-19` | `keystore_lockPasscodesStoredEncrypted` | `EncryptedAppPassphrase` / `EncryptedSelfDestructPassphrase` prefs hold Keystore-encrypted bytes that do not decode to the digits (desktop stores Base64 of the plain value, 04 harness fact 3); `ksAppPassword.get()` returns the digits | — | Lock set up as 04 §C |
+| Archive | Export to a document | "Chat data" > "Database passphrase & export" > "Export database" (after setting a passphrase) | `C/views/database/DatabaseView.kt:190-201,258,606-625`; `A/platform/Files.android.kt:36-43` | `dbExport_androidCreateDocument` | After export, `ACTION_CREATE_DOCUMENT` fires with the archive name `simplex-chat.<timestamp>.zip`; the stub returns a writable URI; the toast "File saved" is recorded (R11) and the URI holds a zip | INTENTS, TOAST | Desktop: 04 `dbMgmt_exportArchive` (`FD`) |
+| Archive | Import from a document | "Import database" | `C/views/database/DatabaseView.kt:202-214,269` | `dbImport_androidGetContent` | Fires `ACTION_GET_CONTENT` with type `application/zip`; with the stub returning an exported archive, "Import chat database?" → "Import" restores it | INTENTS | Desktop: 04 `dbMgmt_importArchive_restoresData` |
+| Archive | Critical error "Restart" | an agent `CRITICAL` error with restart offered | `C/views/helpers/ProcessedErrors.kt:30-50`; `A/views/database/DatabaseView.android.kt:5-7` | `criticalError_restartEndsProcess` | – | IGNORE: the action ends the app process, which is the instrumentation process | The alert itself is shared; only "Restart" differs (desktop restarts the core) |
+
+### 12. "Use from desktop": Android as the remote host of a CLI controller (16 tests)
+
+This is the other side of 04 §K: the Android app is the mobile host and a current-build CLI plays the desktop controller, as `desktop` does in `tests/RemoteTests.hs:624-642` (`startRemote`) with the roles swapped. CLI sequence:
+1. Controller: `/set device name My desktop`, then `/start remote host new addr=192.168.240.1 iface=waydroid0 port=<p>`; it prints `new remote host started on 192.168.240.1:<p>`, possibly `other addresses: …`, then `Remote session invitation:` and the invitation (`src/Simplex/Chat/View.hs:295-300`). The address must be reachable from Android, so this controller runs in the host network namespace on the Waydroid bridge address (open question 9).
+2. The test puts the invitation on the system clipboard (`CB`, carry-over rule R13) before opening "Connect to desktop" ("Paste desktop address" reads the clipboard only when the screen is first drawn, `C/views/remote/ConnectDesktopView.kt:373-381`; a test that sets the device name first starts the controller and sets the clip before opening the screen); Android pastes it (the paste field needs developer tools, `C/views/remote/ConnectDesktopView.kt:139-142`).
+3. Controller: `new remote host connecting`, `Compare session code with host:`, `<code>` (`View.hs:546-550`); after "Confirm" on Android: `new remote host 1 added: <Android device name>` and `remote host 1 connected (with compression)` or `(no compression)` (`View.hs:551-554`).
+4. Controller stop: `/stop remote host 1` → `ok`; Android stop: the controller prints `remote host 1 stopped` (`View.hs:555-557`).
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification (GUI / CLI) | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Entry | User picker row | user picker | `C/views/chatlist/UserPicker.kt:352-368` | `useFromDesktop_pickerRowOpensConnectScreen` | The row "Use from desktop" (desktop shows "Link a mobile" here) opens "Connect to desktop"; disabled when the chat is stopped | — | – |
+| Layout | Without developer tools | "Connect to desktop" | `C/views/remote/ConnectDesktopView.kt:127-144,351-370` | `useFromDesktop_layoutWithoutDevTools` | "This device name" field (Pref `deviceNameForRemoteAccess`) and "Scan QR code from desktop" with the camera section; no "Desktop address" section and no "Linked desktops" row (none stored) | PERM (CAMERA granted) | – |
+| Layout | Paste field | developer tools on | `C/views/remote/ConnectDesktopView.kt:372-413` | `useFromDesktop_pasteFieldStates` | "Desktop address" with "Paste desktop address" (disabled while the clipboard is empty) and "Connect to desktop" (disabled until an address is set); pasting shows the address in an editable field | CB, DT | The clipboard is the system one, which keeps its clip across tests; it is empty here because the reset clears it (setup item 4, R13); "Paste desktop address" reads the clipboard once when the screen is drawn (`disabled = !clipboard.hasText()`, `C/views/remote/ConnectDesktopView.kt:380`), so the clip is set before the screen is opened (reopen "Connect to desktop" after changing it) |
+| Pairing | Connect and verify | paste the invitation > "Connect to desktop" | `C/views/remote/ConnectDesktopView.kt:146-171,259-286,501-537`; `C/model/SimpleXAPI.kt:3499-3507` | `useFromDesktop_pasteVerifyConfirm_connected` | "Connecting to desktop" with "My desktop (new)" and the version, then "Verify connection": section "Connected to desktop", "Verify code with desktop" showing the first 23 characters of the controller's code, "Confirm", "Disconnect"; "Confirm" → title "Connected to desktop", section "Connected desktop" "My desktop", "Session code", "Disconnect"; the controller prints the step 3 lines | P (controller), CB, DT | The session code comparison is the test's own check: GUI text = controller code `.take(23)` |
+| Pairing | Device name reaches the controller | set "This device name" to "Android test" before pairing | `C/views/remote/ConnectDesktopView.kt:130-137,458-463` | `useFromDesktop_deviceNameShownToController` | The controller prints `new remote host 1 added: Android test`; Pref `deviceNameForRemoteAccess = "Android test"` | P (controller), CB, DT | – |
+| Use | Controller drives the Android core | after pairing, controller `/switch remote host 1`, `/contacts`, `@bob hi from desktop` | `src/Simplex/Chat/Remote.hs` | `useFromDesktop_controllerSendsAsAndroidUser` | Controller prints `Using remote host 1 (<name>)` and `bob` for `/contacts`; bob receives `alice> hi from desktop`; Android's chat with bob has the sent item | P ×2 (controller, bob), CB, DT | As `remoteMessageTest` (`tests/RemoteTests.hs:260-280`) |
+| Stop | Disconnect from Android | "Disconnect" on "Connected to desktop" | `C/views/remote/ConnectDesktopView.kt:335-337,551-561`; `C/views/chatlist/UserPicker.kt:361-363`; `C/model/SimpleXAPI.kt:3622-3629` | `useFromDesktop_disconnectFromAndroid` | The controller prints `remote host 1 stopped`; "Connect to desktop" closes (this Disconnect also calls the modal's `close`) and the chat list shows Android's own chats (`switchToLocalSession`) | P (controller), CB, DT | – |
+| Stop | Close while connected | Back (or the close button) on "Connected to desktop" | `C/views/remote/ConnectDesktopView.kt:47-56,581-589` | `useFromDesktop_closeWhileConnected_asksToDisconnect` | Alert "Disconnect desktop?" / "Only one device can work at the same time" / "Disconnect"; confirming stops the session and closes the screen | P (controller), CB, DT, BACK | – |
+| Stop | Controller stops | controller `/stop remote host 1` | `C/model/SimpleXAPI.kt:3508-3530` | `useFromDesktop_controllerStops_noAlert` | Android leaves the session without an alert (reason `Disconnected`) and shows "Connect to desktop" | P (controller), CB, DT | – |
+| Errors | Bad address | paste "not an address" > "Connect to desktop" | `C/views/remote/ConnectDesktopView.kt:512-523,591-595` | `useFromDesktop_badAddressAlert` | Alert "Bad desktop address" | CB, DT | – |
+| Errors | Incompatible controller | the controller is the stable CLI | `C/views/remote/ConnectDesktopView.kt:514-516,597-602`; `src/Simplex/Chat/Remote.hs:77-91` | `useFromDesktop_incompatibleControllerAlert` | Alert "Incompatible version" with "Desktop app version <v> is not compatible with this app." (an empty `<v>` when the version error comes from the transport) | P (stable controller), CB, DT | `minRemoteCtrlVersion` is 7.1.0.9; the stable tag v7.0.3 is older |
+| Stored | Reconnect a linked desktop | after a first pairing, controller `/start remote host 1`; paste its invitation | `C/views/remote/ConnectDesktopView.kt:87-96,529-537` | `useFromDesktop_storedDesktop_autoConfirms`, `useFromDesktop_storedDesktop_verifyWhenEnabled` | With "Verify connections" off (default) the session is confirmed automatically: controller prints `remote host 1 connected (…)`; with it on, "Verify connection" is shown first | P (controller), CB, DT | – |
+| Stored | Linked desktops | "Linked desktops" | `C/views/remote/ConnectDesktopView.kt:351-360,415-451,563-568` | `useFromDesktop_linkedDesktops_deleteAndOptions` | "Desktop devices" lists "My desktop"; long-press → "Delete" removes it at once (no confirmation: `showUnlinkDesktopAlert` has no caller); "Linked desktop options": "Verify connections", "Discover via local network", and "Connect automatically" only while discovery is on | P (controller), CB, DT | – |
+| Stored | Discover via local network | discovery on, desktop stored; controller `/start remote host 1 multicast=on` | `C/views/remote/ConnectDesktopView.kt:110-117,189-257,472-485`; `C/model/SimpleXAPI.kt:3488-3498` | `useFromDesktop_multicastFindsKnownDesktop` | "Connecting to desktop" with "Found desktop" / "Waiting for desktop…", then "Found desktop" with "My desktop", which connects automatically by default ("Connect automatically" is on, `C/model/SimpleXAPI.kt:262`, ConnectDesktopView.kt:252-256; with it off, "Connect" and "Cancel"); the session connects | P (controller), CB, DT, MCAST (bridge) | `MCAST (bridge)` is defined under "Needs codes added by this file"; multicast across the bridge is unverified (open question 9) |
+| Service | Service runs while the screen is open | notification mode OFF; open "Connect to desktop", then close it | `C/views/remote/ConnectDesktopView.kt:61-69` | `useFromDesktop_startsServiceWhileOpen` | The "SimpleX Chat service" notification appears while the screen is open and disappears after it closes | SYSNTF | Keeps the session alive in the background |
+
+### 13. The system Back key (17 tests)
+
+`BACK` presses the real Back key. Compose `BackHandler`s registered by the open screen run first (`A/platform/Back.android.kt:5-8`); with none enabled, `MainActivity.onBackPressed` finishes the activity on API 30+, unless a forward is in progress, and drops shared content (`APP/MainActivity.kt:91-118`). `android:enableOnBackInvokedCallback="false"` keeps `onBackPressed` in use (`MAN:38-49`). On desktop the same handlers run on Esc (04 `keyboard_escClosesTopModal`); the rows below cover the Android-only outcomes and the screens most used with Back.
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification (GUI / activity) | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Chat | Chat → chat list | chat with bob open | `C/views/chat/ChatView.kt:1215-1226` | `back_chatToChatList` | The chat list shows; the activity keeps running | P, BACK | – |
+| Chat | Search first | chat search open with text | `C/views/chat/ChatView.kt:1215-1222` | `back_closesChatSearchBeforeChat` | First Back closes the search and clears the content filter; the second returns to the chat list | P, BACK | opening chat search shows the soft keyboard (`C/views/helpers/SearchTextField.kt:46-50`), so the keyboard is hidden first and Back reaches the app (05 `back_hidesKeyboardFirst`) |
+| Chat | Selection mode | select two messages | `C/views/chat/SelectableChatItemToolbars.kt:20-30` | `back_exitsSelectionMode` | Selection ends; the chat stays open | P, BACK | – |
+| Chat | Chat info | chat info open | `C/views/chat/ChatInfoView.kt:67`; `C/views/chat/group/GroupChatInfoView.kt:73` | `back_closesContactAndGroupInfo` | Contact info and group info each close to their chat | P, BACK | – |
+| Chat | Pending member closes the support chat | alice joins bob's group "team" (review on) by its link, so her support chat opens over the group (03 `joinerPendingReview_supportChatAutoOpens`); Back in the support chat (titled "Chat with admins"), then the same with its back arrow | `C/views/chat/group/MemberSupportChatView.kt:33-47,64-72,111-113`; `C/views/chat/ChatView.kt:246-256` | `pendingReview_closeSupportChat_returnsToChatList` | The chat list shows instead of the group's chat (`chatModel.chatId` is null) and lists "team"; tapping the row opens the group, which opens the support chat over it again; the back arrow also returns to the chat list | P, CB, BACK | Android only (`appPlatform.isAndroid`, for the user's own support chat while `memberPending`); desktop returns to the group's chat, whose compose shows "reviewed by admins" (03 `joinerPendingReview_supportChatAutoOpens`) |
+| Keyboard | Keyboard first | the message field focused, keyboard shown | `A/platform/UI.android.kt:46-55` (keyboard-state reader, used to assert the keyboard is hidden) | `back_hidesKeyboardFirst` | The first Back only hides the keyboard (the IME consumes it); the chat stays open | P, BACK, IME, VIEW | – |
+| Chat list | Search text | text in "Search or paste SimpleX link" | `C/views/chatlist/ChatListView.kt:811-815` | `back_clearsChatListSearch` | Back clears the text; the next Back finishes the activity | BACK | The keyboard is hidden first so Back reaches the app |
+| Chat list | User picker | user picker open | `C/views/chatlist/UserPicker.kt:48-56` | `back_closesUserPicker` | The picker slides away; the chat list stays | BACK | – |
+| Chat list | New chat sheet | "Start new chat" open | `C/views/chatlist/ChatListView.kt:106-125` | `back_closesNewChatSheet` | The sheet closes; the chat list shows and the activity keeps running | BACK | – |
+| Modals | Nested settings | Settings > "Appearance" | `C/views/helpers/ModalView.kt:40-42` | `back_closesModalsOneByOne` | Back closes "Appearance", then "Your settings"; once nothing is open (the user picker too), the next Back finishes the activity | BACK | – |
+| Activity | Root finishes the activity | chat list with nothing open | `APP/MainActivity.kt:91-117` | `back_onChatListRootFinishesActivity` | `MainActivity.isFinishing` is true; launching the app again shows the chat list with the same chats (the process and core keep running) | BACK | With SimpleX Lock on, auth is cleared too (§10 `androidLock_backFromRootClearsAuth`) |
+| Activity | Forward in progress | a message forwarded from bob's chat ("Forward" → "Forward message…" list) | `APP/MainActivity.kt:92-96,107-116` | `back_duringForward_returnsToSourceChat` | The activity does not finish; the shared content is dropped and bob's chat opens again | P, BACK | – |
+| Lock | Passcode prompt of a protected action | Passcode lock on; Settings > "Migrate to another device" (prompt "Open migration screen") | `C/views/helpers/LocalAuthentication.kt:41-58`; `US/SettingsView.kt:106,473-520` | `back_onProtectedActionPrompt_leavesUnlockScreen` | Back on "Enter Passcode" cancels it; the full-screen "Unlock" button remains; a second Back closes it without opening the migration screen | BACK | Opening "Your chat profiles" asks for nothing; only its actions are protected (04 `lock_protectedActionsPrompt`) |
+| Lock | Setting a passcode | "Enable lock" in Passcode mode → "New Passcode" | `C/views/localauth/SetAppPasscodeView.kt:24-35` | `back_onSetPasscode_cancelsAndLeavesLockOff` | The passcode screen closes; `performLA` stays false | BACK | – |
+| Onboarding | Profile screen | "Your profile" | `C/views/WelcomeView.kt:227-242` | `back_onboardingProfile_returnsToWelcome` | The welcome screen shows again (no profile is created) | ONBOARD, BACK | Desktop uses the back button (01 `onboardingCreateProfileBackReturnsToWelcome`); the name field is focused after 300 ms and shows the keyboard (`C/views/WelcomeView.kt:300-303`), so the keyboard is hidden first and Back reaches the app |
+| Onboarding | Screens without a close button | "Your network" | `C/views/onboarding/YourNetwork.kt:61-62` | `back_onboardingYourNetwork_finishesActivity` | No handler: the activity finishes and the onboarding stage is unchanged; relaunching shows "Your network" again | ONBOARD, BACK | – |
+| What's New | What's New | Settings > "Help & support" > "What's new" | `C/views/onboarding/WhatsNewView.kt:170`; `C/views/helpers/ModalView.kt:40-42` | `back_closesWhatsNew` | What's New closes to "Help & support" | BACK | – |
+
+### 14. Layout, gestures, keyboard and appearance on Android (28 tests)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification (GUI / prefs) | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Layout | One pane | open bob's chat from the chat list | `C/App.kt:313-360` | `layout_onePane_chatReplacesList` | The chat slides over the list: while it is open no chat-list row is displayed; desktop shows both side by side (`C/App.kt:429`, `DesktopScreen`) | P | Carried-over 01/02 rows navigate through screen objects (setup item 6) |
+| Layout | Reachable toolbars by default | fresh profile | `C/model/SimpleXAPI.kt:275-276`; `C/views/chatlist/ChatListView.kt:569-605` | `layout_reachableToolbarsDefault_bottomBars` | With the defaults (`oneHandUI = chatBottomBar = true`) the chat-list search field and toolbar and the chat's app bar are at the bottom of the screen (their bounds' top is in the lower half) | P | – |
+| Appearance | Interface section | Settings > "Appearance" | `A/views/usersettings/Appearance.android.kt:72-122` | `appearanceAndroid_interfaceSectionToolbars` | "Reachable app toolbars" on; "Reachable chat toolbar" shown only while it is on; turning app toolbars off moves the bars to the top; turning it on again also sets `chatBottomBar = true` | — | Desktop: 04 `appearance_reachableAppToolbars`; replaces 04 `appearance_reachableChatToolbarVisibility` on Android |
+| Appearance | Language recreates the activity | "Language" > "Deutsch", then "System" | `A/views/usersettings/Appearance.android.kt:89-104`; `A/helpers/Locale.kt:10-36` | `appearanceAndroid_languageRecreatesActivity` | After about 200 ms the activity is recreated and the whole UI is German at once (Settings title "Einstellungen"); "System" restores English; Pref `appLanguage = "de"`, then `= null` | — | Desktop changes the pref and re-reads strings (04 `appearance_language_switch`) |
+| Appearance | App icon | "App icon" section, the dark-blue icon | `A/views/usersettings/Appearance.android.kt:40-63,130-152,161-165`; `MAN:133-155` | `appearanceAndroid_appIconSwitchesLauncherAlias` | The dark-blue icon gets the border; `PackageManager` reports `.MainActivity_dark_blue` enabled and `.MainActivity_default` disabled; choosing the default icon reverses it | — | Restored at the end of the test; component names use the `chat.simplex.app` namespace with the debug application id |
+| Appearance | Font size slider | "Font size" slider | `US/Appearance.kt:211-247` | `appearanceAndroid_fontSizeSlider` | A slider from 75 % to 125 % with 13 positions (`steps = 11`, about 4.2 % apart); the value is rounded to 0.05 and saved to `fontScale` when the drag ends; tapping "Aa" resets it to 1.0 | — | The desktop slider has another range and step: 0.7–1.5, `steps = 9`, rounded to 0.1 (`US/Appearance.kt:248-265`) |
+| Appearance | System night mode | "Color mode" > "Dark" / "System" | `C/ui/theme/ThemeManager.kt:105-113`; `APP/SimplexApp.kt:274-288` | `appearanceAndroid_colorModeSetsApplicationNightMode` | `UiModeManager.getApplicationNightMode()` is `MODE_NIGHT_YES` for "Dark" and `MODE_NIGHT_AUTO` for "System" (API 31+) | — | – |
+| Appearance | Crowdfunding page zoom | Settings > "Crowdfunding on Wefunder" | `C/views/onboarding/WhatsNewView.kt:1173-1198,1276-1300` | `getStake_pinchZoomAndroid` | A two-finger pinch on the page scales it (the bounds of the page title `"Invest in\nSimpleX Chat"` grow; it is in the same zoomable column, `WhatsNewView.kt:1198-1200`, while the slide images exist only in a build with `-Psimplex.assets.dir`, `WhatsNewView.kt:1179-1194`); on desktop a click opens the slide full screen instead | — | `performTouchInput { pinch(…) }` |
+| Gestures | Swipe to reply | swipe a received message from right to left | `C/views/chat/ChatView.kt:1970-2003` | `gesture_swipeToReply_quotesMessage` | The compose area shows the quote of bob's message; sending replies with it (`bob <# "alice> > hello"` then the reply, as 02 `reply_menu_sendQuoted_peerSeesQuote`) | P | Desktop has no swipe |
+| Gestures | No swipe when not allowed | swipe a deleted item; swipe in a chat with a deleted contact | `C/views/chat/ChatView.kt:1987-1991` | `gesture_swipeToReply_notOnDeletedOrDisabled` | No quote appears for a marked-deleted item or when sending is disabled | P | – |
+| Gestures | Pager swipes | New chat tabs ("Start new chat" > "Create 1-time link", `C/views/newchat/NewChatSheet.kt:58,189`); "Servers info" tabs (the chat list's server status indicator, `C/views/chatlist/ChatListView.kt:638-654`) | `C/views/newchat/NewChatView.kt:157`; `C/views/chatlist/ServersSummaryView.kt:800-805` | `pager_newChatTabsSwipe`, `pager_serversSummaryTabsSwipe` | Swiping left on "1-time link" shows "Connect via link"; swiping on the servers summary changes the tab (the pagers scroll by touch only on Android) | — | – |
+| Toolbar | Content filter in the ⋮ menu | bob's chat with calls available | `C/views/chat/ChatView.kt:1335-1400` | `toolbar_directChat_filterInMenuWhenCallsAvailable` | The bar shows the call button and no filter icon; the ⋮ menu lists the filters after a divider, at least "Images" and "Links" (`ContentFilter.alwaysShow`, `ChatView.kt:865,3987`); choosing one opens the search with that filter | P | Desktop always shows the filter icon (02 `search_*` rows) |
+| Toolbar | Content filter in the bar | bob ran `/set calls @alice no` | `C/views/chat/ChatView.kt:1335-1355` | `toolbar_directChat_filterInBarWhenCallsUnavailable` | No call button; the filter icon is in the bar | P | – |
+| Toolbar | Notes: content filter in the ⋮ menu | open "Private notes" | `C/views/chat/ChatView.kt:1240-1254,1339-1340,1377-1400,1423-1440` | `toolbar_notes_filterInMenuAndroid` | The bar shows the "Search" icon and the "More" (⋮) button but no filter icon; the ⋮ menu has a divider followed by the filters, at least "Images" and "Links" (`ContentFilter.alwaysShow`, `ChatView.kt:3987`); choosing "Images" opens the search with that filter, and the search field shows the filter icon | — | Replaces the filter-icon assertion of 02 `notes_opens_showsSearchAndContentFilterIcons` on Android |
+| Toolbar | Short support-chat banner | alice is admin of "team"; member bob writes to admins | `C/views/chat/ChatView.kt:1712-1735` | `toolbar_supportBanner_shortCountOnAndroid` | The banner reads "1 chat(s)" (desktop: "1 chat with a member") | P | As 03 `supportChat_memberSendsToAdmins` |
+| Info | "Search" closes the info screen | contact info > "Search"; group info > "Search" | `C/views/chat/ChatInfoView.kt:883-899`; `C/views/chat/group/GroupChatInfoView.kt:398-414` | `chatInfo_searchButtonClosesInfoAndSearches` | The info screen closes and the chat's search field opens (on desktop the info stays in its own pane) | P | – |
+| Compose | Clear-text button for wrapped text | type one paragraph without line breaks that wraps to four or more lines of the message field | `A/platform/PlatformTextField.android.kt:196`; `C/views/chat/SendMsgView.kt:314-322` | `compose_editText_clearButtonForWrappedParagraph` | The clear-text (x) button appears once the `EditText` shows four lines (`lineCount >= 4`), although the text has no "\n"; it is absent at three lines; tapping it clears the field | P, VIEW | Desktop counts "\n"-separated lines (`D/platform/PlatformTextField.desktop.kt:204`), so a wrapped paragraph shows no (x) there; typed line breaks are 02 `compose_clearTextButton_clears` |
+| Compose | Keyboard for reply and edit | "Reply" / "Edit" on an item | `A/platform/PlatformTextField.android.kt:75-84,185-190` | `compose_replyAndEdit_showKeyboard` | The field gets focus and the soft keyboard opens (100 ms after "Reply", 300 ms after "Edit") | P, IME, VIEW | – |
+| Compose | Enter inserts a line break | chat with bob; type "hello", press Enter, type "there", tap the send button | `A/platform/PlatformTextField.android.kt:60-63,99-132`; `C/views/chat/SendMsgView.kt:177,452-490` | `compose_enterKeyInsertsNewline_sendButtonSends` | After Enter the field holds "hello" and a line break and bob prints nothing; the send button ("Send Message") then sends both lines: `bob <# "alice> hello"`, `bob <## "there"` | P, IME, VIEW | The multi-line `EditText` (`maxLines = 16`) has no key listener and never calls `onDone`, `onUpArrow` or `onFilesPasted`; desktop sends on Enter and inserts the line break on Shift+Enter (`D/platform/PlatformTextField.desktop.kt:123-137`). Replaces 02 `multiline_shiftEnter_peerReceivesTwoLines` on Android (`05-android-carryover.md`) |
+| Compose | Field above the keyboard | focus the message field | `MAN:61`; `C/views/chat/ComposeView.kt` | `layout_composeStaysAboveKeyboard` | With the keyboard open the compose area's bottom is above the keyboard (`adjustResize` + IME insets) and the last message stays visible | P, IME, VIEW | – |
+| Compose | Connect progress strip in a chat | bob sends his 1-time short link (`@alice <link>`); SMP traffic then goes through a SOCKS stub that accepts the CONNECT and never answers; alice taps the link in bob's chat | `C/views/newchat/ConnectPlan.kt:48-53,77-79`; `C/model/ChatModel.kt:48-77`; `C/views/chat/ChatView.kt:61-91,168-185,303-305` | `connectProgress_inChatStripAndCancel` | After 1 s a strip above the message field shows a progress indicator, "Loading profile…" and the close icon "Cancel"; tapping the icon removes the strip, and no plan alert or connection-error alert follows when the plan's command fails at the proxy's connect timeout; tapping the link again and pressing Back cancels the plan as the chat closes (Android only, `ChatView.kt:168-174`): the chat list's toolbar shows no progress indicator (`C/views/chatlist/ChatListView.kt:561-567`) | P, SOCKS (stub holds the CONNECT unanswered), BACK, SLOW | Desktop shows only the toolbar indicator (01 `planProgressIndicatorAndCancel`). The stub runs in the instrumentation process; SOCKS is set through the network config before the tap (04 §E owns the UI), which switches the timeouts to `NetCfg.proxyDefaults` (30 s interactive connect timeout, `C/model/SimpleXAPI.kt:5263-5271`) |
+| Compose | Custom disappearing time | long-press send > "Disappearing message" > "Custom time" | `C/views/chat/SendMsgView.kt:296-311`; `A/views/helpers/CustomTimePicker.android.kt:15-105` | `timedCustom_androidWheelPickerSetsTtl` | "Delete after" shows two wheels (number and unit); scrolling them to "2" and "minutes" and "Send" sends the message with a 120 s TTL | P | Desktop picker: 02 `timed_customTime_sendsWithChosenTtl` |
+| User picker | Bottom sheet | tap the profile image | `A/views/chatlist/UserPicker.android.kt:127-201`; `C/views/chatlist/UserPicker.kt:195-215,300-330` | `userPickerAndroid_bottomSheetLayoutAndDismiss` | A bottom sheet with the profiles row, the address row, "Chat preferences", "Your chat profiles", "Use from desktop" and "Settings" with the colour-mode switch; swiping it down or tapping the dimmed area closes it | — | – |
+| User picker | Profiles row | three profiles | `A/views/chatlist/UserPicker.android.kt:34-70` | `userPickerAndroid_profilesRowSwitchesUser` | The profiles are in one horizontally scrolling row; tapping another activates it and the row scrolls back to the start | — | – |
+| User picker | Landscape | rotate with the picker open | `C/views/chatlist/UserPicker.kt:305-330` | `userPickerAndroid_landscapeTwoColumns` | In landscape the address/preferences/profiles items and the settings items are in two columns | ROT | – |
+| Rotation | State survives rotation | chat with bob open, text typed | `APP/MainActivity.kt:44-48` | `rotation_keepsOpenChatAndDraft` | After rotating, bob's chat is still open with the typed text (the compose state is saveable, `C/views/chat/ChatView.kt:148`), and the launch intent is not processed again | P, ROT, VIEW | – |
+| Lists | Emoji picker for a list | "Add list" > emoji button | `A/views/chatlist/TagListView.android.kt:22-81`; `C/views/chatlist/ChatListView.kt:1336-1344`; `C/model/SimpleXAPI.kt:4169` | `tagListAndroid_emojiPickerViewSetsEmoji` | A full-screen `EmojiPickerView` (10 columns) opens; picking 🎉 closes it and the list editor shows 🎉 before the name; then typing `Party` and "Save list" adds a chip showing 🎉 in place of the label icon, and the Log's `/_create tag` carries `"emoji": "🎉"` | VIEW | Desktop: a single-emoji text field (01 `createListWithEmoji`) |
+
+### 15. Android-only settings rows and app lifecycle (15 tests, 3 ignored)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification (GUI / system) | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Settings | Root items | Settings | `US/SettingsView.kt:80-149`; `A/views/usersettings/SettingsView.android.kt:31-34` | `settingsAndroid_rootListsAndroidItems` | "Your settings": "Appearance", "Your privacy", "Help & support", "Chat data", "Migrate to another device"; "Supporter perks"; under "Advanced settings": "Network & servers", "Notifications", "Audio & video calls", "Shutdown", and the version row "<ANDROID_VERSION_NAME> (<ANDROID_VERSION_CODE>)"; "Crowdfunding on Wefunder" (foss build) | — | Desktop list: 04 `settingsRoot_listsDesktopItems` |
+| Settings | Shutdown alert | "Shutdown" | `A/views/usersettings/SettingsView.android.kt:31-71` | `settingsAndroid_shutdownAlertCancel` | Alert "Shutdown?" / "Notifications will stop working until you re-launch the app" with "Cancel", "Restart" and "Shutdown" (red); "Cancel" closes it and nothing else happens | — | – |
+| Settings | Shutdown and Restart | "Shutdown" / "Restart" in that alert | `A/views/usersettings/SettingsView.android.kt:36-45` | `settingsAndroid_shutdownAndRestartEndProcess` | – | IGNORE: the action ends the app process, which is the instrumentation process | `WorkManager` work is cancelled and the service stopped before the exit |
+| Help | "Rate the app" | Settings > "Help & support" > "Support the project" | `US/SettingsView.kt:171-180,267-281` | `helpAndroid_rateTheAppOpensMarket` | The row "Rate the app" (Android only) fires `ACTION_VIEW` with `market://details?id=chat.simplex.app`, recorded and stubbed with `INTENTS` so nothing launches (R13); "Contribute" and "Star on GitHub" are also listed (foss) | INTENTS | The `https://play.google.com/…` fallback is unreachable: `openUriCatching` (`C/views/helpers/Utils.kt:605-611`) swallows the exception, so `runCatching` never fails (`US/SettingsView.kt:267-271`) |
+| Version | Version screen | the version row | `US/VersionInfoView.kt:30-52`; `A/views/usersettings/SettingsView.android.kt:21-29` | `versionAndroid_showsAndroidBuildAndDevTools` | "App version" page: "App version: v<ANDROID_VERSION_NAME>", "App build: <ANDROID_VERSION_CODE>", "Core version: v…", and the "Developer tools" row | — | Desktop: 04 `version_screenShowsVersions` |
+| Version | Developer options | "Developer tools" with developer tools on | `US/DeveloperView.kt:40-63` | `devToolsAndroid_noConsoleWindowOption` | "Developer options" lists "Enable logs", "Confirm database upgrades", "Show internal errors", "Show slow API calls"; no "Show console in new window" (desktop only) | DT | – |
+| Network | Network connection status | Settings > "Network & servers" | `NS/NetworkAndServers.kt:306-316`; `A/helpers/NetworkObserver.kt:56-92` | `networkAndroid_connectionStatusOnline` | Section "Network connection" with the network type ("Cellular", "WiFi", "Wired ethernet" or "Other") and a green dot described "Connected" | — | Waydroid's network type is not fixed here; the test compares with `ConnectivityManager` |
+| Network | Offline status | airplane mode on | `A/helpers/NetworkObserver.kt:68-92` | `networkAndroid_connectionStatusOffline` | After about 3 s the row shows "No network connection" with a red dot; turning airplane mode off restores the type and the green dot | SHELL | Restored at the end of the test; open question 12 |
+| Profiles | Delete the last visible profile | alice is the only visible profile; user picker > "Your chat profiles" > alice's menu > "Delete" → "Delete chat profile?" > "Profile and server connections" | `US/UserProfilesView.kt:345-362` | `profilesAndroid_deleteLastVisibleReturnsToOnboarding` | The app stops the core (`/_stop` in `chatModel.terminalItems`), sets `onboardingStage = Step1_SimpleXInfo` and closes every modal: the welcome screen with "Get started" shows instead of the user picker with "Create chat profile" | — | Replaces 01 `profilesDeleteLastVisibleShowsCreateChatProfile` on Android; the same path runs when hidden profiles remain |
+| Builds | Play Store build | google flavor | `US/SettingsView.kt:174-176`; `C/views/onboarding/WhatsNewView.kt:1073-1085`; `APP/SimplexApp.kt:347-353` | `settingsAndroid_playStoreBuildDifferences` | – | IGNORE: Play Store build: the test APK is the foss flavor and the runtime has no Google Play services | – |
+| Builds | Xiaomi text | Notifications screen and battery alert on a Xiaomi device | `US/NotificationsSettingsView.kt:58-60,74-76`; `APP/SimplexService.kt:546-551` | `settingsAndroid_xiaomiAutostartText` | – | IGNORE: device-brand text shown only on Xiaomi, Redmi and POCO devices | – |
+| Lifecycle | Service restarted on resume | SERVICE mode; the test stops the service in-process; Home, back | `APP/SimplexApp.kt:118-137` | `lifecycle_resumeRestartsServiceInServiceMode` | On `ON_RESUME` the "SimpleX Chat service" notification is back | BG, SYSNTF | – |
+| Lifecycle | Unlocked within the delay | Passcode lock, "Lock after" "30 seconds"; Home for 2 s, back | `C/AppLock.kt:271-290`; `APP/MainActivity.kt:70-89` | `lifecycle_lockNotShownWithinDelay` | No passcode screen on return; after 31 s in the background it is shown | BG, SLOW | – |
+| Lifecycle | Video stops in the background | an inline video playing in bob's chat; Home | `APP/MainActivity.kt:85-89` | `lifecycle_backgroundStopsVideoPlayback` | `VideoPlayerHolder.stopAll()` runs: on return the video is paused | P, XFTP, AV, BG | – |
+| Lifecycle | Chat list reloaded on start | app in background while bob sends 3 messages | `APP/SimplexApp.kt:96-116` | `lifecycle_startReloadsChatList` | On `ON_START` the app reloads the chats (`apiGetChats`): bob's row shows 3 unread and his last message; the command log (`chatModel.terminalItems`, as `00-legend.md`'s "Log") gains `/_get chats <userId> pcc=on` (`C/model/SimpleXAPI.kt:4153`) | P, BG | For the chat open while leaving, the reload keeps its old unread stats (`SimplexApp.kt:105-111`) |
+
+---
+
+## Notes
+
+- `AV` marks rows that assert sound or playback; rows that only incidentally play a sound (the foreground incoming-call ringtone, `C/views/call/IncomingCallAlertView.kt:31-33`, and the outgoing connecting sound, `A/views/call/CallView.android.kt:152`) carry no `AV` in this file; as on desktop, the harness installs the seam fakes for every test (plan §11.2, R10), so no real sound plays.
+
+**Carry-over from 01–04.** `05-android-carryover.md` names every 01–04 test whose Android behaviour or harness mechanism differs, with its class (REPLACED by a named 05 test, DESKTOP-ONLY, or ADAPT), what changes and the code refs; a test not listed there runs on Android unchanged. The general rules behind it (its R1–R13):
+- Right-click does nothing on Android (`Modifier.onRightClick` returns the modifier unchanged, `A/platform/Modifier.android.kt:16`); every `onRightClick` in the shared code sits next to a `combinedClickable(onLongClick = …)` with the same action, so the driver uses `longClick()` (01 setup item 8) for "right-click" entries, and rows named for the right-click test the long press of the same handler.
+- The message field is an `EditText` that handles no keys (`A/platform/PlatformTextField.android.kt:60-63`): Enter inserts a line break, the send button sends (`C/views/chat/SendMsgView.kt:452-490`), and Shift+Enter, Up, Ctrl+V and typed file paths (`D/platform/PlatformTextField.desktop.kt:97-110,123-150`) don't exist; files are attached through the §6 "File" stub.
+- `FD` rows use `INTENTS` stubs (§6, §11); `shareText`/`shareFile` open the system chooser (§6 note); the item menu's "Copy" sets only the item's text, with no toast (§6).
+- Onboarding has no passphrase step and no "Link a mobile", the welcome button is "Get started", and "Continue" on "Your network" applies the notification mode (§1).
+- The new-chat entry is "Paste link / Scan" and opens the connect screen with the camera section (`C/views/newchat/NewChatSheet.kt:61,194`); `CAMERA` and `RECORD_AUDIO` are pre-granted (setup item 2).
+- `NTF` rows assert through `SYSNTF` (§3); 04 §C lock rows set "Lock mode" to "Passcode" first and read the Keystore-encrypted passcode prefs through `DatabaseUtils.ksAppPassword` (§10, §11); calls start `CallActivity` instead of the URI handler (§9); Esc becomes the system Back key (§13); `REC`/`AV` rows need Android actuals of the plan §11.2 seams (`A/platform/RecAndPlay.android.kt`, `A/platform/VideoPlayer.android.kt`).
+- `TOAST` steps read the accessibility events of the system toast (R11; Needs codes, open question 13); the Android `type()` leaves the cursor at the end of the text, which the mention picker needs (R12, setup item 5).
+- `URI` steps assert the outgoing `ACTION_VIEW` with `INTENTS`, and `CB` steps use the real system clipboard, which the reset clears (R13, setup item 4); 02 §B link-preview rows fetch `http://127.0.0.1:<port>`, which needs a debug-only network-security-config allowing cleartext there (open question 15).
+- Desktop-only areas: 04 §K "Link a mobile" (Android is the host, §12), 04 §M window and tray, the update checker, text selection across messages, `IMGCB`, and `MCAST` on loopback.
+
+**Excluded.** Badge display and purchase screens are excluded as in the plan (Play Billing is in the `google` flavor only). `showUnlinkDesktopAlert` (`C/views/remote/ConnectDesktopView.kt:570-579`) has no caller and no visible entry point, so it has no row (plan §11.3). `androidAskToAllowBackgroundCalls` is reached only from the call pill (§9). Split-screen and other multi-window layouts have no rows: Waydroid shows one full-screen window.
+
+**Possible app bugs found while writing the rows** (reported when the tests are written, per plan §11.3):
+1. "Open" on the lock-screen call alert sends `OpenChatAction` with a plain `startActivity`; a running `MainActivity` gets it in `onNewIntent`, which doesn't call `processNotificationIntent` (`APP/MainActivity.kt:64-68`), so the caller's chat is not opened (§9 `call_lockScreenAlert_showMode_openBringsAppWithAlert`).
+2. `QRCodeScanner`'s "Camera not available" button is unreachable (§5 `qrScanner_cameraNotAvailableBranch`).
+
+**Open questions.**
+1. The new Needs codes, the Android `IGNORE` reasons and the class-map rows (package `chat.simplex.app.ui.android`, one class per section, at most 30 tests) belong in `00-legend.md` and plan §11.3; this file defines them locally until that is approved.
+2. Does `settings put global captive_portal_mode 0` make Waydroid's network count as validated under `wd.sh net isolate` (setup item 3)? If not, the core is told the network is offline and every peer test stalls.
+3. Does rotation (`ROT`) work on Waydroid's fixed-size output, or must `ROT` rows swap the size with `wm size`?
+4. Does `captureToImage()` (failure screenshots, plan §7.5; §7.7 shots once open question 17 is settled) return the content of a `FLAG_SECURE` window? The setup turns screen protection off for screenshots; §10 tests the flag itself.
+5. Does Espresso-Intents see an activity intent fired by a notification action's `PendingIntent` (`serviceNotification_hideOpensChannelSettings`), or must that row use `SYSUI`?
+6. Does Waydroid's MediaProvider accept the app's `MediaStore` insert for "Save" of an image (`rcvImage_save_insertsIntoGallery`), given its null-calling-package bug?
+7. Does Waydroid's system WebView load the call page and answer the capabilities request (§9 outgoing rows)? If not, those rows become `IGNORE` with the WebRTC reason.
+8. Is bug 1 above intended (the "Open" button only brings the app forward)?
+9. The "Use from desktop" controller must listen on an address Android reaches (`192.168.240.1` on `waydroid0`), so it runs outside the loopback-only test namespace; is that acceptable, and does multicast discovery cross the bridge (§12 `useFromDesktop_multicastFindsKnownDesktop`)?
+10. "Open with" is offered only when `PackageManager.resolveActivity` finds an `ACTION_VIEW` handler for the file's MIME type (`A/platform/Share.android.kt:91-110`, `A/views/chat/item/CIFileView.android.kt:24`). If LineageOS on Waydroid has no PDF viewer, the menu has only "Save" and §6 `rcvFile_openWith_firesViewIntentWithReadGrant` is unreachable: install a PDF viewer on the runtime, or add a stub viewer activity (an `ACTION_VIEW` filter for `application/pdf`) to the test APK's manifest?
+11. Espresso-Intents stubs answer with an `ActivityResult`; making `launch()` throw `ActivityNotFoundException` (§5 `attachCamera_noCaptureActivity_opensStillCamera`, §6 `attachGallery_noPickActivity_fallsBackToGetContent`) is not a stock capability. Is there a seam that works (a custom `Instrumentation`, or disabling the handling activities on the runtime), or do these rows become `IGNORE`?
+12. Airplane mode turns off radios, not Ethernet. If Waydroid's link is `TRANSPORT_ETHERNET` (§15 `networkAndroid_connectionStatusOnline` leaves the type open), §15 `networkAndroid_connectionStatusOffline` stays online; the runner then needs another way to take the network down (for example from the host side of the bridge).
+13. Do text toasts of a foreground app still reach the `UiAutomation` accessibility listener on Android 13 / Waydroid (System UI draws them for apps targeting API 30+ and sends the event only while accessibility counts as enabled, which a connected `UiAutomation` is expected to do), with the app's package and the toast text (R11)? If not, `TOAST` needs an app-side `showToast` hook, which needs the user's approval like the desktop seams. **Decided 2026-10-13:** check on the device first; add the `showToast` hook only if the check fails.
+14. `restart()` (`RESTART`: §2 `ntfService_passphraseNeededNotification`, §4 `notificationPermission_deniedRationale_notAskedAgain`, §10 `androidLock_noticeOffersModeChoice`, `androidLock_noticePasscodeEntry_setsPasscodeMode`, `androidLock_noticeSystemWithoutCredential_unavailable`, §11 `keystore_removed_restartAsksPassphrase`, `keystore_passphrasePrompt_imeDoneSubmits`, `keystore_keyMissing_showsNotFoundAlert`, and the 45 carried-over `RESTART` tests of 01–04) has no Android mechanism yet. Desktop `restartCore` ends the test-owned composition, restarts the core and composes `TestRoot { AppScreen() }` again (plan §7.3); on Android the composition belongs to `MainActivity` (`APP/MainActivity.kt:57-59`) and the startup code runs once per process in `SimplexApp.onCreate` (`APP/SimplexApp.kt:50-87`). Options: stop the core and run the startup steps again in-process, then finish and relaunch `MainActivity` (or `ActivityScenario.recreate()`) so `AppScreen` is composed again; or restart the process, which ends the instrumentation (as the `IGNORE` reason for "Shutdown" says), so the test would be split across two `am instrument` invocations. Which one? **Decided 2026-10-13:** in-process — stop the core, run the startup steps again, relaunch `MainActivity` (or `ActivityScenario.recreate()`); each test stays in one `am instrument` run.
+15. 02 §B `linkPreview_firstTimeAlert_enable_fetchesPreview`, `linkPreview_sent_peerReceivesLinkContent` and `linkPreview_cancel_sendsPlainText` fetch `http://127.0.0.1:<port>/page` from the host's HTTP stub (port reversed with `adb reverse`), but cleartext HTTP is blocked for an app targeting API 36 with neither `usesCleartextTraffic` nor `networkSecurityConfig` in its manifest (carry-over map, 02:44): the fetch fails and no preview is shown. Approve a debug-only network-security-config (an XML resource in the debug source set allowing cleartext to the domain `127.0.0.1`, referenced from a debug manifest overlay)? It is a build change; without it those three tests fail and 04 `privacy_linkPreviewsOff_noPreview` passes vacuously. **Approved 2026-10-13.**
+16. `FIXTURE` tests (38 in 01–04; the map lists only 04:199 for its fixture) have no Android mechanism yet: plan §11.1 applies SQL fixtures with the host CLI on the GUI's database files, which on Android are in the app's private files. Proposal: database files move between device and host through the bridge (`run-as <pkg>`, debuggable APK), and the SQL edits run the plan §11.1 CLI helper host-side, with `--key` = `ksDatabasePassword.get()` read in-process and sent with the command, while the core is stopped (inside `resetForTest` after the core stops, or inside `restart(fixture)`, open question 14; the test runs as the app's own user, so it can also stream the files over the bridge socket itself instead of `run-as`). Confirm? **Approved 2026-10-13.**
+17. Android screenshots have no capture pipeline yet: plan §7.7 captures one desktop surface at 1600 × 900, density 1, with pinned fonts, while on Android alerts are separate windows, `CallActivity` is another activity and density and fonts come from the device; a Compose capture covers only app windows (system UI — permission dialogs, `BiometricPrompt`, the shade, toasts — never appears). Proposal: capture every Compose root from `ComposeRootRegistry` and composite them by window position, with a separate baseline directory pulled to the host through the bridge and Waydroid's output size, density and fonts recorded as inputs; until decided, Android writes no §7.7 shots (the end-of-test shot and the DSL's `screenshot(name, of)` are skipped on Android; `-PuiShots` is a desktop Gradle property that `am instrument` never receives), while the §7.5 failure PNG is still captured with `captureToImage()` (open question 4). Confirm? **Decided 2026-10-13:** deferred; no Android §7.7 shots until Android work needs them (failure PNGs stay).
+
+## Count
+
+| Section | Tests | Ignored |
+|---|---|---|
+| 1 Onboarding and first-run screens | 15 | 0 |
+| 2 Notification service modes and background-service alerts | 21 | 1 |
+| 3 System notifications | 19 | 0 |
+| 4 Runtime permissions | 13 | 0 |
+| 5 Camera: QR scanning and photo capture | 13 | 8 |
+| 6 Attachments, files, media and the share chooser | 22 | 0 |
+| 7 Sharing into the app | 15 | 0 |
+| 8 Opening links from other apps | 8 | 0 |
+| 9 Calls on Android | 19 | 6 |
+| 10 SimpleX Lock (system authentication) and screen protection | 20 | 1 |
+| 11 Database passphrase in the Keystore, archive files | 11 | 1 |
+| 12 "Use from desktop" (Android as remote host) | 16 | 0 |
+| 13 The system Back key | 17 | 0 |
+| 14 Layout, gestures, keyboard and appearance | 28 | 0 |
+| 15 Android-only settings rows and app lifecycle | 15 | 3 |
+| **Total** | **252** | **20** |
diff --git a/plans/ui-tests/catalogue/tools/catcheck.py b/plans/ui-tests/catalogue/tools/catcheck.py
new file mode 100644
index 0000000000..8f51ad6fea
--- /dev/null
+++ b/plans/ui-tests/catalogue/tools/catcheck.py
@@ -0,0 +1,35 @@
+import re,sys,glob,collections,os
+files=sorted(glob.glob(os.path.join(os.path.join(os.path.dirname(os.path.abspath(__file__)), '..'), '0[1-4]-*.md')))
+allnames=collections.defaultdict(list); summary={}
+for f in files:
+    lines=open(f).read().split('\n'); col=None; needcol=None; names=[]; ign=0; codes=collections.Counter(); sec=None; per=collections.Counter(); perign=collections.Counter(); badcells=0
+    counttab=None; inCount=False
+    for ln in lines:
+        if ln.startswith('## Count'): inCount=True; continue
+        if ln.startswith('## ') or ln.startswith('### '):
+            if not inCount: sec=ln.strip('# ').strip()
+        if not ln.startswith('|'): col=None if not ln.strip() else col; continue
+        cells=[c.strip() for c in ln.strip().strip('|').split('|')]
+        if inCount:
+            m=re.match(r'\*\*Total\*\*',cells[0]) if cells else None
+            if m: counttab=(cells[1].strip('*'),cells[2].strip('*') if len(cells)>2 else None)
+            continue
+        if 'Test case(s)' in cells: col=cells.index('Test case(s)'); needcol=next((i for i,c in enumerate(cells) if c.lower().startswith('needs')),None); continue
+        if col is None or set(ln.replace('|','').strip())<=set('-: '): continue
+        if col>=len(cells): continue
+        cell=cells[col]
+        toks=re.findall(r'`([^`]+)`',cell)
+        rest=re.sub(r'`[^`]+`','',cell).replace(',','').strip()
+        if rest: badcells+=1
+        isign = needcol is not None and needcol<len(cells) and 'IGNORE' in cells[needcol]
+        if needcol is not None and needcol<len(cells):
+            for c in re.findall(r'\b(RELAY|NAMES|XFTP2?|SMP2|FIXTURE|RESTART|MCAST|SLOW|ONBOARD|SOCKS|HTTP|REC|AV|S)\b',cells[needcol]): codes[c]+=len(toks)
+        for t in toks:
+            if not re.match(r'^[A-Za-z_][A-Za-z0-9_]*$',t): print('BAD NAME',f,t)
+            names.append(t); allnames[t].append(f.split('/')[-1]); per[sec]+=1
+            if isign: ign+=1; perign[sec]+=1
+    summary[f.split('/')[-1]]=dict(tests=len(names),ign=ign,counttable=counttab,badcells=badcells,secs=len(per),codes=dict(codes))
+for k,v in summary.items(): print(k,v)
+d=[(n,fs) for n,fs in allnames.items() if len(fs)>1]
+print('duplicates:',d[:20],len(d))
+print('TOTAL',sum(v['tests'] for v in summary.values()),'IGN',sum(v['ign'] for v in summary.values()),'SECS',sum(v['secs'] for v in summary.values()))
diff --git a/plans/ui-tests/catalogue/tools/classmap.py b/plans/ui-tests/catalogue/tools/classmap.py
new file mode 100644
index 0000000000..9a8961671b
--- /dev/null
+++ b/plans/ui-tests/catalogue/tools/classmap.py
@@ -0,0 +1,74 @@
+import re,sys,os
+D=os.path.join(os.path.dirname(os.path.abspath(__file__)), '..') + '/'
+FILES={'01':'01-onboarding-chatlist-connect-profiles.md','02':'02-chat-view-messages.md','03':'03-groups-channels-business.md','04':'04-settings-database-remote.md'}
+PKG={'01':'main','02':'chat','03':'groups','04':'settings'}
+# section id -> list of (ClassBase, first-row selector or None). Selector = Area value (01/02/04) or first test name.
+MAP={
+'01':{'1':[('Onboarding',None)],'2':[('WhatsNew',None)],
+      '3':[('ChatListToolbarSearch',None),('ChatListFiltersLists','area:Filters'),('ChatListRows','area:Rows'),('ChatListMenusPending','area:Contact menu'),('ChatListRequestsCards','area:Requests')],
+      '4':[('ServersSummary',None)],
+      '5':[('UserPicker',None),('ChatProfiles','area:Profiles'),('ProfileEdit','area:Profile edit')],
+      '6':[('NewChatSheet',None)],'7':[('OneTimeLink',None)],'8':[('ConnectPlan',None)],'9':[('PreparedChat',None)],
+      '10':[('PendingConnection',None)],'11':[('Address',None)],'12':[('SimplexName',None)],'13':[('ContactInfo',None)],
+      '14':[('ContactPreferences',None)],'15':[('DeleteContact',None)]},
+'02':{'A':[('ChatShell',None)],'B':[('Compose',None)],'C':[('LiveMessage',None)],'D':[('TimedMessage',None)],'E':[('VoiceMessage',None)],
+      'F':[('SendAttachment',None)],'G':[('ReceiveFile',None)],'H':[('Reply',None)],'I':[('EditMessage',None)],'J':[('DeleteMessage',None)],
+      'K':[('MultiSelect',None)],'L':[('Forward',None)],'M':[('Reaction',None)],'N':[('CopyShare',None)],'O':[('MemberReport',None)],
+      'P':[('ItemInfo',None)],'Q':[('UnreadScroll',None)],'R':[('ChatSearch',None)],'S':[('Draft',None)],'T':[('ItemStatus',None)],
+      'U':[('SpecialItem',None)],'V':[('Notes',None)],'W':[('ContextMenu',None)],'X':[('ChatEdgeCases',None)]},
+'03':{'1':[('CreateGroup',None)],'2':[('InviteMembers',None)],'3':[('GroupInfo',None)],'4':[('GroupProfile',None)],'5':[('GroupPreferences',None)],
+      '6':[('MemberAdmission',None)],'7':[('GroupLink',None)],'8':[('Joining',None)],'9':[('MemberList',None)],'10':[('MemberInfo',None)],
+      '11':[('MemberContact',None)],'12':[('SupportChat',None)],'13':[('ModeratorReport',None)],'14':[('Moderation',None)],
+      '15':[('MentionNotification',None)],'16':[('GroupEvents',None)],'17':[('LeaveDeleteClear',None)],
+      '18':[('ChannelOwnerCreate',None),('ChannelOwnerBroadcast','test:channel_broadcastPlaceholderAndDelivery'),('ChannelOwnerManage','test:channelSubscribers_listAndCount')],
+      '19':[('ChannelSubscriber',None)],'20':[('BusinessChat',None)]},
+'04':{'A':[('SettingsRoot',None)],'B':[('Privacy',None)],'C':[('Lock',None)],'D':[('Appearance',None)],
+      'E':[('NetworkServers',None),('NetworkProxy','area:SOCKS')],'F':[('CallSettings',None)],
+      'G':[('ChatData',None),('DatabaseEncryption','area:Encryption')],'H':[('Migration',None)],'I':[('VersionDevTools',None)],
+      'J':[('Help',None)],'K':[('RemoteDesktop',None)],'L':[('SupporterPerks',None)],'M':[('SettingsOutOfReach',None)]}}
+rows=[];problems=[]
+for cat,f in FILES.items():
+    L=open(D+f).read().split('\n'); sec=None; col=None; need=None; cls=None; title=None; secs_seen=[]
+    data={}  # sec -> list of (area, names, isS, isIgn)
+    for l in L:
+        if l.startswith('## Count'): break
+        m=re.match(r'### (\w+)\. (.*?) \(\d+ tests?',l)
+        if l.startswith('### '):
+            col=None; sec=m.group(1) if m else None
+            if m: data[sec]=[]; secs_seen.append((sec,m.group(2)))
+            continue
+        if sec is None or not l.startswith('|'): continue
+        c=[x.strip() for x in l.strip().strip('|').split('|')]
+        if 'Test case(s)' in c: col=c.index('Test case(s)'); need=next(i for i,x in enumerate(c) if x.startswith('Needs')); hasArea=c[0]=='Area'; continue
+        if col is None or col>=len(c) or set(l.replace('|','').strip())<=set('-: '): continue
+        names=re.findall(r'`([^`]+)`',c[col])
+        if names: data[sec].append((c[0] if hasArea else None,names,bool(re.search(r'(^|[ ,])S([ ,×(]|$)',c[need])),'IGNORE' in c[need]))
+    if set(data)!=set(MAP[cat]): problems.append((cat,'section mismatch',sorted(set(data)^set(MAP[cat]))))
+    for sec,title in secs_seen:
+        spec=MAP[cat].get(sec,[]); idx=0; per={}
+        for area,names,isS,isI in data[sec]:
+            for n in names:
+                if idx+1<len(spec):
+                    k,v=spec[idx+1][1].split(':',1)
+                    if (k=='area' and area==v) or (k=='test' and n==v): idx+=1
+                b=spec[idx][0]; d=per.setdefault(b,dict(first=None,t=0,i=0,s=0)); 
+                if d['first'] is None: d['first']=n
+                d['t']+=1; d['i']+=isI; d['s']+=isS
+        for b,_ in spec:
+            if b not in per: problems.append((cat,sec,b,'empty')); continue
+            d=per[b]; rows.append((cat,sec,title,b,PKG[cat],d))
+if problems: print('PROBLEMS',problems)
+mode=sys.argv[1] if len(sys.argv)>1 else 'table'
+if mode=='table':
+    for cat,sec,title,b,pkg,d in rows:
+        classes='`%sTest`'%b if d['s']<d['t'] else ''
+        if d['s']: classes+=(', ' if classes else '')+'`%sCompatTest`, `%sCompatStableTest`'%(b,b)
+        print('| %s | %s | %s | `%s` | %s | %d | %d |'%(cat,sec,title.replace('|','/'),d['first'],classes,d['t'],d['i']))
+else:
+    import collections
+    print('classes(bases)',len(rows),'with runnable',sum(1 for r in rows if r[5]['t']>r[5]['i']),'max',max(r[5]['t'] for r in rows))
+    secs=collections.defaultdict(lambda:[0,0])
+    for cat,sec,title,b,pkg,d in rows: secs[(cat,sec)][0]+=d['t']; secs[(cat,sec)][1]+=d['i']
+    print('sections',len(secs),'runnable sections',sum(1 for v in secs.values() if v[0]>v[1]))
+    for cat,sec,title,b,pkg,d in rows:
+        if d['t']>30: print('BIG',cat,sec,b,d['t'])
diff --git a/plans/ui-tests/catalogue/tools/needs.py b/plans/ui-tests/catalogue/tools/needs.py
new file mode 100644
index 0000000000..1ec6af4f80
--- /dev/null
+++ b/plans/ui-tests/catalogue/tools/needs.py
@@ -0,0 +1,18 @@
+import re,collections,glob,os
+tot=collections.Counter(); per={}
+for f in sorted(glob.glob(os.path.join(os.path.join(os.path.dirname(os.path.abspath(__file__)), '..'), '0[1-4]-*.md'))):
+    L=open(f).read().split('\n'); col=None; c2=collections.Counter(); k=f.split('/')[-1][:2]
+    for l in L:
+        if l.startswith('## Count'): break
+        if l.startswith('### '): col=None; continue
+        if not l.startswith('|'): continue
+        c=[x.strip() for x in l.strip().strip('|').split('|')]
+        if 'Test case(s)' in c: col=c.index('Test case(s)'); need=next(i for i,x in enumerate(c) if x.startswith('Needs')); continue
+        if col is None or col>=len(c) or set(l.replace('|','').strip())<=set('-: '): continue
+        n=len(re.findall(r'`[^`]+`',c[col])); nd=re.sub(r'\([^)]*\)','',c[need])
+        if nd.startswith('IGNORE'): c2['IGNORE']+=n; continue
+        for code in set(re.findall(r'[A-Z][A-Z0-9]*|—',nd)): c2[code]+=n
+    per[k]=c2; tot+=c2
+legal=set('P S SMP SMP2 XFTP XFTP2 RELAY NAMES HTTP SOCKS SRVCTL PEERCTL RESTART FIXTURE ONBOARD FD CB IMGCB URI NTF TOAST DT REC AV MCAST SLOW REALTIME — IGNORE'.split())
+for k in sorted(tot): print(k,[per[x][k] for x in sorted(per)],tot[k])
+print('illegal',{k:v for k,v in tot.items() if k not in legal})
diff --git a/plans/ui-tests/catalogue/tools/recount.py b/plans/ui-tests/catalogue/tools/recount.py
new file mode 100644
index 0000000000..c01704c8b6
--- /dev/null
+++ b/plans/ui-tests/catalogue/tools/recount.py
@@ -0,0 +1,28 @@
+import re,sys
+p=sys.argv[1]; L=open(p).read().split('\n')
+secs=[];col=None;needcol=None;inCount=False
+for i,ln in enumerate(L):
+    if ln.startswith('## Count'): inCount=True
+    if inCount: continue
+    if ln.startswith('### '):
+        col=None
+        if re.search(r'\(\d+ tests?',ln): secs.append([i,0,0])
+        continue
+    if not ln.startswith('|'): 
+        if not ln.strip(): col=None
+        continue
+    c=[x.strip() for x in ln.strip().strip('|').split('|')]
+    if 'Test case(s)' in c: col=c.index('Test case(s)'); needcol=next((k for k,x in enumerate(c) if x.lower().startswith('needs')),None); continue
+    if col is None or set(ln.replace('|','').strip())<=set('-: ') or col>=len(c): continue
+    n=len(re.findall(r'`[^`]+`',c[col])); secs[-1][1]+=n
+    if needcol is not None and 'IGNORE' in c[needcol]: secs[-1][2]+=n
+for i,t,g in secs:
+    tail='%d tests'%t + ('' if g==0 else (', all ignored' if g==t else ', %d ignored'%g))
+    L[i]=re.sub(r'\(\d+ tests?[^)]*\)\s*$','(%s)'%tail,L[i]); assert tail in L[i],L[i]
+ci=L.index('## Count'); rows=[k for k in range(ci+1,len(L)) if L[k].startswith('|') and '**Total**' not in L[k] and not L[k].startswith('| Section') and not set(L[k].replace('|','').strip())<=set('-: ')]
+assert len(rows)==len(secs),(len(rows),len(secs))
+for k,(i,t,g) in zip(rows,secs):
+    c=L[k].strip().strip('|').split('|'); L[k]='| %s | %d | %d |'%(c[0].strip(),t,g)
+T=sum(s[1] for s in secs); G=sum(s[2] for s in secs)
+tk=[k for k in range(ci,len(L)) if '**Total**' in L[k]][0]; L[tk]='| **Total** | **%d** | **%d** |'%(T,G)
+open(p,'w').write('\n'.join(L)); print(p.split('/')[-1],'tests',T,'ignored',G,'sections',len(secs))
diff --git a/plans/ui-tests/catalogue/tools/status.py b/plans/ui-tests/catalogue/tools/status.py
new file mode 100644
index 0000000000..4d6bf5a64f
--- /dev/null
+++ b/plans/ui-tests/catalogue/tools/status.py
@@ -0,0 +1,26 @@
+import re, glob, sys, os, subprocess, collections
+impl_root = os.path.join(os.path.dirname(os.path.abspath(__file__)), '../../../../apps/multiplatform')
+src = subprocess.run(['grep', '-rhoE', r'@Test fun [A-Za-z0-9_]+', impl_root + '/common/src/uiTestShared', impl_root + '/android/src/androidTest', impl_root + '/common/src/desktopTest/kotlin/chat/simplex/app/ui'], capture_output=True, text=True).stdout
+implemented = set(m.split()[-1] for m in src.split('\n') if m)
+rows = []
+for f in sorted(glob.glob(os.path.join(os.path.join(os.path.dirname(os.path.abspath(__file__)), '..'), '0[1-5]-*.md'))):
+    if 'carryover' in f: continue
+    L = open(f).read().split('\n'); col = None; need = None; sec = ''
+    for i, l in enumerate(L, 1):
+        if l.startswith('## Count'): break
+        if l.startswith('### '): sec = l[4:].strip(); col = None; continue
+        if not l.startswith('|'): continue
+        c = [x.strip() for x in l.strip().strip('|').split('|')]
+        if 'Test case(s)' in c:
+            col = c.index('Test case(s)'); need = next(j for j, x in enumerate(c) if x.startswith('Needs')); continue
+        if col is None or col >= len(c) or set(l.replace('|', '').strip()) <= set('-: '): continue
+        nd = re.sub(r'\([^)]*\)', '', c[need]) if need < len(c) else ''
+        codes = 'IGNORE' if nd.startswith('IGNORE') else ' '.join(sorted(set(re.findall(r'[A-Z][A-Z0-9]*|—', nd))))
+        for t in re.findall(r'`([A-Za-z0-9_]+)`', c[col]):
+            rows.append((os.path.basename(f)[:2], i, sec, t, codes, t in implemented))
+if len(sys.argv) > 1 and sys.argv[1] == 'summary':
+    c = collections.Counter((r[4], r[5]) for r in rows)
+    print('total', len(rows), 'implemented', sum(r[5] for r in rows))
+    for k in sorted(set(r[4] for r in rows)): print(f"{k:30s} done {c[(k, True)]:4d} todo {c[(k, False)]:4d}")
+else:
+    for r in rows: print('\t'.join(map(str, r)))
diff --git a/plans/ui-tests/catalogue/verify/01-a.md b/plans/ui-tests/catalogue/verify/01-a.md
new file mode 100644
index 0000000000..f853568bea
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/01-a.md
@@ -0,0 +1,19 @@
+| Test name(s) | Problem | Evidence (file:line + short quote) | Exact corrected text for the row (or "delete row"/"split: ...") |
+|---|---|---|---|
+| `onboardingSetDatabasePassphrase`, `onboardingSetPassphraseMismatchDisablesButton`, `onboardingUseRandomPassphraseAlert` | Behaviour incomplete: "Set database passphrase" doesn't encrypt straight away. It first shows the "Encrypt database?" alert, and the test has to confirm it with "Encrypt", which the row doesn't mention. The random-passphrase alert continues with "OK". | `SetupDatabasePassphrase.kt:115` "encryptDatabaseAlert(onConfirmEncrypt)"; `C/views/database/DatabaseEncryptionView.kt:220-227` title `encrypt_database_question` "Encrypt database?", confirm `encrypt_database` "Encrypt"; `SetupDatabasePassphrase.kt:229-235` confirmText `ok` | \| Onboarding \| DB passphrase setup \| After profile → "Setup database passphrase", fields "New passphrase…" / "Confirm new passphrase…", "Set database passphrase" → "Encrypt database?" / "Encrypt", or "Use random passphrase" → "OK" \| `C/views/onboarding/SetupDatabasePassphrase.kt:26,96,191,202,229`; `C/views/database/DatabaseEncryptionView.kt:220` \| `onboardingSetDatabasePassphrase`, `onboardingSetPassphraseMismatchDisablesButton`, `onboardingUseRandomPassphraseAlert` \| Mismatched passphrases keep the button disabled. "Set database passphrase" shows the "Encrypt database?" alert ("Database will be encrypted."); "Encrypt" sets `storeDBPassphrase=false`, encrypts and moves to "Your network" (or "Link a mobile" if no user). Random shows the "Use random passphrase" alert ("Random passphrase is stored in settings as plaintext…"); "OK" moves on the same way. Haskell: `testDatabaseEncryption` (H/Direct.hs:1589) \| ONBOARD \| — \| |
+| `onboardingCreateProfileValidName`, `onboardingCreateProfileButtonDisabledForEmptyName`, `onboardingCreateProfileInvalidNameShowsCorrectionAlert`, `onboardingCreateProfileBackReturnsToWelcome` | (a) The note "use names like `a_1`" is misleading: a `_N` suffix is invalid, so `a_1` is corrected to `a-1`. (b) The Haskell quotes ("invalid display name", "you could use this one") are the GUI user's own CLI output, which the legend forbids quoting, and the GUI shows "Invalid name!" from a client-side check anyway. | `src/Simplex/Chat/Library/Commands.hs:6705-6707` `noLdnSuffix` → `'-'`; `tests/ChatTests/Profiles.hs:346-348` `alice ##> "/p alisa_1"` / `alice <## "invalid display name: alisa_1"`; `WelcomeView.kt:480-482` `mkValidName(name) == name` | Verification: "Button is disabled for an empty or invalid name. An invalid name shows the info icon, then the "Invalid name!" / "Correct name to %s?" alert (e.g. `a_1` → "Correct name to a-1?"); confirming replaces the name. Success moves to "Setup database passphrase" (fresh database, setup item 6). Back (`WelcomeView.kt:227`) returns to the welcome screen. Name rule: core `mkValidName` (`src/Simplex/Chat/Library/Commands.hs:6703`)"; Testability notes: "Name validity comes from core `chatValidName` (FFI over `mkValidName`); a `_N` suffix is invalid, so use `a_1` for the invalid case and `a1` or `a-1` for the valid one" |
+| `onboardingCreateProfileWhenOnlyHiddenUsersExist` | (a) Wrong next screen: `Step3_ChooseServerOperators` renders "Your network" on desktop, not "Server operators". (b) The fixture has to have no active user. If a hidden user is active, `apiGetActiveUser` returns it and the app boots into the chat list, never reaching onboarding. | `C/App.kt:285-287` "Step3_ChooseServerOperators, … -> YourNetworkView(chatModel)"; `C/platform/Core.kt:141,153-166` `if (user == null) { … onboardingStage.set(Step1_SimpleXInfo)` | Verification: "Continues like a fresh install: with no visible user (`WelcomeView.kt:398-404`) onboarding moves on to "Setup database passphrase" or "Your network", not straight to `OnboardingComplete`"; Needs `ONBOARD, FIXTURE (only hidden users, none active)`; notes: "Fixture: a database whose only users are hidden and none is active (`active_user = 0`), so startup takes the no-user path (`Core.kt:153-166`)" |
+| `whatsNewOkCloses` | Wrong Needs. "OK" exists only when What's New opens automatically (`!viaSettings`). The auto-show is checked once at first composition, and the harness pre-sets `whatsNewVersion`, so the test needs a pref change plus `restart()` (RESTART) like `whatsNewShownAfterVersionUpgrade`. | `WhatsNewView.kt:218` "if (!viaSettings) { … generalGetString(MR.strings.ok)"; `SettingsView.kt:160` `WhatsNewView(viaSettings = true …)`; `ChatListView.kt:219-226` `LaunchedEffect(Unit) { val showWhatsNew = shouldShowWhatsNew…` | split: row 1 keeps `whatsNewFromSettings` (Verification: "Title "New in %s"; opens from Settings → "What's new"; no "OK" button there (`WhatsNewView.kt:218`), closed with back"; Needs —); row 2 becomes `whatsNewShownAfterVersionUpgrade`, `whatsNewOkCloses` (Verification: "Shown automatically 1 s after the chat list when `whatsNewVersion` is older; "OK" closes it"; Needs RESTART) |
+| `serversSummaryOpensFromIndicator`, `serversSummaryShowsLocalSmpConnected`, `serversSummaryAllVsCurrentProfile`, `serversSummarySmpServerDetail`, `serversSummaryDetailedStats`, `serversSummaryReconnectServer`, `serversSummaryReconnectAll`, `serversSummaryResetStats` | (a) "All profiles"/"Current profile" aren't tabs. They're options of a "Showing info for" dropdown that appears only with 2+ visible users; with one user it is forced to Current profile. (b) Wrong Needs: a server is listed only when it has sessions, subscriptions or stats. A fresh user with no connections has no server row and zero counts, so the server-row, count and reset tests need a peer with traffic. | `ServersSummaryView.kt:706-712` "count { … } == 1 → CURRENT_USER else showUserSelection = true"; `:812-814` `servers_info_target` "Showing info for"; `src/Simplex/Chat/Stats.hs:216-229` `isCurrentlyUsed … isJust sessions \|\| isJust subs` | split: \| Servers \| Servers info \| Click the subscription indicator → "Servers info"; "Reconnect all servers" \| `C/views/chatlist/ChatListView.kt:638-655`; `C/views/chatlist/ServersSummaryView.kt:691,929` \| `serversSummaryOpensFromIndicator`, `serversSummaryReconnectAll` \| "Servers info" opens ("No info, try to reload" before stats load); "Reconnect all servers" → "Reconnect servers?" → confirm, no error alert \| — \| – \| and \| Servers \| Servers info with traffic \| "Servers info"; "Messages" tab; "Showing info for" dropdown "All profiles"/"Current profile" (2+ visible users only); "Reset all statistics"; server row → "SMP server" → "Reconnect"; "Details" \| `C/views/chatlist/ServersSummaryView.kt:691,706-712,389,958,592,652` \| `serversSummaryShowsLocalSmpConnected`, `serversSummaryAllVsCurrentProfile`, `serversSummarySmpServerDetail`, `serversSummaryDetailedStats`, `serversSummaryReconnectServer`, `serversSummaryResetStats` \| Local SMP listed under "Connected servers" with message counts; "Reconnect server?"; "Reset all statistics?" / "Reset" zeroes the counters \| P \| The test connects a CLI peer and exchanges messages first, because a server is listed only once it has sessions, subscriptions or stats (`src/Simplex/Chat/Stats.hs:216-229`); `serversSummaryAllVsCurrentProfile` also creates a second user \| |
+| `serversSummaryFilesTabShowsXftp` | Wrong Needs: an unused XFTP server has no entry, so the "Files" tab lists nothing until a file has gone through the server. That requires sending a file to a peer. | `src/Simplex/Chat/Stats.hs:230-233` `xftpSummsIntoCategories = partition isCurrentlyUsed . M.elems` over `xftpServersStats`/sessions; `ServersSummaryView.kt:876-906` | \| Servers \| Servers info, files \| Click the subscription indicator → "Servers info" → "Files" \| `C/views/chatlist/ServersSummaryView.kt:691,876-906` \| `serversSummaryFilesTabShowsXftp` \| After a file is sent to the CLI peer, the "Files" tab lists the local XFTP server \| P, XFTP \| The file transfer has to come first: an unused XFTP server is not listed \| |
+| `serversSummaryShareJson` | (a) Wrong file:line: the share button is in the chat-list toolbar, not in `ServersSummaryView.kt`. (b) Missing testability note: `summary` is read when the indicator is clicked, and it is still null on the first open (it is filled by the view that opens), so the button is absent until Servers info is reopened. | `ChatListView.kt:641-652` "val summary = serversSummary.value … endButtons = { if (summary != null) { ShareButton { … clipboard.shareText(text)"; `ChatListView.kt:522` `remember { mutableStateOf(null) }` | \| Servers \| Servers info share \| Click the subscription indicator → "Servers info" → share button \| `C/views/chatlist/ChatListView.kt:641-652` \| `serversSummaryShareJson` \| Share copies the pretty-printed `PresentedServersSummary` JSON to the clipboard stub \| CB \| The share button appears only when Servers info is opened after a summary was loaded: open it, wait for the stats, close it, then reopen it \| |
+| `profilesAddProfileDuplicateNameError` (row "List and add") | Wrong alert text, and it quotes the GUI user's own CLI output. The GUI shows "Duplicate display name!" / "You already have a chat profile with the same display name. Please choose another name." | `C/model/SimpleXAPI.kt:987-991` `UserExists` → `failed_to_create_user_duplicate_title`/`_desc`; strings.xml:134-135 | Verification: "Footer "Tap to activate profile."; a duplicate name shows the "Duplicate display name!" alert ("You already have a chat profile with the same display name. Please choose another name.", `SimpleXAPI.kt:987-991`)" |
+| `profilesHideProfileWithPassword`, `profilesHidePasswordMismatchDisabled`, `profilesHiddenNotListedAfterHide`, `profilesRevealHiddenByPasswordInSearch`, `profilesActivateHiddenViaSearchPassword`, `profilesUnhideActiveRequiresPassword`, `profilesHideOnlyWhenMoreThanOneVisible` | (a) Needs aren't exact for every name: only the "CLI messages to a hidden user are not counted" check needs P, so the row has to be split. (b) "hidden user missing from the picker" duplicates `userPickerHiddenUsersNotListed`, so `profilesHiddenNotListedAfterHide` should assert the "Your chat profiles" list and the unread mark instead. | `UserProfilesView.kt:305-315` `filteredUsers` (hidden shown only with password); `ChatListView.kt:621-625` `allRead` excludes hidden users; `UserPicker.kt:57-60` picker filter, already covered by `userPickerHiddenUsersNotListed` | split: \| Profiles \| Hide and unhide \| (same entry path) \| (same file:line) \| `profilesHideProfileWithPassword`, `profilesHidePasswordMismatchDisabled`, `profilesRevealHiddenByPasswordInSearch`, `profilesActivateHiddenViaSearchPassword`, `profilesUnhideActiveRequiresPassword`, `profilesHideOnlyWhenMoreThanOneVisible` \| "Enter password in search" banner for 10 s; a typed password reveals the hidden user; "Unhide" of the active hidden user asks for "Profile password". Core side: `testUserPrivacy` (H/Direct.hs:2752) \| — \| Banner timing is 10 s; a second user is created in the test \| and \| Profiles \| Hidden user not listed or counted \| Hide a user that has a contact with the CLI peer \| `UserProfilesView.kt:305-315`; `ChatListView.kt:621-625` \| `profilesHiddenNotListedAfterHide` \| The hidden user is absent from "Your chat profiles"; CLI messages to it don't light the profile button's unread mark \| P \| – \| |
+| `profilesDeleteInactiveWithConnections`, `profilesDeleteInactiveLocalDataOnly`, `profilesDeleteActiveSwitchesToNext`, `profilesDeleteLastVisibleShowsCreateChatProfile`, `profilesDeleteHiddenActiveRequiresPassword` | Needs aren't exact for every name: only the two inactive-deletion tests check CLI output (P). The other three need no peer, so the row has to be split. The Haskell citation also lacks its file. | `UserProfilesView.kt:345-364` (active/last-visible paths, no peer involved); `tests/ChatTests/Direct.hs:2211` `testDeleteUser`, `:2270` the `cath <## "[alisa, …] error: connection authorization failed…"` line | split: \| Profiles \| Delete with peer check \| Menu "Delete" → "Delete chat profile?" with "Profile and server connections" / "Local profile data only" \| `UserProfilesView.kt:67-97,330-375` \| `profilesDeleteInactiveWithConnections`, `profilesDeleteInactiveLocalDataOnly` \| With connections: CLI sending gets `[<deleted profile name>, contactId: <id>, connId: <id>] error: connection authorization failed - this could happen if connection was deleted, …` (H/Direct.hs:2270). Local only: no CLI error. Haskell: `testDeleteUser` (H/Direct.hs:2211) \| P \| – \| and \| Profiles \| Delete active / last / hidden \| same entry path \| `UserProfilesView.kt:327-364`; `UserPicker.kt:252` \| `profilesDeleteActiveSwitchesToNext`, `profilesDeleteLastVisibleShowsCreateChatProfile`, `profilesDeleteHiddenActiveRequiresPassword` \| Deleting the active user activates the next visible one; deleting the last visible user shows the picker with "Create chat profile"; the active hidden user's deletion asks for "Profile password" → "Delete chat profile" \| — \| – \| |
+| `editProfileDisplayName`, `editProfileFullNameShownOnlyIfDifferent`, `editProfileBio`, `editProfileBioTooLarge`, `editProfileDescription`, `editProfileUnsavedChangesAlertSave`, `editProfileUnsavedChangesAlertExit`, `editProfileNameUsedByOtherUserError`, `editProfileSaveDisabledWhenUnchanged` | (a) Needs aren't exact for every name: P only for the tests that check CLI lines, so the row has to be split. (b) The duplicate-name error text is missing. (c) The CLI line for a description change is missing, and `testProfileDescriptionShown` doesn't assert it. (d) `testUpdateProfile` lacks its file. | `C/model/SimpleXAPI.kt:1930-1931` `failed_to_create_user_duplicate_title` "Duplicate display name!"; `src/Simplex/Chat/View.hs:2342` `"contact " <> n <> " updated description: "`; `tests/ChatTests/Profiles.hs:208` `testUpdateProfile` | split: \| Profile edit \| Your current profile, peer notified \| (same entry path) \| `C/views/usersettings/UserProfileView.kt:32,61,166-246` \| `editProfileDisplayName`, `editProfileBio`, `editProfileDescription`, `editProfileUnsavedChangesAlertSave` \| CLI: "contact alice changed to alice2" / "use @alice2 <message> to send messages"; "contact alice updated bio: …"; "contact alice updated description: …" (View.hs:2342); the unsaved-changes alert "Save preferences?" → "Save and notify contacts" saves and notifies. Haskell: `testUpdateProfile` (H/Profiles.hs:208) \| P \| – \| and \| Profile edit \| Your current profile, local checks \| (same entry path) \| `C/views/usersettings/UserProfileView.kt:93-99,201,218-226,238,288-305`; `C/model/SimpleXAPI.kt:1930` \| `editProfileFullNameShownOnlyIfDifferent`, `editProfileBioTooLarge`, `editProfileUnsavedChangesAlertExit`, `editProfileNameUsedByOtherUserError`, `editProfileSaveDisabledWhenUnchanged` \| "Full name:" shown only when it is non-empty and differs from the name; "Bio too large" shown; "Exit without saving" discards; a name used by another user shows "Duplicate display name!"; Save is disabled while nothing changed \| — \| `editProfileNameUsedByOtherUserError` creates a second user; `editProfileFullNameShownOnlyIfDifferent` sets a full name through the API first \| |
+| `editProfileImageSetAndDelete` | The CLI check can't work: an image-only profile change prints nothing on the peer, and `testUpdateProfileImage` asserts only the GUI user's own output. | `src/Simplex/Chat/View.hs:2334` (image is not compared, so the result is `[]`); `tests/ChatTests/Profiles.hs:1170-1177` only `alice <## "profile image updated"` / `"profile image removed"` | \| Profile edit \| Your current profile, image \| Picker → current user → "Edit image" / "Delete image" \| `C/views/usersettings/UserProfileView.kt:178-186,263-286` \| `editProfileImageSetAndDelete` \| An image chosen from a file appears on the profile and is saved with "Save and notify contacts" (`chatModel.currentUser.profile.image` is set); "Delete image" clears it and saving stores no image. The peer prints nothing for an image-only change (View.hs:2334) \| FD \| Image picker is a bottom sheet; the file dialog is completed by the test \| |
+| `userPickerLinkAMobileRow` (row "Option rows") | The "Linked mobiles" label appears only once a remote host exists, which takes a pairing with a mobile host (catalogue 04 §L; P (mobile host)). The row's Needs `—` can't produce it. | `UserPicker.kt:370` `if (… remoteHosts.isEmpty()) MR.strings.link_a_mobile else MR.strings.linked_mobiles`; 04 §L `linkMobile_newPairing_verifyAndConnect` | Entry path: ""Create SimpleX address"/"Your SimpleX address", "Chat preferences", "Your chat profiles", "Link a mobile", "Settings""; Verification: "Labels change with state ("Your SimpleX address" once an address exists; "Linked mobiles" after a pairing is tested in 04 §L); rows except "Settings" are disabled when chat is stopped; hidden users absent" |
+| `userPickerDisabledWhenChatStopped` (row "Option rows") | Behaviour overstated: the "Settings" row has no `disabled` and stays enabled when chat is stopped. Only the current-user, address, preferences, profiles and Link a mobile rows are disabled. | `UserPicker.kt:381-388` `SectionItemView(click = { … SettingsView … }, padding = …)` (no `disabled`); `:212,223,233,300,377` `disabled = stopped` | Verification: "Labels change with state; with chat stopped the current-user, address, "Chat preferences", "Your chat profiles" and "Link a mobile" rows are disabled and "Settings" stays enabled; hidden users absent" |
+| `incognitoInfoScreen` | Duplicate by meaning of `oneTimeLinkIncognitoInfoButton` (§7). Both press the ⓘ next to "Incognito" in the profile picker, which opens the same `IncognitoView`. | `C/views/newchat/NewChatView.kt:255,403` `onInfo = { ModalManager.start.showModal { IncognitoView() } }`; 01 §7 row "Incognito / profile" lists `oneTimeLinkIncognitoInfoButton` | delete row (then §5 heading becomes 44 tests, the file total 352, and the `## Count` row for §5 changes to 44) |
+| `userPickerOpensAndShowsCurrentUser`, `userPickerCurrentUserOpensProfileEditor` | The file path is elided (`D/.../`), so it isn't a repo-relative path. | `apps/multiplatform/common/src/desktopMain/kotlin/chat/simplex/common/views/chatlist/UserPicker.desktop.kt:90` `actual fun PlatformUserPicker` | Main file:line: "`C/views/chatlist/UserPicker.kt:46,211-215`; `D/views/chatlist/UserPicker.desktop.kt:90`" |
+| `userPickerSwitchProfile` | The Haskell citation gives only a line number, without its file. The row also needs a second user, which nothing in it mentions. | `tests/ChatTests/Direct.hs:1968` `testCreateSecondUser ::` | Verification: "Active user changes; the chat list reloads. Haskell: `testCreateSecondUser` (H/Direct.hs:1968)"; Notes: "Avatars have no text; match by display name. The second user is created in the test" |
diff --git a/plans/ui-tests/catalogue/verify/01-b.md b/plans/ui-tests/catalogue/verify/01-b.md
new file mode 100644
index 0000000000..d406094cdb
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/01-b.md
@@ -0,0 +1,20 @@
+| Test name(s) | Problem | Evidence (file:line + short quote) | Exact corrected text for the row (or "delete row"/"split: ...") |
+|---|---|---|---|
+| `previewReportPrefix` | Can't happen with the current core. A report is always stored in the member-support scope, and neither the core preview query nor the client preview update looks at scoped items, so a report never becomes a group row's preview. The only exception is a pending member, who can't report. | `src/Simplex/Chat/Library/Internal.hs:1989-1992` "isReport mc -> ... mkMemberSupportChatInfo"; `Library/Commands.hs:793` "(Just $ GCSMemberSupport Nothing)"; `src/Simplex/Chat/Store/Messages.hs:914` "ci.group_scope_tag IS NULL"; `C/model/ChatModel.kt:574` "if (cInfo.groupChatScope() == null \|\| ...memberPending == true)" | split: `previewGroupSenderPrefix` stays in its row (Needs `P`); new row `Rows \| Report prefix \| Group row whose newest main-scope item is a report \| ChatPreviewView.kt:266-275 \| previewReportPrefix \| Report shown with a red italic "<reason>: " prefix (TextItemView.kt:117-118) \| P, RESTART, FIXTURE (report item moved to the main scope: group_scope_tag and group_scope_group_member_id set to NULL) \| Current cores always put reports in the member-support scope (Internal.hs:1989), so only a legacy/edited item reaches the preview`. Alternatively delete the test. |
+| `loadingChatsState` | The harness can't reach this state. `chatRunning` is null only before the first `startChat` in the process and is never set back to null. The harness starts the chat before it composes (`resetForTest` calls `startChat`, then `setContent`), and `restartCore` composes only after init has finished, so "Loading chats…" is never on screen. | `C/model/ChatModel.kt:146` "val chatRunning = mutableStateOf<Boolean?>(null)" (no other null assignment); `ChatListView.kt:450` "if (chatModel.chatRunning.value == null)"; plan §7.2 `runBlocking { chatController.startChat(u) }` before composition; §7.3 "wait until initialisation has finished, and compose AppScreen() again" | delete row. Or, if a model poke is acceptable: Notes `The test sets chatModel.chatRunning.value = null before setContent (the plan has no such step; nothing in the app sets it back to null)`. |
+| `contactRequestLegacyRowWantsToConnect`, `contactRequestTapAlertAccept`, `contactRequestTapAlertAcceptIncognito`, `contactRequestTapAlertReject` | (a) The fixture comes from "a client version that predates contacts for requests", so the requesting CLI peer has no matching database and "Accept: CLI alice: contact is connected" can't happen. The request must be produced in the test by a live peer and then edited between `restart()` steps, which needs `RESTART`. (b) "Accept incognito" appears only when `addressShortLinkDataSet()` is false. The request row needs its address to exist (the query joins `user_contact_links`), and a GUI-created address has short-link data, so the incognito button is hidden unless the fixture also clears it. | `C/model/ChatModel.kt:276` "userAddress.value?.shortLinkDataSet ?: true"; `ChatListNavLinkView.kt:710` "if (!chatModel.addressShortLinkDataSet())"; `src/Simplex/Chat/Store/Messages.hs:1159-1162` "JOIN user_contact_links uc ... AND cr.contact_id IS NULL"; legend FIXTURE "between restart() steps for data the test produced itself (then also RESTART)" | split: row 1 `contactRequestLegacyRowWantsToConnect`, `contactRequestTapAlertAccept`, `contactRequestTapAlertReject` with Needs `P, RESTART, FIXTURE (request without contact)` and Notes `The CLI sends /c <address> live; between restart() steps the request's contact is deleted and contact_requests.contact_id set to NULL`; row 2 `contactRequestTapAlertAcceptIncognito` with Needs `P, RESTART, FIXTURE (request without contact; address without short-link data)` |
+| `previewConnectingForInvitation` | "connecting…" lasts only while the peer hasn't completed the handshake. With the CLI online, a prepared invitation contact connects within about a second after "Connect", so asserting it is a race. The peer has to be stopped, as the sibling row `pendingAcceptedRowIcon` already does. | `ChatPreviewView.kt:194-198` "!cInfo.contact.sndReady && cInfo.contact.activeConn != null ... contact_connection_pending" | split: `previewContactShouldAcceptForAddress`, `previewGroupInvitationJoinAs` stay with Needs `P`; new row `previewConnectingForInvitation` with Needs `P, PEERCTL` and Notes `The CLI is stopped after creating its 1-time link, so the contact stays "connecting…" after alice taps "Connect"` |
+| `contactMenuDelete` | Same meaning as §15. §15's entry path is "Row menu "Delete" or info "Delete contact"", and its tests cover the dialog this menu item opens. The row also gives no verification for this test. | `ChatListNavLinkView.kt:462-467` "DeleteContactAction ... deleteContactDialog(chat, chatModel)"; catalogue 01 §15 row 1 "Row menu "Delete" or info "Delete contact" → "Delete contact?"" | Remove `contactMenuDelete` from the Contact menu row (Test case(s): `contactMenuMarkRead`, `contactMenuMarkUnread`, `contactMenuFavoriteUnfavorite`, `contactMenuMuteUnmute`, `contactMenuClearChat`, `contactMenuRightClickOpens`). Recount §3 from 107 to 106 and update the header and `## Count`. |
+| `pendingInvitationRowIconAndName`, `pendingConnectionMenuSetName`, `pendingConnectionMenuDeleteInitiated`, `pendingConnectionClickOpensInfo` | (a) Needs `P` covers all four, but only the delete test uses a CLI; a 1-time link created by alice needs no peer. (b) The Haskell source for the error line is an address test. The deleted 1-time short-link case has its own test. | `ContactConnectionView.kt:26` "if (contactConnection.initiated) MR.images.ic_add_link"; `tests/ChatTests/Profiles.hs:4268` `testShortLinkDeletedInvitation` ("alice ##> "/_delete :1"" … "bob <##. "error: connection authorization failed"") | split: `pendingInvitationRowIconAndName`, `pendingConnectionMenuSetName`, `pendingConnectionClickOpensInfo` with Needs `—`; `pendingConnectionMenuDeleteInitiated` with Needs `P` and Verification `"Delete pending connection?" with "The contact you shared this link with will NOT be able to connect!"; a CLI /c with the deleted link prints "error: connection authorization failed…". Haskell: testShortLinkDeletedInvitation (Profiles.hs:4268)` |
+| `pendingAcceptedRowIcon`, `pendingConnectionMenuDeleteAccepted` | The entry doesn't say which link. Pasting a CLI short link creates a prepared contact (a contact row), not a pending connection. Only a full (old-client) invitation link with "Use current profile" creates a `ContactConnection` with `initiated = false`. | `C/views/newchat/ConnectPlan.kt:93-102` (short-link data → `showPrepareContactAlert`) vs `:103-113` (no short-link data → `askCurrentOrIncognitoProfileAlert`); `ConnectPlan.kt:417-421` "apiConnect ... updateContactConnection(rhId, pcc)" | Entry path: `Row after alice pastes the CLI's full 1-time link ("The invitation link for old clients:") and taps "Use current profile" while the CLI is stopped; menu "Delete"`. Main file:line: `ContactConnectionView.kt:26`; `ChatListNavLinkView.kt:582,775`; `ConnectPlan.kt:103-113,417-421` |
+| `searchNameShowsConnectToNameRow`, `searchKnownNameFiltersChat` | (a) Needs `P, NAMES` covers both tests, but the "Connect to %s" row comes from local parsing alone: any 5+ character word or dotted name shows it, with no peer or names server. (b) `@alice.simplex` is the GUI user's own name in this harness (copied from Names.hs, where alice is the name owner). Per the legend, the peer's name belongs here. | `ChatListView.kt:846-847` "val candidate = nameSearchCandidate(it.trim()); connectNameCandidate.value = candidate"; `:1158-1161` "core.length >= MIN_NAME_LENGTH -> ...$DEFAULT_NAME_TLD"; `:1200-1202`; `tests/ChatTests/Names.hs:46` "registerName reg aliceName (contactNameRecord "alice.simplex" ..." | split: `searchNameShowsConnectToNameRow`: Entry `Type bobby or @bob.simplex (bare words need 5+ characters)`, Verification `Row "Connect to bobby.testing" / "Connect to @bob.simplex"; "bob" shows no row`, Needs `—`; `searchKnownNameFiltersChat`: Verification `A known name filters to that chat. Haskell: Names.hs testConnectByName`, Needs `P, NAMES`, Notes unchanged |
+| `getStakeBannerShownAndDismissed`, `getStakeBannerOpensCrowdfunding` | Needs `URI` covers both, but only the "opens" test opens a URI. Showing and dismissing the banner touch only prefs. | `ChatListView.kt:1092-1094` "showDismiss = getStakeBannerTapped.value && ... onDismiss = { appPrefs.getStakeBannerDismissed.set(true) }"; `WhatsNewView.kt:1235` "onclick = { uriHandler.openUriCatching(WEFUNDER_URL) }" | split: `getStakeBannerShownAndDismissed` with Needs `—` (Verification `Banner shown; the dismiss button appears after the first tap (GetStakeBanner.kt:75) and hides it`); `getStakeBannerOpensCrowdfunding` with Needs `URI` (Verification `Tap opens GetStakeView (GetStakeBanner.kt:74-78); its "Learn more" Wefunder button records WEFUNDER_URL in the URI stub (WhatsNewView.kt:1231-1235)`) |
+| `contactWithRequestOpenToAccept`, `contactWithRequestComposeAccept`, `contactWithRequestComposeReject` | The entry path describes the "Accept contact request" alert (Accept / Accept incognito / Cancel), but no test in the row reaches it. With a GUI address (short-link data set), "Accept" accepts at once. | `ComposeContextContactRequestActionsView.kt:91-95` "if (chatModel.addressShortLinkDataSet()) acceptContactRequest(...) else showAcceptRequestAlert(...)"; `:136-165` | Add a row: `Requests \| Accept bar alert \| Open the request's chat for an address without short-link data → "Accept" → "Accept contact request" \| ComposeContextContactRequestActionsView.kt:91-95,136-165 \| contactWithRequestComposeAcceptAlertIncognito \| "Accept contact request" with "Accept" / "Accept incognito" / "Cancel"; Accept incognito: CLI sees a random name \| P, FIXTURE (address without short-link data) \| –` (recount §3). Or remove the alert clause from this row's Entry path. |
+| `groupMenuMuteModesAllMentionsNone` | The labels are described wrongly. `hasMentions` is true for every group, so the menu always reads "Mute" (All→Mentions), then "Mute all" (Mentions→None), then "Unmute" (None→All). "Mute all" doesn't depend on mentions existing. | `C/model/ChatModel.kt:1830` "val hasMentions: Boolean get() = this is Group"; `C/model/SimpleXAPI.kt:5437-5450` "All -> if (mentions) Mentions else None … None -> if (mentions) MR.strings.mute_all_chat" | Verification: `Menu label "Mute" moves All→Mentions, then "Mute all" moves Mentions→None, then "Unmute" moves None→All (hasMentions is true for every group, ChatModel.kt:1830); the row icon follows the mode. Haskell: testMuteGroup. Leave, delete and archive reports from this menu are in catalogue 03` |
+| `addChatToListFromContextMenu`, `changeChatListFromContextMenu`, `removeChatFromList` | "tapping toggles membership" is inaccurate. Tapping an unchecked list replaces the chat's tags with that one list, which moves the chat. Tapping the checked list removes it. The sheet closes after each tap. | `TagListView.kt:130` "setTag(rhId = rhId, tagId = if (selected) null else tag.chatTagId, chat = chat, close = {...close()})"; `:404-411` "listOf(tagId) ... apiSetChatTags" | Verification: `With no lists it opens the editor (button "Add to list"), which creates the list and assigns the chat; otherwise a list sheet with a check mark on the chat's list; tapping another list moves the chat to it (tags replaced, TagListView.kt:402-411), tapping the checked list removes it; the sheet closes after each tap` |
+| `unreadFilterToggle`, `unreadFilterEmptyState` | The description is incomplete. The filter uses `unreadTag`, which leaves out a muted chat with unread messages (unless it was marked unread) and, in a mentions-only group, counts only unread mentions. | `C/model/ChatModel.kt:1460-1464` "All -> chatStats.unreadChat \|\| chatStats.unreadCount > 0; Mentions -> ... unreadMentions > 0; else -> chatStats.unreadChat"; `ChatListView.kt:1575` | Verification: `Shows only chats with unreadTag (ChatModel.kt:1460-1464): unread messages in unmuted chats, unread mentions in mentions-only groups, and "Mark unread" chats; a muted chat with unread messages is hidden. Empty state "No unread chats" (tap clears the filter). Haskell: testFilterUnread, testFilterFavoriteOrUnread` |
+| `newChatButtonOpensNewChatSheet` | Overlaps §6 `newChatSheetShowsActions`, whose entry is the same "Start new chat" → "New chat". The parts unique to this row aren't tested: the one-hand bottom-bar button and the disabled FAB when the chat is stopped. | `ChatListView.kt:262-263` (FAB only without one-hand UI), `:482` "if (!stopped) showNewChatSheet", `:585-605` (one-hand toolbar button, same description "Start new chat") | Verification: `The FAB "Start new chat" opens the "New chat" sheet; with "Reachable app toolbars" on, the bottom-bar button opens it instead (ChatListView.kt:585-605); with chat stopped the FAB is grey and does nothing (ChatListView.kt:482)`; Main file:line `ChatListView.kt:102,479-501,585-605` |
+| `listsArePerUser` | Main file:line is missing ("–"). | `C/model/SimpleXAPI.kt:775-776` "chatModel.userTags.value = if (hasUser) apiGetChatTags(rhId) ... activeChatTagFilter.value = null" | Main file:line: `C/model/SimpleXAPI.kt:775-776` (`getUserChatData` reloads lists on user switch) |
+| `subscriptionIndicatorConnected`, `subscriptionIndicatorPercentageToggle`, `subscriptionIndicatorServerDown` | `ServersSummaryView.kt:120` is `SubscriptionStatusIndicatorView`. The "Show percentage" toggle the verification mentions is at :349. | `ServersSummaryView.kt:349` "SettingsPreferenceItem(null, stringResource(MR.strings.subscription_percentage), ...networkShowSubscriptionPercentage)" | Main file:line (both rows): `ChatListView.kt:668`; `ServersSummaryView.kt:120,349` |
+| `contactMenuMuteUnmute` | The citation quotes the `<muted>` suffix. In testMuteContact the suffix is printed by the muting side, which here is alice (the GUI user), so it is GUI output quoted as a CLI line, against the legend. | `tests/ChatTests/Direct.hs:1844` "bob <# "alice> hi <muted>"" (bob is the muting user) | In Verification replace `testMuteContact (1834, <muted>)` with `testMuteContact (1834)` |
+| `contactRequestMenuAccept`, `contactRequestMenuReject`, `contactRequestIncognitoHiddenWithShortLinkData`, `contactRequestMenuAcceptIncognito` | The line range has drifted: `ContactRequestMenuItems` spans 527-557 and the request branch of `ContactMenuItems` is 279-286. | `ChatListNavLinkView.kt:527` "fun ContactRequestMenuItems(" … `:557` "}" | Main file:line (both rows): `C/views/chatlist/ChatPreviewView.kt:192`; `C/views/chatlist/ChatListNavLinkView.kt:279-286,527-557`; core `src/Simplex/Chat/Store/ContactRequest.hs:84-107,195-215` |
diff --git a/plans/ui-tests/catalogue/verify/01-c.md b/plans/ui-tests/catalogue/verify/01-c.md
new file mode 100644
index 0000000000..14a499d616
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/01-c.md
@@ -0,0 +1,28 @@
+| Test name(s) | Problem | Evidence (file:line + short quote) | Exact corrected text for the row (or "delete row"/"split: ...") |
+|---|---|---|---|
+| `newChatSheetShowsActions`, `newChatSheetContactsListSorted`, `newChatSheetCreateGroupEntry`, `newChatSheetCreateChannelEntry` | The Needs `P` covers every name in the row, but only the sorted-list test needs contacts. The action buttons and the group and channel entries show with no peer. The sort order includes "card", and a card can only come from a fixture (the row's own §6 card note says so). | `C/views/newchat/NewChatSheet.kt:186-207` (the four action buttons have no condition); `:85-87` `CARD, CONTACT_WITH_REQUEST, REQUEST, RECENT`; `C/model/ChatModel.kt:1933-1934` `isContactCard` = no connection + `contactLink` | split: (a) `newChatSheetShowsActions`, `newChatSheetCreateGroupEntry`, `newChatSheetCreateChannelEntry`, Needs `—`; (b) `newChatSheetContactsListSorted`, Verification "Order: card, contact with request, request, recent (`NewChatSheet.kt:85,648`)", Needs `P, FIXTURE (contact card with a placeholder address)` |
+| `contactCardConnectCurrentProfile`, `contactCardConnectIncognito` | The card has to carry the CLI's real address, which only exists after the CLI runs `/ad` during the test. So the fixture can only be applied between `restart()` steps, and the legend then requires `RESTART`. Also, the CLI line "alice wants to connect to you!" is wrong for the incognito test: the CLI sees a random name. | legend `00-legend.md:49` "between `restart()` steps for data the test produced itself (then also `RESTART`)"; `C/views/chatlist/ChatListNavLinkView.kt:852` `connectContactViaAddress(..., incognito = true)` | Verification: "'Connection request sent!'; CLI 'alice wants to connect to you!' (incognito: '<rand> wants to connect to you!'); after `/ac`, connected. Haskell: `testPlanAddressContactViaAddress` (2341)"; Needs: `P, RESTART, FIXTURE (contact without connection carrying the CLI's address, inserted after the CLI's /ad)` |
+| `newChatSheetConnectToNameRow` | The "Connect to %s" row is built locally from the typed text, with no network. As written, the test needs neither `P` nor `NAMES`. Those codes only fit if the test also taps the row. | `C/views/newchat/NewChatSheet.kt:557-558` `nameSearchCandidate(it.trim())`; `C/views/chatlist/ChatListView.kt:1152-1163` (local parsing only); `:1212-1223` (the tap runs `planAndConnect`) | Verification: "Typing a name shows the row 'Connect to %s' (bare words get `.simplex`); tapping it shows the CLI's profile alert and closes the sheet"; Needs `P, NAMES` (unchanged) |
+| `oneTimeLinkCreatedPendingRowAppears` | Duplicate by meaning of §3 `pendingInvitationRowIconAndName`, which also asserts the pending row that appears after "Create 1-time link". | catalogue 01:85 "Row after creating a 1-time link … `pendingInvitationRowIconAndName`" | Remove `oneTimeLinkCreatedPendingRowAppears` from this row; Verification "Link text and QR shown. Haskell: `testAddContact`" (counts: §7 16 tests) |
+| `createOneTimeLinkShowsLinkAndQr` | The label "Or show this code" is drawn in upper case, so a lookup by `MR.strings.or_show_this_qr_code` text never matches it. | `C/views/newchat/NewChatView.kt:507` `stringResource(MR.strings.or_show_this_qr_code).uppercase()` | Notes: "'Or show this code' is drawn upper-case (`NewChatView.kt:507`): match it ignoring case or by its key" |
+| `oneTimeLinkCliConnectsViaShortLink`, `oneTimeLinkCliConnectsViaFullLink` | Wrong Haskell coverage. `versionTestMatrix2` always passes `withShortLink = True`, and `getInvitation` returns the full "old clients" link. So `testAddContact` only connects via the full link. The short-link connect is `testShortLinkInvitation`. | `tests/ChatTests/Utils.hs:128-134` `(runTest True True)`; `tests/ChatTests/Utils.hs:571-574` `(_, fullInv) <- getInvitations cc`; `H/Profiles.hs:3879-3886` `testShortLinkInvitation` `bob ##> ("/c " <> inv)` with the short link | Short-link row Haskell: "`testShortLinkInvitation` (H/Profiles.hs:3879)"; full-link row Haskell: "`testAddContact` (H/Direct.hs:191; full link in every matrix case)" |
+| `oneTimeLinkCreationErrorShowsRetry` | Imprecise behaviour. With the server down, the first thing shown is the retryable "Connection error" alert, which has its own "Retry" button. Only after that alert is cancelled does the screen show the refresh icon with "Retry". | `C/model/SimpleXAPI.kt:1612` `sendCmdWithRetry`; `:880-889` `confirmText = retry_verb … onDismiss = onCancel`; `:899` `NETWORK -> connection_error`; `C/views/newchat/NewChatView.kt:193,211-223` | Verification: "'Connection error' alert with 'Retry'/'Cancel'; after 'Cancel', the refresh icon with 'Retry'; after the server is started again, tapping it shows the link" |
+| `oneTimeLinkSwitchToIncognito`, `oneTimeLinkSwitchBackFromIncognito`, `oneTimeLinkChangeToOtherProfile`, `oneTimeLinkChangeToHiddenProfileViaPassword`, `oneTimeLinkIncognitoInfoButton` | The Needs `P` covers the info-button test, but that test only opens `IncognitoView` and needs no peer. | `C/views/newchat/NewChatView.kt:248-265,403` `onInfo = { ModalManager.start.showModal { IncognitoView() } }` | split: `oneTimeLinkIncognitoInfoButton` into its own row, Verification "ⓘ next to 'Incognito' opens the incognito info screen", Needs `—`; the other four keep `P` |
+| `pasteLinkInvalidTextAlert`, `planProgressIndicatorAndCancel`, `planInvitationShortLinkOpenNewChat`, `planInvitationFullLinkUseCurrentProfile`, `planInvitationFullLinkUseIncognito`, `planInvitationFullLinkCancel`, `planOwnInvitationConnectToYourself`, `planInvitationAlreadyConnectingFullLink`, `planInvitationKnownContactOpenChat`, `planInvitationDeletedLinkError`, `planAddressShortLinkOpenNewChat`, `planAddressFullLinkConnectAlert`, `planOwnAddressConnectToYourself`, `planAddressRepeatConnectionRequest`, `planAddressConnectingProhibitOpensKnown`, `planAddressKnownContactOpenChat`, `planAddressDeletedContactReconnect`, `planBotAddressShowsBotIcon` | The §8 entry for every row is "Tap to paste link", which reads `LocalClipboardManager` (the clipboard stub), but only the first row lists `CB`. The legend makes Needs exact per name. | §8 entry "Tap to paste link (reads the clipboard stub)"; `C/views/newchat/NewChatView.kt:673-675` `clipboard.getText()` | Add `CB` to the Needs of every listed row (e.g. `P, CB`; `P, S, CB`; `CB` for the own-link rows). Or change the §8 entry to "type the link into the chat-list search" and drop `CB` from `pasteLinkInvalidTextAlert` only where it is not pasted |
+| `planInvitationFullLinkUseCurrentProfile`, `planInvitationFullLinkUseIncognito`, `planInvitationFullLinkCancel`, `planInvitationAlreadyConnectingFullLink`, `planAddressFullLinkConnectAlert`, `planAddressRepeatConnectionRequest`, `pendingInfoAcceptedShowsNoLink`, `pendingInfoGroupLinkHidesAlias` | Not drivable as written with the current-build peer (`P`). That CLI prints "The invitation link for old clients:" (and the full contact or group link) only when started with `--show-full-links`, and the plan §8.1 command line doesn't pass it. (The stable v7.0.3 CLI always prints it, so the `S` run works.) | `src/Simplex/Chat/Options.hs:433-437` `switch (long "show-full-links")`; `src/Simplex/Chat/View.hs:1076` `if showFullLinks && isJust shortLink`; `git show v7.0.3:src/Simplex/Chat/View.hs:1051` `if isJust shortLink` | Notes of each row: "The current-build peer is started with `--show-full-links` (Options.hs:433) so it prints the full link; the stable CLI prints it by default" |
+| `planInvitationFullLinkUseIncognito`, `planInvitationFullLinkCancel` | The shared CLI line "alice: contact is connected" is wrong for incognito (the CLI sees a random name) and for Cancel (nothing connects). | `C/views/newchat/ConnectPlan.kt:477-498` (incognito = true; Cancel only runs `cleanup`) | Verification ends: "…; CLI 'alice: contact is connected' (incognito: '<rand>: contact is connected'; Cancel: no request, no pending row)" |
+| `planProgressIndicatorAndCancel` | Wrong for desktop, and not drivable as written. The "Loading profile…" text is shown only on Android. Desktop shows a bare spinner (chat-list toolbar, new-chat search, paste row), and only after a 1 s real-time delay. A plan against the local server finishes in milliseconds, so the spinner never appears unless the short link's server is stopped. | `C/model/ChatModel.kt:55-61` `delay(1000) … connectProgressByTimeout`; `C/views/chat/ChatView.kt:304` `if (appPlatform.isAndroid && connectInProgressText != null)`; `C/views/chatlist/ChatListView.kt:561-567` (spinner only) | Verification: "With the link's SMP server stopped, the toolbar spinner appears after 1 s (no text on desktop); clearing the chat-list search cancels the plan and the spinner goes away"; Needs `P, SRVCTL, CB` |
+| `planInvitationShortLinkOpenNewChat` | The quoted "invitation link: ok to connect" is printed by the side that runs the plan. Here that side is the GUI, so it is the GUI user's own output quoted as a CLI line. | `H/Profiles.hs:4083-4084` `bob ##> ("/_connect plan 1 " <> shortLink)` / `bob <## "invitation link: ok to connect"` (bob = planner = GUI role) | Haskell: "`testShortLinkInvitationPrepareContact` (4077; Ok plan with short-link data)" |
+| `planAddressShortLinkOpenNewChat` | Same problem: the quoted "contact address: ok to connect" is the planner's (GUI) own output. | `H/Profiles.hs:4194-4195` `bob <## "contact address: ok to connect"` | Haskell: "`testShortLinkAddressPrepareContact` (4188; Ok plan with short-link data)" |
+| `planAddressRepeatConnectionRequest` | (1) The quoted "connecting, allowed to reconnect" is the planner's (GUI) output. (2) `PEERCTL` isn't needed: the request stays pending as long as the CLI doesn't run `/ac`, whether the CLI is online or not. | `H/Profiles.hs:2240-2241` `bob <## "contact address: connecting, allowed to reconnect"`; `src/Simplex/Chat/Library/Commands.hs:4684-4686` (`CAPConnectingConfirmReconnect` comes from the pending connection, not from peer state) | Haskell: "`testPlanAddressConnecting` (2229; ConnectingConfirmReconnect plan)"; Needs `P, CB` |
+| `planOwnInvitationConnectToYourself` | Wrong GUI behaviour. "alice_1/alice_2" are core local display names. The GUI shows both new contacts by profile display name, so the chat list has two rows named "alice". | `C/model/ChatModel.kt:1912` `override val displayName get() = localAlias.ifEmpty { profile.displayName }`; `H/Direct.hs:520-523` `alice_1 (Alice) … alice_2 (Alice)` | Verification: "'Connect to yourself?' / 'This is your own one-time link!' (buttons in the error colour); connecting gives two contacts, both shown as 'alice'. Haskell: `testPlanInvitationLinkOwn` (507)" |
+| `planInvitationAlreadyConnectingFullLink`, `planInvitationConnectingPreparedOpensKnown` | The second test cites the "Connecting with a contact" branch, but the core never returns `ILPConnecting` with a contact. A prepared or connecting contact reached through its short link always plans as `ILPKnown`, so the alert comes from the Known branch: "Open new chat" before Connect, "Open chat" after. `PEERCTL` isn't needed for that test. | `src/Simplex/Chat/Library/Commands.hs:4655-4662` (only `ILPConnecting Nothing`); `:4441` `CPInvitationLink . ILPKnown`; `H/Profiles.hs:4087-4088` `"invitation link: known prepared contact alice"`; `C/views/newchat/ConnectPlan.kt:533` | split: `planInvitationAlreadyConnectingFullLink` keeps the row (Verification "'Already connecting!' / 'You are already connecting via this one-time link!'. Haskell: `testPlanInvitationLinkConnecting` (543)", Needs `P, PEERCTL, CB`); move `planInvitationConnectingPreparedOpensKnown` to the Invitation Known row (`ConnectPlan.kt:143-152,519`) with Verification "Pasting the short link of a prepared contact shows the profile alert with 'Open new chat' (before Connect) / 'Open chat' (after). Haskell: `testShortLinkInvitationPrepareContact` (4087)", Needs `P, CB` |
+| `planAddressConnectingProhibitOpensKnown` | Entry is incomplete. Pasting the short address of a prepared contact returns `CAPKnown` (Known branch), not `CAPConnectingProhibit`. ConnectingProhibit comes only from the full-address lookup, while the contact is active but not ready. | `src/Simplex/Chat/Library/Commands.hs:4511-4516` `getContactToConnect … CAPKnown ct'`; `:4686-4687` `not (contactReady ct) && contactActive ct -> plan $ CAPConnectingProhibit ct` | Entry path: "After Connect on a prepared contact (CLI not yet accepted), paste the CLI's full address"; Verification "Profile alert with 'Open chat'"; Needs `P, CB`; Notes "current-build peer with `--show-full-links`" |
+| `planAddressKnownContactOpenChat`, `planAddressContactViaAddressOpensChat`, `planAddressDeletedContactReconnect` | (1) `planAddressContactViaAddressOpensChat` needs a contact card, which per §6 exists only as a fixture carrying the CLI's address, so it needs `FIXTURE` + `RESTART`. (2) `planAddressDeletedContactReconnect` doesn't get "Open chat"/"Open new chat". After the CLI deletes the contact (`/d alice`, not "deleted the conversation"), the plan is Ok again: the prepare alert for a short link, "Connect via contact address?" for a full one. | `src/Simplex/Chat/Library/Commands.hs:4496-4499` `getContactWithoutConnViaShortAddress … CAPContactViaAddress`; `:4688` `contactDeleted ct -> plan $ CAPOk`; `:4516` `if contactDeleted ct' then Nothing`; `H/Profiles.hs:2304-2305` `"contact address: ok to connect"` | split: (a) `planAddressKnownContactOpenChat`: "'Open chat'. Haskell: `testPlanAddressOkKnown` (2147)", Needs `P, CB`; (b) `planAddressContactViaAddressOpensChat`: "With a contact card for the CLI's address, pasting the address shows 'Open chat' and opens the card's chat. Haskell: `testPlanAddressContactViaAddress` (2341)", Needs `P, CB, RESTART, FIXTURE (contact without connection carrying the CLI's address)`; (c) `planAddressDeletedContactReconnect`: Entry "after the CLI deletes the contact (`/d alice`)", Verification "The plan is Ok again: the prepare alert 'Open new chat' (short link), and connecting gives a new contact. Haskell: `testPlanAddressContactDeletedReconnected` (2276), `testShortLinkAddressDeleteContact` (4230)", Needs `P, CB` |
+| `planSignedAddressCardVerified` | The quoted "owner signature: verified" is printed by the side that receives the card and runs the plan. Here that is the GUI. | `H/Profiles.hs:3953-3955` `bob ##> ("/_connect plan 1 " <> bLink <> " sig=" <> bSig)` / `bob <## "owner signature: verified"` | Verification: "Info line 'Link signature verified.' in the profile alert. Haskell: `testShareAddressViaChat` (3937; verified owner signature)"; Notes "The CLI runs `/ad` before `/share address @alice`" |
+| `planConnectByNameContact`, `planConnectByNameNotFound`, `planConnectByNameOtherKindButton` | Needs differ by name. (1) Not-found needs no peer. (2) The other-kind button needs a name that resolves to both a contact and a channel, and the channel needs a relay. (3) The quote "NAME … NOT_FOUND" is the GUI side's own error output; the GUI shows the "Name not found" alert. | `H/Names.hs:221-228` (only the connecting side `bob`); `H/Names.hs:369-375` `withNewTestChatOpts ps relayTestOpts "cath"` + `prepareChannel1Relay`; `C/model/SimpleXAPI.kt:1707-1710` `simplex_name_not_found`; strings.xml:203 "Name not found" | split: (a) `planConnectByNameContact`: "Profile alert with name caption. Haskell: `testConnectByName`", Needs `P, NAMES`; (b) `planConnectByNameNotFound`: "Alert 'Name not found'. Haskell: `testConnectByNameNotFound`", Needs `NAMES`; (c) `planConnectByNameOtherKindButton`: "Second button 'Join channel %s' when the name also resolves to a channel. Haskell: `testConnectByNameContactAndChannel`", Needs `P, NAMES, RELAY` |
+| `planOpenedViaSimplexUriHandler` | Android only. Nothing on desktop ever sets `chatModel.appOpenUrl`: no desktop URI or argument handler, and the only writer is Android `MainActivity`. A desktop user can't reach this path. | `apps/multiplatform/android/src/main/java/chat/simplex/app/MainActivity.kt:149` `chatModel.appOpenUrl.value = null to uri.toString()` (the only writer); no hit in `common/src/desktopMain` or `desktop/src` | delete row (§8 becomes 27 tests, 1 ignored) |
+| `preparedContactAddressSendRequestWithMessage`, `preparedContactAddressSendRequestWithoutMessage`, `preparedContactSendRequestAlertAddMessage`, `preparedContactAfterConnectShowsContactShouldAccept` | The alert has two buttons, and their labels depend on the compose text: empty gives "Send request without message" / "Add message", text gives "Send request" / "Cancel". "alice> hello" only applies to the with-message test. | `C/views/chat/ComposeView.kt:672-691` `if (empty) compose_view_send_request_without_message else compose_view_send_request … if (empty) compose_view_add_message else cancel_verb` | Verification: "With text: 'Send request' / 'Cancel'; empty: 'Send request without message' / 'Add message' ('Add message' closes the alert). CLI 'alice wants to connect to you!' (plus 'alice> hello' when sent with text); GUI shows 'contact should accept…'. Haskell: `testShortLinkAddressPrepareContact`" |
+| `preparedBotConnect` | "Connected without approval" also needs the CLI address to auto-accept. A bot `peerType` alone doesn't accept requests. | `C/views/chat/ComposeView.kt:1807-1812` (Connect sends the request without the alert); `src/Simplex/Chat/Library/Commands.hs:6155` `/_profile` (sets the profile only) | Notes: "CLI sets peerType bot through `/_profile` and turns on `/auto_accept on` for its address" |
+| `preparedContactChangeProfileBeforeConnect`, `preparedContactIncognitoBeforeConnect` | Wrong behaviour. After connecting, the profile picker is gone (it is shown only while `nextConnectPrepared`). "Can't change profile" appears only while the picker is still shown and the prepared contact already has a connection, i.e. after a failed connect attempt. | `C/views/chat/ComposeView.kt:1686` `if (chat.chatInfo.nextConnectPrepared && …) ComposeContextProfilePickerView`; `C/model/ChatModel.kt:1895-1896` `nextConnectPrepared … activeConn.connStatus == ConnStatus.Prepared`, `profileChangeProhibited get() = activeConn != null`; `C/views/chat/ComposeContextProfilePickerView.kt:128-140` | Verification: "CLI sees the chosen or random profile; after connecting the picker is gone. Haskell: `testShortLinkChangePreparedContactUser` (4762), `testShortLinkInvitationConnectPreparedContactIncognito` (4705)"; add to the Retry row (`preparedContactConnectRetryAfterServerError`): "after the failed attempt, choosing another profile shows 'Can't change profile'" |
+| `pendingInfoSetAliasPersistsToContact` | The quoted "connection 1 alias updated: friend" is the output of the side that sets the alias, which is the GUI. | `H/Profiles.hs:3253-3254` `alice ##> "/_set alias :1 friend"` / `alice <## "connection 1 alias updated: friend"` | Verification: "After the CLI connects, the contact shows the alias. Haskell: `testSetConnectionAlias` (3247; alias carried to the contact)" |
diff --git a/plans/ui-tests/catalogue/verify/01-d.md b/plans/ui-tests/catalogue/verify/01-d.md
new file mode 100644
index 0000000000..3e5093c855
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/01-d.md
@@ -0,0 +1,16 @@
+| Test name(s) | Problem | Evidence (file:line + short quote) | Exact corrected text for the row (or "delete row"/"split: ...") |
+|---|---|---|---|
+| Setup every test needs, item 2 | The list after the colon says every pre-set pref needs `restart()` after it changes. Only three notices are checked once at first composition: SimpleX Lock (`laNoticeShown`), app update (`appUpdateNoticeShown`) and What's New (`whatsNewVersion`). The cards and banners read their prefs reactively through `.state`, and the alerts read theirs when the action runs, so neither group needs a restart. The app-update cite also points at the notice body, not the check. | `C/views/chatlist/ChatListView.kt:950-955` "remember { appPrefs.oneHandUICardShown.state }" … `getStakeBannerDismissed.state`; `C/views/usersettings/UserProfilesView.kt:191` "showHiddenProfilesNotice.state.value"; `:119` "showMuteProfileAlert.get()" (on tap); `C/views/chat/ChatInfoView.kt:259,337` "showDeleteConversationNotice.get()" / "showDeleteContactNotice.get()" (on tap); `desktop/src/jvmMain/kotlin/chat/simplex/desktop/Main.kt:68-77` "!appPrefs.appUpdateNoticeShown.get() … chats.size > 3" | 2. **Pre-set prefs** for onboarded tests unless the test is about them (full list in plan §11.1; onboarding boots keep defaults). Three notices are checked once at first composition, so a test about one of them changes the pref and then calls `restart()`: `laNoticeShown` (the "SimpleX Lock" alert appears once there are more than 3 chats, `C/App.kt:94-103`), `appUpdateNoticeShown` (the app-update channel notice, `desktop/src/jvmMain/kotlin/chat/simplex/desktop/Main.kt:68-77`) and `whatsNewVersion` (What's New, `ChatListView.kt:219-228`). The others take effect without a restart: `oneHandUICardShown`, `addressCreationCardShown`, `getStakeBannerDismissed` (crowdfunding is always available on desktop, `C/views/onboarding/WhatsNewView.kt:1073`), `supporterBannerShown` and `showHiddenProfilesNotice` are read through `.state` (`ChatListView.kt:950-955`, `UserProfilesView.kt:191`); `showMuteProfileAlert`, `showDeleteConversationNotice` and `showDeleteContactNotice` are read when the action runs (`UserProfilesView.kt:119`, `ChatInfoView.kt:259,337`). |
+| Setup every test needs, item 6 | "Create profile" doesn't go to the passphrase step first. It opens profile creation (Step2_CreateProfile), and the passphrase step comes after the profile is created. Only "Link a mobile" goes to it first. | `D/views/onboarding/SimpleXInfo.desktop.kt:20` "create_your_profile, onboarding = OnboardingStage.Step2_CreateProfile"; `C/views/WelcomeView.kt:400-401` (after `apiCreateActiveUser`) "Step2_5_SetupDatabasePassphrase" | 6. **Onboarding goes through the passphrase step.** A fresh database has a random passphrase (`initialRandomDBPassphrase`), so "Link a mobile" goes to "Setup database passphrase" first (`D/views/onboarding/SimpleXInfo.desktop.kt:19`), and "Create profile" goes there right after the profile is created (`C/views/WelcomeView.kt:400`). Tests reaching later steps pass it (e.g. "Use random passphrase"). |
+| `createAddressNoContactsSharesAutomatically`, `createAddressWithContactsAsksToShare`, `createAddressWithContactsAsksToShareCancel` | The Needs cell `P` covers every name, but the no-contacts test has no peer: with no contacts the address is shared at once, with no alert and no CLI output. | `C/views/usersettings/UserAddressView.kt:87-108` "if (hasRelevantContacts) { … showAlertDialog … } else { setProfileAddress(true) }" | split: `\| Address \| Create \| "Create SimpleX address" \| `UserAddressView.kt:74-113` \| `createAddressNoContactsSharesAutomatically` \| No contacts: no alert; the address is created and shared at once ("Share with SimpleX contacts" is on in "Address settings") \| — \| – \|` and `\| Address \| Create \| "Create SimpleX address" \| `UserAddressView.kt:74-113` \| `createAddressWithContactsAsksToShare`, `createAddressWithContactsAsksToShareCancel` \| With contacts: "Share address with SimpleX contacts?" / "Share" (`createAddressWithContactsAsksToShare` taps "Share"); CLI "alice set new contact address, use /info alice to view". Cancel: the address is created but not shared, and the CLI prints nothing. Haskell: `testProfileLink` (1550) \| P \| – \|` |
+| `addressShareViaChat` | Picking bob doesn't send anything. The pick runs `/_share address`, which only returns the content; the GUI puts an address-card preview in bob's compose area, and the test has to click send before the CLI prints anything. | `C/views/chat/ComposeView.kt:1651-1665` "apiShareMyAddress(…) … preview = ComposePreview.ChatLinkPreview"; `src/Simplex/Chat/Library/Commands.hs:1259` "pure $ CRChatMsgContent user MCChat {…}" (only `/share address`, :2582-2584, also sends) | Verification: Share via chat opens the share list; pick bob: bob's chat opens with the address card in the compose preview; click send; CLI "alice> contact address of @alice (signed):" followed by the link line and the signature line. Haskell: `testShareAddressViaChat` |
+| `addressDelete` | Creating an address shares it by default, so "Delete address?" normally shows the longer "…update sent" text. "All your contacts will remain connected." alone appears only when sharing is off. Sharing contacts also get a CLI line. | `C/views/usersettings/UserAddressView.kt:150` "if (shareViaProfile.value) all_your_contacts_will_remain_connected_update_sent else all_your_contacts_will_remain_connected"; strings.xml:1172 "All your contacts will remain connected. Profile update will be sent to your contacts."; `tests/ChatTests/Profiles.hs:1600-1606` "bob <## \"alice removed contact address\"" | Verification: "Delete address?" with "All your contacts will remain connected. Profile update will be sent to your contacts." (address shared, the default after creation; "All your contacts will remain connected." when sharing is off) / "Delete"; each CLI contact gets "alice removed contact address". A new CLI `/c` fails with "error: connection authorization failed…"; pending requests can still be accepted. Haskell: `testProfileLink`, `testRejectContactAndDeleteUserContact`, `testKeepConnectionRequests`, `testShortLinkDeletedAddress` (short link) |
+| `simplexNameEntryShownWithAddress`, `simplexNameValidationIcon`, `simplexNameSaveConfirmBroadcast`, `simplexNameSaveNotOwnAddressError`, `simplexNameRemove`, `simplexNameUnsavedChangesAlert`, `simplexNameRemovedWhenAddressDeleted` | (a) "has no valid connection link" is alice's own CLI output, which the legend forbids quoting. The GUI shows its own alert text instead. (b) Two cited Haskell tests (`testAddressSharingOffRemovesName`, `testUpdateProfileKeepsName`) have no test name in the row. (c) Nothing says what `simplexNameRemovedWhenAddressDeleted` or `simplexNameRemove` assert. "Remove name" only clears the field; "Save" then removes the name. (d) A name registered to another user's address (as the Haskell test does) needs a peer's address, but the row has no `P`. | `C/model/SimpleXAPI.kt:1963-1964` "showAlertMsg(error_saving_simplex_name, ownerMsg)"; strings.xml:960 "The SimpleX name %1$s is registered without SimpleX address…"; `C/views/usersettings/SetSimplexNameView.kt:189` "{ name.value = \"\"; editing.value = true }"; `tests/ChatTests/Names.hs:236-243` "bob ##> \"/ad\" … registerName reg aliceName (… bobShortLink)" | Verification: Error icon for invalid names. "Save" shows "Profile update will be sent to your SimpleX contacts." / "Save" (name registered to alice's address with `register alice.simplex contact=<alice's address>`). A name registered without alice's address shows "Error saving name" / "The SimpleX name alice.simplex is registered without SimpleX address. Add your SimpleX address to the name via the registration page.". With a name set, "Remove name" clears the field and "Save" removes it. Unsaved: "Save SimpleX name?" / "Save" / "Exit without saving". After "Delete address" and "Create SimpleX address", the entry reads "Get SimpleX name (BETA)" again. Haskell: `testSetNameNotOwnAddress` (core error NoValidLink), `testAddressDeleteRemovesName` — Needs: NAMES — Notes: The not-own name is registered with `register alice.simplex` and no `contact=` (using a CLI peer's address instead would need P). The sale countdown depends on the clock |
+| `contactInfoHeaderShowsNameBioCopy` | "Copied to clipboard" is a toast, not an alert, so the test needs `TOAST`. | `C/views/chat/ChatInfoView.kt:745-748` "clipboard.setText(…); showToast(generalGetString(MR.strings.copied))" | Needs: P, CB, TOAST |
+| `contactInfoSendReceiptsNo`, `contactInfoSendReceiptsDefault` | The real CLI never prints ⩗. Receipts appear only with `testView && showReceipts`, and the CLI default is `showReceipts = False`; the Haskell test turns it on in its config. So "CLI sees no ⩗" can't be checked from terminal output. | `src/Simplex/Chat.hs:119` "showReceipts = False"; `src/Simplex/Chat/View.hs:848-851` "CISSndRcvd … \| testView && showReceipts"; `tests/ChatTests/Direct.hs:3457` "cfg = testCfg {showReceipts = True}" | Verification: The CLI sends a message, then reads its status with `/_get chat @<alice's id> count=1` (JSON): with "no", `itemStatus` never becomes `sndRcvd`; with "default (yes)", it becomes `sndRcvd`. The terminal never prints ⩗ (`showReceipts` is off in the real CLI). Haskell: `testConfigureDeliveryReceipts` (`/receipts @bob on`) |
+| `contactInfoFixConnection` | (a) The info-screen "Fix connection" button syncs at once, with no alert. "Fix connection?" / "Fix" is shown only from the call buttons and is commented out for the force variant. (b) `setupDesynchronizedRatchet` desynchronises the side whose database is restored. Restoring the CLI's copy desynchronises the CLI, not alice, and the GUI shows "Fix connection" only when its own stats allow sync. | `C/views/chat/ChatInfoView.kt:144-149` "syncContactConnection = { withBGApi { syncContactConnection(…force = false) …" (no alert); `:994` showFixConnectionAlert only in CallButton; `:600-601` "if (cStats != null && cStats.ratchetSyncAllowed)"; `tests/ChatTests/Direct.hs:3210,3222-3228` "copyDb \"bob\" \"bob_old\" … bob <## \"alice: decryption error (connection out of sync)…\"" | `\| Info \| Fix connection \| "Fix connection" (runs at once, no confirmation) \| `ChatInfoView.kt:144-149,193,600-602` \| `contactInfoFixConnection` \| CLI "alice: connection synchronization agreed" then "alice: connection synchronized". Haskell: `testSyncRatchet` (3242), roles swapped \| P, RESTART, FIXTURE (alice's own database copy restored) \| alice must be the desynchronised side: copy her database, exchange messages, restore the copy between `restart()` steps, then receive a CLI message. Restoring the CLI's copy desynchronises the CLI instead \|` |
+| `contactInfoNotReadyContactHidesSections` | `PEERCTL` isn't needed for a not-ready contact. If alice connects through the CLI's address and the CLI never accepts, the contact stays not ready (`!contact.ready`). | `C/views/chat/ChatInfoView.kt:594,644` "if (contact.ready && contact.active)"; `tests/ChatTests/Names.hs:80-83` (request pending until `/ac`) | Needs: P — Notes: alice connects through the CLI's address; the CLI never sends `/ac`, so the contact stays not ready |
+| `deleteNotReadyContactConfirm` | Same as above: a contact waiting for the CLI to accept is not ready, so `PEERCTL` isn't needed. | `C/views/chat/ChatInfoView.kt:242-243` "else -> // !(contact.sndReady && contact.active) deleteNotReadyContact" | Needs: P — Notes: alice connects through the CLI's address; the CLI never sends `/ac` |
+| `contactDeletedByPeerShowsDeleted` | The GUI chat-list row doesn't show "contact deleted". Its preview is the item "deleted contact" plus the inactive overlay icon; "contact deleted" is the disabled compose text inside the chat. The quoted Haskell lines ("contact deleted", "not ready") come from the receiving side, which here is the GUI user, so they can't be quoted as CLI lines. The CLI's own line was missing. | strings.xml:1772 "rcv_direct_event_contact_deleted">deleted contact; `C/model/ChatModel.kt:5423`; `C/views/chatlist/ChatPreviewView.kt:69` "if (!cInfo.contact.active) inactiveIcon()"; `C/model/ChatModel.kt:1696` "cant_send_message_contact_deleted"; `tests/ChatTests/Direct.hs:597-604` | Verification: CLI "alice: contact is deleted". The GUI row shows the item "deleted contact" with the inactive overlay icon. In the chat the compose field shows "contact deleted" (disabled); clicking it shows "You can't send messages!" (`C/views/chat/SendMsgView.kt:101-112`). Haskell: `testDeleteContactKeepConversation` (receiving side) |
+| `contactPrefsDisappearingMessagesAllow`, `contactPrefsFullDeletion`, `contactPrefsReactions`, `contactPrefsVoice`, `contactPrefsCalls`, `contactPrefsResetRevertsChanges`, `contactPrefsUnsavedAlertSave`, `contactPrefsUnsavedAlertExit`, `contactPrefsContactAllowsReflectsPeer` | (a) "Disappearing messages" has a "You allow" toggle, not the always/yes/no/default dropdown. (b) The example CLI line ("default (no)") holds only after the CLI sets its own voice preference to no, as `testSetContactPrefs` does first. With core defaults it reads "default (yes)". | `C/views/chat/ContactPreferences.kt:180-185` "PreferenceToggle(chat_preferences_you_allow …)"; `src/Simplex/Chat/Types/Preferences.hs:559` "voice = VoicePreference {allow = FAYes}"; `tests/ChatTests/Profiles.hs:3288` "\"voice\": {\"allow\": \"no\"}" | Entry path: Info → "Contact preferences": "Disappearing messages" ("You allow" toggle, "Delete after"), then "Delete for everyone", "Message reactions", "Voice messages", "Audio/video calls", each with a "You allow" dropdown (always/yes/no/default (…)); every section has "Contact allows"; "Reset", "Save and notify contact" — Verification: CLI "alice updated preferences for you:" then e.g. "Voice messages: enabled for you (you allow: default (yes), contact allows: always)" ("default (no)" once the CLI has set voice to no, as `testSetContactPrefs` does); "Save preferences?" / "Save and notify contact" / "Exit without saving". Haskell: `testSetContactPrefs` (3279), `testFeatureOffers`, `testAllowFullDeletionContact` |
+| `contactInfoAbortSwitchAddress` | Weak evidence: the only Haskell abort test runs the switching side with the previous chat version (`testCfgVPrev`), so it doesn't show that a current-build switcher offers an enabled "Abort changing address" while the peer is stopped. | `tests/ChatTests/Direct.hs:3041` "withNewTestChatCfg ps testCfgVPrev \"alice\""; `C/views/chat/ChatInfoView.kt:662-665` "disabled = … !it.canAbortSwitch" | Notes: The CLI is stopped mid-switch. `testAbortSwitchContact` runs the switcher with `testCfgVPrev`; the test must check that "Abort changing address" is enabled (`canAbortSwitch`) with the current build |
diff --git a/plans/ui-tests/catalogue/verify/02-a.md b/plans/ui-tests/catalogue/verify/02-a.md
new file mode 100644
index 0000000000..d4555ad057
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/02-a.md
@@ -0,0 +1,18 @@
+| Test name(s) | Problem | Evidence (file:line + short quote) | Exact corrected text for the row (or "delete row"/"split: ...") |
+|---|---|---|---|
+| `directChat_opens_showsToolbarAndBanner`, `groupChat_opens_showsBannerGroup`, `notes_opens_showsSearchAndContentFilterIcons` | The Needs cell is wrong for one name: the notes test needs no peer, but the row says `P`. Also, the group test's "BannerGroup" check repeats the "Group" context line that `chatBanner_contextText_perChatType` (next row) already asserts. | CV:1240-1254 `is ChatInfo.Local -> { barButtons.add {` (notes, no contact); CV:2280-2283 `else -> generalGetString(... MR.strings.chat_banner_group)` | split: `\| Shell \| Open direct / group chat \| Click the chat in the list \| CV:98, CV:918, CV:1194 \| \`directChat_opens_showsToolbarAndBanner\`, \`groupChat_opens_showsBannerGroup\` \| Title = display name; the banner (avatar and name, CV:2302-2330) is shown. The context line is asserted only in \`chatBanner_contextText_perChatType\` \| P \| \|` and `\| Shell \| Open notes chat \| Click the chat in the list \| CV:98, CV:1240-1254, CV:1339 \| \`notes_opens_showsSearchAndContentFilterIcons\` \| Notes show the search icon ("Search") and the content-filter icon (always added on desktop, CV:1339; \`ContentFilter.alwaysShow\` includes Images and Links, CV:3986) \| — \| Notes title is not clickable (CV:1446) \|` |
+| `toolbarMenu_group_items`, `toolbarMenu_channel_items` | The expected item lists leave out the notification toggle. The toggle is added for every group, channels included, not only for direct chats. | CV:1357 `if (((chatInfo is ChatInfo.Direct && ...) \|\| chatInfo is ChatInfo.Group) && enableNtfs != null) { ... menuItems.add {` | Group row Verification: `Direct: "Search" plus the notification toggle. Group: "Invite members" (\`icon_descr_add_members\`) or "Group link", "Search", plus the notification toggle. The toggle switches the chat's notification mode (\`testMuteContact\`)`; channel row Verification: `"Channel link", "Search", plus the notification toggle (CV:1356-1374)` |
+| `toolbarCall_audio_opensCallLink` | The labels "Audio call" / "Video call" are not the strings this menu uses. It uses `icon_descr_audio_call` = "audio call" and `icon_descr_video_call` = "video call", capitalised at runtime. The verbatim "Audio call" is a different key (`call_service_notification_audio_call`), so a lookup by `MR.strings` key fails. | CV:1545 `ItemAction(stringResource(MR.strings.icon_descr_audio_call).capitalize(Locale.current)`; strings.xml:1392 `<string name="icon_descr_audio_call">audio call</string>` | Trigger: `Call icon → "Audio call" / "Video call" (\`icon_descr_audio_call\` / \`icon_descr_video_call\`, lower-case in strings.xml and capitalised at runtime, CV:1545/1551; the driver looks them up capitalised)`; File:line: `CV:1289, 1542-1556, 906` |
+| `link_click_showsOpenWebLinkAlert`, `link_openClean_opensSanitizedUri` | "Open full link" / "Open clean link" appear only for a URL that has tracking parameters. For any other URL the alert has a single "Open" button. The row doesn't say which URL each test uses. | TextItemView.kt:540-546 `if (sanitizedUri == null) { AlertManager.shared.showAlertDialog(... confirmText = generalGetString(MR.strings.open_verb)`; :547-563 the full/clean buttons; Markdown.hs:468 `"utm",` | Verification: `"Open web link?". For a plain URL (\`http://127.0.0.1/page\`) the alert has "Open"; for a URL with a tracking parameter (\`http://127.0.0.1/page?utm_source=test\`) it has "Open full link" / "Open clean link" / "Cancel", and "Open clean link" makes the \`LocalUriHandler\` stub record the URL without \`utm_source\``; File:line: `C/views/chat/item/TextItemView.kt:371, 533-574` |
+| `linkPreview_sent_peerReceivesLinkContent` | bob's expected `/_get content types @2` line is copied from `testLinkContentFilter`, where "text" comes from the other plain messages in that test. Here bob's chat holds only the preview message, so the core prints only `link`. | Store/Messages.hs:1238 `SELECT DISTINCT msg_content_tag FROM chat_items WHERE ...`; Direct.hs:3577-3586 (plain text messages sent before the check) | Verification: `"Enable link previews?" with "Disable" / "Enable". \`bob <# "alice> http://127.0.0.1:<port>/page"\`; bob's \`/_get content types @2\` prints \`Chat content types: link\` (format from \`testLinkContentFilter\`; "text" appears only after a plain message is also sent)` |
+| `mention_maxReached_showsLimit` (row with `mention_picker_select_insertsAndSends` …) | The `(testMemberMention)` citation is attached to the GUI limit message, which that test doesn't contain. It covers only the CLI lines. | Groups.hs:7965-8001 (no limit text); GroupMentions.kt:274 `String.format(generalGetString(MR.strings.max_group_mentions_per_message_reached), MAX_NUMBER_OF_MENTIONS)` | Verification: `\`bob <# "#team alice!> hello @bob"\`, \`cath <# "#team alice> hello @bob"\` (\`testMemberMention\`). Limit message (GUI only) "You can mention up to 3 members per message!" (\`max_group_mentions_per_message_reached\` formatted with 3, MEN:274)`; File:line: `CV:1043, MEN:37-160, 265-280` |
+| `liveMessage_typingUpdates_peerSeesUpdates` (row with `liveMessage_menuStart_alertConfirm_peerSeesStarted`, `liveMessage_finish_peerSeesEnded`) | The CLI hides intermediate live updates unless `/show on` was run, so the "peer sees updates" test has no CLI line to assert as written. Also, the `N` in `/show [on/off/N]` is bob's item id: `testDirectLiveMessage` prints `8`. | View.hs:869 `\| itemLive == Just True && not liveItems -> []`; Commands.hs:6350 `"/show" *> (ShowLiveItems <$> ...)`; View.hs:2377 `\| updated -> ttyFrom "[LIVE] "`; Direct.hs:926 `[LIVE started] use /show [on/off/8] hello` | Verification: `\`bob <# "alice> [LIVE started] use /show [on/off/<bob's item id>] hello"\`, then \`bob <# "alice> [LIVE ended] hello there"\` (\`testDirectLiveMessage\`). For the typing-updates test bob first runs \`/show on\` (prints \`ok\`) and then prints \`alice> [LIVE] hello …\` for each 3-s update; without \`/show on\` the CLI prints nothing between started and ended (View.hs:869)` |
+| `liveMessage_info_historyHasVersions` | "History has 2 versions" depends on timing. Each 3-s tick that sends changed text adds a version, so a test that types and waits gets 3 or more. | Commands.hs:815-816 `when changed $ addInitialAndNewCIVersions db itemId ...`; CMP:1169-1177 (each tick sends the changed text); SMV:545-550 `delay(3000)` | Verification: `History has at least 2 versions: the oldest "hello", the newest "hello there"; no live option in notes; "LIVE" label on the received message` |
+| `liveMessage_notAvailableInNotes` | Duplicates §W `notes_menu_noReplyLiveTimed` ("the menu has no Reply, live or timed options"). Both check that notes don't offer live messages (CMP:1509). | CMP:1509 `sendLiveMessage = if (chat.chatInfo.chatType != ChatType.Local) ::sendLiveMessage else null`; 02 §W row 1 | split: remove `liveMessage_notAvailableInNotes` from this row (the Count for C becomes 10) and keep the check in §W `notes_menu_noReplyLiveTimed`; or narrow §W to Reply only. Remaining row: `\| Live \| History in Info, received badge \| Info / bob runs \`/live @alice hi\` \| \`C/views/chat/item/FramedItemView.kt:287-288\` \| \`liveMessage_info_historyHasVersions\`, \`liveMessage_received_showsLiveBadge\` \| History has at least 2 versions; "LIVE" label on the received message \| P \| \|` |
+| `timed_meta_showsTimerAndTtl` | When the item's TTL equals the chat TTL, the meta shows only the timer icon, with no TTL text. Under a 3 s chat timer every item has TTL 3, so no TTL text is rendered. The test name suggests a visible TTL. | CIMetaView.kt:86-91 `StatusIconText(painterResource(MR.images.ic_timer), color) ... if (ttl != chatTTL) { Text(shortTimeText(ttl) ...` | Verification: `The GUI feature item reads "Disappearing messages: 3 sec" (\`C/model/ChatModel.kt:4329-4331\`); the received item disappears after 3 s once read; the CLI prints \`timed message deleted: hi\` and \`timed message deleted: hey\` (\`testEnableTimedMessagesContact\`). The item meta shows the timer icon and no TTL text, because the item TTL equals the chat TTL (CIMetaView.kt:89); the TTL (3) is asserted through \`ItemMetaKey.timedTtl\` (plan §4)` |
+| `voice_needToAllow_allowUpdatesPrefs` | The setup that makes the "Allow voice messages?" path reachable is missing. alice's own voice preference must be "no" while bob allows it. With the defaults (both allow), the normal record button is shown and no alert appears. | CMP:1359-1363 `((userPreference as? ContactUserPref.User)?.preference?.allow == FeatureAllowed.NO \|\| ...) && contactPreference.allow == FeatureAllowed.YES` | Notes: `Setup: alice's voice preference for bob is "no" (set before the test through \`/_set prefs @<bobId> {"voice":{"allow":"no"}}\` on the GUI core) and bob runs \`/set voice @alice yes\`; then the microphone is greyed and shows the alert` |
+| `dragDrop_webmAudio_sentAsFile` | Telling audio-only .webm from video .webm uses `VideoPlayer.hasVideoTrack`, a libvlc parse that the approved AV seam doesn't cover. The seam is `getBitmapFromVideo`, RecAndPlay:92 and VideoPlayer:217. Headless, or without libvlc, it returns `false` for every .webm, so the test passes even if the classification is broken. | ComposeView.kt:300 `attachFiles(uris, uris.filter { isWebmUri(it) && hasVideoTrack(it) }.toSet())`; VideoPlayer.desktop.kt:269-299 `vlcPreviewFactory.media().newMedia(...)`, `catch (e: Exception) { ... false }`; plan §11.2 seam table | Needs: `P, XFTP, AV`; Notes: `Driven through \`onFilesAttached\`, as above. \`hasVideoTrack\` (VideoPlayer.desktop.kt:269) must be part of the audio/video seam (plan §11.2), which returns "no video track" for this file; a second .webm with a video track is sent as a video` (and the Seam-use AV count becomes 5) |
+| `paste_filePathText_attachesFile` | "the absolute path" is too narrow. A relative path that names an existing file is attached too, because `File(rel).toURI()` resolves against the JVM working directory. Plan §7.4 says so. | PTF:227-229 `val uri = File(it.removePrefix("\"").removeSuffix("\"")).toURI(); val path = uri.toPath(); if (!path.exists() \|\| !path.isAbsolute \|\| path.isDirectory()) return emptyList()`; plan §7.4 "absolute, or relative to the JVM's working directory" | Verification: `File preview appears (any inserted text of two or more characters whose every line names an existing non-directory file — absolute, or relative to the JVM working directory, optionally in double quotes — is attached; a \`file:///\` URI string is not)` |
+| `attachVideo_undecodable_showsAlert` (row with `attachVideo_send_peerReceivesVideo`) | "decode error alert" doesn't give the alert's exact strings. | Utils.kt:542-546 `title = generalGetString(MR.strings.image_decoding_exception_title), text = generalGetString(MR.strings.video_decoding_exception_desc)`; strings.xml:597, 599 | Verification: `"sends file video_….mp4"; for the undecodable file the alert "Decoding error" / "The video cannot be decoded. Please, try a different video or contact developers." and no preview` |
+| `attachImage_withQuote_peerSeesQuote`, `attachImage_group_allMembersReceive` | The File:line cell is "—", and Verification names only the Haskell tests, with no expected lines. | CMP:877-899 (media send), CMP:947-950 `is ComposeContextItem.QuotedItem -> cs.contextItem.chatItem.id`; Files.hs:302-305, 374-381 | File:line: `CMP:877-899, 947-950`; Verification: `bob <# "alice> > hi alice"\`, \`bob <## "      hey bob"\`, \`bob <# "alice> sends file IMG_….jpg (…)"\` (\`testSendImageWithTextAndQuote\`); \`bob <# "#team alice> sends file IMG_….jpg (…)"\` and \`cath <# "#team alice> sends file IMG_….jpg (…)"\` (\`testGroupSendImage\`; the GUI names compressed images \`IMG_<timestamp>.jpg\`, Utils.kt:184)` |
+| File header / conventions | (a) The fixture list leaves out two files that §F uses: an audio-only .webm (`dragDrop_webmAudio_sentAsFile`) and an undecodable video (`attachVideo_undecodable_showsAlert`). (b) The "controls without a label" list leaves out the compose clear-text (x) button, which has a null content description. (c) "Labels in quotes are exact English strings from strings.xml" doesn't cover labels capitalised or formatted at runtime ("Audio call", "You can mention up to 3 members per message!", "Disappearing messages: 3 sec") or the hard-coded "//" literal. | SMV:320 `Icon(painterResource(MR.images.ic_close), null, ...)`; CV:1545 `.capitalize(Locale.current)`; CMP:1293 `Text("//", ...)` | Fixture files: `\`tests/fixtures/test.jpg\` (136.5 KiB), \`test.pdf\` (266.0 KiB), \`test_1MB.pdf\`, a 17 MB file made with \`xftp rand\`, a sparse file over 1 GB, a GIF, an mp4, an audio-only .webm and an undecodable video file.`; Controls list: `... (selection-toolbar delete/forward, status ticks, scroll buttons, call and content-filter buttons, the compose clear-text (x) button, "go to item" buttons, selection circles, and the live-message bolt, which shares the send button's "Send Message" label) ...`; Conventions: `Labels in quotes are exact English strings from \`strings.xml\`; where the app capitalises or formats a string at runtime, the row names the key, and hard-coded literals (such as "//") are cited at their file:line.` |
diff --git a/plans/ui-tests/catalogue/verify/02-b.md b/plans/ui-tests/catalogue/verify/02-b.md
new file mode 100644
index 0000000000..316ac4d7b4
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/02-b.md
@@ -0,0 +1,14 @@
+| Test name(s) | Problem | Evidence (file:line + short quote) | Exact corrected text for the row (or "delete row"/"split: ...") |
+|---|---|---|---|
+| `rcvFile_serverDown_showsTemporaryError`, `sndFile_xftpDown_showsFileError` | Stopping the XFTP server can't produce either alert. A stopped server gives `BROKER NETWORK`, a temporary error that the XFTP agent retries silently. `RFWARN`/`SFWARN` (RcvWarning/SndWarning, "Temporary file error") are sent only for `serverHostError`, which is `HOST` or `TEVersion`. `HOST` needs `requiredHostMode`, and its UI is commented out. No `SFERR` is sent either: after `xftpConsecutiveRetries` (3) failed attempts the worker just stops, so the item keeps its progress indicator and never reaches "File error". The cited range CIFileView:259-276 has also drifted: `showFileErrorAlert` is at :255-271 | simplexmq `FileTransfer/Agent.hs:219` "when (serverHostError e) $ notify c … (RFWARN e)", :542 same for SFWARN, :268-271 `withRetryIntervalLimit` "when (n < maxN)", :276 "if temporaryOrHostError e then loop"; `Agent/Client.hs:1293-1294` "PCENetworkError e -> BROKER host $ NETWORK e", "PCEIncompatibleHost -> BROKER host HOST", :1633-1636 brokerHostError = HOST or TEVersion; `Env/SQLite.hs:257` "xftpConsecutiveRetries = 3"; app `AdvancedNetworkSettings.kt:87` "//      requiredHostMode = …"; CIFileView.kt:255 "fun showFileErrorAlert" | split: (a) `\| Errors \| Auth error \| Click the failed item \| CIFileView:100-101, 255-271 \| `rcvFile_xftpAuthError_showsFileErrorAlert` \| "File error" (`testXFTPRcvError` FileErrAuth) \| P, XFTP, SRVCTL \| The XFTP server is restarted without its store (`reset xftp1`) before the GUI receives \|`; (b) `\| Errors \| Send error \| Send the 17 MB file; `reset xftp1` during the upload; click the failed item \| CIFileView:104-105, 255-271 \| `sndFile_xftpResetDuringUpload_showsFileError` \| "File error": the next chunk upload gets AUTH, a permanent error, so the agent sends SFERR (SndError) \| P, XFTP, SRVCTL \| Uses the 17 MB file, so the reset lands mid-upload (plan §11.1 Server control) \|`; (c) `\| Errors \| Temporary file error \| — \| CIFileView:102-103, 106-107 \| `rcvFile_temporaryError_showsTemporaryFileError` \| "Temporary file error" \| IGNORE: a state the local servers can't produce — agent-level connection failures (RcvWarning/SndWarning need a BROKER HOST error; a stopped server gives NETWORK, which the agent retries silently) \| \|`. Section G stays at 20 tests, with 1 ignored |
+| `rcvFile_missingOnDisk_toastFileNotFound` | On desktop without a remote host, clicking the file after deleting it from disk does nothing and shows no toast. `getLoadedFilePath` checks `File.exists()`, so `forwardingAllowed()` is false and the click falls through to `else -> {}`. The "File not found" toast is reached only when connected to a remote host | CIFileView.kt:108 "file.forwardingAllowed() ->", :120 "showToast(…file_not_found)", :124 "else -> {}"; ChatModel.kt:4610-4614 "getLoadedFilePath(this) != null -> true"; platform/Files.kt:170-171 "File(filePath).exists() &&" | `\| Open \| File missing on disk \| Delete the received file on disk, then click the item and open its menu \| CIFileView:108-124, `C/model/ChatModel.kt:4610-4614` \| `rcvFile_missingOnDisk_clickDoesNothing` \| The click opens no dialog and records no toast; the menu has no "Save", "Share", "Copy" or "Forward" \| P, XFTP, TOAST, FD \| FD only asserts that no save dialog is awaiting; "File not found" appears only when connected to a remote host (CIFileView:111-120), owned by catalogue 04 §L \|` |
+| `fullScreen_galleryNavigates` | Desktop has no next/previous navigation in the full-screen view. `HorizontalPager` is used only on Android; desktop renders `Content(pagerState.currentPage)` and has no key handler, arrow or pager. A click on the image closes the view | `C/views/chat/item/ImageFullScreenView.kt:173-177` "if (appPlatform.isAndroid) { HorizontalPager(…) } else { Content(pagerState.currentPage) }"; :82 ".clickable(… onClick = goBack)" | `\| Viewer \| Full-screen image; click closes it \| Click the image; click the full-screen image \| `D/views/chat/item/CIImageView.desktop.kt:30`, `C/views/chat/item/ImageFullScreenView.kt:82, 173-177` \| `rcvImage_click_opensFullScreen`, `fullScreen_click_closes` \| Full-screen view opens; a click closes it (desktop has no gallery paging) \| P, XFTP \| \|` |
+| `forwarded_received_showsHeader` | A message received as forwarded from a contact carries `CIForwardedFrom.Unknown`. It shows the one-line header "forwarded", not "forwarded from". The two-row "forwarded from" header appears only for a Group with `groupType`, a GroupLink, or in notes (where it reads "saved from") | `src/Simplex/Chat/Library/Internal.hs:256` "Nothing -> pure $ Just CIFFUnknown"; `C/views/chat/item/FramedItemView.kt:317-327` twoRowHeader, :345 "FramedItemHeader(forwarded.text(chatInfo.chatType) …)"; ChatModel.kt:4201 "forwarded_description"; strings.xml:70 "forwarded" | `\| Source \| Go to source; received forwarded header \| Hover → arrow button; receive a forwarded message \| CIV:284-302, `C/views/chat/item/FramedItemView.kt:345` \| `forwarded_goToSource_opensOriginalChat`, `forwarded_received_showsHeader` \| The arrow opens the chat with bob at the original item; the received item's header reads "forwarded" (`cath <# "alice> -> forwarded"` in `testForwardContactToContact`) \| P \| The arrow button gets a key in K2 \|` |
+| `edit_notOffered_forReceivedVoiceForwarded`, `edit_group_membersSeeEdited` | The "voice" case needs alice's own sent voice message, because received items are never editable. The GUI can only make one by recording, so it needs REC (plan §11.2) and XFTP. Needs apply to every name, so the row must be split. The REC seam-use count under §Y then goes from 7 to 8 | CIV:464 "cItem.meta.editable && cItem.content.msgContent !is MsgContent.MCVoice"; `src/Simplex/Chat/Messages.hs:538` "editable = deletable && isNothing itemForwarded" | split: `\| Rules \| No Edit on received, own voice or forwarded \| — \| CIV:464 \| `edit_notOffered_forReceivedVoiceForwarded` \| The item menu has no "Edit" for a received item, alice's recorded voice message or a forwarded item (the core would refuse a forwarded edit, `testForwardEditProhibited`) \| P, XFTP, REC \| \|` and `\| Rules \| Group edit \| "Edit" in a group \| CIV:464-469 \| `edit_group_membersSeeEdited` \| bob and cath print `bob <# "#team alice> [edited] hey 👋"` / `cath <# "#team alice> [edited] hey 👋"` (`testGroupMessageUpdate`) \| P \| \|`. Also update §Y "REC — 7" to "REC — 8" |
+| `reply_notOfferedInNotes`, `reply_whileEditing_replacesEdit` | `reply_notOfferedInNotes` duplicates §W `notes_menu_noReplyLiveTimed` ("the menu has no Reply"). Its Needs `P` is also wrong, because notes need no peer. The other test's verification is missing | 02 §W row "`notes_menu_noReplyLiveTimed` … the menu has no Reply, live or timed options \| —"; CIV:407 "!cItem.localNote", :409-410 "if (composeState.value.editing) { composeState.value = ComposeState(contextItem = ComposeContextItem.QuotedItem(cItem) …" | `\| Rules \| Reply replaces edit \| "Edit" an own message, then "Reply" on another \| CIV:407-416 \| `reply_whileEditing_replacesEdit` \| The edit context and the edited text are replaced by an empty compose quoting the chosen item \| P \| No Reply in notes is covered by §W `notes_menu_noReplyLiveTimed` \|`. Section H goes to 7 tests; update the heading, `## Count` and the file header |
+| `sndFile_stopDuringUpload` | The verification doesn't match the core. For XFTP the peer gets the file invitation before the upload finishes, and on "Stop" the core sends `XFileCancel`, so bob prints a cancel line. "the peer gets no file" can't be checked exactly. Stopping the server before the action keeps the item in SndStored/SndTransfer, so "Stop file" is offered | ChatModel.kt:4537-4538 "SndStored -> sndCancelAction", "SndTransfer -> sndCancelAction"; `src/Simplex/Chat/Library/Commands.hs:3532` "sendDirectContactMessage user contact $ XFileCancel sharedMsgId"; `tests/ChatTests/Files.hs:976` "bob <## \"alice cancelled sending file 1 (test.pdf)\"" | `\| Cancel \| GUI stops during upload \| "Stop file" → "Stop sending file?" → "Stop" \| CIV:483-485, 1378, `C/model/ChatModel.kt:4709-4716` \| `sndFile_stopDuringUpload` \| `bob <# "alice> sends file test.pdf (266.0 KiB / 272376 bytes)"`, then after "Stop" `bob <## "alice cancelled sending file 1 (test.pdf)"`; the GUI item shows the cancelled icon \| P, XFTP, SRVCTL \| The XFTP server is stopped before sending, so the upload can't finish first \|` |
+| `rcvImage_large_clickDownloads` | Not drivable as written: no image over the auto-receive limit (522240 bytes) exists. The fixture list's only image is `test.jpg` (139737 bytes), and `tests/fixtures` holds nothing larger than `test_1MB.pdf` | `C/views/helpers/Utils.kt:118-119` "MAX_IMAGE_SIZE: Long = 261_120", "MAX_IMAGE_SIZE_AUTO_RCV = MAX_IMAGE_SIZE * 2"; `ls tests/fixtures`: logo.jpg 32080, test.jpg 139737 | Notes cell: `` `/f` would send a file message, not an image (Library/Commands.hs:3487-3491). The image is a JPEG over 522240 bytes generated by the harness into the peer's directory (add "a JPEG over 510 KiB" to the fixture-file list in the header and plan §11.1) `` |
+| `edit_unchanged_noUpdate` | The verification column covers only `edit_menu_updatesPeer`. The unchanged-edit case has a defined outcome: the core answers `chatItemNotChanged`, sends nothing, and the item isn't marked edited | `tests/ChatTests/Direct.hs:672-673` "alice ##> (\"/_update item @2 \" <> itemId 1 <> \" text hello 🙂\")", "alice <## \"message didn't change\""; `C/model/SimpleXAPI.kt:1301` "r.res is CR.ChatItemNotChanged -> return r.res.chatItem" | Verification cell: `` `bob <# "alice> [edited] hey 👋"` (`testDirectMessageUpdate`); submitting an unchanged edit prints nothing on bob and the item's meta stays not edited (core "message didn't change", same test) `` |
+| `delete_received_fullDelete_removed` | The verification doesn't cover this test, and its precondition is missing: bob can fully delete his message only if alice allows full deletion for him | `tests/ChatTests/Profiles.hs:3445-3452` "alice ##> \"/set delete @bob always\"" … "alice <# \"bob> [deleted] hey\"", then the item is gone from `/_get chat` | Verification cell: `"marked deleted", "Reveal", "Hide"; with full deletion allowed, bob's broadcast delete removes the item from the GUI chat (`testAllowFullDeletionContact`)`; Notes cell: `For the full-delete test alice first sets "Delete for everyone" to "always" for bob in contact preferences (setup only; the preferences screen is owned by catalogue 01 §14)` |
+| `copyShare_hidden_whenNoContent` | The verification cell is "—", so nothing is asserted | CIV:419-423 "cItem.content.text.isNotEmpty() -> true; cItem.file?.forwardingAllowed() == true -> true; else -> false" | Verification cell: `The menu of a received file with no text that isn't downloaded has no "Copy" and no "Share"; after download both appear` and Needs `P, XFTP` |
+| `textSelection_dragAcrossItems_copyButton`, `textSelection_ctrlC_copies` | Line drift: the Copy button's click handler is at TSEL:543 (`SelectionCopyButton` is :528-551), not ~549 (the icon) | `C/views/chat/TextSelection.kt:528` "fun SelectionCopyButton()", :543 "manager.onCopySelection?.invoke()" | File:line cell: `TSEL:354, 528-551` |
diff --git a/plans/ui-tests/catalogue/verify/02-c.md b/plans/ui-tests/catalogue/verify/02-c.md
new file mode 100644
index 0000000000..67a58ebe51
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/02-c.md
@@ -0,0 +1,16 @@
+| Test name(s) | Problem | Evidence (file:line + short quote) | Exact corrected text for the row (or "delete row"/"split: ...") |
+|---|---|---|---|
+| `report_member_spam_moderatorsReceive`, `report_reasons_allListed`, `report_sentAlert_dontShowAgain`, `report_cancelReason` | The row uses three peers (bob, cath, dan) but Needs says `P`, while O2/O3 with the same setup say `P ×3`. The reasons are also listed out of UI order | `C/model/ChatModel.kt:5304` `listOf(Spam, Illegal, Community, Profile, Other)`; strings.xml:122-126 | Needs: `P ×3`. Verification reasons: "Spam", "Inappropriate content", "Community guidelines violation", "Inappropriate profile", "Another reason" (rest of row unchanged) |
+| `info_history_listsVersions`, `info_historyBubble_copy` | Trigger says "History" tab, but with only one tab (direct chat, no quote or forward) there is no tab row: HistoryTab is drawn directly | INFO:480 `if (numTabs() > 1) {` … INFO:554-556 `} else { HistoryTab() }` | Trigger: `"Info" (history is shown directly; "History" is a tab only when there are two or more tabs)` (rest unchanged) |
+| `status_serverDown_warningAlert`, `status_pending_whileServerDown` | "Message delivery warning" never appears when the SMP server is stopped. A refused connection is `BROKER NETWORK`, and the agent sends MWARN for temporary errors only when `serverHostError` (HOST / TEVersion) is true, so the item just stays pending until `messageTimeout` (2 days) | simplexmq @ee66dd68 `Agent.hs:2671` `when (serverHostError e) $ notify $ MWARN`; `Agent/Client.hs:1627-1637` `HOST -> True`; `Agent/Client.hs:1293/1298` `NETWORK` | split: `\| Errors \| Pending while the server is down \| Stop the SMP server, send \| CIMetaView:99-109, `C/model/ChatModel.kt:4031` \| `status_pending_whileServerDown` \| The item stays pending (item meta status sndNew); no warning appears \| P, SMP, SRVCTL \| \|` + `\| Errors \| Delivery warning alert \| bob is stopped; alice sends 17 messages to bob \| CIV:130-138, `C/model/ChatModel.kt:4051-4061` \| `status_quotaExceeded_warningAlert` \| Clicking the warning icon shows "Message delivery warning" \| P, PEERCTL \| The test server's quota is 16 messages per queue (plan §8.2); the agent sends MWARN on QUOTA (simplexmq Agent.hs:2632) \|` |
+| `meta_signature_missingAlert` | File:line cites only the icon. The "Signature missing" alert is opened by the item click handler and its text comes from the model | CIV:130 `val info = cItem.meta.itemStatus.statusInto ?: cItem.meta.msgVerified?.sigMissingInfo`; `C/model/ChatModel.kt:2730-2733` `sigMissingInfo` | File:line: `CIV:130-138, `C/model/ChatModel.kt:2730-2733`, CIMetaView:118-121` |
+| `featureOffer_timed_set1Day` | Nothing in the trigger produces the timed offer. "Accept"/"Set 1 day" is shown only when the GUI user doesn't allow the feature, but the default user prefs allow timed messages, so a bob offer shows no button. The trigger lists only voice and delete | CIFeaturePreferenceView.kt:30 `contact.allowsFeature(feature) && !contact.userAllowsFeature(feature)`; :32 `setParam = … ttl == null`; `src/Simplex/Chat/Types/Preferences.hs:556` `timedMessages = … allow = FAYes` | Trigger: `bob `/set voice @alice no`; `/set delete @alice yes`; for the timed offer alice first turns off "Disappearing messages" for bob, then bob `/set disappear @alice yes 30s`` (rest unchanged) |
+| `callItem_incoming_answerButton`, `callItem_endedStates`, `callItem_answerEnded_showsAlert` | `callItem_answerEnded_showsAlert` can't be reached as described. A peer's `x.call.end` turns a pending item into "missed call" (no Answer button), and stored invitations are reloaded on start, so a Pending item always still has its invitation | `src/Simplex/Chat/Library/Internal.hs:725` `(Just CISCallPending, WCSDisconnected) -> Just (CISCallMissed, 0)`; `Library/Commands.hs:354-361` `restoreCalls`; CICallItemView.kt:34-37 | split: `\| Calls \| Incoming call item with answer; ended states \| bob `/_call invite @2 …`, `/_call end @2` \| CIV:600, CV:616-627, `C/views/chat/item/CICallItemView.kt:32-58` \| `callItem_incoming_answerButton`, `callItem_endedStates` \| "Answer call"; the item's ended/missed states (`testNegotiateCall`) \| P, URI \| Answering launches the browser through the `LocalUriHandler` stub \|` + `\| Calls \| Answering a call whose invitation is gone \| bob invites; between two restart() steps the `calls` row is deleted from the GUI database; click "Answer call" \| CV:616-627 \| `callItem_answerEnded_showsAlert` \| "Call already ended!" \| P, RESTART, FIXTURE (calls row deleted) \| The item stays pending but `apiGetCallInvitations` returns nothing \|` |
+| `integrityError_skipped_devToolsVisible` | The example label is wrong: the format string is printed literally with "(s)" | strings.xml:1444 `%1$d skipped message(s)`; `C/model/ChatModel.kt:5398` `String.format(generalGetString(MR.strings.integrity_msg_skipped), toMsgId - fromMsgId + 1)` | Verification: `The item reads "%1$d skipped message(s)" (e.g. "3 skipped message(s)"; setup as in `testMsgDecryptError`)` |
+| `invalidJson_item_rendered` | The fixture changes a chat item the test created, "written with the core stopped", so it is applied between `restart()` steps, but `RESTART` is missing (legend FIXTURE: "then also RESTART") | 00-legend.md:49 "between `restart()` steps for data the test produced itself (then also `RESTART`)" | Needs: `P, RESTART, FIXTURE (unparseable chat item)` |
+| `contentFilter_links_showsOnlyLinks`, `contentFilter_withSearchText` | Verification quotes the GUI user's own CLI output ("Chat content types: link, text" is alice's `/_get content types` reply), which the legend forbids | `tests/ChatTests/Direct.hs:3586-3587` `alice ##> "/_get content types @2"` / `alice <## "Chat content types: link, text"`; 00-legend.md:30 | Verification: `Only link messages remain: the items the core returns for `/_get chat @2 content=link count=100` in `testLinkContentFilter`` |
+| `contentFilter_menu_listsAvailableTypes`, `contentFilter_files`, `contentFilter_images`, `contentFilter_allMessages_resets` | Verification is incomplete. The menu always includes Images and Links as well as the types present, and "All messages" appears only while a filter is active | CV:865 `types.union(ContentFilter.alwaysShow)`; CV:3987 `alwaysShow = setOf(Image, Link)`; CV:1506 `if (showSearch.value) {` … "All messages" | Verification: `The menu lists the types present in the chat plus "Images" and "Links" (always shown); "All messages" appears only while a filter is active; file list from `runTestMessageWithFile`` |
+| `draft_voiceRecording_finishedOnSwitch` | File:line drift: CMP:1381-1395 is the live-message branch. The unfinished voice preview is finished at 1408-1412 | CMP:1408 `if (cs.preview is ComposePreview.VoicePreview && !cs.preview.finished) {` … :1411 `copy(finished = true)` | File:line: `CMP:1408-1415` |
+| `hover_showsGoToButton` | Wrong behaviour, nothing to assert, and a duplicate. The go-to button is always present (search results / forwarded items); hover only changes its background and tint. Its click is covered by `forwarded_goToSource_opensOriginalChat` (§L) and `search_goToResult_opensAroundItem` (§R) | CIV:249 `val fullyVisible = parentActivated.value \|\| buttonActivated.value \|\| hoveredItemId.value == cItem.id`; CIV:250-266 colour only; CIV:283-302 button rendered without hover | delete row (X becomes 5 tests; file total 275) |
+| `rcvFile_inlineSmpTransfer_waitingAlert` | The quoted alert text is not verbatim (truncated), the title is missing, and File:line has no line | strings.xml:684 `Waiting for file`; :686 `File will be received when your contact is online, please wait or check later!`; CIFileView.kt:93-97 | Feature: `Inline (SMP) file transfer and its "Waiting for file" alert ("File will be received when your contact is online, please wait or check later!")`; File:line: `C/views/chat/item/CIFileView.kt:93-97` |
+| `send_apiFailure_restoresCompose` | File:line has no line | CMP:978 `val lastFailed = lastMessageFailedToSend`; :989-1007 restore / save as draft | File:line: `CMP:978-1007` |
diff --git a/plans/ui-tests/catalogue/verify/03-a.md b/plans/ui-tests/catalogue/verify/03-a.md
new file mode 100644
index 0000000000..b2aa3d326a
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/03-a.md
@@ -0,0 +1,25 @@
+| Test name(s) | Problem | Evidence (file:line + short quote) | Exact corrected text for the row (or "delete row"/"split: ...") |
+|---|---|---|---|
+| `createGroupIncognito_opensGroupLinkStep`, `createGroupIncognito_inviteMembersProhibited`, `createGroupIncognito_cliJoinerSeesIncognitoHost` | (a) The Needs are not the same for every name: only the CLI-joiner test needs a peer, but the row says `P` for all three. (b) The link step does not show «Create link» as the row claims: GroupLinkView creates the link by itself on open, so the step shows the QR code, «Share link» and «Continue». «Create link» is visible only until the link exists. | V/chat/group/GroupLinkView.kt:119-123 `LaunchedEffect(Unit) { if (groupLink == null && !creatingLink) { createLink() } }`; :207-217 (button only `if (groupLink == null)`); :250-296 (Share link / Continue when creatingGroup; no «Delete link» :279) | split: (1) `\| Incognito group \| «Incognito» toggle ▸ «Create group» \| V/newchat/AddGroupView.kt:59-62,170; V/chat/group/GroupLinkView.kt:119-123,288-296 \| `createGroupIncognito_opensGroupLinkStep`, `createGroupIncognito_inviteMembersProhibited` \| The «Group link» step opens and creates the link by itself: QR code, «Share link», «Continue» (no «Delete link»). In Group info the «Invite members» row keeps its label in the secondary (grey) colour, and tapping it shows the alert «Can't invite contacts!» (V/chat/group/GroupChatInfoView.kt:757-758; V/chatlist/ChatListNavLinkView.kt:920-925) \| — \| — \|`; (2) `\| Incognito group, CLI joiner \| «Incognito» toggle ▸ «Create group» ▸ link to CLI \| V/newchat/AddGroupView.kt:59-62 \| `createGroupIncognito_cliJoinerSeesIncognitoHost` \| CLI `/c <link>` gives `connection request sent!`, `#team: joining the group...`, `#team: you joined the group`; when alice sends hello, the CLI shows `#team <incognito>> hello` (testNewGroupIncognito, H/Groups.hs:572) \| P \| — \|` |
+| `inviteMembers_reAddInvitedMember` | The row has no file:line, and Verification only cites the Haskell test, with no visible effect or CLI line to assert. | V/chat/group/AddGroupMembersView.kt:98-100 `.filter { it.memberCurrent }` (MemInvited isn't current, C/model/ChatModel.kt:2918); H/Groups.hs:924-931 second `bob <## "#team: alice invites you to join the group as member"` | `\| Re-add invited member \| Group info ▸ «Invite members» again \| V/chat/group/AddGroupMembersView.kt:96-111 \| `inviteMembers_reAddInvitedMember` \| bob, invited but not yet joined, is still in the list (only current members are excluded). Inviting him again gives the CLI a second `#team: alice invites you to join the group as member` / `use /j team to accept` (testGroupReAddInvited, H/Groups.hs:909) \| P \| — \|` |
+| `groupInfo_muteCycleWithMentions` | `P` is not needed. The mute button depends only on `groupInfo.ready` (= `membership.memberActive`, true for the creator), and the Mentions step is always offered for groups (`nextMode(true)`). | V/chat/group/GroupChatInfoView.kt:425,431 `nextMode(true)`, `disabled = !groupInfo.ready`; C/model/ChatModel.kt:2499 `ready get() = membership.memberActive`; C/model/SimpleXAPI.kt:5437-5442 | Needs: `—` (rest of row unchanged) |
+| `groupInfo_prefsFooterByChatType` | The test name promises to check several chat types, but the row is `—` and checks only the group wording. The channel wording needs `RELAY` and the business wording needs a business peer (`P`), and no other row checks either. | V/chat/group/GroupChatInfoView.kt:726-729 `only_channel_owners_can_change_prefs` / `only_group_owners_can_change_prefs` / `only_chat_owners_can_change_prefs` | `\| Prefs footer \| Group info \| V/chat/group/GroupChatInfoView.kt:726-729 \| `groupInfo_prefsFooterForGroup` \| «Only group owners can change group preferences.» \| — \| The channel («Only channel owners can change channel preferences.») and business («Only chat owners can change preferences.») footers belong in §18 and §20 \|` (rename the test; counts unchanged) |
+| `editGroupProfile_renameNotifiesMembers`, `editGroupProfile_shortDescription` | No expected CLI output is given for `editGroupProfile_shortDescription`. The core prints `description changed to: …` when the short description changes. | src/Simplex/Chat/View.hs:2114 `["description " <> ... "changed to: " ...  \| n == n' && fullName == fullName' && shortDescr /= shortDescr']`; H/Groups.hs:1624-1625 `bob <## "alice updated group #my_team: (signed)"` / `bob <## "description changed to: My team"` | Verification: «Save group profile». CLI after a rename: `alice updated group #team: (signed)` / `changed to #my_team`. CLI after setting «Short description:»: `alice updated group #team: (signed)` / `description changed to: <text>` (testUpdateGroupProfile, H/Groups.hs:1594) |
+| `editGroupProfile_changeImage` | "Members get the profile update" names no line to assert. The core prints `profile image updated`. | src/Simplex/Chat/View.hs:2115 `["profile image " <> maybe "removed" (const "updated") image'` | Verification: New avatar in Group info; each CLI member prints `alice updated group #team: (signed)` / `profile image updated` |
+| `editGroupProfile_hiddenForNonOwner` | File cited without a line. | V/chat/group/GroupChatInfoView.kt:714-717 `if (groupInfo.isOwner && groupInfo.businessChat?.chatType == null) { ... EditGroupProfileButton` | Main file:line: `V/chat/group/GroupChatInfoView.kt:714-717` |
+| `welcomeMessage_readOnlyForMember` | File cited without a line. | V/chat/group/WelcomeMessageView.kt:135-139 `} else { ... TextPreview(wt.value, linkMode); CopyTextButton` | Main file:line: `V/chat/group/WelcomeMessageView.kt:97,135-139` |
+| `welcomeMessage_receivedAsFirstItem` | File cited without a line, and no code in ChatItemView.kt is specific to welcome messages (the core delivers it as an ordinary received message). | H/Groups.hs:1748 `cath <# "#team alice> Welcome to the team!"` (the first item after `you joined the group`) | Main file:line: `—` (core: the host sends the description as a message on join, testGroupDescription H/Groups.hs:1746-1749) |
+| `groupPrefs_reactionsOff_hidesReactionMenu` | The cited Haskell test never turns reactions off; it only adds and removes reactions. No CLI line for the change is given. | H/Groups.hs:4327-4345 testSetGroupMessageReactions (`+1 #team hi`, no `/set reactions`); src/Simplex/Chat/View.hs:2121-2124 prints `groupPreferenceText`; V/chat/item/ChatItemView.kt:157,404 `cInfo.featureEnabled(ChatFeature.Reactions)` | Verification: CLI `Message reactions: off`; the reaction row and the reaction items of the item menu are absent (V/chat/item/ChatItemView.kt:157,404). A CLI `+1 #team hi` is rejected with `bad chat command: feature not allowed Message reactions` (src/Simplex/Chat/Library/Commands.hs:980) |
+| `groupPrefs_voiceOff_showsNotAllowed`, `groupPrefs_voiceForAdminsOnly` | (a) Wrong compose text. With voice off, compose does not show «Voice messages not allowed»: that banner appears only when the compose preview is a voice preview and the item is being edited. What actually happens is that the microphone button gets the disabled look, and tapping it shows the alert. (b) Off applies to every role, so the off case can be tested with alice as owner. The note "for a member alice" and "bob is the CLI host" belong only to the admins-only case. | V/chat/ComposeView.kt:1737-1746 `voiceProhibited = composeState.value.preview is ComposePreview.VoicePreview && ...`, `if (preview !is VoicePreview \|\| editing)`; V/chat/SendMsgView.kt:142-148 `DisallowedVoiceButton { ... showDisabledVoiceAlert(isDirectChat) }`, :585-594; C/model/ChatModel.kt:2509 `Voice -> voice.on(membership)` | Verification: `groupPrefs_voiceOff_showsNotAllowed`: alice (owner) saves «Voice messages» off and the CLI prints `Voice messages: off`. alice's microphone button gets the disabled look, and tapping it shows «Voice messages prohibited!» / «Only group owners can enable voice messages.» (V/chat/SendMsgView.kt:142-148,585-594). `groupPrefs_voiceForAdminsOnly`: the CLI host bob runs `/set voice #team on admin`, and alice (member) sees the same disabled microphone and alert. Notes: For `groupPrefs_voiceForAdminsOnly` bob is the CLI host and alice a member. «Voice messages not allowed» appears only while editing a voice item (ComposeView.kt:1737-1746) |
+| `groupPrefs_directMessagesForOwnersOnly` | The Verification suggests alice sees «Can't message group member» in both tests. For "on for owners" alice is the owner, so `directMessages.on(membership)` is true and her message button stays active. Only the CLI member is refused. | V/chat/group/GroupMemberInfoView.kt:514 `else if (groupInfo.fullGroupPreferences.directMessages.on(groupInfo.membership))`; :528-532 alert only in the `else` branch | Verification: `Direct messages: off` / `Direct messages: on for owners`. In both cases the CLI member's `@cath hi` gets `bad chat command: direct messages not allowed`. Only with off does alice's member-info message button show «Can't message group member»; with on-for-owners alice (owner) keeps an active message button (testProhibitDirectMessages H/Profiles.hs:3483; testGroupPrefsDirectForRole :3683) |
+| `groupPrefs_filesForOwnersOnly` | The quoted CLI line is a fragment. The full line has the `bad chat command:` prefix. | H/Profiles.hs:3770 `bob <## "bad chat command: feature not allowed Files and media"` | Verification: `Files and media: on for owners`; CLI member `bad chat command: feature not allowed Files and media` (testGroupPrefsFilesForRole, H/Profiles.hs:3752) |
+| `groupPrefs_simplexLinksForOwnersOnly` | The Haskell test is cited by line only, with no name, and the CLI rejection line is missing. | H/Profiles.hs:3787 `testGroupPrefsSimplexLinksForRole`; :3801 `bob <## "bad chat command: feature not allowed SimpleX links"` | Verification: `SimpleX links: on for owners`; a CLI member's message with a SimpleX link gets `bad chat command: feature not allowed SimpleX links` (testGroupPrefsSimplexLinksForRole, H/Profiles.hs:3787) |
+| `groupPrefs_resetRestoresSaved`, `groupPrefs_unsavedChangesAlert` | `P` is not needed. Reset, the save button state and the «Save preferences?» alert are local to the screen, and an owner can save preferences in a group with no members. | V/chat/group/GroupPreferences.kt:64-68,241-251,340-360 (no member dependency) | Needs: `—` (rest of row unchanged) |
+| `review_pendingMemberListedInChatsWithMembers`, `review_hostChatsWithPendingMember`, `review_acceptAsMember`, `review_acceptAsObserver`, `review_rejectPendingMember`, `review_acceptFromLongPressMenu` | (a) Wrong status text. In «Chats with members», a pending member's row shows the long status text «pending review»; «review» is the short text used in the Group info member list. (b) The reject citation testGLinkDeletePendingApprovalMember depends on `chatHooks` (pending approval), so it supports only the output pattern. | V/chat/group/MemberSupportView.kt:174-175 `else if (member.memberPending) { member.memberStatus.text }`; strings.xml `group_member_status_pending_review` = "pending review"; H/Groups.hs:3990 `cfg = testCfg {chatHooks = ...GAPendingApproval...}` | Verification: Status «pending review», with the flag icon on the row. The group row in alice's chat list shows the primary-colour flag (moderator side, V/chatlist/ChatPreviewView.kt:390-391). «Accept» opens «Accept member» / «Member will join the group, accept member?»; «Accept as member» / «Accept as observer» lead to CLI `#team: you joined the group` plus history. «Reject» opens «Reject member?», and confirming leads to CLI `#team: alice removed you from the group (signed)` / `use /d #team to delete the group` (review flow: testGLinkReviewMember H/Groups.hs:3678-3785; the removal lines follow the pattern of testGLinkDeletePendingApprovalMember :3986-3988) |
+| `review_moderatorAcceptsMember` | The cited Haskell line is off by 4 (more than the allowed ±3). | H/Groups.hs:3775 `alice <## "#team: dan accepted eve to the group (will introduce remaining members)"` | Verification: CLI host: `#team: alice accepted cath to the group (will introduce remaining members)` (H/Groups.hs:3775, names substituted) |
+| `groupLink_createdAutomatically`, `groupLink_toggleFullShortLink` | The Needs are not the same for both names. The «Full link»/«Short link» toggle renders only with developer tools on, so the toggle test needs `DT`. | V/newchat/NewChatView.kt:585-586 `fun ToggleShortLinkButton(...) { if (appPrefs.developerTools.state.value) {` | split: (1) `\| Create \| Group info ▸ «Create group link» \| V/chat/group/GroupLinkView.kt:30-169 \| `groupLink_createdAutomatically` \| «Group link» opens and creates the link by itself: QR code, «Initial role», «Share link», «Delete link» \| — \| — \|`; (2) `\| Full/short toggle \| «Group link» ▸ «Full link»/«Short link» \| V/chat/group/GroupLinkView.kt:232-239; V/newchat/NewChatView.kt:585-596 \| `groupLink_toggleFullShortLink` \| The toggle switches the QR code between the short and full link. It is shown for groups with a short link, not for channels, and only with developer tools on \| DT \| — \|` |
+| `groupLink_cliJoinsViaShortLink`, `groupLink_cliJoinsViaFullLink` | (a) The Needs are not the same for both names: the full link is reachable only through the developer-tools toggle (catalogue 01 uses `P, S, DT` for its own full-link row). (b) File cited without a line. | V/newchat/NewChatView.kt:585-586 (toggle only with developer tools); V/chat/group/GroupLinkView.kt:232-265; 01-onboarding-chatlist-connect-profiles.md:144 `oneTimeLinkCliConnectsViaFullLink` … `P, S, DT` | split: (1) `\| CLI joins (short link) \| CLI `/c <link>` \| V/chat/group/GroupLinkView.kt:250-265 \| `groupLink_cliJoinsViaShortLink` \| CLI `/c` gives `connection request sent!`, `#team: joining the group...`, `#team: you joined the group`; alice gets «invited via your group link» (testGroupLink, H/Groups.hs:3086) \| P \| — \|`; (2) the same row for `groupLink_cliJoinsViaFullLink` with Entry path `«Full link» toggle ▸ CLI /c <full link>`, Needs `P, DT`, Notes `The «Full link»/«Short link» toggle is visible only with developer tools (NewChatView.kt:585)` |
+| `groupLink_creationStepContinue` | (a) Verification is empty. (b) «Create link» is only on screen until the link exists, because the link is created on open. (c) The group-link creation step (`creatingGroup = true`, non-channel) is reached only from incognito group creation, the same screen as §1 `createGroupIncognito_opensGroupLinkStep`; this test should assert only «Continue». | V/chat/group/GroupLinkView.kt:119-123 (link created on open); :288-296 `if (creatingGroup && close != null) { SettingsActionItem(... continue_to_next_step ...` ; V/newchat/AddGroupView.kt:59-62 (only non-channel caller with `creatingGroup = true`) | `\| Creation step \| Incognito group creation (§1) ▸ «Continue» \| V/chat/group/GroupLinkView.kt:119-123,279-296 \| `groupLink_creationStepContinue` \| After the link is created by itself, «Continue» closes the step and leaves the group chat open; this step has no «Delete link» \| — \| The step opens only from incognito group creation; opening it is tested by `createGroupIncognito_opensGroupLinkStep` \|` |
+| `groupLink_upgradeOldLink` | (a) Line 97 is the «Share old link» button, not the upgrade flow. (b) Verification skips the confirmation alert «Upgrade group link?» / «Upgrade» that tapping the row opens. | V/chat/group/GroupLinkView.kt:97 `share_old_link_alert_button`; :72-88 `showAddShortLinkAlert` (title `share_group_profile_via_link` = "Upgrade group link?", button "Upgrade"); :241-249 | Main file:line: `V/chat/group/GroupLinkView.kt:57-88,241-249`. Verification: «Upgrade group link» opens «Upgrade group link?»; «Upgrade» adds a short link, and the «Upgrade group link» row disappears |
+| `groupLink_shareOldLink` | (a) Incomplete entry path: «Share old link» is a button in the alert that «Share link» opens for an old link. (b) Wrong lines: 241-244 is the upgrade row. | V/chat/group/GroupLinkView.kt:255-258 `if (!isChannel && groupLink.shouldBeUpgraded) { showAddShortLinkAlert { clipboard.shareText(...) } }`; :90-102 «Share old link» button | Entry path: `«Share link» ▸ «Upgrade group link?» ▸ «Share old link»`. Main file:line: `V/chat/group/GroupLinkView.kt:72-117,255-258`. Verification: «Share old link» puts the existing link, not upgraded, on the clipboard (the full link in `https://simplex.chat/` form when there is no short link, C/model/SimpleXAPI.kt:7342-7351) |
+| `groupLink_memberRejoinsAfterDeletingGroup`, `groupLink_existingContactMerged` | (a) `contact and member are merged` is printed on both sides with different text, and the row doesn't say which side is asserted. alice's line is GUI output and must not be quoted as a CLI line. (b) The rejoin test has no line to assert. | H/Groups.hs:3559 `alice <## "contact and member are merged: bob, #team bob_1"` (GUI user, not assertable); :3564 `bob <## "contact and member are merged: alice, #team alice_1"`; :2812-2834 rejoin lines | Verification: Rejoin: CLI `/l team`, `/d #team`, then `/c <link>` again gives `connection request sent!` … `#team: you joined the group`, and alice sees bob as a member again (testGroupLinkDeleteGroupRejoin, H/Groups.hs:2793). Merge: bob, already alice's contact, joins via the link; CLI `contact and member are merged: alice, #team alice_1` / `use @alice <message> to send messages`, and alice's member row for bob opens the existing contact (testGroupLinkExistingContactMerged, H/Groups.hs:3542) |
diff --git a/plans/ui-tests/catalogue/verify/03-b.md b/plans/ui-tests/catalogue/verify/03-b.md
new file mode 100644
index 0000000000..b618c6c8c5
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/03-b.md
@@ -0,0 +1,26 @@
+# Verification of 03-groups-channels-business.md, sections 8–17
+
+49 rows / 111 test names checked against wt-7573 (Kotlin app, core, tests, simplexmq tag ee66dd6). All «» labels exist verbatim in strings.xml; all cited Haskell tests exist at the cited lines; counts, headings and name uniqueness are correct.
+
+| Test name(s) | Problem | Evidence (file:line + short quote) | Exact corrected text for the row (or "delete row"/"split: ...") |
+|---|---|---|---|
+| `connectPlan_connectingAllowsReconnect`, `connectPlan_connectingProhibit` | The row doesn't say how each alert is reached, and «Already joining the group!» can't be produced: it needs `GLPConnectingProhibit Nothing`, i.e. a host contact created from an `XInfo` confirmation (the deprecated pre-`x.grp.link.inv` protocol). Current and stable hosts send `XGrpLinkInv`, which creates the group, so the prohibit case always carries the group → «Group already exists!». The cited test covers only the reconnect state. | src/Simplex/Chat/Library/Commands.hs:4705-4708 "TODO [short links] RcvDirectMsgConnection branches are deprecated"; :4713-4714 `not (memberActive membership) … GLPConnectingProhibit $ Just gInfo`; Subscriber.hs:3210-3214 `XGrpLinkInv … createGroupInvitedViaLink`; ConnectPlan.kt:298-321 | Verification: "Host bob stopped. `connectPlan_connectingAllowsReconnect`: paste bob's full link, «Use current profile», paste it again → «Repeat join request?» with «Use current profile» / «Use new incognito profile» in red (ConnectPlan.kt:286-297; testPlanGroupLinkConnecting, H/Groups.hs:4132). `connectPlan_connectingProhibit`: paste the short link, «Open group», «Join group», paste it again → «Group already exists!» (ConnectPlan.kt:302-306; membership not yet active, Commands.hs:4713-4714)." Needs unchanged (P, PEERCTL, CB). Drop «Already joining the group!». |
+| `joinGroup_retryAfterServerError` | No UI behaviour, entry path or file:line: the row gives only a test name, so it says nothing about what alice sees or taps. | ComposeView.kt:693 `connectPreparedGroup`; SimpleXAPI.kt:1834 `sendCmdWithRetry(… APIConnectPreparedGroup …)`; :842-869 retry alert; :895-899 `BROKER … NETWORK -> MR.strings.connection_error`; :884 `retry_verb` | Entry path: "prepared group ▸ «Join group» while smp1 is stopped". Main file:line: "V/chat/ComposeView.kt:693; C/model/SimpleXAPI.kt:842-869,891-901". Verification: "Alert «Connection error» with «Retry»; start smp1, «Retry» → CLI host bob: `alice: accepting request to join group #team...`, `#team: alice joined the group` (core behaviour: testShortLinkGroupRetry, H/Profiles.hs:4645)". Needs: P, SRVCTL, CB. |
+| `groupInvitation_joinFromChatListMenu`, `groupInvitation_deleteInvitation`, `groupInvitation_tapAfterAcceptShowsJoiningAlert` | The «Joining group» test needs alice to stay in `MemAccepted` until she taps the row. With a running host she connects within seconds, so the test is a race; it needs the host stopped (PEERCTL), which the other two tests don't. The file:line also leaves out the alert itself. | ChatListNavLinkView.kt:199 `GroupMemberStatus.MemAccepted -> groupInvitationAcceptedAlert(rhId)`; :944-950 `generalGetString(MR.strings.joining_group)` | split: row A `groupInvitation_joinFromChatListMenu`, `groupInvitation_deleteInvitation` — Main file:line "V/chatlist/ChatListNavLinkView.kt:303-336,486-506"; Verification "Row menu «Join»/«Delete»; «Delete» removes the invitation (testGroupDeleteWhenInvited H/Groups.hs:882)"; Needs P. Row B `groupInvitation_tapAfterAcceptShowsJoiningAlert` — Main file:line "V/chatlist/ChatListNavLinkView.kt:196-200,944-950"; Verification "bob stopped after `/a team alice`; alice accepts; a tap on the row shows «Joining group»; start bob → `#team: alice joined the group`"; Needs P, PEERCTL; Notes "bob is the CLI host". |
+| `groupInvitation_tapToJoin`, `groupInvitation_tapRowShowsJoinAlert` | The citation names the wrong helper and is off by 4 lines: `createGroup2` is at :811, and :815 is `createGroup2'`. | tests/ChatTests/Utils.hs:811 `createGroup2 ::`; :815 `createGroup2' gName cc1 (cc2, role2) doConnectUsers` | "(createGroup2', H/Utils.hs:815)" |
+| `joinGroup_preparedChangeProfile` | The row doesn't mention that this test needs a second chat profile. The legend says such setup states belong in Notes, and the cited test switches to another user. | H/Profiles.hs:4908 testShortLinkChangePreparedGroupUser | Notes: "Incognito comes from the app pref or the profile picker (ComposeContextProfilePickerView); `joinGroup_preparedChangeProfile` needs a second chat profile, picked in the profile picker" |
+| `memberInfo_roleReadOnlyForHigherRole` | `:968-991` is `updateMemberRoleDialog`, not the read-only row. The read-only «Role» row is the `InfoRow` shown when `canChangeRoleTo` returns null. The second peer isn't needed: the CLI owner bob is himself the higher-role member. | GroupMemberInfoView.kt:607-612 `if (roles != null) { RoleSelectionRow … } else { InfoRow(stringResource(MR.strings.role_in_group) …`; C/model/ChatModel.kt:2939-2945 `canBeRemoved … userRole >= memberRole` | Main file:line ":605-612; C/model/ChatModel.kt:2939-2955". Needs "P". Notes "bob is the CLI owner, alice an admin; open bob's member info". |
+| `memberInfo_changeRoleToAdmin`, `memberInfo_changeRoleDismissRestores`, `memberInfo_changeRoleOfInvitedMember` | The cited range 1641-1652 covers only the invited-member line. The quoted `changed your role from member to admin (signed)` line is at :1663. | H/Groups.hs:1663 `bob <## "#team: alice changed your role from member to admin (signed)"` | "(testUpdateMemberRole, H/Groups.hs:1641-1664)" |
+| `memberInfo_blockForAllNotifiesMembers`, `memberInfo_unblockForAll`, `memberInfo_blockedByAdminShownToMember` | It isn't clear which CLI prints the line. The blocked member bob prints nothing; only the other members print `alice blocked bob` and later see `[blocked by admin]`. | H/Groups.hs:7275-7276 `cath <## "#team: alice blocked bob (signed)"`, `bob <// 50000` | Verification: "«Block for all?» / «Block for all». cath's CLI: `#team: alice blocked bob (signed)`; bob's CLI prints nothing; bob's later messages reach cath as `… [blocked by admin]` (testBlockForAllMarkedBlocked, H/Groups.hs:7259). For `memberInfo_blockedByAdminShownToMember` (alice a member, bob the CLI host blocks cath), cath's member info shows the disabled «Blocked by admin» row" |
+| `memberInfo_removeMemberWithMessages`, `memberInfo_deleteMessagesOfLeftMember` | Two problems. With messages, bob's CLI prints `removed you from the group with all messages (signed)`, not the plain line. For a member who has left, the UI shows «Delete member messages» → «Delete member messages?» → «Delete messages», which the row never names. | H/Groups.hs:2078 `"#team: alice removed you from the group with all messages (signed)"`; GroupMemberInfoView.kt:445-449 `DeleteMemberMessagesButton`; :336-345 `button_delete_member_messages_question`, `delete_member_messages_confirmation` | Verification: "«Remove member?» «Remove» / «Remove and delete messages». CLI: `#team: alice removed you from the group (signed)`; with messages `#team: alice removed you from the group with all messages (signed)`. For a member who left: «Delete member messages» → «Delete member messages?» / «Delete messages» (testGroupRemoveAdd :1102; testDeleteMemberWithMessages :2011; testDeleteMemberMessagesLeftRemoved :2114)" |
+| `memberInfo_directMessagesProhibitedAlert` | This duplicates §5 `groupPrefs_directMessagesOff_memberInfoProhibited`, which already asserts «Can't message group member» from the member-info message button when direct messages are off. The only part §5 doesn't cover is the call/video buttons' prohibited alert. | 03 §5 row "alice's member-info message button shows «Can't message group member»"; GroupMemberInfoView.kt:535-540 `showDirectMessagesProhibitedAlert(generalGetString(MR.strings.cant_call_member_alert_title), messageId)` | Rename to `memberInfo_callButtonsDirectMessagesProhibitedAlert`; Verification: "Direct messages off: «call»/«video» show «Can't call group member» / «Direct messages between members are prohibited in this group.»" (keep P; the member is not alice's contact) |
+| `memberInfo_abortSwitchAddress` | It can't be driven as written. At agent version 8 (current), a switch can be aborted only in `RSSwitchStarted`. Once the new queue exists and QADD is enqueued (the peer can be offline), the status becomes `RSSendingQADD` and «Abort changing address» is disabled. The Haskell test aborts only because alice runs the previous agent version (`testCfgVPrev`). Stopping the peer doesn't help; stopping the SMP server keeps the switch in `RSSwitchStarted`. | simplexmq ee66dd6 Agent/Store.hs:214-216 `RSSwitchStarted -> True`, `RSSendingQADD -> connAgentVersion < rpcAddressSMPAgentVersion`; Agent.hs:2878-2881 QADD enqueued then `RSSendingQADD`; Protocol.hs:327,333 both version 8; H/Direct.hs:3087 `withNewTestChatCfg ps testCfgVPrev "alice"`; GroupMemberInfoView.kt:651-654 | Verification: "Stop smp1; «Change receiving address» → «Change receiving address?»; «Abort changing address» is enabled (switch still in `RSSwitchStarted`) → «Abort changing address?» / «Abort»; start smp1; the row is gone and messages flow (core: testAbortSwitchGroupMember H/Direct.hs:3085 uses an older agent version for the same reason)". Needs: P, SRVCTL. Notes: "Server stopped before the switch starts". |
+| `memberInfo_fixConnectionAfterDesync` | The desync is set up on the wrong side. The side whose database is restored is the one that gets "synchronization required" (`ratchetSyncAllowed`), so restoring the peer puts the Fix action on bob, not on alice. alice's «Fix connection» appears only when alice's own database is the restored copy. | H/Groups.hs:4201-4231 setupDesynchronizedRatchet: restored `bob_old` gets (:4222) "decryption error (connection out of sync), synchronization required"; H/Groups.hs:4253 `bob ##> "/sync #team alice"`; GroupMemberInfoView.kt:556,566-567 `canSyncConn = cStats.ratchetSyncAllowed` | Verification: "Copy alice's database, exchange messages with bob, restart alice on the old copy; after bob sends, «Fix connection» → «Fix connection?» → «Fix»; bob's CLI: `#team alice: connection synchronization agreed`, `#team alice: connection synchronized`; alice's chat shows the synchronisation event items and messages flow (testGroupSyncRatchet H/Groups.hs:4235, roles swapped)". Needs: P, RESTART, FIXTURE (alice's own database copy restored between restarts). Notes: "alice's database is the desynchronised side". |
+| `memberContact_createAndSendInvitation`, `memberContact_incognitoMemberSharesIncognitoProfile` | Two problems. The CLI sequence leaves out `alice: you can send messages to contact`, which bob prints between `alice> hi` and `contact is connected`. The setup also isn't stated: the member must not already be alice's contact, or «message» opens the existing chat and the compose step never appears. | H/Groups.hs:4840-4845 `"#team alice is creating direct contact alice with you"`, `WithTime "alice> hi"`, `bob <## "alice (Alice): you can send messages to contact"`; GroupMemberInfoView.kt:497-518 | Verification: "… CLI: `#team alice is creating direct contact alice with you`, `alice> hi`, `alice: you can send messages to contact`, `alice: contact is connected` …". Notes: "bob joins through alice's group link, so he is not alice's contact" |
+| `supportChat_memberSendsToAdmins`, `supportChat_memberReceivesAdminReply`, `supportChat_unreadBannerInGroupChat`, `supportChat_hiddenWhenDisabledWithoutChat`, `supportChat_search` | The «%d messages» banner citation is off by 23 lines. Line 1707 is in the reports banner. | V/chat/ChatView.kt:1730 `stringResource(MR.strings.group_new_support_messages).format(supportUnreadCount)` | "«%d messages» banner (V/chat/ChatView.kt:1730)" |
+| `chatsWithMembers_removedMemberChatGone` | The Verification describes «Delete» (that's `chatsWithMembers_deleteChat`), not a removed member. The behaviour for removed members is a list filter. | V/chat/group/MemberSupportView.kt:89 `.filter { it.supportChat != null && it.memberStatus != GroupMemberStatus.MemLeft && it.memberStatus != GroupMemberStatus.MemRemoved }` | Append to Verification: "A member who left or was removed is no longer listed in «Chats with members» (MemberSupportView.kt:89)" |
+| `chatsWithMembers_emptyStates` | The name is plural, but only one state is described, and the second empty state («Chats with members are disabled») can't be reached without a peer: alice can't turn support off in a group (the toggle is disabled), so the CLI owner has to run `/set support #team off` while alice is a moderator. | MemberSupportView.kt:120 `if (groupInfo.fullGroupPreferences.support.on) MR.strings.no_support_chats else MR.strings.support_chats_disabled`; 03 §5 `groupPrefs_supportToggleDisabledInGroups` | split: `chatsWithMembers_emptyState` — «No chats with members», Needs —; `chatsWithMembers_disabledState` — "bob (CLI owner) runs `/set support #team off`; alice (moderator) sees «Chats with members are disabled»", Needs P (section count unchanged) |
+| `groupEvents_initialFeatureItems` | This duplicates §1 `createGroup_opensChatAndInviteSheet`, whose Verification already asserts "The group chat opens with its feature items". | 03 §1 row "Create, then invite step" | delete row (section 16: 8 tests; file total 309) |
+| `groupEvents_memberConnectedMerged`, `groupEvents_roleChangeItems`, `groupEvents_memberLeftAndRemoved`, `groupEvents_groupProfileUpdated`, `groupEvents_expandCollapsed` | The quoted labels need different roles for alice, and the row doesn't say which. «changed your role to %s» and «updated group profile» are received events (the CLI host acts on alice), while «you removed %1$s» and the merged «connected» need alice as host. When alice herself updates the profile she sees «group profile updated». | strings.xml:1784 `rcv_group_event_changed_your_role`, :1789 `rcv_group_event_updated_group_profile`, :1799 `snd_group_event_member_deleted`, :1801 `snd_group_event_group_profile_updated` | Notes: "alice is the host (bob and cath join) for `groupEvents_memberConnectedMerged`, `groupEvents_memberLeftAndRemoved`, `groupEvents_expandCollapsed`; bob is the CLI host for `groupEvents_roleChangeItems` and `groupEvents_groupProfileUpdated`" |
+| `history_welcomeAfterHistory` | It overlaps §4 `welcomeMessage_newMemberReceivesItFirst` (a new CLI member receives the welcome message), and the two disagree on order: this core test delivers the welcome after the `[>>]` history items, while §4 says "first". | H/Groups.hs:6723-6725 `"#team alice> hello [>>]"`, `"#team bob> hey! [>>]"`, `"#team alice> welcome to team"` | Verification: "CLI: `#team alice> hello [>>]` …; with a welcome message the new member gets the history items first, then `#team alice> <welcome>` (testGroupHistoryWelcomeMessage :6692)"; and reword §4 `welcomeMessage_newMemberReceivesItFirst` so the two don't contradict each other (outside this slice) |
+| `deleteGroup_memberSeesGroupDeleted` | The Verification quotes only CLI lines from the owner case. When alice is a member and the CLI host deletes the group, the row doesn't say what alice's GUI shows. | C/model/ChatModel.kt:1745 `GroupMemberStatus.MemGroupDeleted -> generalGetString(MR.strings.cant_send_message_group_deleted)` | Append: "When bob (CLI host) runs `/d #team`, alice's compose shows «group is deleted»" |
diff --git a/plans/ui-tests/catalogue/verify/03-c.md b/plans/ui-tests/catalogue/verify/03-c.md
new file mode 100644
index 0000000000..3324dda8f0
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/03-c.md
@@ -0,0 +1,22 @@
+| Test name(s) | Problem | Evidence (file:line + short quote) | Exact corrected text for the row (or "delete row"/"split: ...") |
+|---|---|---|---|
+| `createChannel_singleRelayCompletesAndShowsLink`, `createChannel_cancelAndDelete`, `createChannel_relayAddressDeletedShowsError` | (a) «1/1 relays active» is never on screen. When every relay is active, the progress step calls onLinkReady straight away, and on desktop that closes all modals and opens the channel with the «Channel link» modal. (b) `cancelAndDelete` needs the progress step to stay open, but a running relay becomes active in about a second and the step closes itself, so the test races. (c) `relayAddressDeletedShowsError` needs the relay to run `/da`, which is a relay command (§0 stop/`-e`/start). So Needs `RELAY` alone is incomplete for (b) and (c). | V/newchat/AddChannelView.kt:399-403 `if (relays.all { it.relayStatus == RelayStatus.Active … }) { onLinkReady()`; :63-70 `closeAll() … GroupLinkView(… isChannel = true …)`; H/Groups.hs:12069 `cath ##> "/da"` | split: `\| Create channel, one relay \| «Create public channel» ▸ «Creating channel» \| V/newchat/AddChannelView.kt:41-586 \| `createChannel_singleRelayCompletesAndShowsLink` \| «Creating channel» progress step; once the relay is active, on desktop the channel opens with the «Channel link» modal automatically (core behaviour: prepareChannel' H/Groups.hs:9374) \| RELAY \| — \|` and `\| Create channel, cancel or relay error \| «Create public channel» ▸ «Creating channel» \| V/newchat/AddChannelView.kt:358-536 \| `createChannel_cancelAndDelete`, `createChannel_relayAddressDeletedShowsError` \| «Cancel and delete channel» ▸ «Cancel creating channel?»: Wait keeps the step, Cancel deletes the channel; «Error creating channel» when the relay address was deleted (core behaviour: testChannelCreateDeletedRelay H/Groups.hs:12055) \| RELAY, PEERCTL \| cancel: the relay is stopped after registration, so the step stays at «0/1 relays active»; error: the relay runs `/da` as in §0 before alice creates the channel \|` |
+| `createChannel_twoRelaysProgress` | «%1$d/%2$d relays active» never shows 2/2, for the same reason: at 2/2 the step closes and the channel opens. The entry path «Configure relays» only opens Network & servers. The harness registers the relays, and registering relays through the UI belongs to catalogue 04. | V/newchat/AddChannelView.kt:399-403 (auto onLinkReady); :317-327 `configure_relays … NetworkAndServersView(close)` | `\| Create channel, two relays \| «Create public channel» ▸ «Creating channel» \| V/newchat/AddChannelView.kt:395-445 \| `createChannel_twoRelaysProgress` \| The progress step counts «%1$d/%2$d relays active» out of 2; when both relays are active it closes and the channel opens with «Channel link»; «Chat relays» then shows both relays as «active» (prepareChannel2Relays H/Groups.hs:9400) \| RELAY ×2 \| Both relays registered by the harness \|` |
+| `channelInfo_subscriberCountUpdates` | The count includes the owner: it is current members minus relays. With two CLI subscribers the header reads "3 subscribers", not 2. The cited test has 3 subscribers and expects 4. | src/Simplex/Chat/Store/Groups.hs:2270-2281 `publicCount = max 0 (totalCount - relayCount)`; H/Groups.hs:9293 `alice <## "subscribers: 4"` (3 subscribers + owner); :10946 `subscribers: 3` after one leaves | In the Verification cell replace "«%1$d subscribers» shows 2 after the two CLI subscribers join (core behaviour: H/Groups.hs:9293)" with "«%1$d subscribers» shows 3 after the two CLI subscribers join (the owner is counted; core behaviour: H/Groups.hs:9293, 4 with three subscribers)" |
+| `channelName_removeSimplexName` | «Remove name» only clears the field and switches to editing. The name goes away only after «Save». | V/usersettings/SetSimplexNameView.kt:189-190 `SectionItemView({ name.value = ""; editing.value = true }) { … remove_name`; :182 Save | Verification: "After saving, the row shows the name under «Channel SimpleX name»; «Remove name» then «Save» restores «Get SimpleX name (BETA)»" |
+| `channelLink_shareViaChatToGroup` | The only quoted CLI line is the signed direct-chat card. A card shared to a group is unsigned, and the group line has a different shape. | H/ChatRelays.hs:303-305 `alice <# "#team link to join channel #news:"` / `bob <# "#team alice> link to join channel #news:"` | Verification: "CLI: direct `alice> link to join channel #team (signed):` (testShareChannelDirect H/ChatRelays.hs:244); group `#<group> alice> link to join channel #team:` (unsigned, testShareChannelGroup :295); `/c` lines from testConnectChannelCLI H/Groups.hs:9206" |
+| `channel_ownerRelayBarStates` | "Both relays stopped" does not produce the state. A stopped relay stays `Active` with no connFailedErr, and the owner bar only appears when fewer relays are active than in total. «Add relays to restore message delivery.» appears only after expanding the bar, and only when every relay is removed, left or failed. | V/chat/ComposeView.kt:1700 `if (s.relays.isEmpty() \|\| s.activeCount < s.relays.size)`; :2162-2164 removed/active/failed counts; :1899 `allBroken`; :1952-1955 `if (relayListExpanded.value) { if (allBroken) … relay_bar_owner_no_delivery` | `\| Owner relay bar \| compose relay bar, expanded \| V/chat/ComposeView.kt:1890-1985 \| `channel_ownerRelayBarStates` \| After both relays are removed, expanding the compose relay bar shows «Add relays to restore message delivery.» \| RELAY ×2 \| alice removes both relays in «Chat relays» ▸ «Remove relay» \|` |
+| `channelRelays_addRelay`, `channelRelays_noAvailableRelays` (row "Chat relays view") | Channel creation picks every enabled relay, up to 3. With both harness relays registered before creation, both join the channel. The add list then excludes them, so `addRelay` sees «No available relays» and has nothing to add. The row does not say the second relay is registered after creation. Also, no verification in the row uses `P`. | V/newchat/AddChannelView.kt:181 `maxRelays = 3`, :197-218 round-robin adds all; V/chat/group/ChannelRelaysView.kt:114 `existingRelayIds = groupRelays.mapNotNull { … }`; V/chat/group/AddGroupRelayView.kt:114 `no_available_relays` | Needs: "RELAY ×2"; Notes: "The channel is created with relay1 only; the harness registers relay2 in alice's servers after creation (`addRelay` adds it; `noAvailableRelays` runs after it is added)" |
+| `channelRelays_rejectedRelayStatus` | A relay that left can't be re-added straight away. Its group_relays row still exists, so the «Add relay» list excludes it. The core test removes the left relay first, and that cascade clears the row. | V/chat/group/ChannelRelaysView.kt:112-114 `Backend gate … rejects any chatRelayId already in group_relays`; H/Groups.hs:11850 `alice ##> "/rm #team bob"` before `/_add relays` | Verification: "The relay's status shows «removed by operator»; after alice removes the relay that left («Remove relay») and adds it again («Add relay»), it shows «rejected» (testChannelRelayLeave H/Groups.hs:10997; testRelayRejectAfterLeave :11816)" |
+| `channelSupport_ownerRepliesToSubscriber` | (a) Main file:line is "—". (b) A channel created in the UI has "Chat with admins" off, so a subscriber can't open a support chat until alice turns it on. The row leaves this setup out. | V/chat/group/GroupChatInfoView.kt:658-661 `MemberSupportButton(chat, openMemberSupport)`, :1014-1017 `member_support`; V/newchat/AddChannelView.kt:119 `support = GroupPreference(GroupFeatureEnabled.OFF)` | `\| Channel support \| «Chats with members» \| V/chat/group/GroupChatInfoView.kt:658-661,1014-1029 \| `channelSupport_ownerRepliesToSubscriber` \| bob's `#team (support) hi` appears under «Chats with members»; alice's reply reaches only bob: `#team (support) alice> hello [>>]` (testChannelSupportScope H/Groups.hs:12082) \| RELAY, P ×2 \| alice first enables "Chat with admins" in «Channel preferences» («Enable chats with admins?» ▸ «Enable») \|` |
+| `joinChannel_twoRelaysBothConnect` | The subscriber relay bar is hidden once every relay is resolved, so «%1$d/%2$d relays connected» can't be seen at 2/2. | V/chat/ComposeView.kt:1707-1708 `if (s.total == 0 \|\| s.removedCount + s.failedCount > 0 \|\| resolvedCount < s.total)` | Verification: "The relay bar shows «%1$d/%2$d relays connected» out of 2 while joining and disappears once both relays are connected; «Chat relays» then shows both relays as «connected»" |
+| `subscriber_promotedToContributorCanPost` | The owner gets the subscriber's post through the relay, so the CLI line ends in the forwarded marker. | H/Groups.hs:11534 `alice <# "#team cath> member post [>>]"` | Verification: "«you are subscriber»; after promotion the CLI owner sees `#team alice> member post [>>]` (testChannelObserverCannotPost H/Groups.hs:11518)" |
+| `subscriber_relayBarAfterRelayRemoved`, `subscriber_relayBarWaitingForOwner` | «Waiting for channel owner to add relays.» is shown only in the expanded bar. The row gives no expand step and does not say how the relay goes away. | V/chat/ComposeView.kt:2049-2052 `if (relayListExpanded.value) { if (allBroken) … relay_bar_subscriber_waiting` | Verification: "After the CLI owner removes the only relay (`/rm #team <relay>`, testChannelRemoveRelay H/Groups.hs:11621), the relay bar appears; expanding it shows «Waiting for channel owner to add relays.»" |
+| `connectPlan_ownChannelLink`, `connectPlan_relayAddressRejected` (row "Plans") | The Needs are not shared by all three names. "Your channel" requires alice to own the channel (§18 setup, no CLI owner). The relay-address alert is raised client-side before any peer is involved. Only `connectPlan_knownChannelSubscriber` needs `P`. | V/newchat/ConnectPlan.kt:35-42 `linkType == SimplexLinkType.relay`; :566-569 `if (groupInfo.useRelays) … connect_plan_this_is_your_link_for_channel` | split: `\| Plans \| paste the channel link \| V/newchat/ConnectPlan.kt:322-336,664 \| `connectPlan_knownChannelSubscriber` \| «You are a subscriber», «Open channel» \| P, RELAY, CB \| — \|` and `\| Plans (own channel, relay address) \| paste alice's own channel link or a relay address \| V/newchat/ConnectPlan.kt:35-42,566-597 \| `connectPlan_ownChannelLink`, `connectPlan_relayAddressRejected` \| «Your channel» ▸ «Open channel»; «Relay address» alert \| RELAY, CB \| alice creates the channel herself (as in §18) \|` |
+| `subscriber_chatWithAdmins` | «Chat with admins» is shown only when the channel's support preference is on, and the row does not set it up. | V/chat/group/GroupChatInfoView.kt:637-639 `showUserSupportChat = … support.on …`; H/Groups.hs:12094 `alice ##> "/set support #team on"` | Notes: "For `subscriber_chatWithAdmins` the CLI owner first runs `/set support #team on` (testChannelSupportScope H/Groups.hs:12082)" |
+| `joinChannel_noActiveRelays` | The row does not say how a channel with no active relays is produced. | H/Groups.hs:11060-11063 `channel has no active relays, please try to join later` (after both relays leave); V/newchat/ConnectPlan.kt:337-363 | Notes: "For `joinChannel_noActiveRelays` the CLI owner removes its relay (`/rm #team <relay>`) before alice pastes the link" |
+| `business_customerProfileUpdateRenamesChat` | The customer's profile change reaches the business only with the customer's next message. A bare `/p` does not rename the chat. | H/Profiles.hs:2038-2042 `alice ##> "/p alisa"` … `alice #> "#biz hello again" -- profile update is sent with message` … `changed to #alisa` | Verification: "… customer `/p <new name>` followed by a message renames the business chat on alice's side (testBusinessAddress H/Profiles.hs:1950; testBusinessUpdateProfiles :2014, names substituted)" |
+| `customer_connectWithRequestMessage` | The order is reversed. The business receives the request message before the "accepting" line. | H/Profiles.hs:4512-4513 `biz <# "#bob bob_1> Hello!"` then `biz <## "#bob (Bob): accepting business address request..."` | Verification: "Banner «Business connection». CLI business: `#alice: accepting business address request...`; with a request message, `#alice alice_1> Hello!` comes first, then the accepting line (H/Profiles.hs:4426,4490, names substituted)" |
+| `customer_knownBusinessPlan` | The cited lines are the ConnectingProhibit branch. A known business is GroupLinkPlan.Known, which shows the known-group alert with «Open chat». | V/newchat/ConnectPlan.kt:322-336 `is GroupLinkPlan.Known`; :645, :678 `… else MR.strings.connect_plan_open_chat` | Main file:line: "V/newchat/ConnectPlan.kt:322-336,645-690" |
+| `connectPlan_businessConnectingProhibit` | Unreachable as written. When a business short link is pasted again, the core finds the prepared business group by its short link and returns GLPKnown whatever its status. After the request is sent, nextConnectPrepared is false, so the GUI shows the «Open chat» alert, not «Chat already exists!». The quoted «You are already connecting to %s» is also not verbatim. | src/Simplex/Chat/Library/Commands.hs:4520 `Nothing -> (gPlan =<<) <$> getGroupToConnect …`, :4536 `gPlan … CPGroupLink (GLPKnown g …)`; C/model/ChatModel.kt:2501 `nextConnectPrepared = … !preparedGroup.connLinkStartedConnection`; strings.xml:2806 `You are already connecting to <b>%1$s</b>.` | `\| alice as customer, still connecting \| paste the business address again while the join is pending \| V/newchat/ConnectPlan.kt:322-336,645-690 \| `connectPlan_businessConnectingProhibit` \| The known-chat alert with «Open chat» opens the pending business chat (the core returns the known prepared group for the short link, src/Simplex/Chat/Library/Commands.hs:4536) \| P, PEERCTL, CB \| bob (business, auto-accept) is stopped after alice sends the request, so the join stays pending \|` |
+| `customer_seesTeamMemberAdded`, `customer_chatInfoRows`, `customer_addFriendsWhenPromoted`, `customer_leaveChat` | Main file:line has no line numbers, though the row tests several distinct places. | V/chat/group/GroupChatInfoView.kt:759-763 `BusinessChatType.Business -> MR.strings.button_add_friends`; :253-256 `leave_chat_question`; :829-838 leave button | Main file:line: "V/chat/group/GroupChatInfoView.kt:253-262,759-763,829-838" |
diff --git a/plans/ui-tests/catalogue/verify/04-a.md b/plans/ui-tests/catalogue/verify/04-a.md
new file mode 100644
index 0000000000..b33c29b911
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/04-a.md
@@ -0,0 +1,30 @@
+| Test name(s) | Problem | Evidence (file:line + short quote) | Exact corrected text for the row (or "delete row"/"split: ...") |
+|---|---|---|---|
+| (header) Harness fact 3 | Theme overrides (wallpapers, colours, imported themes) are not stored in `themes.properties`. They go to `<configPath>/themes.yaml`. `themes.properties` holds only the legacy `Themes` map (`themeOverridesOld`). | `C/platform/Files.kt:153-161` `writeThemeOverrides` → `File(getPreferenceFilePath("themes.yaml"))`; `C/model/SimpleXAPI.kt:241-246` `themeOverridesOld = mkMapPreference(SHARED_PREFS_THEMES_OLD, … settingsThemes)`, `themeOverrides = mkThemeOverridesPreference()` | Fact 3 first sentence: "**Settings storage.** Settings go to `<configPath>/settings.properties` (`D/platform/Resources.desktop.kt:39-40`). Theme overrides (wallpapers, colours, imported themes) go to `<configPath>/themes.yaml` (`C/platform/Files.kt:127-161`). `themes.properties` (`Resources.desktop.kt:41-42`) holds only the legacy `Themes` map." |
+| `settingsRoot_listsDesktopItems` | The version row has no "v" prefix. It shows the desktop version name, then the build code in brackets. | `US/SettingsView.kt:355-356` `Text(appVersionInfo.first + (if (appVersionInfo.second != null) " (" + appVersionInfo.second + ")" else ""))`; `C/platform/AppCommon.kt:28-31` `DESKTOP_VERSION_NAME to DESKTOP_VERSION_CODE`; `apps/multiplatform/gradle.properties:30` `desktop.version_name=7.1-beta.6` | Verification: replace `version row "vX (build)"` with `version row "<DESKTOP_VERSION_NAME> (<DESKTOP_VERSION_CODE>)" (e.g. "7.1-beta.6 (167)", no "v" prefix)` |
+| `settingsRoot_crowdfundingOpensGetStake` | The row needs `URI`, but its check only opens the page and never uses a link, so the stub is not exercised. | `US/SettingsView.kt:138` `GetStakeView(showFirstImage = true, close = close)`; `C/views/onboarding/WhatsNewView.kt:1200` `val title = "Invest in\nSimpleX Chat"`; `:1232-1236` `labelId = MR.strings.v7_0_invest_learn_more … uriHandler.openUriCatching(WEFUNDER_URL)`; `:1036` `WEFUNDER_URL = "https://wefunder.com/simplex.chat?utm_source=app"` | Verification: `GetStakeView opens (title "Invest in SimpleX Chat", a hard-coded literal at WhatsNewView.kt:1200); "Learn more on Wefunder" records https://wefunder.com/simplex.chat?utm_source=app in the URI stub (WhatsNewView.kt:1232-1236)`; Needs: `URI` (unchanged) |
+| `keyboard_escDismissesAlert` | The entry path "any alert open" names no alert, so the test can't be written as specified and the check isn't repeatable. | `NS/NetworkAndServers.kt:101-125` `showAlertDialog(title = … network_enable_socks …)`; `C/views/helpers/AlertManager.kt:140-141` `AlertDialog(onDismissRequest = { onDismissRequest?.invoke(); hideAlert() }` | Entry path: `Settings > "Network & servers" > "Use SOCKS proxy" (alert "Use SOCKS proxy?"), press Esc`; Main file: `C/views/helpers/AlertManager.kt:126-141`, `NS/NetworkAndServers.kt:101-125`; Verification: `The alert is dismissed, the switch stays off, no /_network appears in the Log, and Network & servers stays open` |
+| `privacy_sectionsAndFooter` | "More privacy" is not a section. It is an item in an untitled last section. | `US/PrivacySettings.kt:107-114` `SectionView { SettingsActionItem(… stringResource(MR.strings.more_privacy), …) }` | Verification: `Sections "Device" (SimpleX Lock only), "Chats", "Files", "Auto-accept" (footer names the current profile), then an untitled section with the "More privacy" item` |
+| `morePrivacy_verifySimplexNamesPref` | The check is not specified ("exact assertion chosen when the test is written"). Needs is missing `P`: the setting only affects a contact's SimpleX name on that contact's info page, so a peer with a registered name is required. | `C/views/chat/SimplexNameView.kt:63-65` `if (verifiable && …privacyVerifySimplexNames.get() && verified == null) runVerify(manual = false)`; `:95-101` `stringResource(MR.strings.verify_simplex_name_action)` ("Verify name"); `:120-135` `ContactSimplexNameView`, used at `C/views/chat/ChatInfoView.kt:760` | Verification: `Pref PrivacyVerifySimplexNames (default off); bob's profile carries a registered SimpleX name; with the pref on, opening bob's contact info verifies the name automatically (check icon, SimplexNameView.kt:63-65,80-84); with it off, the name shows the "Verify name" link (:95-101) until it is clicked`; Needs: `P (bob), NAMES` |
+| `morePrivacy_showEncryptionToggle` | The lock icon appears only after the file is downloaded (`encrypted` is null while the item has no file source), and the row doesn't say the file is received. The `CIMetaView.kt:82` citation points at the pref read, not at the icon. | `C/views/chat/item/CIMetaView.kt:111-114` `if (encrypted != null && showEncryption) { … ic_lock else ic_lock_open_right`; `C/views/chat/item/CIFileView.kt:210` `val encrypted = if (file?.fileSource == null) null else …` | Main file: `PrivacySettings.kt:162`, `C/views/chat/item/CIMetaView.kt:82,111-114`; Verification: `Pref PrivacyShowEncryption; bob sends a file and the GUI receives it (the icon needs the downloaded file); with the setting on, the item shows the lock icon (ItemMetaKey encrypted); with it off, no lock icon` |
+| `receipts_contactsToggle_noOverrides` | Checking "PrivacyDeliveryReceiptsSet=true" proves nothing, because the harness pre-sets that pref to true for every onboarded test (plan §11.1). | plan §11.1 "Pre-set prefs … `privacyDeliveryReceiptsSet`"; `US/PrivacySettings.kt:203` `privacyDeliveryReceiptsSet.set(true)` | Verification: `Log /_set receipts contacts <userId> <on/off> clear_overrides=<on/off> (SimpleXAPI.kt:4127); Pref PrivacyDeliveryReceiptsSet goes from false to true; no alert (H/Direct.hs testConfigureDeliveryReceipts)`; Notes: `The harness pre-set of privacyDeliveryReceiptsSet is cleared first (the startup prompt is checked only in startChat, so it does not appear without a restart)` |
+| `receipts_contactsOverrideAlert_keep`, `receipts_contactsOverrideAlert_forAll`, `receipts_contactsOverrideAlert_cancel` | When receipts are being disabled, only overrides set to "on" are counted. An "off" override (or none) skips the alert, so the setup must name the override value. | `US/PrivacySettings.kt:253-264` `count + (if (sendRcpts == null \|\| sendRcpts == enable) 0 else 1)` … `if (contactReceiptsOverrides == 0) setSendReceiptsContacts(enable, clearOverrides = false)` | Notes: `bob's contact has receipts explicitly turned on first (contact override sendRcpts = true, e.g. /receipts @bob on in the console); an "off" override is not counted when disabling (PrivacySettings.kt:253-264)` |
+| `receipts_groupsOverrideAlert` | Same as for contacts: only an "on" group override triggers the alert when disabling. The alert's buttons are also not listed. | `US/PrivacySettings.kt:268-279` (same fold for groups); `:455-477` buttons `receipts_groups_disable_keep_overrides` = "Disable (keep group overrides)", `receipts_groups_disable_for_all` = "Disable for all groups", "Cancel" | Verification: `Alert "Disable receipts for groups?" with "Disable (keep group overrides)" / "Disable for all groups" / "Cancel" (H/Groups.hs testConfigureGroupDeliveryReceipts)`; Notes: `A group with bob is set up first, with group receipts explicitly turned on (/receipts #<group> on); an "off" override is not counted when disabling (PrivacySettings.kt:268-279)` |
+| `lock_protectedActionsPrompt`, `profiles_actionsRequireAuthOnceWhenLocked` | Opening "Your chat profiles" is not protected; only the first profile action inside it prompts. The row also gives no path to the Chat console, which on desktop is reached through the version row and "Developer tools". | `C/views/chatlist/UserPicker.kt:268-297` opens `UserProfilesView` directly; `doWithAuth(… auth_open_chat_profiles …)` runs only inside the per-action block when `!authorized.value`; `US/DeveloperView.kt:32` `ChatConsoleItem { withAuth(… auth_open_chat_console …) }`; `D/views/usersettings/SettingsView.desktop.kt:19` "Developer tools"; `US/VersionInfoView.kt:52` | Entry path: `"Migrate to another device"; version row > "Developer tools" > "Chat console"; a profile action inside Picker > "Your chat profiles"; Chat data > stop chat`; Main file: add `US/DeveloperView.kt:32`; Verification: `Prompts "Open migration screen" / "Open chat console" / "Change chat profiles" / "Stop chat" (one test iterating over the 4 actions); opening "Your chat profiles" itself does not prompt; its first profile action prompts, and later actions in the same screen don't (stateGetOrPut "authorized", UserPicker.kt:274-292)` |
+| `selfDestruct_infoView`, `selfDestruct_displayNamePersisted`, `selfDestruct_changePasscode`, `selfDestruct_disable` | Setup is missing. The self-destruct section shows only when the lock is on (passcode mode). The display-name field and "Change self-destruct passcode" show only when self-destruct is on, and disabling needs it on. | `US/PrivacySettings.kt:697` `if (performLA.value && laMode.value == LAMode.PASSCODE)`; `:716` `if (remember { selfDestructPref.state }.value) {` | Notes for `selfDestruct_infoView`: `Lock enabled first (the section shows only with the lock on, PrivacySettings.kt:697)`; Notes for `selfDestruct_displayNamePersisted`, `selfDestruct_changePasscode`, `selfDestruct_disable`: `Lock and self-destruct enabled first (PrivacySettings.kt:716)` |
+| `appearance_language_switch`, `appearance_language_backToSystem` | (1) Screens already on screen keep their old strings. The app forces a full recomposition through the Window key, which tests don't render, so the localized "Settings" shows only on a screen composed after the change. (2) `Locale.setDefault` changes JVM-wide state that `PrefStores.restore()` doesn't reset, so later tests in the same JVM would resolve `MR.strings` in German. (3) "waitUntil" is not the plan's mechanism; the plan uses `poll` (§6). | `D/DesktopApp.kt:123-124` "Reload all strings in all @Composable's after language change" `if (remember { appLanguage.state }.value != "") { Window(…)`; `D/views/usersettings/Appearance.desktop.kt:53-61` `delay(200) … Locale.setDefault(Locale.forLanguageTag(it))`; `D/platform/AppCommon.desktop.kt:19` `val defaultLocale: Locale = Locale.getDefault()`; plan §7.3 PrefStores.restore (no Locale reset) | Verification: `Pref AppLanguage=de / null; after poll for the 200 ms delayed write, Settings is closed and the Picker reopened, and it shows the localized "Settings" (screens composed before the change keep their strings: the full recomposition is the Window key at DesktopApp.kt:123-124, which tests don't render)`; Notes: `The test restores Locale.setDefault(Locale.ENGLISH) in a finally block: Locale.getDefault() is JVM-wide and PrefStores.restore() does not reset it ("system" restores defaultLocale, AppCommon.desktop.kt:19)` |
+| `appearance_reachableChatToolbarVisibility` | On desktop, ChatBottomBar defaults to true and nothing in the desktop UI sets it to false. The "Reachable chat toolbar" row shows only when it is false, so the UI can't reach it. | `C/model/SimpleXAPI.kt:276` `chatBottomBar = mkBoolPreference(…, true)`; `D/views/usersettings/Appearance.desktop.kt:65-67` `if (oneHandUI && !chatBottomBar) SettingsPreferenceItem(… chat_bottom_bar …)`; `SimpleXAPI.kt:8722` `if (appPlatform.isAndroid) … else def.chatBottomBar.set(true)` | Notes: `On desktop ChatBottomBar is true by default and no desktop UI sets it false, so the test writes appPrefs.chatBottomBar = false directly, checks that the row appears with OneHandUI on, and that turning it on hides the row` |
+| `appearance_wallpaperPreset_select` | The preset wallpaper is written to `themes.yaml`, not `themes.properties`. | `US/Appearance.kt:487` `ThemeManager.saveAndApplyWallpaper(baseTheme, type)` → `C/ui/theme/ThemeManager.kt:141-144` `pref.set(…)` (themeOverrides, written by `C/platform/Files.kt:153-161` to `themes.yaml`), `appPrefs.currentThemeIds.set(themeIds)` | Verification: `themes.yaml (<configPath>/themes.yaml, C/platform/Files.kt:153-161) holds the preset wallpaper for the current base theme; Pref CurrentThemeIds is updated; Log /_save app settings` |
+| `appearance_themeDestination_perUser` | Choosing a profile in "Apply to" sends nothing by itself. `apiSetUserUIThemes` runs only when a theme change follows, so the test must make one. | `US/Appearance.kt:930-944` `onSelected = { userId -> themeUserDest.value = userId … }` (no save); `:485-493` `onTypeChange` → `saveThemeToDatabase(themeUserDestination.value)`; `:776-788`; `SimpleXAPI.kt:4278` `"/_set theme user $userId …"` | Verification: `"Apply to" > alice, then a wallpaper preset is chosen; Log /_set theme user <userId> {…} (apiSetUserUIThemes); the user's uiThemes is set; themes.yaml is unchanged` |
+| `customizeTheme_importInvalidTheme` | An invalid theme file shows an error alert. "Changes nothing" leaves out that visible result. | `C/views/helpers/Utils.kt:157-171` `AlertManager.shared.showAlertMsg(title = generalGetString(MR.strings.import_theme_error), …)` = "Import theme error" | Verification: `YAML written via saveDialog (file name "simplex.theme", Appearance.kt:715); import applies colors; invalid YAML shows the "Import theme error" alert and changes nothing (C/views/helpers/Utils.kt:157-171)` |
+| `operators_reviewAcceptConditions` | The test can't run as written. The harness disables both operators, so the core returns no conditions action and "Review conditions" / "Accepted conditions" is hidden. The conditions action is also read only once, when the screen opens. | `NS/NetworkAndServers.kt:169` `val conditionsAction = remember { m.conditions.value.conditionsAction }`; `:219` `if (conditionsAction != null && anyOperatorEnabled.value)`; `src/Simplex/Chat/Operators.hs:119-121` `null enabledOperators -> Nothing`; `NS/NetworkAndServers.kt:1009-1013` save refreshes `chatModel.conditions` | Notes: `The harness disables both operators, so the button is hidden: an operator is enabled and saved ("Save servers") first, then Network & servers is reopened (conditionsAction is read once when the screen opens); "Review conditions" shows while that operator's conditions are not accepted` |
+| `operators_roleToggles_validation` | The role switches show only for an enabled operator (the harness disables both), and "Error footers" names no error. | `NS/OperatorView.kt:242` `if (operator.enabled) {` (role sections at :258-412); `C/model/SimpleXAPI.kt:4922-4923` `StorageMissing → no_message_servers_configured_for_receiving` = "No servers to receive messages." | Verification: `With the operator enabled first (role sections show only for an enabled operator, OperatorView.kt:242): a role change that leaves no server to receive messages shows the footer "No servers to receive messages." and disables "Save servers" (SimpleXAPI.kt:4922-4923; T/OperatorTests.hs)` |
+| `yourServers_addSmpManually` | "New server" has no Save button. Going back adds the server to the list, and it is saved with "Save servers" on Network & servers. | `NS/NewServerView.kt:26-36` `ModalView(close = { addServer(…) })`; `NS/NetworkAndServers.kt:271-279` "Save servers" | Verification: `"New server" → address → "Test server" ✓ → back (adds it to "Your servers") → "Save servers" on Network & servers; Log /_servers <uid> {…}; reopening shows it (testGetSetSMPServers)` |
+| `yourServers_testServers_someFail` | The alert title is "Server test failed!"; "Some servers failed the test:" is the start of its text. The cited range 382-410 also leaves out the alert, which is at 375-378. | `NS/ProtocolServersView.kt:375-378` `title = generalGetString(MR.strings.smp_servers_test_failed), text = generalGetString(MR.strings.smp_servers_test_some_failed) + "\n" + msg` | Main file: `ProtocolServersView.kt:237-260,349-380`; Verification: `Alert "Server test failed!" whose text starts "Some servers failed the test:" and names the failed server (testTestSMPServerConnection)` |
+| `servers_validationErrorsBlockSave` | Wrong footer text. With no receive servers, the error has its own text ("No message servers." or "No servers to receive messages."), and that text replaces the generic one. "Errors in servers configuration." appears only for errors with no text of their own, such as a duplicate host. | `NS/NetworkAndServers.kt:281-291` `if (serversErrs.isNotEmpty()) { … ServersErrorFooter(err) } else if (serverErrors.value.isNotEmpty()) { … errors_in_servers_configuration`; `C/model/SimpleXAPI.kt:4919-4923`; `src/Simplex/Chat/Operators.hs:540,544` current-user errors have `user = Nothing` | Verification: `Deleting the only message server (smp1) in "Your servers" shows the footer "No message servers."; "Save servers" is disabled. ("Errors in servers configuration." appears only for errors without their own text, e.g. two servers with the same host)` |
+| `chatRelays_addAndTest` | A headless relay takes no typed commands, so its address can't come from `/ad`. The plan reads the link the relay prints on first start. | plan §8.1 "headless creates the relay address on first start and prints `Chat relay address is created:` … A headless relay takes no typed commands" | Notes: `The relay's address is the link its headless process prints after "Chat relay address is created:" on first start (plan §8.1); the harness does not pre-register this relay in the GUI's servers` |
+| `chatRelays_testFails` | The test can't run as written. A contact address (bob's) is not a relay link, so "Test relay" stays disabled. The client-side check accepts only relay-type SimpleX links. | `NS/ChatRelayView.kt:58-64` `validRelayAddress … linkType == SimplexLinkType.relay`; `:213` `validAddress = … validRelayAddress(…)`; `:302` `disabled = !valid \|\| testing.value`; `tests/ChatTests/ChatRelays.hs:218-223` scenario 3: `bob ##> "/da"` … `"relay test failed at RTSGetLink, error: "` | Verification: `The relay's address is entered, then the relay deletes it (RelayPeer.run("/da"), plan §8.1); "Test relay" shows "Relay test failed!" (H/ChatRelays.hs testChatRelayTest, scenario 3, RTSGetLink)`; Needs: `RELAY, PEERCTL`; Notes: `A contact address is not a relay link, so "Test relay" stays disabled for it (ChatRelayView.kt:58-64,302)` |
+| `socks_saveAndReconnect` | "Save and reconnect" and the `/_network` call exist only while the SOCKS proxy is on. With it off, the button is "Save" and only the pref is written. The row doesn't say SOCKS is turned on first. | `NS/NetworkAndServers.kt:428-430` `if (networkUseSocksProxy && !migration) { withBGApi { if (controller.apiSetNetworkConfig(cfg, …`; `:546-549` `if (networkUseSocksProxy && !migration) showUpdateNetworkSettingsDialog { save(false) } else save(false)` | Notes: `For socks_saveAndReconnect, "Use SOCKS proxy" is enabled first; with it off the button is "Save" and only the pref is written (no /_network)` |
+| `socks_wrongConfigAlert` | The row doesn't say which input the core rejects, and the core is called only while SOCKS is on. Client validation rejects only "@" in the host and bad port numbers. | `NS/NetworkAndServers.kt:428-441` `if (networkUseSocksProxy && !migration) … else { … showWrongProxyConfigAlert() }`; `:654-661` `validHost = !s.contains('@')`, `validPort` regex | Notes: `"Use SOCKS proxy" is enabled first (the core is called only then, NetworkAndServers.kt:428); the row must name a host/port value that passes validHost/validPort (:654-661) but that the core's /_network rejects (still to be found against the core's SOCKS proxy parser)` |
+| `advNet_persistAcrossRestart` | The main file is wrong. `/_network` is sent on start from `startChat` in SimpleXAPI.kt, not from Core.kt. | `C/model/SimpleXAPI.kt:666` `apiSetNetworkConfig(getNetCfg())` (inside `startChat`, :663) | Main file: `C/model/SimpleXAPI.kt:666` |
+| `advNet_transportIsolation` | The cited range is the picker's definition. The row the test opens is in Advanced network settings. | `NS/AdvancedNetworkSettings.kt:241-243` `SectionView(stringResource(MR.strings.network_session_mode_transport_isolation)) { SessionModePicker(…) }` | Main file: `AdvancedNetworkSettings.kt:241-243`, `NetworkAndServers.kt:615-652` |
diff --git a/plans/ui-tests/catalogue/verify/04-b.md b/plans/ui-tests/catalogue/verify/04-b.md
new file mode 100644
index 0000000000..ee960724fb
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/04-b.md
@@ -0,0 +1,35 @@
+| Test name(s) | Problem | Evidence (file:line + short quote) | Exact corrected text for the row (or "delete row"/"split: ...") |
+|---|---|---|---|
+| `iceServers_saveCustom`, `iceServers_invalidRejected`, `iceServers_resetToDefaults` | The entry path is wrong. With no saved servers the screen shows only the "Configure ICE servers" switch and "Using SimpleX Chat servers."; the editor with "Save" appears after the switch is turned on, and "Edit" appears only once servers are saved. Reset happens by turning the switch off, which shows "Use SimpleX Chat servers?" with the button "Confirm". | `US/RTCServers.kt:35-36` `editRTCServers = !isUserRTCServers`; `:111-118` `configure_ICE_servers` switch; `:62-76` reset alert, `confirm_verb` | Entry path: `"WebRTC ICE servers" > "Configure ICE servers" switch on > type one server per line > "Save"; "Edit" reopens the editor`. Verification: `Pref WebrtcICEServers; an invalid or duplicate line gives "Error saving ICE servers"; switching "Configure ICE servers" off gives "Use SimpleX Chat servers?" → "Confirm" and sets the pref to null` |
+| `calls_relayPolicyEffect` | Ownership/duplicate. The legend gives the WebRTC `IGNORE` row to 02, and 02 already has it (`call_webrtcSession_connects`, which says "this is the only WebRTC row"). The relay effect can only be seen inside a real WebRTC call. | `00-legend.md` ownership: "Calls: … the WebRTC `IGNORE` row \| 02"; `02-chat-view-messages.md:263` | delete row. Also change the §G `calls_alwaysUseRelayToggle` note to "The call effect is covered only by the WebRTC `IGNORE` row in catalogue 02 (`call_webrtcSession_connects`)", and recount §N (8 tests, 8 ignored) and the totals |
+| `dbMgmt_exportArchive` | "chat restarted" is wrong. `exportArchive` always returns false, so `stopChatRunBlockStartChat` doesn't call `startChat`, and the chat stays stopped after the export. | `C/views/database/DatabaseView.kt:630` `return false`; `:541-543` `if (canStart) { startChat(…) }` | Verification: `Log /_db export {…}; zip at the saveDialog path; Pref ChatArchiveName/Time; the chat stays stopped afterwards ("Chat is stopped" toggle off) (testMaintenanceMode, …WithFiles)` |
+| `dbMgmt_importArchive_restoresData` | A step is missing. The import removes the stored key while StoreDBPassphrase stays true, so the restart after import fails with ErrorNotADatabase and `DatabaseErrorView` asks for the passphrase before any chat is visible. | `DatabaseView.kt:724` `DatabaseUtils.ksDatabasePassword.remove()`; `DatabaseErrorView.kt:96-100` `encrypted_database` + `SaveAndOpenButton` when `useKeychain` | Verification: `"Import chat database?" → "Import"; /_db import; "Chat database imported"; then "Encrypted database" / "Enter passphrase…" → type the exported database's passphrase → "Save passphrase and open chat"; a message from bob received after the export is gone` |
+| `dbMgmt_importInvalidArchive` | "Error importing chat database" is never shown for a bad zip. `apiImportArchive` throws `Exception`, but `importArchive` catches only `kotlin.Error`. The exception escapes, `stopChatRunBlockStartChat` logs it and starts the chat again on storage that `/_db delete` already removed. This looks like an app bug: confirm it in the real app before writing the test. | `C/model/SimpleXAPI.kt:1128` `throw Exception("failed to import archive…")`; `DatabaseView.kt:740,745` `catch (e: Error)`; `:535-540` `catch (e: Throwable) { … true }` | Verification: `Expected "Error importing chat database" for a bad zip; current code does not show it (Exception vs catch (e: Error), DatabaseView.kt:740) — report as an app bug and keep the test @Ignore("app bug: import error not caught") until fixed`. Notes: `/_db delete runs before the import (DatabaseView.kt:718), so a failed import leaves no database` |
+| `dbMgmt_importRestoresAppSettings` | RESTART is not needed. The import sets ShouldImportAppSettings, and the settings are applied by the `initChatController` that runs when the passphrase is entered after the import, not at a later app restart. | `DatabaseView.kt:723` `shouldImportAppSettings.set(true)`; `Core.kt:144-152` (inside `initChatController`); `DatabaseErrorView.kt:224` `runChat` → `initChatController` | Needs: `FD`. Verification: `After the import and the passphrase prompt ("Save passphrase and open chat"), theme/prefs from the archive are applied (testAppSettings)` |
+| `dbMgmt_deleteDatabase` | "onboarding after restart" is wrong, and RESTART is not needed. After the delete the block returns true, `startChat` re-inits the controller (chatDbChanged=true) with no user, and desktop goes straight to onboarding Step1 with no restart. | `DatabaseView.kt:279-281` `deleteChat(m, progressIndicator); true`; `:414-426`; `Core.kt:153-166` `onboardingStage.set(Step1_SimpleXInfo)`, `startChatWithoutUser()`; `SimpleXAPI.kt:708` `localUserCreated.value = false` | Verification: `"Delete chat profile?" → "Delete"; "Chat database deleted"; the onboarding welcome screen ("Link a mobile" / "Create your profile") appears without a restart`. Needs: `—` |
+| `dbMgmt_openDatabaseFolder` | The Main file:line points at the wrong file. `D/views/database/DatabaseView.desktop.kt` holds only `restartChatOrApp`. The folder opener is `desktopOpenDatabaseDir` in `Files.desktop.kt`. | `D/platform/Files.desktop.kt:33-40` `desktopOpenDir(dataDir)` … `Desktop.getDesktop().open(dir)`; click at `DatabaseView.kt:239-246` | Main file:line: `DatabaseView.kt:239-246`, `D/platform/Files.desktop.kt:33-40` |
+| `dbEncrypt_setFirstPassphrase` | The alert is wrong for the desktop default. On a fresh desktop DB `currentKey` is pre-filled with the stored random key, so "Update database passphrase" shows the "Change database passphrase?" alert with "Update". "Encrypt database?" → "Encrypt" appears only when `currentKey == ""` (an unencrypted DB). | `C/views/database/DatabaseEncryptionView.kt:49` `currentKey = … if (initialRandomDBPassphrase.value) ksDatabasePassword.get()`; `:165-175`; `D/views/database/DatabaseEncryptionView.desktop.kt:95-101` `change_database_passphrase_question` / `update_database` | Verification: `"New passphrase…", "Confirm new passphrase…", "Update database passphrase" (DatabaseEncryptionView.kt:197; "Set passphrase" is used only in migration) → "Change database passphrase?" → "Update"; Log /_db encryption (obfuscated); "Database encrypted!"; Pref InitialRandomDBPassphrase=false (testDatabaseEncryption)` |
+| `dbEncrypt_removeFromSettings`, `dbEncrypt_saveToSettings` | A setup step is missing. The "Save passphrase in settings" switch is disabled while the DB has its initial random passphrase (the harness default), so a passphrase must be set first. Turning the switch on sets only StoreDBPassphrase; EncryptedDBPassphrase is written at the next passphrase update. | `DatabaseEncryptionView.kt:130` `enabled = (!initialRandomDBPassphrase.value && …) \|\| migration`; `:292-297` `setUseKeychain`; `:467-468` | Notes: `A passphrase is set first (harness fact 8: the switch is disabled with the random passphrase). Turning the switch on sets StoreDBPassphrase=true; EncryptedDBPassphrase (Base64) is written by the next "Update database passphrase"` |
+| `dbEncrypt_footerStates` | Needs are incomplete. The "unencrypted" footer requires `chatDbEncrypted == false`, i.e. a DB opened with an empty key. A desktop DB is always encrypted (random key), and the UI can't set an empty passphrase, so this state needs a fixture. | `D/views/database/DatabaseEncryptionView.desktop.kt:66-67` `if (chatDbEncrypted == false)`; `DatabaseUtils.kt:56-58` random key on a new DB; `DatabaseEncryptionView.kt:180` `newKey.value.isEmpty()` disables | split: `dbEncrypt_footerStates` (random / stored / not-stored footers) Needs `—`; the unencrypted footer goes to a new name (e.g. `dbEncrypt_footerUnencrypted`) with Needs `FIXTURE (unencrypted DB)`, which also covers the "Encrypt database?" → "Encrypt" alert |
+| `dbError_saveAndOpen` | Not reachable in this row's setup. With the passphrase not stored (StoreDBPassphrase=false) the screen shows only "Open chat". "Save passphrase and open chat" appears when StoreDBPassphrase=true but no key is stored, for example after an import. | `DatabaseErrorView.kt:98-104` `if (useKeychain) { … SaveAndOpenButton } else { … OpenChatButton }`; `DatabaseView.kt:724` | split: keep `dbError_enterPassphraseOnStartup_open`, `dbError_wrongPassphrase` (Needs `RESTART`; verification "Encrypted database" / "Enter passphrase…" / "Open chat"; wrong gives "Wrong passphrase!"); new row `dbError_saveAndOpen`: entry "restart with StoreDBPassphrase=true and no stored key (e.g. EncryptedDBPassphrase cleared before restart)", verification "Encrypted database" / "Save passphrase and open chat"; Pref EncryptedDBPassphrase written, Needs `RESTART` |
+| `dbError_incompatibleDowngrade` | Line drift. 122-150 is the Downgrade branch ("Database downgrade"). "Incompatible database version" with the NoDown text is the `MigrationError.Error` branch. | `DatabaseErrorView.kt:146-152` `incompatible_database_version` … `mtrErrorDescription`; `:283-284` `mtr_error_no_down_migration` | Main file:line: `DatabaseErrorView.kt:146-152,281-287` |
+| `dbError_restoreBackup` | The fixture is incomplete and "→ opens" is wrong. If the main DB opens, `initChatController` clears EncryptionStartedAt and the error screen never shows, so the main DB must fail to open (an interrupted re-encryption). `restoreDb` only copies the `.bak` files and hides the button; it doesn't reopen the chat. | `Core.kt:140` `if (encryptionStartedAt.get() != null) encryptionStartedAt.set(null)` (only on OK); `DatabaseErrorView.kt:268-279` `restoreDb` copies, sets flag false, no `runChat` | Needs: `FIXTURE (EncryptionStartedAt set, *.bak files that open with the stored key, main files encrypted with another key), RESTART`. Verification: `"Restore database backup" → "Restore database backup?" → "Restore"; the button disappears and EncryptionStartedAt is cleared; entering the backup's passphrase (or a restart) then opens the chat` |
+| `migrateFrom_stopsChatAndAuth` | "on failure 'In order to continue, chat should be stopped.'" can't be driven: `apiStopChat` can't be made to fail on demand. | `MigrateFromDevice.kt:447-465` `ChatStopFailed` only on an exception | Verification: `"Migrate device"; Log /_stop; then the passphrase step (random DB → "Set passphrase", harness fact 8)` |
+| `migrateFrom_passphraseNotSetRedirect` | Line drift; the prompt is vague. The redirect is decided at 453 (line 120 is the back-disable list), and the prompt is `DatabaseEncryptionView(migration = true)` with the button "Set passphrase". | `MigrateFromDevice.kt:453` `if (initialRandomDBPassphrase.get()) PassphraseNotSet`; `:209-217`; `DatabaseEncryptionView.kt:197` `set_passphrase` | Main file:line: `MigrateFromDevice.kt:209-217,453`. Verification: `"Chat is stopped", "New passphrase…", "Confirm new passphrase…", "Set passphrase"; after setting it, "Archive and upload" appears` |
+| `migrateFrom_verifyPassphraseWrong` | The alert is wrong. A wrong key gives ErrorOpen/ErrorNotADatabase, which shows "Wrong passphrase!" / "Enter correct passphrase.". "Error verifying passphrase:" is only for other errors. | `MigrateFromDevice.kt:472-473` `showErrorOnMigrationIfNeeded(DBMigrationResult.ErrorNotADatabase(""))`; `DatabaseErrorView.kt:243-244` `wrong_passphrase_title`, `enter_correct_passphrase` | Verification: `"Verify database passphrase" with a wrong passphrase → "Verify passphrase" → "Wrong passphrase!" / "Enter correct passphrase."`. Notes: `A passphrase is set first (otherwise the passphrase-not-set step is shown)` |
+| `migrateFrom_uploadAndShowLink`, `migrateFrom_cancelMigration`, `migrateFrom_finalize_startChatWarning`, `migrateFrom_finalize_deleteDatabase` | Can't be driven with the harness. The upload runs in a temporary database whose new "Temp" user gets the preset operators' servers, so the archive goes to public XFTP servers, which are unreachable in the namespace. The harness configures servers only for the GUI user (plan §8.2), so the link, cancel and finalize steps are never reached. | `C/model/SimpleXAPI.kt:722` `apiCreateActiveUser(null, Profile(displayName = "Temp", …), ctrl = ctrl)`; `MigrateFromDevice.kt:516-531,600`; `src/Simplex/Chat/Operators/Presets.hs:122-127` (public `xftp…simplexonflux.com`); plan §8.2 "Presets are enabled when the user is created" | Needs: `IGNORE: destinations on public servers (the migration upload goes to the preset XFTP servers of a temporary user): unreachable in the namespace (plan §11.3)`. Notes: `The temporary database's user is created with preset operators (SimpleXAPI.kt:722); making it testable needs a seam or a plan change`. Recount §I |
+| `migrateFrom_uploadFailedRetry` | Can't be driven. The upload never targets the local XFTP server (see above), so stopping it has no effect. A stopped or unreachable server also gives temporary errors, which the agent retries (SFWARN) without ever sending SndFileError, so "Upload failed" doesn't appear. | `MigrateFromDevice.kt:585-591` "Upload failed" only on `CR.SndFileError`; simplexmq `FileTransfer/Agent.hs:274-278` `retryOnError … if temporaryOrHostError e then loop`, `:494-498` unlimited prepare retries | Needs: `IGNORE: destinations on public servers (the migration upload goes to the preset XFTP servers of a temporary user): unreachable in the namespace (plan §11.3)` |
+| `migrateTo_roundTripSameJvm` | Can't be driven: it depends on the GUI's own upload, which goes to public XFTP servers (see the `migrateFrom_uploadAndShowLink` finding). | `SimpleXAPI.kt:722`; `MigrateFromDevice.kt:600` | Needs: `IGNORE: destinations on public servers (the migration upload goes to the preset XFTP servers of a temporary user): unreachable in the namespace (plan §11.3)` |
+| `migrateTo_invalidLink`, `migrateTo_deletedFile` | Needs differ between the two names, and they are incomplete. A valid link can't come from the GUI, so `deletedFile` needs a CLI peer to upload an archive (`/_upload 1 <zip>` prints "upload complete. download with:" and the links, as in testXFTPStandaloneSmall, H/Files.hs:1266-1279). The file is then deleted from the server (`servers.reset("xftp1")`, SRVCTL); a deleted file gives a permanent AUTH error → RcvFileError. | `MigrateToDevice.kt:604-609` RcvFileError → "Download failed" / "File was deleted or link is invalid"; `:547-550` "Invalid link" | split: `migrateTo_invalidLink` — verification "Invalid link" for pasted non-link text, Needs `CB, ONBOARD`; `migrateTo_deletedFile` — entry "link from a CLI peer's `/_upload 1 <archive>`, then the XFTP store reset before pasting", verification `"Download failed" alert "File was deleted or link is invalid", then the "Download failed" section with "Repeat download"`, Needs `P, XFTP, SRVCTL, CB, ONBOARD` |
+| `migrateTo_downloadFailedRepeat` | Not drivable as described. A stopped XFTP server gives temporary network errors, which the agent retries a limited number of times and then stops without RFERR, so "Download failed" never appears. "Download failed" + "Repeat download" is produced only by a permanent error (a deleted file), which duplicates `migrateTo_deletedFile`. | `MigrateToDevice.kt:604-617` (RcvFileError / NoRcvFileUser only); simplexmq `FileTransfer/Agent.hs:209-215` `withRetryIntervalLimit … retryOnError`, `:268-271` `when (n < maxN)` | delete row ("Repeat download" is asserted in `migrateTo_deletedFile`); recount §I |
+| `migrateTo_wrongPassphrase` | Needs are incomplete and the alert is unnamed. The link must come from a CLI peer whose archive is encrypted (`/db encrypt <key>` before `/_db export`): an unencrypted archive can't reach the step, because "Open chat" stays disabled with an empty key. A wrong key shows "Wrong passphrase!". | `MigrateToDevice.kt:438` `disabled = … currentKey.value.isEmpty()`; `:443-450` → `showErrorOnMigrationIfNeeded`; `DatabaseErrorView.kt:243-244` | Verification: `"Enter passphrase" step, wrong passphrase → "Open chat" → "Wrong passphrase!" / "Enter correct passphrase."; stays on the step`. Needs: `P, XFTP, CB, ONBOARD`. Notes: `Link from a CLI peer: /db encrypt, /_db export, /_upload 1 <zip> (H/Files.hs:1266-1279)` |
+| `migrateTo_networkSettingsConfirm` | A link "from a SOCKS-configured source" can't be produced by the GUI (its upload is unreachable). It must be crafted: a CLI peer's upload link with the migration `data` parameter (networkProxy, hostMode, requiredHostMode) appended. | `MigrateToDevice.kt:527-534` Onion state only when `hasProxyConfigured && hostMode != null && requiredHostMode != null`; `MigrateFromDevice.kt:575-583` `data.addToLink(…)` | Entry path: `paste a CLI peer's /_upload link with MigrationFileLinkData {networkConfig: {networkProxy, hostMode, requiredHostMode}} added`. Needs: `P, XFTP, CB, ONBOARD` |
+| `migrateTo_resumeAfterRestart` | Vague, and the line is off. Only the ArchiveImport stage (archive file present → "Import failed" / "Repeat import") and the Passphrase stage ("Enter passphrase") come back after a restart. A restart during the download drops the migration. A valid link needs a CLI peer. | `MigrateToDevice.kt:55-82` `makeMigrationState` … `is DownloadProgress -> … null`, `is ArchiveImport -> ArchiveImportFailed`, `is Passphrase -> Passphrase` | Main file:line: `MigrateToDevice.kt:55-82`, Pref MigrationToStage. Verification: `restart at the "Enter passphrase" step → after restart "Migrate here" reopens at "Enter passphrase" (a restart during "Downloading archive" drops the migration)`. Needs: `P, XFTP, CB, RESTART, ONBOARD` |
+| `version_screenShowsVersions` | The label is wrong. The Settings version row shows the version text (`vX (build)`); "App version" is the title of the screen it opens. | `US/SettingsView.kt:350-356` `AppVersionText()` (`appVersionInfo.first …`); `US/VersionInfoView.kt:33` `app_version_title` | Entry path: `Settings > version row ("vX (build)")`. Verification: `"App version" screen: "App version: v%s", "App build: %s", "Core version: v%s", "simplexmq: v%s (%2s)"; /version in Log` |
+| `updates_channelDropdown`, `updates_noticeDialog` | Harness side effect not noted. Choosing Stable/Beta calls `setupUpdateChecker`, whose `createUpdateJob` is a `withLongRunningApi { delay(24 h) }`. UiIdle (plan §6) sees it as in flight for the rest of the test, so the next `drain()` waits its full 30 s and the failure report lists it. | `D/views/helpers/AppUpdater.kt:161-176` `createUpdateJob() … delay(24 * 60 * 60 * 1000)`; `:135-136,143-144` | Notes (add): `Selecting Stable/Beta starts a 24 h withLongRunningApi job; the test ends by selecting "Disabled" in the dropdown (setupUpdateChecker cancels the job, AppUpdater.kt:162-165) so UiIdle drains` |
+| `dev_enableLogs`, `dev_confirmDbUpgradesPref`, `dev_showConsoleInNewWindow_requiresAuth`, `dev_showInternalErrors`, `dev_showSlowApiCalls` | Missing `DT`. These rows are in the "Developer options" section, which renders only when developer tools are on; other rows needing that state carry `DT` (`dev_devToolsExtraSessionModes`, `dbError_upgradeConfirmation`). | `US/DeveloperView.kt:40-63` `if (devTools.value) { … debug_logs … confirm_database_upgrades … terminal_always_visible … show_internal_errors … show_slow_api_calls }` | Needs: `DT` for each of these rows |
+| `dev_resetAllHints` | The precondition clashes with the harness. The pre-set prefs (laNoticeShown, oneHandUICardShown, addressCreationCardShown, …) are hint prefs, so "Reset all hints" is already enabled when the test starts. | `C/model/SimpleXAPI.kt:278-293` `hintPref(laNoticeShown, false)`, …; plan §11.1 "Pre-set prefs" | Verification: `Enabled at start (the harness pre-sets change hint prefs); after tapping, all hint prefs are defaults and the row is disabled` |
+| `dev_installTerminalLink`, `help_contributeAndStar`, `badges_howItWorks`, `badges_getYourCodeLink` | A step is missing. `openExternalLink` first shows the "Open external link?" alert (the URL as text) with "Open"; the URI stub gets the URL only after "Open". | `C/views/helpers/Utils.kt:613-624` `showAlertDialog(title = open_external_link_title, text = uri, confirmText = open_verb, onConfirm = { openUriCatching(uri) })`; `US/SettingsView.kt:256,284,317`; `BadgesSupportSimplexView.kt:130`; `C/views/onboarding/HowItWorks.kt:80` | Verifications: `dev_installTerminalLink`: `"Open external link?" with the GitHub URL → "Open"; URI stub gets https://github.com/simplex-chat/simplex-chat`. `help_contributeAndStar`: `each shows "Open external link?" → "Open"; URI stub gets …#contribute / https://github.com/simplex-chat/simplex-chat`. `badges_howItWorks`: `Title, 3 paragraphs; the blog link shows "Open external link?" → "Open"; URI stub gets https://simplex.chat/blog/20260919-simplex-supporter-badges.html`. `badges_getYourCodeLink`: `"Open external link?" → "Open"; URI https://simplex.chat/badges/` |
+| `linkMobile_newPairing_verifyAndConnect` | A quoted label isn't verbatim: "Connected mobile: Mobile" is not a string. It is the section title "Connected mobile" with the device name "Mobile" under it. | `C/views/remote/ConnectMobileView.kt:218-224` `SectionView(stringResource(MR.strings.connected_mobile)) { … Text(deviceName …) }`; strings.xml `connected_mobile` = "Connected mobile" | Verification: `QR + "Waiting for mobile to connect:"; after connect: "Verify connection", section "Connected mobile" showing "Mobile", and the "Verify code on mobile" code shown by the GUI is the first 23 characters of the CLI's session code (ConnectMobileView.kt:234); then the GUI switches to the remote host (startRemote)` |
+| `linkMobile_remoteFiles` | The verification is only a test reference, with no behaviour to assert. | Row: `(remoteStoreFileTest)`; `T/RemoteTests.hs:286-300` | Verification: `While connected to the mobile host, attach tests/fixtures/test.jpg (FD) and send to bob → bob receives it; a file bob sends is received and opened from the desktop's remote-hosts store (remoteStoreFileTest)` |
+| Count table / §G, §H, §I, §N headings, file header | Counts change if the fixes above are applied (§N −1 test and −1 ignored; §I −1 test plus 6 rows moving to `IGNORE`; §H +1 or +2 tests from the splits). | `04-settings-database-remote.md` `## Count` | Recount with the script after the row changes (legend "Count rules") |
diff --git a/plans/ui-tests/catalogue/verify/05-carryover-progress.md b/plans/ui-tests/catalogue/verify/05-carryover-progress.md
new file mode 100644
index 0000000000..1b58716779
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/05-carryover-progress.md
@@ -0,0 +1,12 @@
+# 05 carry-over map progress (round 20 + full map)
+
+## Done
+- Task 1 row fixes in 05: §6 share-links row (unlabelled share icon on the 1-time link / "Share address" / "Share 1-time link", refs NewChatView 715-757, UserAddressView 115,343-366, ContactConnectionInfoView 159-166); §13 back_onProtectedActionPrompt (entry Settings > "Migrate to another device", SettingsView 104); §14 interfaceSectionToolbars note (replaces 04 reachableChatToolbarVisibility); §14 Enter row pointer
+- Map 05-android-carryover.md: rules R1-R10, "not listed" scope, summary; 01 (86), 02 (97), 03 (58), 04 (94) = 335 listed: 34 REPLACED, 50 DESKTOP-ONLY, 251 ADAPT; 842 unchanged
+- All r20 GAPs/NITs applied as map rows (lock Keystore R8, 02 file rows, appearance zoom/persist/reachable, Esc rows, privacy/network/updates/migrateTo, serversSummaryFilesTab, noSelectedChatPlaceholder, channelRelays_removeLastRelayWarning, itemsMatrix, rcvFile_senderRevoked unchanged)
+- 05 Notes carry-over lists replaced by pointer + general rules; §6 carry-over note, §10/§11 intros and header point to the map
+- recount.py 05: 252 tests / 20 ignored / 15 sections (header unchanged)
+- Checks: every map name exists in 01-04 at the cited line (scratchpad cmap/fill.py), REPLACED rows each name an existing 05 test, all 05 names cited exist; 01-04 concurrent edits (20:35/20:40) diffed vs r20a copies: only 02 itemsMatrix (now P, AV) affected -> R10 added
+
+## Remaining
+- none
diff --git a/plans/ui-tests/catalogue/verify/05-progress.md b/plans/ui-tests/catalogue/verify/05-progress.md
new file mode 100644
index 0000000000..92fbfb364a
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/05-progress.md
@@ -0,0 +1,22 @@
+# 05-android-only.md progress
+
+## Done (survey notes, 2026-10-12)
+- read legend, 01 model, research doc §5.3, plan §11.3, 04 §A/C/F/K/M
+- surveyed: manifests, MainActivity (intents, back, FLAG_SECURE), SimplexApp (lifecycle, service start, platform iface), SimplexService (bg notices, battery), NtfManager.android, CallActivity, CallView.android (permissions, PiP, overlay), CallService, CallSettings, CallManager, IncomingCallAlertView, ConnectDesktopView, UserPicker(android), ChatListView android branches (SetNotificationsModeAdditions in chat list!), YourNetwork + SetNotificationsMode, NotificationsSettingsView, SettingsView (+android shutdown, rate app), PrivacySettings android (protect screen, lock mode), AppLock, LocalAuthentication.android, Cryptor/Keystore + DatabaseEncryptionView.android, QRCodeScanner.android (camera_not_available branch unreachable), ScanProtocolServer, ComposeView.android (attachments), GetImageView (camera/gallery, 10 limit), Share.android (chooser, open with), CIFileView android menu, ChatItemView.android (save image MediaStore), PlatformTextField.android (EditText! IME image commit), Appearance.android (icon, lang recreate), CustomTimePicker wheel, ChatView android branches (swipe reply, back handler, filter in menu, ConnectInProgressView)
+- key facts: no FCM (INSTANT commented out); compose field is an EditText in AndroidView; Android onboarding has no passphrase step; Waydroid Android 13 → POST_NOTIFICATIONS runtime perm
+
+- WRITTEN: header, Needs codes, IGNORE reasons, setup (8 items), §1 Onboarding (14), §2 ntf modes (20), §3 system ntfs (18), §4 permissions (13), §5 camera/QR (12, 7 IGNORE), §6 attachments (19), §7 share-in (15), §8 app links (8), §9 calls (19, 6 IGNORE), §10 lock/protect (19, 1 IGNORE), §11 keystore/archive (11, 1 IGNORE), §12 use-from-desktop (15), §13 back (16), §14 layout/gestures (25), §15 settings/lifecycle (14, 3 IGNORE), Notes (carry-over, excluded, bugs, open questions), Count; recount.py run: 243 tests / 20 IGNORE / 15 sections; header filled; no duplicate names across 01-05; all IGNORE cells match the defined reasons line numbers of androidMain files re-checked against real files (earlier stripped-import listings were wrong)
+
+## Remaining
+- nothing; file complete (243 tests, 20 IGNORE, 15 sections). Full read-through review done 2026-10-12.
+
+## Open questions collected so far
+1 legend/plan: new Needs codes + IGNORE reasons + class-map rows need adding to 00/plan (fenced)
+2 captive_portal_mode 0 → network validated under net isolate?
+3 rotation on Waydroid
+4 FLAG_SECURE vs captureToImage
+5 PendingIntent.send of system intents vs Espresso-Intents
+6 MediaProvider NPE for MediaStore insert (save image)
+7 WebView loads call page on Waydroid?
+8 BUG? lock-screen 'Open' OpenChatAction ignored by onNewIntent (MainActivity.kt:64-68)
+9 Use-from-desktop controller CLI must listen on the waydroid bridge (host netns); multicast over bridge unverified
diff --git a/plans/ui-tests/catalogue/verify/05-r18-fixes-progress.md b/plans/ui-tests/catalogue/verify/05-r18-fixes-progress.md
new file mode 100644
index 0000000000..e672fc14ab
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/05-r18-fixes-progress.md
@@ -0,0 +1,12 @@
+# 05 round-18 fixes progress
+
+## Done
+- WRONG-FACT sysNtf_previewHidden (no large icon; app-icon assertion moved to sysNtf_contactRequest_acceptAction)
+- 6 GAP rows inserted (§6 attachSheet_keyboardOpen_fullyExpanded, copyAndroid_text_noToast, copyAndroid_fileItem_copiesCaptionOnly; §10 passcodeAndroid_landscapeShowsSubmit; §14 toolbar_notes_filterInMenuAndroid; §15 profilesAndroid_deleteLastVisibleReturnsToOnboarding)
+- Notes bullets: copy, calls via CallActivity (replacement rows named), runtime permissions + "Paste link / Scan", notes filter, last-profile delete; setup item 2 pre-grants CAMERA/RECORD_AUDIO
+- Open questions 10-12 (Open with viewer, ActivityNotFoundException stubs, offline vs Ethernet) + row pointers
+- NITs: font slider; §14 XFTP/images dropped; clear-text row renamed compose_editText_clearButtonForWrappedParagraph (wrapped paragraph); MCAST (bridge) defined + §12 row
+- Uniqueness across 01-05 checked (no duplicates); recount.py: 249 tests, 20 ignored; header totals updated
+
+## Remaining
+- none
diff --git a/plans/ui-tests/catalogue/verify/05-r19-fixes-progress.md b/plans/ui-tests/catalogue/verify/05-r19-fixes-progress.md
new file mode 100644
index 0000000000..df7d2e23c6
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/05-r19-fixes-progress.md
@@ -0,0 +1,13 @@
+# 05 round-19 fixes progress
+
+## Done
+- NITs: l.124/l.225 P ×2 (bob, cath); l.147 "Denied once"; l.148 canAsk pre-set false (+ no-dialog check, no SYSUI needed)
+- Rows: §13 pendingReview_closeSupportChat_returnsToChatList; §14 compose_enterKeyInsertsNewline_sendButtonSends, connectProgress_inChatStripAndCancel (verified against d72f68e6d; strings "Chat with admins", "Loading profile…", "Send Message", "Cancel")
+- Notes GAP 1: message-field bullet rewritten (no key handling on Android; send-button rows, replaced row, desktop-only rows, §6 "File" stub for draft_withAttachment_restored and typed-path rows 02 l.115/116/118)
+- Notes GAP 2: §W desktop-only rows named; passphrase-step + Link a mobile 01 rows desktop-only; callStart_browserUnavailable desktop-only; text selection; pagination 75; dbMgmt_layout folder; right-click -> longClick with every affected 01-04 row named (all onRightClick sites have a combinedClickable onLongClick twin, checked)
+- Notes NIT: QR tap = share chooser for 01 oneTimeLinkQrClickSavesPng
+- Uniqueness 01-05 (1429 names, no dups); all Notes test refs exist; new rows 8 cells
+- recount.py: 252 tests, 20 ignored, 15 sections; header totals updated
+
+## Remaining
+- none
diff --git a/plans/ui-tests/catalogue/verify/05-r21-fixes-progress.md b/plans/ui-tests/catalogue/verify/05-r21-fixes-progress.md
new file mode 100644
index 0000000000..1523a1d494
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/05-r21-fixes-progress.md
@@ -0,0 +1,12 @@
+# 05 round-21 fixes progress
+
+## Done
+- Verified: toast event class is `android.widget.Toast` (ToastPresenter.java:332, SDK 36), not `Toast$TN` (pre-R); app targetSdk 36; all Android toasts via showToast (UI.android.kt:23)
+- Verified: setText -> cursor 0 (TextView.java:7504,7519; ArrowKeyMovementMethod.java:364); app forwards at PTF.android 123-128,160-167 (findings cited 126-131/156-160: off)
+- Map: summary table + text (340 listed, 33/50/257, 837 unchanged); R11, R12; not-listed bullet (replaceText+setSelection, clear-text wrap note)
+- Map rows: +01:120, +01:250, +03:57, +04:105, +04:187; 02:261 REPLACED->ADAPT; 02:262 Accept branch; 02:214 note; 04:183 R11
+- 05: Needs-codes TOAST = R11 recorder; open question 13; 7 toast rows cite R11; setup item 5 cursor-at-end; 05:202 ref 715-763; §9 intro; Notes R1–R12 + bullet
+- recount.py: 252 tests / 20 ignored / 15 sections (header unchanged); map recount 01 88(10/7/71), 02 97(12/11/74), 03 59(0/0/59), 04 96(11/32/53) = 340 (33/50/257) matches table; no dups; every row name at its cited line; all cited test names exist
+
+## Remaining
+- none
diff --git a/plans/ui-tests/catalogue/verify/05-r22-fixes-progress.md b/plans/ui-tests/catalogue/verify/05-r22-fixes-progress.md
new file mode 100644
index 0000000000..8097903bc4
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/05-r22-fixes-progress.md
@@ -0,0 +1,14 @@
+# 05 round-22 fixes progress
+
+Input: r22e findings (scratchpad r22e/findings.md). Files: 05-android-carryover.md, 05-android-only.md, research doc line ~158 only.
+
+## Done
+- Verified: no LocalUriHandler/LocalClipboardManager provider in android/ or androidMain; Compose ui-android 1.8.2 AndroidUriHandler.openUri = startActivity(Intent(ACTION_VIEW, Uri.parse)), ActivityNotFoundException rethrown as IllegalArgumentException; AndroidClipboardManager wraps the system ClipboardManager.
+- Verified: Utils.kt:605-611, SettingsView.kt:267-271, strings 2898-2902 (Cellular), cleartext SDK refs, MAN:40-50, targetSdk 36, jsoup 1.17.2, LinkPreviews.kt:96-140.
+- Header-aware scans: URI 16 tests (10 unlisted), HTTP 5 (4 unlisted), CB 90.
+- Map: R13 added; 13 ADAPT rows (10 URI R13 + 3 link preview 02:44); Not-listed bullets for CB (90) and 04:53 vacuous pass; Summary recounted: 01 91/10/7/74/261, 02 102/12/11/79/179, 03 59/0/0/59/253, 04 102/11/32/59/130, total 354/33/50/271/823; names at cited lines verified, no dups, rows in line order.
+- 05: codes para (URI/CB via R13, restart -> OQ14); setup item 4 clears clipboard; §12 step 2 + 05:322 note; 05:399 verification/Needs INTENTS/Notes fixed; 05:402 Cellular; Notes R1-R13 + bullet; open questions 14 (restart) and 15 (debug network-security-config). recount.py: 252/20/15 = header.
+- Research doc :158 corrected to point at R13.
+
+## Remaining
+- none
diff --git a/plans/ui-tests/catalogue/verify/P1a-progress.md b/plans/ui-tests/catalogue/verify/P1a-progress.md
new file mode 100644
index 0000000000..4f62984c63
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/P1a-progress.md
@@ -0,0 +1,112 @@
+# P1a progress (started 2026-10-13, time box 3 h this session)
+
+Worktree `~/wt-uitest`, branch `nd/desktop-ui-tests`, based on origin/master eda94a505. Nothing is committed yet.
+
+## Done
+- `common/build.gradle.kts`:
+  - desktopTest opt-ins and dependencies (`uiTestJUnit4`, `currentOs`, `pty4j` 0.13.13);
+  - `desktopTest` excludes `chat/simplex/app/ui/**`;
+  - `desktopUiTest` (`KotlinJvmTest`; no Kover or fonts yet; testLogging shows stdout for P1a);
+  - minimal `uitestPrepare` (resolves `desktopTestRuntimeClasspath` and writes `build/uitest/env.properties`; later `env.properties` moved to `scripts/uitest.sh`, and `uitestPrepare` only resolves the classpath).
+- `scripts/uitest.sh`, a P1a cut of plan §7.1.1:
+  - outside, it runs cmake, the test classes and `uitestPrepare`;
+  - inside `unshare -rn --pid`, it runs the offline `desktopUiTest`;
+  - one pass; no cabal step yet. (Later added: the cabal step, the fingerprint skip of the outside Gradle step, the peer DB template, the MemAvailable guard and automatic forks; still one pass. Plan 0.5.9.)
+- Harness `common/src/desktopTest/kotlin/chat/simplex/app/ui/harness/`:
+  - `UiEnv`, `UiJvm` (per-JVM directory, `user.home`, tmpdir, shutdown hook);
+  - `UiTestApp` (`bootJvm`, `resetForTest` with an approximate stop-and-delete reset);
+  - `UiTest`/`UiScope` (`app`, `poll`, `texts`);
+  - `HarnessBootTest`, `HarnessMeasureTest` (20 resets, frame cost, `captureToImage`).
+- The namespace works on this host: lo only, uid 0, no DNS.
+
+## Results (session 1)
+- Both `HarnessBootTest` and `HarnessMeasureTest` PASS inside the namespace, offline. The measurements are in plan section 15.1.
+- Fixes made on the way:
+  - `import java.time.Duration` (the plan snippet is corrected);
+  - submodule init;
+  - the explicit `platform.NtfManager` import;
+  - `TestPrefs.preset()`;
+  - a stopgap: `conditionsAction` cleared until `TestServers.configure` lands.
+- Libs: hardlinked from `~/build/slots/s3` (`libapp-lib.so` is a real copy). `stage-libs.sh` refuses on master (it expects the reviewed `build-lib-linux.sh` hash).
+- Run: `cd apps/multiplatform && scripts/uitest.sh --tests '*Harness*'`. Logs are in `~/uitest-review-tmp/p1a-run*.log`.
+
+## Done after session 1
+- Template DB (`DbTemplate.kt`, `<run>/db-template` with the key). Reset 7.2 s → 0.94 s median. Both harness tests pass (run 11).
+
+## Done (session 2)
+- `uitest-servers` (`tests/UITestServers.hs`; cabal flag `uitest`, executable stanza): smp1 only, `ready smp1 <addr>`, EOF stop. Built with `cabal build -O0 -f uitest --builddir=dist-uitest` (25 min cold); the runner builds it and passes the paths through `env.properties`.
+- `CliPeer` + `VtScreen` (pty4j, `stty -echo -icanon` before exec, verified typing, echo wait, `expects`/`eventually`/`nextLine`/`contactId`); `TestServers` (slot lock, port base 20000+100k, `configure()` disables the operator groups and adds smp1/xftp1, refreshes conditions).
+- `HarnessCliPeerTest` PASS: the CLI connects to the GUI's one-time short link over the local SMP; `contactId` = 3. All 3 harness tests pass together (150 s); no leftover processes.
+- Plan fixes: `configure` must run after `startChat` (`chatNotStarted`), and `chatModel.currentUser` must be set first.
+
+## Done (session 2, continued)
+- Keys in app code (`ui/Ui.kt`, `uiTagsEnabled` internal): alerts (by manager), chat-list rows (both platforms), new-chat buttons and actions, `SectionItemView`/`SettingsActionItem`/`UserPickerOptionRow`/`ExposedDropDownSetting` `uiKey` params, `LinkTextView`, the message field (both platforms), user picker/address/settings/appearance.
+- `TestRoot` (in-memory clipboard, recording URI handler); screen objects (`App`, `ChatListScreen`, `NewChatScreen`, `UserPickerScreen`, `AddressScreen`, `AppearanceScreen`); `restart()` per plan 7.3.
+- Tests: main/OneTimeLinkCompatTest, main/AddressCompatTest, chat/SendCompatTest, groups/JoiningCompatTest, settings/AppearanceTest. All 5 PASS individually.
+- Exit check loop: `~/uitest-review-tmp/p1a-exit/loop.sh`, summary in `summary.txt`.
+
+## Done (session 2, end)
+- `UiIdle` hooks plus harness use (drain, deadline extension, timeout messages); `idle = false` at PopChatCollector, ProcessedErrors and createUpdateJob.
+- Peer start is async with a 60 s deadline (first start 8–10 s, over 30 s under load).
+- Full reset (`Reset.kt`: PrefStores, ModelSnapshot, UiState) and `HarnessResetTest`. All 10 tests pass (run 33). (Later `ModelSnapshot`, `CommonUiState` and `CommonPrefs` moved to `uiTestShared/.../harness/CommonReset.kt`; `Reset.kt` keeps the desktop `PrefStores` and `UiState`.)
+- Final exit check: `~/uitest-review-tmp/p1a-exit2/` (20 runs).
+
+## P1a COMPLETE (2026-10-13)
+- Final exit check: 20/20 runs (`~/uitest-review-tmp/p1a-exit2/summary.txt`), 98–329 s per run.
+- Also done: outside-Gradle skip by fingerprint; CLI peer DB template (first start 11–14 s → 0.4 s).
+
+## Next
+- Report to the user; P1b re-plan; the first-PR question (open after P1a?). Nothing committed yet.
+
+## Batch 1 (2026-10-13, after P1a)
+- Desktop: 12 more catalogue tests pass (messaging 5, contacts 3, profile 1, groups 3); 2 parked with @Ignore (`edit_menu_updatesPeer`, `deleteContactAndNotify`, reasons in plan 15.2). Driver rules and keys are in plan 15.2.
+- Android: `ANDROID_TEST=1` mode in `~/build/android.sh` (backup `android.sh.pre-androidtest`); androidTest dependencies; `initUiTags`; `SmokeTest` PASS on Waydroid instance 2; runner `scripts/uitest-android.sh`. Instance 2 was stopped again afterwards (`wd.sh down`).
+- Next for Android: boot/reset/template, `uiTestShared` refactor, peer bridge with adb reverse, port the 5 tests, Back and notification tests, exit check (about 2 days).
+
+## Batch 2 (2026-10-14)
+- VM crashed (OOM) during an Android build: lingering Kotlin daemons. Now in-process Kotlin compile in uitest runs, plus a MemAvailable guard (memory note `feedback_kotlin_daemon_ram_crash`).
+- Desktop: edit and delete-contact unparked (driver: select-all, settle, then input; `ScrollBy` needs clock frames). Shared folder `common/src/uiTestShared` (screens, helpers, server config, `CommonReset`, tests). All 24 desktop tests pass (19 catalogue + 5 harness).
+- Android: host bridge (`UiBridge`, Gradle `uitestBridge`; replaced in batch 4 by `uitestBridgeClasspath` + `java -cp`) plus Android `CliPeer`/`UiTest`/`UiScope`/`UiTestApp`; adb reverse; Espresso-Intents capture for "Share"; Android pre-set prefs; the runner skips an unchanged app APK. 12 of 18 shared tests pass on Android (run-20261014-080106).
+- Android open: accept-request timeout, message-field replace flake (edit, group send), unread badge, alias, delete contact.
+
+## Batch 3 (2026-10-14, later)
+- Desktop: ChatListMenuTest (4) and OneTimeLinkTest incognito (1) pass. Keys and driver calls are in plan 15.3.
+- Android fixes: clock advance in poll, message-field retry, 30 s accept wait, failure screenshots, bridge PID kill. 14/14 executed passed in run-20261014-090056. Claude Code stopped the run on host memory pressure from another session; 10 tests not reached (list in plan 15.3).
+
+## Batch 4 (2026-10-14, afternoon): Android working and faster
+- Desktop 29/29; Android 25/25 (all 24 catalogue tests + smoke) in one run, run-20261014-134126.
+- Speed: bridge 1–7 min → 1 s (no Gradle); reset 31.6 s → ~4 s (template from the startup DB); close 45 s → 0.4 s (release Intents first); Waydroid boots in parallel; per test 65–90 s → 10–30 s.
+- Robustness: watchdog + crash-resume runner, per-test results.txt, failure screenshots, click-geometry log, tap point that avoids nested buttons (no coordinates in tests).
+- Findings with causes: plan 15.4 (items 1–16 plus 10a/10b/15a).
+
+## Batch 5 (2026-10-14, evening): exhaustive pass, batch 1 (onboarding, What's New, chat list)
+- Starting point: desktop 43/43 twice (`b13-desktop-1/2.log`); Android 53/53 (`run-20261014-164429`: 38 shared + 14 `BackKeyTest` + smoke). The Back-key tests and 14 more shared tests came after batch 4.
+- 50 catalogue rows drafted in parallel (`~/uitest-drafts/b1`, `batch1.tsv`): 22 onboarding, 5 What's New, 23 chat list (toolbar, subscription indicator, search, unread and preset filters). Desktop-only rows (onboarding, What's New for a new user) go to `desktopTest/.../ui/desktop`.
+- Harness changes found while running it: `ModelSnapshot` unwraps `by lazy` fields (plan 15.4 item 26); per-test `drain()` inside the scene and the known-app-issue allowlist (15.4 items 27–28; 15.5 item 3); desktop failure PNGs (item 29); the CLI typing window 200 ms → 1.5 s (item 30).
+- Catalogue corrections from passing tests: plan 15.6.
+- First desktop run with the batch: `b14-desktop.log`, 93 tests, 19 failed.
+
+## Batch 6 (2026-10-14, late evening): chat list lists, rows, menus, cards; PR review fixes
+- 50 chat-list rows drafted (`~/uitest-drafts/b2`, `batch2.tsv`): the remaining preset filters, user lists, row previews and icons, row menus, pending connections, contact requests and cards. Batches 5 and 6 together added 99 catalogue tests: 74 shared, 25 desktop-only.
+- Runs: `b15-desktop.log` 142 completed, 12 failed; `b16-desktop.log` 142 completed, 8 failed. Final results: plan 15.3 status ("RESULTS" line).
+- PR review fixes (plan 0.5 describes the result):
+  - app code: `UiIdle` is a no-op unless `uiTestHooksEnabled` (renamed from `uiTagsEnabled`); counters removed; `sendCmd` and the receiver use thin `UiIdle.track`/`trackEvent` wrappers; unused keys removed (`Ui.UserPicker.Sheet` kept as the one presence-only key); app rule in plan 13;
+  - peers: line matching moved to shared `PeerLines` (15 s line timeout); the platform `CliPeer`s implement only `fill()`/`type()`; the Android bridge socket has a 60 s read timeout;
+  - Android `poll` extends past its deadline while the same API calls are in flight (60 s), as desktop does; a condition that throws counts as "not yet", and the last error is reported (both platforms);
+  - `described(text)` pseudo-keys and `goBack()`; `enterText` without echo verification; the paste-link search tests are shared now; desktop-only classes renamed `*DesktopTest` (`OnboardingTest` kept);
+  - helpers consolidated in `Helpers.kt` (`openContextMenu`, `joinGroupFromList` with `MemConnected` + `quiesce`, `CONNECT_TIMEOUT_MS` = 60 s);
+  - the allowlist passes only tests whose body completed and never matches an `AssertionError`;
+  - desktop JVM crash logs go to the run directory (`-XX:ErrorFile`), and the shutdown hook stops the core; `HarnessMeasureTest` is `@Ignore`d (manual benchmark); click debug logs removed (the click-geometry log of batch 4 is gone);
+  - `scripts/uitest-android.sh` is portable: `UITEST_SERIAL` selects any adb device and skips Waydroid; `ADB`, `JAVA_HOME`, `UITEST_APP_ID`; it requires one `scripts/uitest.sh` run first and says so;
+  - What's New tests read the app's `lastVersion` by reflection;
+  - Android template decryption calls `apiStopChat` before `apiStorageEncryption`; verified in the final Android run (plan 15.4 item 25).
+- Counts now (plan 0.5.1): desktop 142 `@Test` (112 shared + 25 desktop-only + 5 harness, 1 ignored); Android 127 (112 shared + 15).
+- Still open: Android notification tests, the Android 10-run exit check, `wd.sh net isolate` in the Android runner, `xftp1` not served (plan 15.3 "Open").
+
+## Batch 7 (2026-10-14, night): PR preparation, second review, first full Android run
+- Plan docs synced with the code: plan 0.5 "As built", one-line "as built" notes in §§2–10, §13 decisions (Android in scope, minimal app code, desktop forks from free memory); START marked historical; ANDR doc status, bridge protocol and runner.
+- Catalogue corrections from batches 1–2 applied to `01-onboarding-chatlist-connect-profiles.md` (35 full, 5 partial; the skipped parts were stale after the tests became shared).
+- Second code review (two concurrent reviewers) and fixes: plan 15.4 items 32–41, 15.4.2 (test strength limits and accepted harness limits).
+- Desktop runs: b18 136/141 + 4 failed (pending-connection info has no Back on desktop, item 33); b20 141/141; b21 140/141 (one SQLite "disk I/O error" after a reset, item 41); b22 141/141 (6.6 min).
+- First full Android run of the shared tests (127): 121 passed; the 6 failures were Android-only (keyboard eats the first Back, prepared chat covers the list, no camera on Waydroid → app finding 15.5 item 4, one flake 15.4.1a); after the fixes the 4 affected classes passed 49/49 with the camera test skipped.
+- App code fix needed for Android compile: `uiKey` moved before trailing lambdas (item 39).
diff --git a/plans/ui-tests/catalogue/verify/REVIEW-STATE.md b/plans/ui-tests/catalogue/verify/REVIEW-STATE.md
new file mode 100644
index 0000000000..7864798b15
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/REVIEW-STATE.md
@@ -0,0 +1,59 @@
+# Adversarial review loop — resume state
+
+Goal (user): adversarial review of plans/ui-tests/2026-10-10-desktop-ui-test-dsl-plan.md + plans/ui-tests/catalogue until 2 consecutive clean passes.
+A pass = 4 fresh concurrent general-purpose reviewers: A consistency, B plan claims vs code, C catalogue accuracy, D feasibility.
+Only BUG / CONTRADICTION / WRONG-FACT / WRONG-REF / MISSING-CODE reset the count; NITs are fixed without resetting.
+
+## Status (2026-10-12)
+- Rounds 1–16: not clean; all findings applied (round 16: §7.7 screenshot design hardened — display-clock seam (user-approved), pinned fonts incl. DejaVu Sans, settle loop advancing the clock, git-lfs required, VolatileKey unmerged; 02 revoke rows, fixture sources).
+- Round 17: NOT clean; all applied (B: name-sale countdown in seam; A: realTimes tests save no shots + REALTIME code, volatile-set rule, clock shift; C: 02:219 REALTIME; D: focus after delayed requestFocus, FreeType version recorded + FREETYPE_PROPERTIES removed, settle by steps, git-lfs check). Per-name expectations being filled by an agent (verify/expectations-progress.md); 05-android-only.md being written.
+- Rounds 1–18: not clean; all applied (round 18: Kover KotlinJvmTest + onlyIf runner marker, per-pass .ic copy and merge task, Skiko bundles FreeType, named-shot focus restore, REALTIME exceptions, 05 fixes → 249/20, 01–04 fixes; 10 sweep tests added → 1,177 / 28).
+- Round 19: NOT clean (A: 4 contradictions; B: watchdog budget (already fixed), nits; C CLEAN; D CLEAN (nits applied); E: 4 gaps in 05 → agent applying, verify/05-r19-fixes-progress.md). All plan/01–04 findings applied.
+- Round 20: NOT clean; plan/01–04 findings all applied (A merge with skipped pass + unsaved R19-D edits; B CLEAN; C timed-offer setup, matrix AV (AV 11), splits; D relay one-shots -t 3 (verified 0/4 vs 4/4), atomic PNG writes, failing-test peers stopped, ProcessedErrors idle=false, watchdog helper records composition errors). E: 05 fixes + systematic carry-over map in progress (verify/05-carryover-progress.md).
+- Rounds 1–21: not clean; all applied (round 21: A, B CLEAN; C 3 wrong facts; D /reconnect + peer readiness + parallel start (measured); E 3 Android gaps).
+- Rounds 1–22: not clean; all applied (round 22: A CLEAN; B sends/echo rule, timings; C default-pref preconditions (16 edits); D XFTP reset timing (formula measured) → short timeouts via UI+console, 150 MB file, stop-server recipes, SRVCTL 16; E Android R13 links/clipboard, link-preview config (approval), map 354).
+- Rounds 1–23: not clean; all applied (round 23: A echo rule + nits; B XFTP hang mechanism (plan + 02:118), persistErrorInterval notes (01 ×2, 03:140); C 3 timing races (2 splits, PEERCTL 21) + 8 nits; D CLEAN; E 05 RESTART list + 05:105 note, map RESTART bullet + 26 line resyncs, research-doc counts, 05:241 query flags).
+- Round 24: NOT clean — A: 45 of 48 RESTART carry over, 05:105 in-process only, research-doc counts/§W/SYSNTF (applied); C: 02:246 receipts-off setup lost in split, 02:171 forward timing, 03:65 spinner + 4 nits (applied); D CLEAN (2 nits applied); E: 02:211 map entry (355/272/822), NtfManager refs +9, ACTION_PICK has no data (applied); B: XFTP plain stop completes (store log), dataDir/tmp comment, /live needs CliPeer.types + 02:63 rewritten, relay ready line (applied). Findings in scratchpad/r24{a..e}/findings.md.
+- Round 25: NOT clean — B: XFTP worker never stops retrying (3-attempt rounds restart), banner before Current user, Input.hs:91 (applied + nits); A: same XFTP retry fact (fewest-retries chunk, AgentStore.hs:3777/3824), sentence moved before the SMP backoff text, nits (applied); E: 05:326 disconnect closes the screen + ref, 2 nits (applied); C: 04:58 member-contact setup, 04:176 TTL expiry observation, 04:277 multicast GUI step + 3 nits (applied); D: CLI drops typed chars during output (verified input + retype), first-start echo mode (restart keeps), live-message sync, relay ready OK (applied). findings in scratchpad/r25{a..e}/findings.md (subagent Write may refuse report files: then findings come back in the reply).
+- Round 26: NOT clean — B: DatabaseView.kt:572-574 ref + 2 nits (applied); A: retype in live mode keeps pre-filled text, mobileHost gets the start-stop-start cycle, 3 nits (applied); C: 02:70 feature-off setup missing + 4 nits (applied); E: research doc runner task names (fossDebug), 05:371 slide image needs assets build, 3 nits (applied); D: LC_ALL=C.UTF-8 for every CLI, live prompt stripping + erase rule, Enter-arrival check for types, DEL 0x7f, unchanged-for-200 ms, start() clears ECHO/ICANON (applied). findings in scratchpad/r26{a..e}/findings.md.
+- Round 27: NOT clean — E: 05:136 in-app call alert is composed (no ringtone) + nit (applied); B: Enter re-send must match the live prompt too + 2 nits (applied); A: 01:95/96 fixture order (FK cascade), 02:248 name command, 05 RemoteTests ref, package suffix from local.properties, 3 nits (applied); C: CLI pref change → GUI acts before XInfo arrives (02:70/150/181 wait for Contact preferences), 02:71 merged feature row + hi after TTL arrives, 02:46 debounce bound (applied); race sweep: 17 rows (queued-before-delivered prefs/roles/deletions; verify/r27-race-sweep-progress.md) + reverse race (GUI delete → CLI AUTH: 01:89, 01:127, 01:233, 03:128) fixed; D: dedicated Gradle home build/uitest/gradle-home (outside daemons/prebuild timer), live-end lock-up recovery note, literal peer sends need @alice (applied). findings in scratchpad/r27{a..e}/findings.md.
+- Round 28: NOT clean — E: Android message-field reads (EditText withText/withHint) undocumented + 2 nits (applied); A: runner --stop without -g, plan-read refs 01:233→4485 03:128→4546, CLI inserts active chat after `! `/`> `/`\ ` (Typing rule), 3 nits (applied); D: live end line has HH:MM (expectsMessage), CliPeer.nextLine/repeatUntil added, same-checkout lock conflict noted, home moved to .gradle/uitest-home (clean-safe) (applied); B: same 3 (already fixed) (applied ref); C: 02:39 multi-line send needs types, 4 nits (applied). findings in scratchpad/r28{a..e}/findings.md.
+- Round 29: NOT clean — B CLEAN (3 nits applied); A: 05 setup 5 UiNode.type ref + research §5.1 per-platform message-field bullet (applied); E: field reads via ChatScreen.messageText/placeholder (plan §9.1 added), setSelection(editText.length()), RecAndPlay ref (applied); C: 01:192 button label short form, 02:265 wait for invitation before restart (applied); D: quote/forward//feed sent-item shapes need types (latent), wrap-pending erase, active-chat refs, insertion timing (applied). findings in scratchpad/r29{a..e}/findings.md.
+- Round 30: NOT clean — B: markdown sent/received items lose markers (02:41 rewritten, plan sends list), quote reply indent, /feed via nextLine, active-chat refs (applied); E: 05:131 muted profile must be inactive, 05:285 Lock after Immediately, field reads via ViewAction (not matchers), 05:253 ref (applied); A: VIEW code on 05:212/223/383, 01:192 H/Names.hs ref (quote indent already fixed) (applied); C: 01:78 report with text via /_report + wait for flag before restart, 01:95/96 wait for request row before restart, 04:199 .bak mtime window, 01:192 ref (applied); D: file-level UI state (ChatListViewKt.lazyListState, reportsListState) reset + source check, settle waits for UiIdle quiet + no events between captures (shot budget 26 s), folders re-created, pref files rewritten, untracked coroutines noted, report capture vs body thread, -Djava.io.tmpdir (applied). findings in scratchpad/r30{a..e}/findings.md.
+- Round 31: NOT clean — A: uiRunDir not passed to inside passes + jvmtmp not created, UiIdle event counter undefined in §6 (four uses, §13 fallback), summary list unquiet, composeField() on UiDriver, 02:41 bob's line + rename; B: CIFile.cachedRemoteFileRequests reset, same uiRunDir, active-chat unsets (applied); E: 05:217 VIEW, Android reset before MainActivity launch (createEmptyComposeRule + ActivityScenario.launch), FIXTURE mechanism → 05 open question 16 + map bullet (applied); C: animated GIFs never settle → volatile (plan §7.7/K0, 02:94), 02:69/02:71 notes (applied); D: report capture via runOnUiThread (flag races, measured), settled requires UiIdle quiet between captures (applied). findings in scratchpad/r31{a..e}/findings.md.
+- Round 32: NOT clean — A: WallpaperType.cachedImages, UiIdle start/finish counts for settle check + §13 fallback, 05 OQ16 count, research doc rule names, close ActivityScenario per test, nits (applied); B CLEAN (nit: fullscreen animated image + modifier placement, applied); C: screenshot volatiles — auto-mask text containing run ports, incognito names, remote port/session code, relay address editor (plan §7.7/K0); 02:82 end after playback; 03:233 join order (applied); E: Android boot step (startup init vs first reset), finish all activities per test, INTENT delivery wording, 02:71 map entries (357/274/820), Android animated images volatile, OQ16 nits (applied); D CLEAN (nits: printToString maxDepth, shot budget 28 s with Kover, applied). findings in scratchpad/r32{a..e}/findings.md.
+- Round 33: NOT clean — A: 03:233 gate line (joiner prints `you joined`), pm clear timing contradiction, Android snapshot baseline after startup init (reset to declared initial values; SharedPreferences PrefStores), relay editor ref, 4 nits (applied); D: port auto-mask covers merging ancestor (digit widths differ, measured) (applied); B: same port-width + relay ref (already fixed); nits A/ prefix, incognito refs, EditableText, console times (applied); E: boot step undoes init's pref writes + wait condition, Android §12 session code/invitation volatile, keyboard notes 05:343/356, 05:322 clipboard read once, Android animated check (applied); C: AV fake end-of-track, console line list + queue-info alert volatile, 04:232 expected result (applied). findings in scratchpad/r33{a..e}/findings.md.
+- Round 34: NOT clean — A: AV fake end-of-track refs/wording, boot step skipped when continuing a split test, nits (refs, queue-info alert call sites, run size) (applied); C: 01:70 duplicate-name assertion via Save disabled, 01:144 sheet stays under alert, nits 04:42/01:191/02:82 refs (plan AV ref already fixed) (applied); B CLEAN (nits: ConnectDesktopView refs, console mask on the list, applied); E: pm clear before every invocation except a split second half, grants after clear, Android screenshot pipeline → OQ17 (uiShots=off until), §12 clipboard timing, PrefStores via Editor, AV note (applied); D: port mask = outermost merging ancestor below the scroll container (quotes), AV fake as app-side interface advancing on the real clock, StandardTestDispatcher chosen (snapshotFlow inline in measure, measured) (applied). findings in scratchpad/r34{a..e}/findings.md.
+- Round 35: NOT clean — A+B: scene runner named consistently (runInternalSkikoComposeUiTest, InternalTestApi opt-in), virtual time leads after input injection (advance by 0 runs scheduler), UiIdle sendCmd hook inside withContext(IO), continuations after scene close, 05 AV note vs R10, OQ4, prefs names (applied); C: 01:49 bounded absence (2 s), 01:57 badge must appear first, 04:42 second save (applied); E: split continuation skips the per-test reset, 05:103/135 pre-set canAskToEnableNotifications=false, Android dispatcher note in research §5.1, map 01:70 entry (358/275/819), OQ17 no -PuiShots on Android, nits (applied); D: StandardTestDispatcher verified end to end (toy ports); missing InternalComposeUiApi opt-in (applied). findings in scratchpad/r35{a..e}/findings.md.
+- Round 36: NOT clean — E: OQ17 vs failure screenshots (only §7.7 shots skipped), nits (setup item 2 exceptions, row refs, 04:109 ref) (applied); A: §6 continuation wording, 01:49 setLastVersionDefault on composition, nits (ignoreFrameDuration in settle, 'no §7.7 screenshots') (applied); C: 01:59 indicator value, 04:107 themes.yaml values, nits 04:83/106/134 (applied); assertion sweep agent over ~80 presence-check candidates (verify/r36-assertion-sweep-progress.md); B CLEAN (2 nits applied); D: input injection lead added to clockAtTestStart (frames frozen ~0.6 s after longClick otherwise), opt-in comment, multicast note (applied). Assertion sweep done: 52 of 85 rows fixed (verify/r36-assertion-sweep-progress.md); 01:79 colour check replaced by MutedKey. findings in scratchpad/r36{a..e}/findings.md.
+- Round 37: NOT clean — A: clock lead relative to target (no double count after shots), 04:83 10 s + wait, screenshot-only checks → map Not-listed bullet (01:70 entry dropped, 357/274/820), nits; E: 01:48 v7.1 commented out (opens v7.0.1), map 04:196/04:252 text (applied); B: input injection on body thread → driver wraps in runOnUiThread, clock wording nits (applied); C: Hang up behind right-click (01:252/02:30), 01:130 picker reopened, 02:180 Change role, 02:223 /_read chat items, 04:61 poll contactDomainVerified, 04:108 #ffff0000, 04:197 delete migration row, nits (applied); D CLEAN (runner re-exec readlink nit applied). findings in scratchpad/r37{a..e}/findings.md.
+- Round 38: B CLEAN (2 nits applied); A: Pref definitions unified (05 uses property names), screenshot-only bullet qualifier, nits; C: 02:223 ref/syntax, 04:107 scaleType fit, 01:189 text, 02:178 alice's reaction (applied); E: Android input threading (no runOnUiThread wrap on Android), 05:287 tests the 10 s delay (applied); D: escape() on EDT, hold presses on the node (applied). findings in scratchpad/r38{a..e}/findings.md. Root FS 95% (another session's /tmp dir 7.6 GB); toy builds go to ~/uitest-review-tmp.
+- Round 39: NOT clean — A CLEAN (4 nits applied); E: escape() Android mapping (research §5.1), map 04:107 ref, nits (applied); B CLEAN (no nits); D CLEAN (ModelSnapshot walk verified on real classes; nit applied); C pending; findings in scratchpad/r39{a..e}/findings.md.
+- Round 40: NOT clean — C: 04:93 passcode step + observable prefs, 04:141 socksProxy absent on disable, nits (applied); E: map 04:107 scroll step, Pref casing nits (applied); A: themes.yaml ref 388-391 (r39 nit was wrong), 05:131 broken table cell (||) (applied); B CLEAN (2 range nits applied); D CLEAN (PrefStores, per-JVM dirs, clearUiState reflection verified on real classes). findings in scratchpad/r40{a..e}/findings.md.
+- Round 41: NOT clean — C: 04:91 passcode flow, 04:84 stop-chat path + alert, 03:148 delete confirmation, 03:80 welcome setup, nits (applied); A: map 04:93 stale quote, 04:133 back to :199 (r40 nit was wrong), nits; E: SettingsView.kt:106, map 02:94 range, research §5.3 lock wording (applied); B CLEAN (nit: ModalView site count, applied); D pending; findings in scratchpad/r41{a..e}/findings.md.
+- Round 42: NOT clean — E: 05:104/298/306 skip the "Database passphrase & export" screen, nits (applied); A: single shutdown hook (7.2 refers to 8.2's), SetAppPasscodeView refs, GroupProfileView refs, nits (applied); C: confirmations + outcomes 02:266, 03:161, 03:242, 03:272; 02:132 delete-for-me; 02:152 setup/labels; 02:167 results; 03:76 ref; nits (applied); D: separate hooks race (already unified), shutdown flag for UiUncaught, JNA cache comment (applied); B: DejaVu emoji coverage wording, destroyForcibly (applied). findings in scratchpad/r42{a..e}/findings.md.
+- Round 43: NOT clean — B: emoji in Inter text use Inter glyphs, harness hook wording (applied); D: hook verified (order, 10 s bound, NPE dropped, Kover .ic; parallel forks share .ic via agent lock); uitest-servers SIGKILL wording, pty4j destroy wording (applied); A CLEAN (2 nits applied: 03:240 ref, hook clause order); E: 05:113/385/358 entry paths, nits 05:171/374/87 (applied); C: 9 title-only/no-outcome rows (01:157, 01:232, 04:135, 04:147, 02:170, 03:103, 01:256, 03:37, 01:203) + nits (applied by fix agent; '/_delete :<connId> full notify=on', '/_ttl … 0'). findings in scratchpad/r43{a..e}/findings.md.
+- Round 44: NOT clean — E: 05:236 outcome, 05:238-240/350 nits, desktop 01:46/48/49 What's new path via Help & support (applied); A CLEAN (nits: Log defined in legend, Inter glyph list 'e.g.', applied); B C D pending; findings in scratchpad/r44{a..e}/findings.md.
+- Round 45: E CLEAN (no nits; plan §9.4 'attach sheet' wording applied); B: SectionTextFooter needs a uiKey (new §3.3 row), scrim bounds wording (applied); C: 12 GAPs (multi-test rows with outcome for only some tests, 04:271, 01:278, 03:48 role) + nits (applied by fix agent; 03 multi-test sweep added outcomes to 20 rows; verify/r45-fixes-progress.md); A: respondX poll on onResult identity (QR save reuses the DialogState), scrim site list, nits (applied); D: respondX via captured deferred (isAwaiting poll failed 40/40, fix 40/40 under load), scrim matched by content not bounds, link exemption wording (applied). findings in scratchpad/r45{a..e}/findings.md.
+- Round 46: NOT clean — B CLEAN (nit applied); E CLEAN (nit: map 03:114 applied); A CLEAN (4 nits applied); C: 03:178 verify closes screen, 03:295 «Change role?», 03:233 merged order, 01:126, 02:92, 02:263 missed call, 03:141, 04:173 (applied); multi-test sweep 01/02/04 done (12 fixed, 50 OK; verify/r46-multitest-progress.md); D: GAP pending file dialog keeps its job in flight → end-of-test shot unquiet/unsettled (§6 now completes pending dialogs + waits for idle, ≤5 passes, BEFORE the shot; §7.7 wording), nit §9.4 source check also covers mutable top-level vals (applied); findings in scratchpad/r46{a..e}/findings.md.
+- Round 47: NOT clean — B: §6 drain wording (attach pickers + QR first dialog are composition-scoped, untracked), drain pass = waitForIdle + ≤2 s poll for pending/in-flight (QR dialog #2 opens from a Default job), §7.6 cancelled-waiter nit (applied); E: 05:390 now saves and checks chip emoji + Log (applied); A: QR example in drain rationale was wrong (drain's null answers open nothing; case is the body's last respondSave) (applied), nits §7.3 mutable vals + allow-list, 02:263 URI note (applied); C: 02:263 missed call is an icon (content description "Missed call"), 04:149 Update-network alert step, 02:26 banner states setup, nits shield→verified-user icon, 04:68 clear_overrides=off (applied); D: same QR drain BUG (measured; poll fix measured 10/10, bound now 10 s) (applied); D verified rcv-file save dialog end-of-test shot quiet/settled + pixel-identical, indeterminate spinner mask. findings in scratchpad/r47{a..e}/findings.md.
+- Round 48: B CLEAN (3 nits applied: QRCode.kt:95-96, DesktopApp.kt:294-300, named shots with no dialog pending); A: §9.4 allow-list missing vars (Utils.kt:632, CustomIcons, AppUpdater, extension props), abandoned items ignored by every in-flight use, 01:254/03:178 verified icon had no semantics → §4 Verified adds VerifyCodeView.kt:67-69 + member header, 04:66 clear_overrides=off, nit respondX stale deferred (applied); E: 05:125 notification cancelled by markItemsRead not auto-cancel, 03:178 ref :40-45 (applied); C: verify-code rows compare codes without whitespace (24-char line split), 01:212 (+01:215 same) confirmation alerts, 03:256 ref :250-262, nit 02:60 alert Send (applied); r48c lists still-unsampled rows; D CLEAN (drain verified 24/24 QR under load, 24/24 attach pickers, no-dialog +16-29 ms; nits: drain 10 s in hard-timeout budget (applied), stale respond (already fixed by A's nit)).
+- Round 49: NOT clean — B: loadedImageCache not reset (clearImageCaches in §7.3), VerifyCode status Row needs its own key Ui.VerifyCode.status + mergeDescendants, drain budget per waiting pass (applied); A: §13 UiIdle fallback for the drain poll, same Verified key gap, nits (respondX 'previous UI action' defined, §9.4 extension-prop skip, VerifyCodeView refs 66-72) (applied); E CLEAN (4 nits applied: 02:60 bolt, 05:102 precondition, 05:127 wait, 05:136 wording); C: 6 GAPs (02:283 menu matrix labels, 03:157 roles setup, 04:140 relay toggle pass condition, 04:193 four footer strings, 01:174/01:180 'Use current profile') + nits 03:259, 04:281, 01:90/175/182 — applied by fix agent (verify/r49-fixes-progress.md; 02:283 deleted-content case now uses a group #club with full delete); D pending; findings in scratchpad/r49{a..e}/findings.md. findings in scratchpad/r48{a..e}/findings.md.
+- Catalogue: 1,177 tests / 28 IGNORE (352/0, 281/4, 312/4, 232/20); 82 class bases, max 29 per class.
+
+## How to apply findings
+- Plan edits: python exact-string replace (assert count == 1).
+- Catalogue: same; then `python3 tools/recount.py <file>` (rewrites headings + Count table), update the file header line,
+  `python3 tools/classmap.py table` → sync rows in 00-legend.md, `tools/needs.py` → sync prose tallies (02 "Seam use", 03 "By Needs") and plan §10/§11.1 numbers.
+
+## Parallel task
+- Android UI automation research (user request 2026-10-12): agent writes plans/ui-tests/2026-10-12-android-ui-test-automation.md,
+  progress log plans/ui-tests/2026-10-12-android-research-progress.md ("Next steps" section kept current for resuming).
+- Note: strings.xml path is apps/multiplatform/common/src/commonMain/moko-resources/base/strings.xml (earlier prompts gave a wrong path).
+- Map line resync: after any 01–04 row split, rerun the carry-over map line resync (name → line lookup in 01–04).
+
+## STOPPED 2026-10-13 (user time box)
+User: "Optimize between time and quality, it's time we ship this iteration and list all open items. 30 hours ... I can give you 3."
+No further rounds. Open items are in plan section 15. Round-49 D result is folded in only if it finds a design-level problem.
+- Round 49 D (after stop): respondX record timing GAP (record before input injection, measured 12/24 failures otherwise) + timeout message nit — applied; Verified status-line key and composeField verified on real classes.
+- 2026-10-13 post-stop: P1a/P1b split (§12), decision recommendations (§15), start-here guide plans/ui-tests/2026-10-13-p1a-start-here.md.
diff --git a/plans/ui-tests/catalogue/verify/android-harness-research.md b/plans/ui-tests/catalogue/verify/android-harness-research.md
new file mode 100644
index 0000000000..0fd5f51121
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/android-harness-research.md
@@ -0,0 +1,46 @@
+# Android harness research (2026-10-13), notes
+
+Worktree: /home/user/wt-uitest (branch nd/desktop-ui-tests). Read-only research.
+
+## Q1 build
+- android/build.gradle.kts:24 stale runner android.support.test.runner.AndroidJUnitRunner
+- android/build.gradle.kts:189-192 androidTest deps: androidx.test.ext:junit 1.2.1, espresso-core 3.6.1, ui-test-junit4 commented out
+- gradle.properties:33-35 kotlin 2.1.20, AGP 8.10.1, compose 1.8.2
+- existing android/src/androidTest/java/chat/simplex/app/ExampleInstrumentedTest.kt (stub)
+- abi splits arm64-v8a+armeabi-v7a (build.gradle.kts:131-143)
+- ui-test-junit4-android NOT in ~/.gradle cache (only ui-android 1.8.2, androidx.test runner 1.6.1/core 1.6.1/monitor 1.7.1, espresso-core 3.6.1, ext junit); first build needs network. uiautomator, espresso-intents not cached.
+- common/build.gradle.kts: androidTarget()+jvm("desktop") library; desktopTest has uiTestJUnit4+pty4j (wt diff). Ui.kt:15 `internal var uiTagsEnabled` -> invisible from :android androidTest. Other harness symbols public (deleteChatDatabaseFilesAndState DatabaseView.kt:556, stopChatAsync :509, initChatController Core.kt:70, chatCloseStore Core.kt:26, runMigrations AppCommon.kt:46). Private statics via reflection (works on ART).
+- android.sh:42-46 task hardcoded :android:assembleFossDebug; publishes only arm64 app APK via output-metadata (:157-168). patch_slot_common (common.sh:931-943) seds splits to arm64-v8a in slot copy only. Worktree has NO local.properties -> android.sh uses local.properties.example (.debug suffix).
+- ExampleInstrumentedTest asserts packageName "chat.simplex.app" -> fails with .debug suffix; delete.
+
+## Q2 boot
+- SimplexApp.kt:73-87 onCreate: initHaskell, initMultiplatform, runMigrations, initChatControllerOnStart() (if no app passcode)
+- Core.kt:59-67 initChatControllerOnStart launches coroutine; Core.kt:70-191 initChatController; with no user on Android sets onboardingStage Step1 (:168), no startChat
+- DatabaseUtils.kt useDatabaseKey: no DB -> random key into keystore (ksDatabasePassword) + initialRandomDBPassphrase=true
+- prebuilt core ~/libsimplex.so = simplex-chat 7.1.0.6 / simplexmq 7.1.0.6 (strings); worktree simplex-chat.cabal:8 7.1.0.11; app 7.1-beta.6 (gradle.properties:27)
+
+## Q3 network
+- UITestServers.hs:41 prints smp://<hash>@localhost:<base+1>; desktop runner (uitest.sh:64-66) runs everything in unshare -rn netns (loopback only)
+- wd.sh:361-366 net isolate = nft forward drop on bridge (per instance BR); input to host still accepted (net_allow wd.sh:115-119)
+- instance 1: waydroid0 192.168.240.1 / dev .112; instance 2: waydroid1 192.168.241.0/24, dev 192.168.241.113 (README:82); android.md:111 local SMP at 192.168.240.1 reachable from instance 2
+- SMP server binds all interfaces (simplexmq Transport/Server.hs:233-238 startTCPServer Nothing, AI_PASSIVE, prefers AF_INET6 ::) -> reachable on 127.0.0.1 (adb reverse) and bridge IPs when run in host netns.
+- NetworkObserver.kt:56-92: online = INTERNET && VALIDATED; offline -> apiSetNetworkInfo(offline) after 3 s. Under `net isolate` validation unverified (captive_portal_mode currently null on instance 1; VALIDATED with net open).
+- evidence/net/net-probe-isolated.txt: bridge + adb reverse work while isolated, internet blocked.
+- instance 2: waydroid1 192.168.241.1 (waydroid2/lib/data/scripts/waydroid-net.sh:20), container mem cap 2500M (lxc config:38); currently STOPPED. Instance 1 running, free, no instrumentation installed, no reverses.
+- wd.sh:362 isolate note text hardcodes 192.168.240.1 (cosmetic for instance 2).
+
+## Q4 runner
+- wd.sh shell (wd.sh:388) holds the instance flock for the whole command (with_lock wd.sh:53, dispatch :376) -> do NOT run long am instrument through wd.sh shell; use adb -s $(wd.sh serial) directly while holding the claim; refresh claim with `wd.sh claim <same name>` (no lock, :375).
+- wd.sh install = adb install -r -g (wd.sh:253) grants runtime perms; pm clear revokes them -> regrant.
+- code/testing/android.md:67 pm clear/reset-app/uninstall kills every wd-app snapshot on that instance (keystore key).
+
+## Q5 multi
+- README:74-102, android.md:47-53,189: per-instance claim; WD_INSTANCE=2 up/down; ~1.5-2.5 GB per instance; host 12.7 GB, ~7 GB available at time of check.
+
+## Misc
+- SimplexApp.kt:50-70 wraps main Looper.loop() in a catch loop + registerGlobalErrorHandler: main-thread exceptions become in-app alerts, not instrumentation crashes.
+- Address Share on Android = Intent.createChooser via androidAppContext.startActivity (Share.android.kt:30-45) -> Espresso-Intents stub; no TestRoot clipboard on Android.
+- Ui.Appearance.Zoom only in desktopMain (Appearance.desktop.kt:139) -> Android appearance test drops zoom.
+- Ui.Chat.Send declared but not applied anywhere; Android send needs it (or content-desc).
+- desktop harness is being edited live (P1b: rightClick/textsOf/replaceText, Ui.Chat.Item) -> coordinate any shared-source refactor.
+- prebuilt core exports cover all JNI glue calls of wt-uitest simplex-api.c (nm check: none missing).
diff --git a/plans/ui-tests/catalogue/verify/expectations-progress.md b/plans/ui-tests/catalogue/verify/expectations-progress.md
new file mode 100644
index 0000000000..0209bfd47d
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/expectations-progress.md
@@ -0,0 +1,16 @@
+# Per-name expectations for multi-name rows (01–04)
+
+Source list: r17c findings (area 3 NITs). Line numbers as of 2026-10-12 (edits keep line numbers). Only Verification cells changed (plus one Notes clause on 02:48). Code refs: master d72f68e6d at ~/wt-uitest-ref.
+
+## Done
+- 01 (16 rows, every name): 73, 84, 101, 110, 122, 160, 169, 199, 219, 227, 246, 248, 254, 266, 273, 274
+- 02 (19 rows, every name): 38, 46, 48 (+Notes: the bot's command set), 129, 137, 147, 148, 155, 157, 162, 173, 195, 215, 218, 227, 232, 253, 260, 268
+- 03 (26 rows, every name): 33, 58, 79, 91, 112, 127, 128, 139, 161, 171, 173, 174, 175, 211, 218, 240, 254, 258, 263, 264, 265, 268, 278, 282, 283, 299
+- 04 (1 row): 154
+- catcheck after edits: TOTAL 1167, IGN 28, badcells 0, duplicates 0
+
+## Remaining
+- none
+
+## Unconfirmed
+- 03:264 `channelWelcome_newSubscriberSeesWelcome`: kept as the bare test ref (…LinkAfterWelcomeUpdate :10049). The core puts the welcome in a prepared group as an item (`src/Simplex/Chat/Library/Commands.hs:2226-2233`, seen only via test-view `/_get chat`, H/Groups.hs:10082); no real-CLI line was found showing a `/c`-joined subscriber the welcome, so no oracle was written.
diff --git a/plans/ui-tests/catalogue/verify/r22c-fixes-progress.md b/plans/ui-tests/catalogue/verify/r22c-fixes-progress.md
new file mode 100644
index 0000000000..b5f231ed69
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/r22c-fixes-progress.md
@@ -0,0 +1,22 @@
+# r22c fixes progress (round 22 dimension C findings)
+
+Findings' line numbers 01:283 and 02:63 were stale; the rows are 01:277 (deleteContactKeepConversation) and 02:58 (liveMessage_boltButton_emptyStart).
+
+## Done
+- F1 01:269 contactPrefsDisappearingMessagesAllow: starts on; off hides "Delete after" + "off …" line; on again 1 day + "enabled …" line
+- F3/N1 01:251 call alerts: `/set calls @alice no` → "Calls prohibited!"; alice "You allow" no + CLI default yes → "Allow calls?" / "Allow" → CLI pref update line
+- N2 01:229 addressAutoAcceptOff: turn on first (autoAccept null after create)
+- N6 01:229 addressWelcomeMessage: Auto-accept on first (clears welcome), then welcome + Save
+- N7 01:233 addressDelete: bob connected before creation, "Share" tapped
+- N3 01:277 deleteContactKeepConversation: clears showDeleteContactNotice
+- N4 02:58 live message: confirm "Live message!" / "Send"; note
+- F2 02:265 memberContact_openButton: DM on precondition
+- N8 03:91 groupPrefs_disappearingOff: turn on (3 s) + save first
+- F2 03:92 DM: from default off — on→off; on + owners
+- N5 03:140 retry >3 s note
+- F2 03:176, 03:191, 03:192 DM on preconditions (03:192 also states bob not alice's contact)
+- F2 04:58 DM on precondition
+- catcheck: TOTAL 1177 IGN 28, badcells 0; needs.py unchanged
+
+## Remaining
+- none
diff --git a/plans/ui-tests/catalogue/verify/r23c-fixes-progress.md b/plans/ui-tests/catalogue/verify/r23c-fixes-progress.md
new file mode 100644
index 0000000000..f68d971046
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/r23c-fixes-progress.md
@@ -0,0 +1,20 @@
+# r23c fixes progress (round 23 dimension C: timing and state carry-over)
+
+Line numbers per the findings' current list (01:186, 01:231, 01:255, 02:117/120, 02:171, 02:210, 02:244, 02:290, 03:91, 03:180, 03:298, 04:184). Finding F3's `H/Profiles.hs:1950` is 1955 at d72f68e6d.
+
+## Done
+- F1 02 info_delivery_liveUpdatesOnReceipt: split from info_delivery_groupMemberStatuses (that one keeps P ×2); cath stopped before alice sends, Info > Delivery once delivered-partial, cath started, turns delivered without reopening; Needs P ×2, PEERCTL
+- F2 02 status_direct_sentThenDelivered: split from status_receiptsOff_staysSent (keeps P, S); bob stopped before send, sent → started → delivered; Needs P, S, PEERCTL
+- F3 03 connectPlan_businessPendingOpensKnownChat: bob stopped before alice sends the request (after she opens the prepared chat)
+- N1 01 planAddressDeletedContactReconnect: paste after the row shows "deleted contact"; Known until processed (Commands.hs:4519,4688-4689)
+- N2 01 addressAutoAcceptIncognito: Auto-accept on (saves) → Accept incognito on → Save → CLI /c
+- N3 02 send_apiFailure_restoresCompose, forward_itemsDeletedAfterSelection_alert: wait for "marked deleted"
+- N4 02 rcvFile_xftpAuthError / rcvFile_expired: reset after bob's "completed uploading file 1 (test.pdf) for alice"
+- N5 03 memberInfo_connectionFailedSection: cath started before smp1 stop; explicit timeout ≈ outage/2 + 5 s
+- N6 04 dbMgmt_importArchive_restoresData: chat switched back on after export before bob sends
+- N7 01 contactInfoSendReceipts*: repeat /_get chat until sndRcvd; "no" checked after wait(5 s)
+- N8 03 groupPrefs_disappearingMessageExpires: turn on (3 s) + save first
+- tools: recount (352/281/312/232, unchanged), catcheck TOTAL 1177 IGN 28 badcells 0, needs PEERCTL 02: 2→4 (total 19→21), classmap table unchanged
+
+## Remaining
+- none
diff --git a/plans/ui-tests/catalogue/verify/r27-race-sweep-progress.md b/plans/ui-tests/catalogue/verify/r27-race-sweep-progress.md
new file mode 100644
index 0000000000..18b0f43e8a
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/r27-race-sweep-progress.md
@@ -0,0 +1,37 @@
+# r27 race sweep: CLI command printed before its effect reaches alice
+
+Scope: 01–04 rows where a CLI peer's command line prints when the effect is queued, and alice then acts/asserts at once (absence checks, branch-dependent steps).
+Model wording: 02 `timed_menuHidden_whenFeatureOff`, 01 `contactInfoCallProhibitedAlert`, 03 `groupInvitation_tapAfterAcceptShowsJoiningAlert`.
+
+## Changed
+- 01:66 `unreadFilterToggle`/`unreadFilterEmptyState` row: muted-chat-hidden absence now checked once the row shows its unread count (CLI message echo precedes delivery; vacuous pass otherwise).
+- 01:125 `profilesHiddenNotListedAfterHide`: blind `wait(5 s)` replaced by CLI `/_get chat … count=1` until `sndRcvd` (receipt proves alice's core received it; Store/Profiles.hs:143 receipts default on).
+- 01:178 `planInvitationDeletedLinkError`: `/_delete :1` deletes the queue in a forked thread (Commands.hs:1381, simplexmq Agent.hs:1013-1015); CLI repeats `/_connect plan 1 <link>` until the AUTH error before alice pastes.
+- 02:78 `voice_prohibitedByContact_showsAlert`: `/set voice @alice no` then click → sync on "Contact preferences" "Contact allows" "no" for "Voice messages" (model wording).
+- 02:201 `report_notOffered_forModeratorOrOwn`, `report_groupPrefOff_notOffered`: role change → event "changed your role to moderator"; `/set reports #jokes off` → "Group preferences" "Member reports" "off".
+- 02:248 `status_authError_clickShowsDeliveryError`: `/d alice notify=off` deletes the queue in a forked thread (Commands.hs:1378); bob polls `/get servers summary 1` until `"_connDeleted":1` (simplexmq Agent/Client.hs:2122-2124) before alice sends.
+- 02:253 `meta_signature_missingAlert`: `/set signatures #team on` moved before adding alice and cath (no GUI-observable sync exists: no feature item in regular groups, no prefs row).
+- 03:96 `groupPrefs_voiceForAdminsOnly`: `/set voice #team on admin` → sync on «Group preferences» «Enabled for» «admins» under «Voice messages».
+- 03:151 `groupInvitation_joinAfterHostDeleted_showsExpiredAlert`: group/invitation deletion is async (Internal.hs:2173-2185) → bob polls `/get servers summary 1` for `"_connDeleted":1` before alice taps.
+- 03:172 `memberInfo_roleReadOnlyForHigherRole`: alice's admin role now comes with the invitation (`/a team alice admin`); a later `/mr` would race and a plain member passes vacuously.
+- 03:200 `supportChat_hiddenWhenDisabledWithoutChat`: `/set support #team off` → sync on «Group preferences» «Chat with admins» «off».
+- 03:218 `moderate_notOfferedForHigherRole`: moderator role via the invitation (`/a team alice moderator`).
+- 03:227 `mentions_blockedMemberMentionIgnored`: no-notification check waits until the item shows «blocked by admin».
+- 03:278 `joinChannel_noActiveRelays`: owner's `/rm #team <relay>` updates link data async (Internal.hs:1618-1626) → alice re-pastes (Cancel on «Open channel», no side effect) until the NoRelays alert.
+- 03:282 `subscriber_promotedToContributorCanPost`: alice posts once compose no longer reads «you are subscriber».
+- 04:55 `privacy_autoAcceptImagesOff`: no-`/freceive` absence checked once the image item is in alice's chat.
+- 04:277 `linkMobile_multicastDiscovery`: after CLI `/stop remote ctrl`, alice taps the stored host only once her GUI is back to local chats (Commands.hs:3657, Remote.hs:666-687).
+
+## Safe (examined, no change)
+- 01 all other rows: CLI-command rows end in positive polled assertions (connects, accepts, `/ad`+`/share address`, `/pa on` address section 257, `/set voice @alice no` Contact allows 269, `/d alice` row 280, 186 already synced); `/_profile` + `/auto_accept` (187, 203) update address link data synchronously (`setMyAddressData` → `setConnShortLink`, Commands.hs:4096-4110); remaining absence checks follow GUI actions (out of class).
+- 02 all other rows: positive polled results (feature items/offers 260, received edits/deletes/reactions, `/d alice` draft drop 238, chip counts, call alerts — FIFO on one connection for `/_call end` then `/call`); 79 `/set voice @alice yes` equals bob's default so no XInfo is sent (Commands.hs:4122 guard); 172 already waits for the "Files and media: off" item, which stands alone after the join's member-connected event (Subscriber.hs:911-914) so it shows text; 246 `/receipts @alice off` is local to bob; 151 full delete is decided by alice's own pref.
+- 03 all other rows: CLI group changes end in positive polled results (feature/event items 104, 233; «group is deleted»/«removed from group» 114, 241-242, 283; relay status 262; relay bar 284; «Chat with admins» row 283; «Add friends» 299; support disabled text 203; disappearing member chat 201); roles given at invitation or gated by a control that only appears with the role (46 invite sheet, 113 FIFO on bob→alice); 145 `/gp` sets link data synchronously (`setGroupLinkData'`, Commands.hs:4154).
+- 04 all other rows: GUI-side settings with positive CLI/GUI results (auto-accept 57-58, receipts toggles, SOCKS, proxy icon, show-encryption, notifications); migration `/_upload` link printed after upload completes (214-218); `linkMobile_mobileStopsSession` asserts the positive result; import row 184 receives before the absence check.
+- Out-of-class mirror (alice's GUI deletion → CLI `/c`/send expects AUTH; the core deletes the queue in a forked thread): 01:89 `pendingConnectionMenuDeleteInitiated` (Commands.hs:1381), 01:233 `addressDelete` new-`/c` failure (Commands.hs:2492; the CLI first waits for "alice removed contact address", which narrows it); 01:127 `profilesDeleteInactiveWithConnections` (agent `deleteUser`, not checked). 03:128 `groupLink_deletedLinkRejectsJoin` (GUI deletes link → CLI `/c` AUTH). Not changed; reported.
+
+## Remaining
+(none)
+
+## Tool checks (after all edits)
+- `python3 tools/catcheck.py | tail -2`: `duplicates: [] 0` / `TOTAL 1177 IGN 28 SECS 72`; badcells 0 in all four files.
+- `python3 tools/classmap.py table`: identical to the pre-edit output (no test names or Needs changed).
diff --git a/plans/ui-tests/catalogue/verify/r36-assertion-sweep-progress.md b/plans/ui-tests/catalogue/verify/r36-assertion-sweep-progress.md
new file mode 100644
index 0000000000..3f267c36c7
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/r36-assertion-sweep-progress.md
@@ -0,0 +1,94 @@
+# r36 assertion sweep (presence-check candidates, r36c/cand.txt)
+
+Skipped (checked earlier): 01:49 01:57 01:59 01:99 01:100 01:118 01:162 01:239 01:250 02:38 02:50 02:250 04:42 04:83 04:106 04:107 04:134
+
+## Verdicts
+- 01:27: fixed (b): "opens HowItWorks" named no text; now asserts heading "You were born without an account." (HowItWorks.kt:31)
+- 01:34: fixed (b): "opens SimpleConditionsView" named no text; now title "Conditions of use" (NetworkAndServers.kt:836) and "Chats" after its Accept
+- 01:36: fixed (a): "Private notifications" is only reachable via the Setup notifications button, so its absence is always true; now asserts "Setup routers" present and "Setup notifications" absent on Your network (YourNetwork.kt:58-59,181,214)
+- 01:48: fixed (b): "page through" named no value; now titles "New in v7.1" -> "v7.0.1" -> "New in v7.0.1" -> "New in v7.1" (WhatsNewView.kt:145,160,176,946); Read more on v7.0.1 records the crowdfunding blog URL (:947; v7.1 post = null)
+- 01:56: fixed (b): "Title shown"/"scrolls to the top" named no value and no scrolled setup; now "Chats", picker row "Create SimpleX address" (UserPicker.kt:222), 30 chats scrolled down then first row visible (ChatListView.kt:611,660)
+- 01:58: OK: icon composed only when stopped (ChatListView.kt:545-559); alert text exact
+- 01:61: fixed (wrong expectation): OneHandUI defaults to true so the FAB is not composed by default, and it is never composed with chat stopped (chatRunning == true, ChatListView.kt:262), so "grey and does nothing" could never be observed; now bar button by default, FAB with OneHandUI=false, neither when stopped (ChatListView.kt:241-264,545,571; SimpleXAPI.kt:275)
+- 01:67: fixed (b): only chip presence was asserted, which holds with a broken filter; now each preset leaves only its kind and a chat of another kind disappears (presetTagMatchesChat, ChatListView.kt:1579-1606)
+- 01:79: fixed (b): "rises"/"grey" named no value; now badge "1" then "2", gone after open, muted badge background secondary vs primaryVariant via node capture (ChatPreviewView.kt:495,611)
+- 01:80: fixed (b): "round @ badge" not a semantic value; now icon "Notifications" without count, then icon + "2", none before (ChatPreviewView.kt:476-498)
+- 01:88: fixed (b): icon not distinguishable (both "profile image placeholder"), "open §10" named no text; now row texts "invited to connect"/"you shared one-time link" (ChatModel.kt:3251,3266) and "You invited a contact"
+- 01:90: fixed (b): link icon indistinguishable from add-link icon semantically; now row texts "accepted invitation"/"via one-time link" (ChatModel.kt:3252,3273)
+- 01:97: fixed (a): OneHandUI defaults to true, so "bar moves to the bottom" held before any click; now Top bar then Bottom bar with pref values and title position (ChatListView.kt:158,167,197,241-260), alert text, card present at 2 chats then gone at 3
+- 01:98: fixed (b): "opens NewChatView on the tab"/"sets the pref" named no value (both tab labels always shown); now selected tab + page texts "Share this 1-time invite link"/"Paste the link you received" (NewChatView.kt:131-138,500,648) and AddressCreationCardShown=true + card gone (ChatListView.kt:363,1270)
+- 01:122: fixed (a): profilesListShowsAllVisible asserted only the always-present footer; now rows alice/work listed, hidden "secret" absent (filteredUsers, UserProfilesView.kt:305-315)
+- 01:123: OK: alert only from the LaunchedEffect with showHiddenProfilesNotice && users > 1 (UserProfilesView.kt:189-201), absent before opening; texts exact
+- 01:130: fixed (b): "Exit without saving discards" named no value; now alert texts (UserProfileView.kt:288-293) and the old name "alice" kept; rest OK
+- 01:145: fixed (b): "sending restores it" named no value; now bob row back in chat list with "hi", CLI line, Archived contacts row gone (NewChatSheet.kt:226-258)
+- 01:172: fixed (b): "prepared chat (§9)" named no text; now alert "bob"/"Open new chat" and banner "Tap Connect to chat" + "Connect" (ConnectPlan.kt:711-727, ChatView.kt:2257-2259)
+- 01:176: fixed (b): "opens the chat" named no value; now "Open chat" vs "Open new chat" (ConnectPlan.kt:533) and banner "Your contact" (ChatView.kt:2267)
+- 01:177: OK: exact confirm texts "Open new chat"/"Open chat" before/after Connect (ConnectPlan.kt:533)
+- 01:179: fixed (b): no observable after "Open new chat"; now banner "Tap Connect to send request" (ChatView.kt:2260)
+- 01:183: OK: alert appears only after the paste; "Open chat" distinguishes from the prepared "Open new chat" (ConnectPlan.kt:206-215,533)
+- 01:184: OK: exact confirm text "Open chat" in an alert that exists only after the paste (ConnectPlan.kt:216-246,533)
+- 01:187: fixed (b): cube icon not distinguishable in semantics (generic "profile image placeholder"); now banner "Tap Connect to use bot" (ChatView.kt:2260) + row + Connect button (ComposeView.kt:1806-1812)
+- 01:214: fixed (b): "shows the alias" named no value; now alias "friend" on the pending row and on the contact row/title instead of "bob" (ChatModel.kt:1912,3243)
+- 01:189: OK: exact alert text "⚠️ Signature verification failed: %s." from OVFailed; a genuine card would not show it
+- 01:201: OK: CLI "alice: contact is connected", banner texts and "Open to connect" are exact and change with the action
+- 01:202: OK: alert button texts, CLI lines and "contact should accept…" (strings:513, ChatPreviewView.kt:196) are exact
+- 01:221: OK: no-address texts exist only without an address (UserAddressView.kt:307-321); 1-time link and learn-more targets name exact texts
+- 01:226: OK: the "Open to accept" row appears only after the CLI /c (ChatPreviewView.kt:193)
+- 01:240: fixed (b): save/remove outcomes named no value; now "Your SimpleX name" / "alice.simplex" after save and "Get SimpleX name (BETA)" after remove (UserAddressView.kt:375-378); other texts already exact
+- 01:241: OK: alert "Open web link?" then the exact URL https://simplex.domains/#testing in the URI stub
+- 01:249: fixed (b): "the alias shows in the list" named no value; now row "friend" instead of "bob" after the 500 ms debounce (ChatInfoView.kt:865-870, ChatModel.kt:1912); other parts exact
+- 01:252: fixed (b): "the URI stub records" named no value; now URL http://localhost:<port>/simplex/call/?token=… (CallView.desktop.kt:167) and "Hang up" (ChatListView.desktop.kt:93,152)
+- 02:30: fixed (b): "call page link"/"waiting state" named no value (state text is sent to the page, not composed); now URL (CallView.desktop.kt:167) and "Hang up" (ChatListView.desktop.kt:93,152)
+- 01:261: fixed (a/b): no outcome after Clear, and the editor title "Chat theme" equals the button text already on screen; now messages gone/bob stays, and "Set default theme" (ThemeModeEditor.kt:250,523)
+- 01:276: fixed (b): "CLI keeps sending" named no GUI value; now row gone, then back with "hi" and no earlier messages (testDeleteConversationKeepContact)
+- 01:280: OK: "deleted contact", "contact deleted" and "You can't send messages!" exist only after the peer deletion arrives (SendMsgView.kt:101-112)
+- 02:24: fixed (b): "the banner is shown" named no node; now the second name node in the message list besides the title (CV:2318-2325)
+- 02:27: fixed (b): "Info modal opens" named no text; now field "Set contact name…" (ChatInfoView.kt:845)
+- 02:98: fixed (b): "File preview appears" named no node; now "File" icon, file name and "Cancel file preview" (ComposeFileView.kt:30,36,41)
+- 02:100: fixed (b): "Image preview appears" named no node (image has no description); now "Cancel image preview" (ComposeImageView.kt:67)
+- 02:101: fixed (b, IGNORE row): "Preview appears" named no node; now file name + "Cancel file preview" (ComposeFileView.kt:36,41)
+- 02:43: OK: "Open web link?" and its button sets are exact; the stub URL is the given one without utm_source
+- 02:49: OK: menu rows, keywords, compose text and CLI lines are exact
+- 02:61: OK: exact CLI lines for both members
+- 02:111: fixed (b): "download icon"/"receives it" named no value; now icon "Asked to receive the image" then FileStatusKey rcvComplete and icon gone (CIImageView.kt:89,92)
+- 02:112: fixed (b): "icon shows complete" not observable in semantics (inner icon has no description); now FileStatusKey rcvInvitation -> rcvComplete (CIFileView.kt:162,172)
+- 02:115: fixed (b): the cancelled icon has no description; now FileStatusKey rcvCancelled (CIFileView.kt:173); CLI lines already exact
+- 02:116: fixed (b): "cancelled icon" has no description; now FileStatusKey sndCancelled (CIFileView.kt:153)
+- 02:142: fixed (b): "shows the new text" named no value; now "old caption" -> "new caption" and ItemMetaKey.edited
+- 02:180: fixed (b): "group member names"/"opens info" named no value; now "bob","cath" and member info "Role" "member" (CIV:168-169, GroupMemberInfoView.kt:611)
+- 02:151: OK: alert button set, "marked deleted", Reveal/Hide and item removal are concrete and change with the action
+- 02:168: OK: names the target chat (bob) and the original item; header "forwarded" exact with CLI line
+- 02:178: OK: chip 👍 with count "2" after two reactions; not shown before
+- 02:222: OK: last-visible item and the 39 dp shift are concrete
+- 02:223: fixed (b): "up to the newest"/"at the first unread" named no item; now "300" and "151" in view with "1" not loaded; other parts exact
+- 02:231: fixed (a): with only matching notes the result held without filtering; now a non-matching note "ahoy!" disappears (testNotes)
+- 02:232: fixed (b): contentFilter_files/images/allMessages had no expected items; now which items remain per filter
+- 02:282: fixed (b): "the item's menu opens" named no entry; now "Reply" and "Copy" (CIV:408,445)
+- 04:39: OK: enabled→disabled state of four rows and the red "Chat is stopped" icon change only after /_stop
+- 04:61: fixed (b): the check icon has no description (SimplexNameView.kt:111-115); now "Verify name" link absent after the spinner with the pref on vs present with it off
+- 04:108: fixed (b): "import applies colors"/"changes nothing" named no value; now export file contents (accent, no themeId), import -> themes.yaml accent #00FF00 + Log /_save app settings, invalid -> themes.yaml unchanged (Appearance.kt:710-725)
+- 04:87: OK: dot strings, revealed "1234", disabled Save and "Passcode set!" are exact
+- 04:126: OK: the added server (its typed address) in "Your servers" after reopening, and the Log command, are concrete
+- 04:155: OK: values come from NetCfg.defaults/proxyDefaults, "Reset to defaults" disabled after, alert texts exact
+- 04:166: fixed (b): "Same screen opens" named no text; now title "Your ICE servers" + "Configure ICE servers" (RTCServers.kt:103,111)
+- 04:186: fixed (b): "theme/prefs are applied" named no value; now PrivacyLinkPreviews false in archive, true before import, false after (DatabaseView.kt:645,723; Core.kt:144-152)
+- 04:194: fixed (b): "The unencrypted footer" named no text; now the exact footer string and its disappearance after Encrypt (DatabaseEncryptionView.desktop.kt:66-67,85-91)
+- 04:187: fixed (b): "welcome screen appears" named no text; now "Link a mobile"/"Create your profile"; alert texts exact
+- 04:179: OK: the listed labels exist only on the Chat database screen
+- 04:188: OK (IGNORE row): not observable in-process until the folder-opener seam exists
+- 04:196: fixed (b): "written" named no value; now EncryptedDBPassphrase non-empty again after being cleared, and "Chats" (DatabaseErrorView.kt:53)
+- 04:197: fixed (b): "Migrations: …" named no value; now "Migrations: 20260925_badge_bindings" (Migrations.hs:356, DatabaseErrorView.kt:77-78,115)
+- 04:200: OK (IGNORE row): not observable in-process until the folder-opener seam exists
+- 04:209: OK: the set-passphrase screen texts appear only for a random-passphrase DB; "Archive and upload" appears after setting it
+- 04:219: OK: exact alert texts after the wrong passphrase; the step title stays
+- 04:240: OK: alert title and exact URL in the URI stub
+- 04:250: OK (IGNORE row): destinations on public servers, not observable in the namespace
+- 04:252: fixed (b, minor): "…#contribute" elided the URL; now full https://github.com/simplex-chat/simplex-chat#contribute (SettingsView.kt:256)
+- 04:279: fixed (b): "bob receives it"/"a file bob sends is received" named no value; now CLI lines for test.jpg and item "test.pdf" on the desktop; rest already concrete
+- 04:288: fixed (a/b): "Title, 3 paragraphs" named no text and the title equals the entry button label; now the p1 text (BadgesHowItWorksView.kt:24,30-32); URL step already exact
+- 04:289: OK: alert then exact URL https://simplex.chat/badges/
+- 01:73: OK: editor contents, disabled Save, new chip emoji/name, delete alert texts and chip order are concrete
+
+## Remaining
+(none)
+
diff --git a/plans/ui-tests/catalogue/verify/r4-01.md b/plans/ui-tests/catalogue/verify/r4-01.md
new file mode 100644
index 0000000000..9fe27dca73
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/r4-01.md
@@ -0,0 +1,97 @@
+I found 21 defects in catalogue 01, so it is not CLEAN. I checked §3 and §5 row by row myself; three forked reviewers covered §8–§10, §11–§13 and §1, §2, §4, §6, §7, §14, §15. I re-checked their key claims against the code (`apiConnectPlan` → `sendCmdWithRetry`, the two `share_address` keys, `viewMsgTestInfo`, `ReadMoreButton`). No file was edited.
+
+## §3 Chat list
+
+**1. `searchKnownNameFiltersChat` – wrong name in the entry path**
+- Quote: "Type `bobby` or `@alice.simplex` (5+ characters)".
+- Evidence: `@alice.simplex` is alice's own name. Its plan is `OwnLink`, and `knownChatId` only maps `ContactAddressPlan.Known` to a chat (`ChatListView.kt:1168-1176`), so nothing gets filtered.
+- Corrected Entry path: `Type bobby (bare words of 5+ characters get .testing) or @bob.simplex`
+
+**2. `pendingAcceptedRowIcon`, `pendingConnectionMenuDeleteAccepted` – a paste without CB**
+- Quote: the entry path says "Row after alice pastes the CLI's full 1-time link…"; Needs is `P, PEERCTL`.
+- Corrected Needs: `P, PEERCTL, CB`
+
+**3. `getStakeBannerOpensCrowdfunding` – duplicate coverage and a wrong label**
+- Quote: "its "Learn more" Wefunder button records `WEFUNDER_URL` in the URI stub".
+- Evidence: the label is "Learn more on Wefunder" (`v7_0_invest_learn_more`, strings.xml:2689). Catalogue 04 `settingsRoot_crowdfundingOpensGetStake` already asserts the same button and URI (`WhatsNewView.kt:1232-1236`).
+- Corrected Verification: `Tap opens GetStakeView (GetStakeBanner.kt:74-78); its "Learn more on Wefunder" button is tested in 04 settingsRoot_crowdfundingOpensGetStake`
+- Corrected Needs: `—`
+
+**4. `subscriptionIndicatorConnected`, `subscriptionIndicatorServerDown` – no subscription to measure**
+- Evidence: neither row creates a connection. With `subs.total == 0 && !hasSess` the indicator stays in the "freshly installed" state (`ServersSummaryView.kt:92-94`), so it shows nothing connected and stopping the server changes nothing.
+- Corrected Notes (both rows): `1 s polling. alice first creates a 1-time link so a queue is subscribed; with no subscriptions and no session the indicator stays in the fresh-install state (ServersSummaryView.kt:92-94)`
+
+## §5 Profiles
+
+**5. `editProfileBioTooLarge` – the text is not shown by itself**
+- Quote: ""Bio too large" shown".
+- Evidence: an over-limit bio only adds an error icon. The text appears in an alert after the icon is clicked (`UserProfileView.kt:218-226`), and Save is disabled (`canSaveProfile`, :301-302).
+- Corrected Verification fragment: `an over-limit bio shows the error icon next to "Bio:"; clicking it shows the "Bio too large" alert; Save is disabled`
+
+## §8 Connection plans
+
+**6. `planProgressIndicatorAndCancel` – misses the alert the test meets first**
+- Evidence: with the server stopped, `/_connect plan` fails at once with BROKER NETWORK. `apiConnectPlan` uses `sendCmdWithRetry` (`SimpleXAPI.kt:1642`), which opens the "Connection error" retry alert and waits (:845-874, :897-899). The spinner shows behind that alert.
+- Corrected Entry path: `Type or paste the CLI's short link into "Search or paste SimpleX link"`
+- Corrected Verification: `With the link's SMP server stopped the plan fails at once and the retry alert "Connection error" ("Retry" / "Cancel") opens; the plan stays pending behind it, so the toolbar spinner appears after 1 s (no text on desktop); "Cancel" ends the plan, the spinner goes away and the search is cleared`
+
+**7. `planConnectByNameOtherKindButton` – the entry path can't produce the second button**
+- Evidence: an `@`-prefixed name parses as `CTShortContact`, which always has `otherSimplexName = Nothing` (`Types.hs:1905-1909`, `Commands.hs:4479-4480`). Only a bare domain gets the other kind (`Commands.hs:4446-4474`); the Haskell test uses `/_connect plan 1 acme.simplex` (H/Names.hs:380).
+- Corrected Entry path: `Type bob.simplex (no @ or # prefix) → "Connect to bob.simplex" row, or paste bob.simplex`
+
+## §9 and §7 Retry after a server error
+
+**8. `preparedContactConnectRetryAfterServerError` (§9) and `oneTimeLinkCreationErrorShowsRetry` (§7) – the retry is flaky as written**
+- Evidence: the app's agent caches a failed server connection for 3 s (`persistErrorInterval = 3`, simplexmq `Agent/Env/SQLite.hs:246`; the cache is in `Agent/Client.hs:961-969`). The cited Haskell test sets it to 0 (H/Profiles.hs:4351-4353), so it doesn't hit this.
+- Corrected Notes (both rows): `The app's agent caches a failed server connection for 3 s (persistErrorInterval; the Haskell tests set it to 0), so the retry happens more than 3 s after the failure, after the server is started again`
+
+## §11 Address screens
+
+**9. `addressQrAndShareAddress`, `addressShareViaChat` – wrong label**
+- Evidence: strings.xml defines `share_address` twice, at :572 "Share address…" and at :1957 "Share address". Moko keeps the last one: the generated desktop and Android bundles both have "Share address". `UserAddressView.kt:351` shows it through `ShareAddressButton` (`ChatInfoView.kt:1274-1277`).
+- Corrected Entry path: `QR, "Share address", "Share via chat"`
+- Corrected Verification (`addressQrAndShareAddress`): `QR and "Share address": the clipboard gets the short link`
+
+**10. `addressShareViaChat` – asserts a line the real CLI never prints**
+- Quote: "followed by the link line and the signature line".
+- Evidence: the signature line is printed only in test view: `MCChat {ownerSig = Just sig} | testView -> [viewJSON sig]` (`View.hs:1006-1007`). The real CLI has test view off (`Chat.hs:123`).
+- Corrected Verification fragment: `CLI "alice> contact address of @alice (signed):" followed by the link line (no signature line: it is printed only in the test view, View.hs:1006-1007)`
+
+## §12 SimpleX name (both rows)
+
+**11. Entry path labels**
+- Evidence: the placeholder "@yourname.testing" is a hard-coded literal (`UserAddressView.kt:389`), not a strings.xml label. "Your SimpleX name" is only a section title; with a name set, the row you click shows the name itself (:377-379).
+- Corrected Entry path: `Address screen → "Get SimpleX name (BETA)", or with a name set the name row under the "Your SimpleX name" section → "Set SimpleX name", placeholder "@yourname.testing" (hard-coded literal, UserAddressView.kt:389), "Save", "How to register a test name", "Remove name"`
+
+**12. `simplexNameEntryShownWithAddress`, `simplexNameValidationIcon` – Needs not exact for every name**
+- Evidence: neither test resolves a name. The entry row comes from `contactDomain` alone (`UserAddressView.kt:376-379`), and the error icon comes from a local regex (`SetSimplexNameView.kt:73-79`, :157-158).
+- Fix: split these two into their own row with Needs `—`; the other five names keep `NAMES`. The plan §11.1 count of `NAMES` tests goes from 15 to 13.
+
+## §13 Contact info
+
+**13. `contactInfoE2eeQuantumResistant`, `contactInfoContactAddressSection`, `contactInfoServersSection`, `contactInfoNetworkStatusAlert` – same label problem as #9**
+- Corrected Entry path: `Rows "E2E encryption" ("Quantum resistant"), "Address" with "Share address", "Servers" › "Network status", "Receiving via", "Sending via"`
+
+## §1, §2, §6
+
+**14. `onboardingPassphrasePersistsAcrossRestart` (§1) – the random branch can't give the expected result**
+- Evidence: "Use random passphrase" stores the key in settings, so the restart shows no prompt. Only "Encrypt" sets `storeDBPassphrase=false` (`SetupDatabasePassphrase.kt:50`).
+- Corrected Entry path: `After profile → "Setup database passphrase", fields "New passphrase…" / "Confirm new passphrase…", "Set database passphrase" → "Encrypt database?" / "Encrypt"`
+
+**15. `whatsNewPaginationPrevNext` (§2) – misses the confirmation alert**
+- Evidence: "Read more" calls `uriHandler.openExternalLink(url)` (`WhatsNewView.kt:261`), which first shows an alert (`Utils.kt:618-622`).
+- Corrected Verification: `Previous/next version links page through; "Read more" shows the "Open external link?" alert, and "Open" records the URL in the URI stub`
+
+**16. `newChatSheetContactsListSorted` (§6) – wrong fixture and a missing RESTART**
+- Evidence: every new user already has a card, "Ask SimpleX Team" (`Commands.hs:470,476-478`). The legacy request row can only be made between `restart()` steps, as in §3.
+- Corrected Needs: `P, RESTART, FIXTURE (request without contact)`
+- Corrected Notes: `The card is the built-in "Ask SimpleX Team" card (Commands.hs:470); the request row is made as in §3 contactRequestLegacyRowWantsToConnect`
+
+**17. `newChatSheetConnectToNameRow` (§6) – wrong default suffix**
+- Evidence: `DEFAULT_NAME_TLD = "testing"` (`ChatListView.kt:1139`).
+- Corrected Verification: `Typing a name shows the row "Connect to %s" (bare words of 5+ characters get .testing, e.g. "Connect to bobby.testing"; @bob.simplex is kept as typed); tapping it shows the CLI's profile alert and closes the sheet`
+
+## Checked and clean
+- **§3:** toolbar, search, filters, lists, row previews, row menus (contact, prepared contact, group mute cycle, notes), pending-connection rows, every request row, cards, centre pane and the empty state. Labels, line refs (±5), cited Haskell tests and CLI lines all match; every second user copies the current user's local servers (`chooseServers`).
+- **§5:** every row.
+- **§4, §10, §14, §15, the rest of §1/§2/§6/§7/§8/§9/§11/§13:** clean.
\ No newline at end of file
diff --git a/plans/ui-tests/catalogue/verify/r4-02.md b/plans/ui-tests/catalogue/verify/r4-02.md
new file mode 100644
index 0000000000..10fd99409f
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/r4-02.md
@@ -0,0 +1,144 @@
+Not CLEAN: I found 19 defects (2 low-severity) in sections B, F, G, L, P, Q and T. I made no edits. I re-checked the main defects myself against `wt-uitest-ref`. The rest come from reviewers I ran in parallel on parts of the file, and their evidence is quoted from the code.
+
+Things that are correct: the counts (273 tests, 7 IGNORE, every section count), the class map, the "Seam use" line (REC 8, AV 5, IMGCB 1), the IGNORE reasons (all from §11.3), test-name uniqueness across catalogues, and no row has both `S` and `RELAY`.
+
+## B. Composing
+
+**1. Previews row: `HTTP` is listed for two tests that make no HTTP request.** Tests: `linkPreview_firstTimeAlert_disable_noPreview`, `linkPreview_received_rendersCard`.
+- Quote: Needs `P, HTTP` for all five tests.
+- Evidence:
+  - CMP:483-485: "Disable" sets `preview = ComposePreview.NoPreview` and never fetches.
+  - A received card has to arrive as an `MCLink` that already carries its `preview`, sent with `/_send @2 json` (as in `testLinkContentFilter`, tests/ChatTests/Direct.hs:3562-3563). The CLI does not fetch previews.
+- Fix, split the row:
+  - Row 1: `linkPreview_firstTimeAlert_enable_fetchesPreview`, `linkPreview_sent_peerReceivesLinkContent`, `linkPreview_cancel_sendsPlainText` | Needs `P, HTTP`.
+  - Row 2: `linkPreview_firstTimeAlert_disable_noPreview`, `linkPreview_received_rendersCard` | Verification "Disable: no preview card is fetched or shown. Received: bob sends an `MCLink` with a `preview` via `/_send @2 json` (as in `testLinkContentFilter`); the GUI renders the card" | Needs `P`.
+
+**2. Commands row: the "//" literal is cited at the wrong line.**
+- Quote: `CMP:1283, CMD:36-244, CV:1051`
+- Evidence: CMP:1293 is `Text("//", ...)`; CMP:1283 is `fun CommandsButton()`. The header says literals are cited at their own line.
+- Fix: `CMP:1283-1296 ("//" at CMP:1293), CMD:36-244, CV:1051`
+
+## F. Attachments, sending
+
+**3. (Low) `attachImage_cancelPreview` lists `XFTP` but sends nothing.**
+- Quote: Needs `P, XFTP, FD`.
+- The file case was already split out the same way (`attachFile_cancelPreview_nothingSent`, Needs `P, FD`).
+- Fix: give it its own row | Trigger "Image" → dialog → (x) | File:line CMP:360-414 | Verification "The preview is removed; nothing reaches the CLI" | Needs `P, FD`.
+
+**4. (Low) `attachVideo_undecodable_showsAlert` lists `XFTP` but sends nothing.**
+- Quote: Needs `P, XFTP, FD, AV`.
+- Evidence: CMP:399-408 shows only `showVideoDecodingException()` and drops the video.
+- Fix, split the row:
+  - `attachVideo_send_peerReceivesVideo` | Needs `P, XFTP, FD, AV`
+  - `attachVideo_undecodable_showsAlert` | Needs `P, FD, AV` | add "nothing reaches the CLI" to the Verification.
+- The AV count stays 5.
+
+## G. Receiving files
+
+**5. Three tests where alice sends a file from the GUI don't say how the file is attached, and have no `FD`.** Tests: `sndFile_revoke_peerSeesCancelled`, `sndFile_stopDuringUpload`, `sndFile_xftpResetDuringUpload_showsFileError`.
+- Quotes: Needs `P, XFTP` / `P, XFTP, SRVCTL` / `P, XFTP, SRVCTL`. §F attaches files with "File" → dialog and lists FD.
+- Fix, either:
+  - add "(alice attaches the file by typing its path, PTF:97-110)" to each Trigger and keep the Needs; or
+  - split `sndFile_revoke_peerSeesCancelled` into its own row with Needs `P, XFTP, FD`, and make the other two `P, XFTP, SRVCTL, FD`.
+
+**6. `rcvFile_stopReceiving_thenRedownload`: the Verification is only a test name.**
+- Quote: "Matches `testXFTPCancelRcvRepeat`". The receiver in that test is now the GUI, so its CLI lines say nothing about what the app shows.
+- Evidence: Commands.hs:3559 `resetRcvCIFileStatus user fileId CIFSRcvInvitation`.
+- Fix: "After "Stop" the item returns to the not-downloaded state (download icon, `RcvInvitation`); clicking it again receives the file, and the file on disk matches the source (as in `testXFTPCancelRcvRepeat`)"
+
+**7. `rcvFile_senderDeletedItem_cannotReceive`: File:line is "—" and the Verification is only a test name.**
+- Evidence: tests/ChatTests/Files.hs:185-189 shows `[marked deleted] hi, sending a file`, then `file cancelled`. The marked-deleted menu at CIV:503-519 has no "Download".
+- Fix:
+  - File:line: `CIV:503-519, C/views/chat/item/MarkedDeletedItemView.kt`
+  - Verification: "bob sends a text-and-file message (`/_send @<id> json [{"filePath": …, "msgContent": {"type": "text", "text": "hi, sending a file"}}]`) and broadcast-deletes it; the GUI item reads "marked deleted" and its menu has no "Download" (`testSenderMarkItemDeleted`)"
+
+**8. `rcvFile_group_receive`: Trigger and File:line are "—", and the Verification is only a test name.**
+- Fix:
+  - Trigger: "bob `/f #team tests/fixtures/test.pdf`; click the file in #team"
+  - File:line: `C/views/chat/item/CIFileView.kt:75-84`
+  - Verification: "bob prints `bob <## "completed uploading file 1 (test.pdf) for #team"`; after the click the file icon shows complete and the file on disk matches the source (`testXFTPGroupFileTransfer`)"
+
+**9. `rcvVideo_previewAndDownload`: "Receive mp4" has no CLI command, and "download" usually needs no click.**
+- The CLI has no video command, and `/f` sends a file message (the same section says so for images).
+- Evidence: SimpleXAPI.kt:3034 auto-receives `MCVideo` up to `MAX_VIDEO_SIZE_AUTO_RCV` = 1_047_552 (Utils.kt:121).
+- Fix:
+  - Trigger: "bob `/_send @<id> json [{"filePath": "<mp4>", "msgContent": {"type": "video", "text": "", "image": "<preview data URI>", "duration": <s>}}]`"
+  - Verification: "The preview from the message content is shown; an mp4 of 1023 KB or less is received without a click (Utils.kt:121), a larger one after a click on the download icon"
+
+## L. Forwarding
+
+**10. `forward_withComment_sendsCommentQuoted`: the comment line is never asserted.**
+- Evidence: CMP:843-848 sends the comment with `quoted = message.id` (the last forwarded item). View.hs `directQuote` prints `>>` when the quote and the message have the same direction.
+- Fix, append to the Verification: "with a comment, cath then prints `cath <# "alice> >> hi"`, `cath <## "      <comment>"`"
+
+## P. Chat item info
+
+**11. `info_devTools_showsDbIdAndStatuses`: "File status" needs a file item, so XFTP is missing.**
+- Evidence: INFO:304-306 `if (ci.file != null) { ExpandableInfoRow(... info_row_file_status ...`.
+- Fix: Needs `P, XFTP, DT`; Notes "The item is a received file (bob `/f`), so "File status" is shown (INFO:304-306)"
+
+**12. `info_history_listsVersions`: "No history" can't appear for a message.**
+- Evidence: Commands.hs:733 `itemVersions = if null versions then maybeToList $ mkItemVersion ci else versions`. `mkItemVersion` returns the item itself for any message.
+- Fix: "The history lists every version, newest first, the newest marked "(current)"; an unedited message shows one version (Commands.hs:733)"
+
+**13. `info_delivery_groupMemberStatuses`, `info_delivery_liveUpdatesOnReceipt`: "No delivery information" can't appear.**
+- Evidence: Commands.hs:735 `L.nonEmpty <$> ... getGroupSndStatuses`. An empty list becomes `Nothing`, and then there is no "Delivery" tab at all (INFO:502-504).
+- Fix: "The "Delivery" tab lists bob and cath with status icons, which change from sent to delivered as receipts arrive, without reopening the modal (CV:739-751) (`testSendGroupDeliveryReceipts`)"
+
+**14. `info_quoteTab_showsQuoted`, `info_forwardedTab_showsSource`, `info_notes_savedTab`: the single "Forwarded from" fits only one of the three tests.**
+- Evidence: INFO:349 `in_reply_to`; INFO:365 `if (local) saved_from_chat_item_info_title else forwarded_from_chat_item_info_title`.
+- Fix: "Quote tab: heading "In reply to" and the quoted message; forwarded tab: heading "Forwarded from" and the source item; in notes the tab is "Saved", with heading "Saved from""
+
+## Q. Unread, scrolling, pagination
+
+**15. `newMessage_atBottom_autoScrolls`, `newMessage_scrolledUp_keepsPosition`: the Verification is `—`.**
+- Evidence: CV:2519 `scrollDistance = -39.dp`; CV:2534-2537 `scrollToItem(0)` or else `scrollBy(scrollDistance)`.
+- Fix: "At the bottom, the new item becomes the last visible item (the list scrolls to index 0, CV:2534-2535); when scrolled up, the same items stay in view, shifted by only 39 dp (CV:2519, 2537)"
+
+**16. `groupRcv_consecutiveMessages_avatarOnce`, `groupRcv_avatarClick_opensMemberInfo`: the Verification is `—`.**
+- Fix: "Only the first item in a run of bob's consecutive messages shows bob's avatar and name (CV:2026-2030, 3787); a click on the avatar opens bob's member info"
+
+## T. Status icons
+
+**17. `status_group_partialThenComplete`: the partial state can't be observed reliably as written.**
+- With bob and cath both online, the two receipts arrive within milliseconds. Holding the partial state (ChatModel.kt:4036-4039) needs cath stopped, which is `PEERCTL`, so the row must be split.
+- Fix, new row: `status_group_partialThenComplete` | Trigger "cath is stopped; alice sends "hi" in #team; then cath is started" | Verification "The item status is delivered-partial after bob's receipt and delivered-complete after cath's (`testSendGroupDeliveryReceipts`); `bob <# "#team alice> hi"`, then after the start `cath <# "#team alice> hi"`" | Needs `P, S, PEERCTL`.
+- The remaining row (`status_direct_sentThenDelivered`, `status_receiptsOff_staysSent`) keeps `P, S` without the group clause. T stays at 9.
+
+**18. `meta_signature_verified`: channel messages are unsigned by default.**
+- Evidence: tests/ChatTests/Groups.hs:12977 `-- default send is unsigned`; :13129 uses `sign=on`.
+- Fix, Trigger: "The CLI owner posts with `/_send #1(as_group=on) sign=on text hello` (`testChannelAsGroupSign`)"
+
+## S. Drafts
+
+**19. (Low) `draft_withAttachment_restored` doesn't say how the attachment is made.**
+- With "File" → dialog it needs FD, but the row's Needs are only `P`.
+- Fix: add to the Notes "the attachment is added through `onFilesAttached` (as in §F drag & drop)", or move this test to its own row with Needs `P, FD`.
+
+## Not defects
+
+Group rows use plain `P` in B and F but `P ×N` in O and U. The legend makes `×N` optional, so that is only an inconsistency.
+
+## Rows checked with no defects
+
+- **A:** all 10 tests.
+- **B:** all rows other than Previews and Commands.
+- **C:** labels (spot check).
+- **D:** labels (spot check).
+- **E:** all rows (labels, the REC/AV Needs, voice CLI format).
+- **F:** all rows other than Image and Video.
+- **G:** `rcvImage_autoReceived_renders`, `rcvImage_large_clickDownloads`, `rcvFile_clickIcon_receives`, `rcvFile_menuDownload_receives`, `rcvFile_acceptedBeforeUpload_showsWaitingAlert`, `rcvFile_xftpAuthError_showsFileErrorAlert`, `rcvFile_temporaryError_showsTemporaryFileError`, `rcvFile_expired_showsFileExpired`, `rcvFile_clickCompleted_opensSaveDialog`, `rcvFile_missingOnDisk_clickDoesNothing`, `rcvImage_click_opensFullScreen`, `fullScreen_click_closes`.
+- **H:** CLI lines.
+- **I:** all 10 tests.
+- **J:** CLI lines and labels.
+- **K:** limits.
+- **L:** all tests other than `forward_withComment_sendsCommentQuoted`.
+- **M:** emoji list and CLI lines.
+- **N:** share and copy behaviour.
+- **O:** all rows (role rewrite, CLI lines).
+- **P:** sent/received details, copy a history version, the timed/deleted/moderated rows, share button, closes on chat switch.
+- **Q:** unread, scroll buttons, pagination, dates.
+- **T:** auth error, pending while the server is down, quota warning, unread dot, signature-missing IGNORE.
+- **U:** all 16 tests.
+- **W:** Needs.
+- **Y:** all 4 IGNORE reasons.
\ No newline at end of file
diff --git a/plans/ui-tests/catalogue/verify/r4-03.md b/plans/ui-tests/catalogue/verify/r4-03.md
new file mode 100644
index 0000000000..9a69bb2308
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/r4-03.md
@@ -0,0 +1,145 @@
+I found 26 real defects in catalogue 03. I edited nothing. Each finding below was checked against `~/wt-uitest-ref` (d72f68e6d). I re-checked the most important ones myself (§10 #1 and #2, §8 #1, §12 #1). Two of the five planned review forks hit the concurrency limit, so I reviewed §19 and §20 myself and covered the lower-priority sections only partly.
+
+Coverage:
+- **Fully reviewed:** §6, §8, §10, §12, §18, §19, §20.
+- **Mechanical checks over the whole file:**
+  - Every «label» is in strings.xml.
+  - All 65+ Haskell test refs point at their test.
+  - strings.xml has only one duplicate key, `share_address`.
+- **Spot-checked:** §3, §4, §5, §7, §9, §11, §13–§17.
+
+## §6 Member admission and review
+
+**1. `memberAdmission_enableReviewAll`** — the first CLI line is missing.
+- Quote: "CLI: `changed member admission rules`"
+- Evidence: H/Groups.hs:3688-3691 prints `alice updated group #team: (signed)` first, from View.hs:2109 (`memberUpdated`).
+- Fix: "CLI: `alice updated group #team: (signed)` / `changed member admission rules` (testGLinkReviewMember, H/Groups.hs:3684); read-only for a member"
+
+**2. `joinerPendingReview_supportChatAutoOpens`, `joinerPendingReview_messagesAdmins`, `joinerPendingReview_acceptedByAdmin`, `joinerPendingReview_rejected`** — `CB` is missing, and the rejected test has no verification.
+- Review applies only to members who join by link (Commands.hs:2881-2886). On desktop, joining by link means pasting from the clipboard (NewChatView.kt:673-675).
+- A removed pending member gets `MemRemoved` (ChatModel.kt:1746).
+- Fix, Entry path: "«Paste link» with the link of a CLI group that has review on ▸ «Open group» ▸ «Join group»"
+- Fix, Verification: append "; after `/rm team alice` alice's compose shows «removed from group» (testGLinkDeletePendingApprovalMember H/Groups.hs:3984-3988, roles swapped)"
+- Fix, Needs: `P, CB`
+
+## §8 Joining, connect plans, invitations
+
+**3. `connectPlan_connectingProhibit`** — pasting the short link again gives the known-group alert, not «Group already exists!».
+- For a short link the core checks `knownLinkPlans` first, and `gPlan` returns `GLPKnown` unless the membership was removed (Commands.hs:4537, :4584-4588).
+- «Group already exists!» comes only through `groupPlan`, which returns `GLPConnectingProhibit` (Commands.hs:4715-4716). That path is reached by pasting the full link.
+- Fix: "… paste the short link, «Open group», «Join group», then paste bob's full link → «Group already exists!» (ConnectPlan.kt:302-306; found by `via_group_link_uri_hash`, src/Simplex/Chat/Store/Shared.hs:964; membership not yet active, Commands.hs:4715-4716)"
+
+**4. `joinGroup_preparedJoinIncognito`, `joinGroup_preparedChangeProfile`** — the host does not see the name `alice` in these two tests.
+- Evidence: Profiles.hs:4884-4886 uses `bobIncognito <> ": accepting request…"`; :4936-4938 uses `robert: accepting…`.
+- Fix: "CLI host: `<name>: accepting request to join group #team...`, `#team: <name> joined the group`, where `<name>` is `alice`, the incognito name for `joinGroup_preparedJoinIncognito`, and the second profile's name for `joinGroup_preparedChangeProfile` (…same test refs)"
+
+**5. `connectPlan_ownGroupLinkJoinAsSecondMember`** — the GUI never shows `team_1`.
+- Evidence: `displayName` is `localAlias.ifEmpty { groupProfile.displayName }` (ChatModel.kt:2515).
+- Fix: "«Join your group?» ▸ «Use current profile» → a second "team" group appears in the chat list (testPlanGroupLinkOwn, H/Groups.hs:2931)".
+- Alternative: split the row, giving this test `CB, DT` and checking developer tools «Local name» = `team_1`.
+
+## §10 Member info
+
+**6. `memberInfo_blockForAllNotifiesMembers`** — the CLI line is wrong.
+- Quote: "bob's later messages reach cath as `… [blocked by admin]`"
+- A normal CLI prints nothing for messages from a blocked member (View.hs:613 `not (memberBlocked m)`; View.hs:399-402 `| otherwise = []`). The `[blocked by admin] <muted>` line only exists under `testView`.
+- Fix: "bob's later messages print nothing on cath's CLI; cath's `/tail #team 1` shows `#team bob> <text> [blocked by admin]`"
+
+**7. `memberInfo_memberAddressConnect`** — «Share address…» is probably not the label the app shows.
+- strings.xml defines `share_address` twice: line 572 `Share address…` and line 1957 `Share address`. The later value wins; a built bundle from an older tree with the same duplicate contains `Share address`. This was not confirmed on a moko 0.27.1 build.
+- Fix: "QR, «Share address», «Connect» → address plan"
+
+**8. `memberInfo_messageOpensKnownContact`, `memberInfo_callButtonsShowSendMessageAlert`** — the two tests need opposite setups, and the first has no verification.
+- Evidence: GroupMemberInfoView.kt:497-511 (known contact: open the chat plus the contact's call buttons) vs :512-529 (not a contact: the alert).
+- Fix, Verification: "«message» opens the existing direct chat with bob; for a member who is not a contact, «call»/«video» show «Can't call group member» / «Send message to enable calls.»"
+- Fix, Notes: "For `…OpensKnownContact` bob is alice's contact; for `…SendMessageAlert` bob joins through alice's group link"
+
+**9. `memberInfo_openShowsSections`** — the role row is labelled «Change role» for an owner.
+- Evidence: an editable role shows `RoleSelectionRow` with `change_role` (GroupMemberInfoView.kt:607-612, :920).
+- Fix: "Header, «Member» section with «Group» and «Change role» (alice is the owner), «Servers»"
+
+**10. `memberInfo_blockForMeHidesMessages`** — messages are not hidden; they show as «blocked». The note is also too narrow.
+- Evidence: FramedItemView.kt:277-278; MarkedDeletedItemView.kt:105-106; `NonAdminBlockSection` is shown only below Moderator (GroupMemberInfoView.kt:695-698).
+- Fix, Verification: "«Block member?» / «Block»; that member's later messages show as «blocked» (testMuteGroup, H/Direct.hs:1920)"
+- Fix, Notes: "Moderators and above can't block for self"
+
+**11. `memberInfo_networkStatusAlert`** — no verification.
+- Evidence: GroupMemberInfoView.kt:637-643.
+- Fix: append "; clicking the status row opens the «Network status» alert"
+
+**12. `memberInfo_changeRoleOfInvitedMember`** — the setup is ambiguous.
+- Choosing the role a member already has does nothing (GroupMemberInfoView.kt:150). The Haskell test invites bob as admin, then changes him to member (H/Groups.hs:1647-1650).
+- Fix, Notes: "alice invites bob with «New member role» admin, then changes him to member before he joins; the CLI also prints `use /j team to accept`"
+
+## §12 Support chats
+
+**13. `chatsWithMembers_deleteChat`** — wrong button label.
+- Evidence: MemberSupportView.kt:284/:295 use `delete_member_support_chat_button` = "Delete chat".
+- Fix: "After «Delete chat» (row menu, then the «Delete chat with member?» alert), the member's chat disappears…"
+
+**14. `supportChat_hiddenWhenDisabledWithoutChat`** — no verification.
+- Evidence: GroupChatInfoView.kt:634-636; testSupportPreferenceGroup H/Groups.hs:9108-9126.
+- Fix: append "After bob runs `/set support #team off`, Group info has no «Chat with admins» row while alice has no support chat; if she already has one, the row stays."
+
+**15. `supportChat_unreadBannerInGroupChat`** — «%d messages» is runtime-formatted (ChatView.kt:1729) and the row doesn't say so.
+- Fix: "the «%d messages» banner (runtime-formatted, e.g. "2 messages")"
+
+## §18 Channels, alice as owner
+
+**16. `channelRelays_removeLastRelayWarning`** — the label is truncated.
+- Evidence: strings.xml:3082; the alert is at GroupChatInfoView.kt:284.
+- Fix: «Remove relay?» / «This is the last active relay. Removing it will prevent message delivery to subscribers.»
+
+**17. `channelRelays_noAvailableRelays`** — no expected result.
+- Evidence: AddGroupRelayView.kt:114 shows `no_available_relays`.
+- Fix: add "with both relays in the channel, «Add relay» opens «Add relays» showing «No available relays»"
+
+**18. `createChannel_cancelAndDelete`** — the Notes quote «0/1 relays active», which is not in strings.xml.
+- Fix: "the step stays at "0/1 relays active" (runtime-formatted from «%1$d/%2$d relays active», AddChannelView.kt:440)"
+
+**19. File refs with no line number.**
+- `channel_broadcastFile`: `V/chat/ComposeView.kt:1841-1847`
+- `channelWebPage_copyEmbedCode`: `V/chat/group/ChannelWebPageView.kt:130-138`
+- `channelWebPage_externalEmbedScriptLoads`: `V/chat/group/ChannelWebPageView.kt:173-186`
+
+**20. CLI lines given as fragments, or missing.**
+- `channelSubscribers_promoteToContributor`: `#team: alice changed your role from observer to member (signed)` (H/Groups.hs:9316)
+- `channel_editBroadcast`: `#team> [edited] <new text>` (:12139)
+- `channel_deleteBroadcast`: add `#team> [marked deleted] hi` (:12160)
+- `channel_ownerModeratesContributorMessage`: add `#team bob> [marked deleted by alice] <text>` (:13525-13528)
+- `deleteChannel_ownerDeletesForAll`: add the second line `use /d #team to delete the local copy of the group` (:10821-10822)
+
+## §19 Channels, alice as subscriber
+
+**21. `joinChannel_pasteLinkOpenChannel`, `joinChannel_joinViaRelay`, `joinChannel_incognito`, `joinChannel_noActiveRelays`, `joinChannel_receivesHistory`** — the owner line is only a fragment.
+- Quote: "CLI owner: `introduced alice in the channel`"
+- Evidence: View.hs:1394 builds `ttyGroup' g <> ": " <> ttyMember host <> " introduced " <> ttyFullMember m <> " in the channel"`; memberJoinChannel' only matches it with `EndsWith`.
+- Fix: "CLI owner: `#team: relay1 introduced alice in the channel` (for `joinChannel_incognito`, the incognito name instead of `alice`)"
+
+## §3, §5, §13, §20 and the whole file
+
+**22. §3 `groupInfo_membersSectionCountAndSelfRow`** — «you: …» is not a strings.xml value.
+- Fix: "self row reads «you: %1$s» (runtime-formatted with alice's name)"
+
+**23. §3 Notes vs §18/§20** — the §3 note hands the channel and business preference footers to §18 and §20, but no row there tests them.
+- Evidence: GroupChatInfoView.kt:726-729.
+- Fix, `channelInfo_ownerRows` Verification: add "the footer «Only channel owners can change channel preferences.»"
+- Fix, `businessInfo_rowsForBusinessSide` Verification: add "the footer «Only chat owners can change preferences.»"
+
+**24. §5 `groupPrefs_reactionsOff_hidesReactionMenu`** — the cited line is the direct-chat check.
+- Commands.hs:980 is the `CTDirect` branch; the group check is at :1004-1005 (`unless (groupFeatureAllowed SGFReactions g)`).
+- Fix: `src/Simplex/Chat/Library/Commands.hs:1004-1005`
+
+**25. §13 `reports_*`** — the group name was not rewritten.
+- Quote: "`/report #jokes spam <text>`"
+- Fix: "`/report #team spam <text>`"
+
+**26. "By Needs" totals line** — two counts are wrong. `SRVCTL` covers `joinGroup_retryAfterServerError` and `memberInfo_abortSwitchAddress`. `FIXTURE` covers both group-link rows and `memberInfo_fixConnectionAfterDesync`. The RELAY 80, NAMES 2, PEERCTL 9, SLOW 1, S 6 and 310/9 counts are correct.
+- Fix: "11 need a peer, relay or server stopped or restored (`PEERCTL` ×9, `SRVCTL` ×2); 3 need a `FIXTURE`"
+
+## Checked with no defect
+
+- **Counts and IGNORE rows:** all section counts and the Count table; every IGNORE reason matches plan §11.3; no row combines `S` with `RELAY`.
+- **§20:** all six rows. The business and customer chat names (`#alice:`, `alice_1`), «Add team members» vs «Add friends», the pending-business known plan (Commands.hs:4537), and the request-message order are all correct.
+- **§19:** the other rows (relay bar, plans, leave line, support, «Owners & contributors», «you are subscriber»).
+- **Spot-checked lines:** the CLI lines checked in §4, §7, §11, §14 and §17 match View.hs and the cited tests.
\ No newline at end of file
diff --git a/plans/ui-tests/catalogue/verify/r4-04.md b/plans/ui-tests/catalogue/verify/r4-04.md
new file mode 100644
index 0000000000..612c01baf0
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/r4-04.md
@@ -0,0 +1,61 @@
+I found 9 defects: 5 in section F, 2 in C, 2 in L and 1 in A, which is outside your priority list. Sections D, H and I came out clean.
+
+**1. C: `receipts_contactsOverrideAlert_keep`, `receipts_contactsOverrideAlert_forAll`, `receipts_contactsOverrideAlert_cancel`, and `receipts_groupsOverrideAlert`.** The tests can't produce the alert as set up.
+- Quote (Notes): "contact override `sendRcpts = true`, e.g. `/receipts @bob on` in the console" and "(`/receipts #<group> on`)".
+- Evidence: the console command runs `APISetChatSettings`, which replies with plain `ok` (Commands.hs:1913-1921). TerminalView.kt:60 just calls `sendCmd`, so nothing updates `chatModel.chats`. The alert counts overrides from `chatModel.chats` (PrivacySettings.kt:248-256 and 262-270), finds 0, and sets receipts with no alert.
+- Corrected Notes, contacts row: "bob's contact has receipts explicitly turned on first through the GUI: bob's contact info > "Send receipts" > "yes" (`C/views/chat/ChatInfoView.kt:84-87,1228-1239`). A console `/receipts @bob on` doesn't update the GUI's chat model, so no alert would show. An "off" override is not counted when disabling (`PrivacySettings.kt:253-264`)."
+- Corrected Notes, groups row: "A group with bob is set up first, with group receipts turned on through the GUI: group info > "Send receipts" > "yes" (`C/views/chat/group/GroupChatInfoView.kt:93-96,735`). A console `/receipts #<group> on` doesn't update the GUI model. An "off" override is not counted when disabling (`PrivacySettings.kt:268-279`)."
+
+**2. C: `privacy_autoAcceptGroupInvitations` and `privacy_autoAcceptContactRequestsInGroups`.** The Log entry is named wrongly.
+- Quotes: "Log apiSetUserAutoAcceptGroupInvitations cmd" and "Log cmd".
+- Evidence: the Log shows `cmd.cmdString` (SimpleXAPI.kt:7530). That string is `"/_set accept group invitations $userId ${onOff(enable)}"` at :4134, and `"/_set accept member contacts $userId …"` at :4133. `apiSetUserAutoAccept…` is only the internal command name (:4349-4350).
+- Corrected Verification, first row: "Log `/_set accept group invitations <userId> on`; bob invites, GUI joins without action (`H/Profiles.hs` testAutoAcceptGroupInvitations)".
+- Corrected Verification, second row: "Log `/_set accept member contacts <userId> on`; a member's contact request is auto-accepted".
+
+**3. A: `settingsRoot_crowdfundingOpensGetStake`.** The title literal contains a newline.
+- Quote: 'title "Invest in SimpleX Chat", a hard-coded literal at `WhatsNewView.kt:1200`'.
+- Evidence: WhatsNewView.kt:1200 has `val title = "Invest in\nSimpleX Chat"`.
+- Corrected text: 'title "Invest in\nSimpleX Chat" (a hard-coded literal with a line break, `WhatsNewView.kt:1200`)'.
+
+**4. F: `operators_enableDisableOperator`.** Turning "Use servers" on never just flips the switch in a fresh database.
+- Quote: "Unsaved indicator; "Save servers" sends `/_servers` …". Notes: "Toggling only".
+- Evidence: a fresh database has no accepted conditions, so acceptance is `CARequired Nothing` (Store/Profiles.hs:892,911). In that case the switch opens `SingleOperatorUsageConditionsView` instead of enabling (OperatorView.kt:571-583). Its "Accept conditions" sends `/_accept_conditions` and then enables (:614-623).
+- Corrected Verification: "Turning "Use servers" on opens "Use SimpleX Chat" (conditions are not accepted in a fresh DB, `OperatorView.kt:571-583`). "Accept conditions" sends `/_accept_conditions <conditionsId> <operatorId>` and turns the switch on. Unsaved indicator appears; "Save servers" sends `/_servers` and reads the servers back. Turning it off needs no conditions (`/_operators <json>` is used only by onboarding) (`H/Direct.hs` testOperators)".
+
+**5. F: `operators_reviewAcceptConditions`.** The route in the Notes can't reach "Review conditions".
+- Quote (Notes): "an operator is enabled and saved ("Save servers") first, then Network & servers is reopened … "Review conditions" shows while that operator's conditions are not accepted".
+- Evidence: enabling through the UI already accepts the conditions (defect 4). After that, `usageConditionsAction` returns `UCAAccepted` (Operators.hs:121-124), so reopening shows "Accepted conditions".
+- Corrected Notes: "The harness disables both operators, so the button is hidden. The UI can't enable an operator without accepting its conditions (`OperatorView.kt:571-583`). So the console sends `/_servers <userId> <json>` with the SimpleX Chat operator `enabled: true`, then the core is restarted, because `chatModel.conditions` is reloaded only in `initChatController` (`Core.kt:143`) or after "Save servers". "Review conditions" then shows. After accepting, reopening shows "Accepted conditions"."
+- Corrected Needs: "RESTART".
+
+**6. F: `operators_roleToggles_validation`.** Changing the operator's roles alone never leaves zero receive servers.
+- Quote: "a role change that leaves no server to receive messages shows the footer "No servers to receive messages.""
+- Evidence: the custom smp1 keeps its default storage role, because `resolveServerRoles p Nothing` gives `ServerRoles True True False` (Operators.hs:190-193). `hasRole` therefore still finds a storage server (:545,566-568).
+- Corrected Verification: "With the operator enabled first (conditions accepted in the "Use SimpleX Chat" sheet; role sections show only for an enabled operator, `OperatorView.kt:242`) and smp1's "To receive" set to "no" in its server view (`ProtocolServerView.kt:215`): turning off the operator's "To receive" shows the footer "No servers to receive messages." and disables "Save servers" (`SimpleXAPI.kt:4922-4923`; `T/OperatorTests.hs`)".
+
+**7. F: no row for a feature that exists.** Self-hosted servers now have their own roles (#7254), and no row tests them.
+- Evidence: ProtocolServerView.kt:197-202 and 212-242 show `ServerRolesSection` for enabled SMP servers. It has "Use for messages" with "To receive", "For private routing" and "To resolve names", each set to default (yes/no), "yes" or "no".
+- Suggested row: `| Servers | Per-server roles | "Your servers" > tap smp1 > "Use for messages": "To receive" / "For private routing" / "To resolve names" | `NS/ProtocolServerView.kt:197-242` | `serverView_perServerRoles` | Options "default (yes)"/"yes"/"no" (names: "default (no)"); after "Save servers" the Log `/_servers <uid> {…}` carries the server's roles and reopening shows them; "To receive" = "no" on the only SMP server shows "No servers to receive messages." | — | – |`
+- Adding it changes F to 43 tests and the totals to 229 tests (20 ignored). `NetworkServersTest` becomes 22 in the class map, and plan §10 needs regenerating.
+
+**8. L: `linkMobile_newPairing_verifyAndConnect`.** The GUI can't show "Mobile" at this step.
+- Quote: 'section "Connected mobile" showing "Mobile"'.
+- Evidence: for a new host the session-code event carries `remoteHost_ = Nothing` (Remote.hs:194-195), and the GUI uses that value (SimpleXAPI.kt:3435). The layout then shows `deviceName ?: stringResource(MR.strings.new_mobile_device)` (ConnectMobileView.kt:216). The name "Mobile" is known only after verification, and `RemoteHostConnected` closes the modal right away (SimpleXAPI.kt:3440).
+- Corrected text: 'section "Connected mobile" showing "New mobile device" (italic; the host's name isn't known before verification)'.
+
+**9. L: `linkMobile_remoteFiles`.** Clicking a received file opens a save dialog, not the file.
+- Quote: "a file bob sends is received and opened from the desktop's remote-hosts store".
+- Evidence: CIFileView.kt:108-118 calls `loadRemoteFile`, which sends `"/get remote file $remoteHostId {…}"` (SimpleXAPI.kt:4319), and then `saveFileLauncher.launch`. Opening a file in the OS falls under the §11.3 out-of-reach list.
+- Corrected text: "a file bob sends is received; clicking it on the desktop logs `/get remote file <rhId> {…}`, the file appears in the desktop's remote-hosts store and the save dialog opens (`C/views/chat/item/CIFileView.kt:108-118`; remoteStoreFileTest, `T/RemoteTests.hs:286-300`)". Needs is unchanged, since FD is already there.
+
+**Checked with no defect found:**
+- **C:** every row other than the 6 tests in defects 1 and 2.
+- **D:** all rows. Labels, line references, preference keys, the passcode and self-destruct flows, alert titles, the "1 minutes" wording, `laFailedAlert`, the notice conditions, and RESTART on the startup and trigger rows are all correct.
+- **F:** all other rows, including every SOCKS, advanced and relay label, the `/_network` timing, the unsaved-changes alerts, and the sent-via-proxy row.
+- **H:** all rows. Labels, `/_db`, `/_ttl` and `/_stop` usage, the import key removal and passphrase prompt, the reasoning behind the import-error IGNORE, the encryption alerts, the DB error screens and the fixtures are correct.
+- **I:** all rows. Strings, the `checkUserLink` conditions, download-failed handling, resume after restart (App.kt:143), the temporary user with preset servers behind the IGNOREs, and that `migrationFromStage` is unused are all confirmed.
+- **L:** all other rows, the CLI lines checked against View.hs:306-311, 566-568 and 2770, and the multicast and stored-host commands.
+- **Spot-checked:** A (the other rows), E (one-hand UI), and the J and K labels.
+- **Counts:** every section heading count and ignore count matches the names in its rows (228 in total, 20 ignored), and no name in catalogue 04 appears in catalogues 01–03.
+
+The legend file changed on disk while I was reviewing. I re-read the Needs and IGNORE rules, and nothing in it changes these findings.
\ No newline at end of file
diff --git a/plans/ui-tests/catalogue/verify/r4-feasibility.md b/plans/ui-tests/catalogue/verify/r4-feasibility.md
new file mode 100644
index 0000000000..db435ccea7
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/r4-feasibility.md
@@ -0,0 +1,97 @@
+The plan is not CLEAN. I found 8 designs that would fail as written. Findings 1–3 are confirmed by experiments on this host; the rest are traced through the source of the pinned versions.
+
+### 1. The outside build leaves a Gradle daemon running, and it blocks the Gradle run inside the namespace (every run)
+- **Plan line 323:** "`./gradlew --stop` (an outside daemon can't be asked to release `~/.gradle` locks from inside), then `./gradlew :desktop:cmakeBuildAndCopy :common:desktopTestClasses :common:uitestPrepare`"
+- **Problem:** `--stop` runs first. The build command after it starts a new daemon, and that daemon stays alive holding `caches/journal-1`. Gradle asks a lock holder to release by pinging it over loopback, which can't cross network namespaces.
+- **Evidence:** I reproduced this with Gradle 8.12 and a scratch `GRADLE_USER_HOME`. I ran one daemon build outside, then `unshare -rn … gradle --offline --no-daemon` inside. It failed after 62 s with `Timeout waiting to lock journal cache (…/caches/journal-1). It is currently in use by another Gradle instance. Owner PID: 174285`. After `--stop`, the same inside command passed in 6.8 s.
+- **Also:** `journal-1` and `modules-2` are shared across Gradle versions, but `--stop` only stops daemons of its own version (`~/.gradle/daemon/` has both 8.7 and 8.12).
+- **Fix (replacement text):** "`./gradlew --no-daemon :desktop:cmakeBuildAndCopy :common:desktopTestClasses :common:uitestPrepare`, then `./gradlew --stop`. The script then refuses to enter the namespace while any `GradleDaemon` process (of any version, including an IDE's) uses the same Gradle user home, because a daemon outside holds cache locks the Gradle run inside can't make it release."
+
+### 2. Pass 2 fails with "No tests found" for the plan's own `--tests` example
+- **Plan line 331:** "Pass 2 runs only if the user's `uiTags` is empty or contains `Multicast`: it runs `-PuiTags=Multicast` with the user's exclusions and `--tests`". Plan line 333 gives the usage `scripts/uitest.sh --tests '*OneTimeLink*Test'`.
+- **Problem:** That example leaves `uiTags` empty, so pass 2 runs Multicast ∩ `*OneTimeLink*` = 0 tests. Gradle's `failOnNoMatchingTests` (default true) then fails the build. Pass 1 fails the same way when `--tests` selects only Multicast tests.
+- **Evidence:** Gradle 8.12 project with JUnit 4.13.2, `forkEvery = 1` and a category filter: `test --tests '*OneTimeLink*' -Pinc=a.Multicast` → `> No tests found for given includes: [*OneTimeLink*](--tests filter)`, `BUILD FAILED`.
+- **Fix:** add to `desktopUiTest`: `filter { isFailOnNoMatchingTests = findProperty("uiAllowEmpty") == null }`. Replace the pass rule with: "Both passes add `-PuiAllowEmpty`; the script fails the run only if neither pass executed a test (it counts the XML results in `build/test-results/desktopUiTest`)."
+
+### 3. Ctrl+C and SIGTERM don't stop a run; `timeout` returns while the namespace keeps running
+- **Plan line 326–330:** the script re-executes as `sh -c '… exec "$0" --inside "$@"'`, so the script becomes PID 1 of the pid namespace.
+- **Problem:** PID 1 of a pid namespace ignores signals it has no handler for. `unshare --fork` also ignores SIGINT and SIGTERM while it waits for its child.
+- **Evidence (util-linux 2.38.1):**
+  - Sending SIGINT to the process group killed the inner `sleep` (standing in for Gradle pass 1). The PID-1 `sh` carried on to the next command ("pass 2") and unshare exited 0.
+  - `kill -TERM <unshare>`: unshare survived and the inner commands ran to completion.
+  - `timeout 2 ./t2.sh` returned 124 while the inner commands kept running.
+  - Only SIGKILL to unshare triggered `--kill-child`.
+- **Effect:** the first Ctrl+C kills pass 1's Gradle, its test JVMs and peers, then pass 2 starts, and the exit status can be 0.
+- **Fix (replacement text):** "In `--inside` mode the script first runs `trap 'kill -TERM -1 2>/dev/null; exit 130' INT TERM` (PID 1 receives only signals it handles), records each pass's exit code, and exits non-zero if either failed. The outer invocation doesn't `exec`: it runs `unshare … &`, sets `trap 'kill -KILL $!' INT TERM`, and returns `wait`'s status, so `--kill-child` tears the namespace down."
+
+### 4. `UiIdle` never drains: every reset waits the full 30 s, and assertion deadlines stretch to about 120 s
+- **Plan line 260:** "jobs started by `withBGApi`/`withLongRunningApi`/`withApi` … added on launch and removed on completion". Plan line 262: "`drain()` waits until nothing is in flight (at most 30 s) before a reset".
+- **Evidence:** `PopChatCollector.init` launches `withLongRunningApi { subject.throttleLatest(2000).collect { … } }`, which never completes (C/model/ChatModel.kt:826-835).
+  - One collector is created per `ChatsContext`: ChatModel.kt:161 (`val chatsContext = ChatsContext(null)`, created on the JVM's first access to `ChatModel`), MemberSupportChatView.kt:160, GroupReportsView.kt:80, ChatView.kt:3832/3915, ChatItemView.kt:1491/1542.
+  - A grep of every `withBGApi`/`withLongRunningApi`/`withApi` site found no other job that never ends.
+- **Effect:**
+  - Every `resetForTest` spends 30 s in `drain()`, about 9.7 h over 1,161 tests, against the plan's "a few seconds" per reset.
+  - For the first 120 s of each JVM, and after any support-chat or reports screen opens, every assertion deadline is extended, so a failing check takes about 2 min instead of 10 s.
+- **Fix (replacement text):** "jobs started by `withBGApi`/`withLongRunningApi`/`withApi`, added on launch and removed on completion. `withLongRunningApi` gets a parameter `idle: Boolean = true`; `PopChatCollector.init` (ChatModel.kt:827) passes `idle = false`, because its collector never ends."
+
+### 5. `restartCore()` blocks on the "Start chat?" alert before `AppScreen` is composed
+- **Plan line 396:** "start as desktop startup does — `initChatControllerOnStart()` … — wait until initialisation has finished, and compose `AppScreen()` again with `setContent`". Catalogue 04 line 24 uses the same order.
+- **Problem 1 (deadlock):** when `chatStopped` is set and a passphrase is stored, `initChatControllerOnStart` calls `initChatController(startChat = ::showStartChatAfterRestartAlert)` (Core.kt:60-61).
+  - Initialisation then waits on `startChat().await()` (Core.kt:144), which only the alert's buttons complete (Core.kt:226-235).
+  - The alert renders only inside `AppScreen`, which isn't composed yet, so `ctrlInitInProgress` stays true.
+  - Test `dbMgmt_stoppedStatePersistsRestart` hits the 2-min watchdog every time.
+- **Problem 2 (race):** `initChatControllerOnStart` only launches a coroutine (Core.kt:59) and `ctrlInitInProgress` is still false before it starts (Core.kt:72-73). A wait on that flag can return before initialisation begins.
+- **Fix (replacement text):** "…clear `chatDbStatus` to null, call `initChatControllerOnStart()` (or take the lock-screen path), compose `AppScreen()` again with `setContent` at once, as desktop `showApp` composes while initialisation runs, then poll until `chatModel.chatDbStatus.value != null && !chatModel.ctrlInitInProgress.value`, or until an alert is shown (`AlertManager.shared.hasAlertsShown()`)."
+
+### 6. Restarting a profile-less (onboarding) app ends on the splash screen
+- **Plan line 396:** "raw `apiStopChat` (not `stopChatAsync` …) … clear in-memory state as `clearUiState` does". The `clearUiState` list (plan line 392) doesn't include `chatRunning`.
+- **Problem:** raw `apiStopChat` leaves `chatModel.chatRunning == true`.
+  - On restart with no user, `initChatController` sets `localUserCreated = null` and calls `startChatWithoutUser()` (Core.kt:151-163).
+  - `startChatWithoutUser()` returns at once because of `if (chatModel.chatRunning.value == true) return` (SimpleXAPI.kt:704), so `localUserCreated` stays null.
+  - App.kt:156 then shows `localUserCreated == null -> SplashView()` indefinitely. A real restart starts from `chatRunning = null` (ChatModel.kt:146).
+- **Failing case:** `migrateTo_resumeAfterRestart` (Needs `… RESTART, ONBOARD`; migrate-to is reachable only from onboarding).
+- **Fix (replacement text):** "raw `apiStopChat` … restore `chatStopped` to its previous value and set `chatModel.chatRunning.value = null` (the process-start value, ChatModel.kt:146); `chatCloseStore`; …"
+
+### 7. The watchdog's "poisoned JVM" can't take effect when the EDT is stuck
+- **Plan line 264:** "interrupts the test thread, waits 15 s, and if the thread hasn't finished marks the JVM poisoned: every later `app()` call in this JVM fails immediately".
+- **Evidence:** in ui-test-desktop 1.8.2 (official sources jar), `runDesktopComposeUiTest` → `SkikoComposeUiTest.withScene` runs `scene = runOnUiThread(::createUi)` first and `runOnUiThread(scene::close)` in `finally`. `runOnUiThread` is `SwingUtilities.invokeAndWait` when called off the EDT (DesktopSynchronization.desktop.kt).
+- **Effect:**
+  - If the test body runs on the JUnit thread, JUnit never reaches the next test.
+  - If the body runs on its own thread and the stuck thread is the EDT (the plan names "stuck … on the EDT"), the next test blocks in `createUi` before `app()` checks the flag.
+  - Either way that fork hangs, and the whole `desktopUiTest` task hangs until its 12 h `timeout`.
+- **Fix (replacement text):** "`uiTest` checks the poison flag on entry, before `runDesktopComposeUiTest`, and runs `runDesktopComposeUiTest { … }` on a dedicated daemon thread that the JUnit thread joins with the deadline. When the deadline passes it also probes the EDT (`invokeLater` plus a 5 s latch). If the body thread is still alive 15 s after the interrupt, or the probe fails, the JVM is poisoned and every later `uiTest` in it fails at entry without touching the EDT."
+
+### 8. Minor compile and configuration errors
+- **8a. Plan line 301:** `timeout.set(Duration.ofHours(12))` won't compile. Gradle 8.12's Kotlin DSL implicit imports are `org.gradle.kotlin.dsl.*`, `…plugins.dsl.*`, `Callable`, `TimeUnit`, `BigDecimal`, `BigInteger`, `File`, `Inject` plus Gradle API packages (javap of `ImplicitImports` in gradle-kotlin-dsl-8.12.jar). `common/build.gradle.kts` has no imports. **Fix:** `timeout.set(java.time.Duration.ofHours(12))`.
+- **8b. Plan lines 688 and 692:** "`-PuiTags=Smoke …` runs one test per sub-area plus the traceability check". JUnit 4 `includeCategories(Smoke)` drops uncategorised tests, and `CatalogueTraceabilityTest` is described only as "a plain JUnit test". **Fix:** "`CatalogueTraceabilityTest` carries `@Category(Smoke::class)` (it is exempt from the Needs-to-category rule)."
+
+### What checked out
+- **ui-test 1.8.2 API** (official sources jars):
+  - `runDesktopComposeUiTest(width, height, effectContext, block)` exists; `ExperimentalTestApi` is an error-level opt-in.
+  - With `autoAdvance = false`, `waitForIdle` returns once layout is done and ignores idling resources.
+  - `advanceTimeBy` runs on the EDT; input injection advances the clock itself.
+  - `setContent` can be called again; `captureToImage()`, `performScrollToKey`, `performMouseInput`, `printToString`, `isDialog()` and `LocalClipboard` all exist.
+  - Material `AlertDialog` renders as a same-canvas `Dialog` layer with `dialog()` semantics and Escape-to-dismiss. The AWT-window `DefaultDialog` has no callers.
+  - `compose.desktop.uiTestJUnit4` maps to `org.jetbrains.compose.ui:ui-test-junit4`.
+- **Dependencies and Gradle wiring:**
+  - pty4j 0.13.13 exists and needs kotlin-stdlib 2.1.21, which is compatible.
+  - Skiko 0.9.4.2 unpacks its native library with a temp file and atomic move, so parallel JVMs are safe.
+  - `desktopTest` already runs on JUnit 4 (kotlin-test-junit).
+  - `libapp-lib` has `$ORIGIN` rpath.
+  - `startReceiver` is guarded, so `startChat` after `startChatWithoutUser` is safe.
+  - A fresh-database `initChatController` gets a random key, and a CLI fixture database opens with the empty key.
+- **Namespace** (tested here):
+  - `unshare -rn --pid --fork --kill-child --mount-proc` with lo up, multicast on and the 224.0.0.0/4 route all work.
+  - The ephemeral port range is 32768–60999; `localhost` resolves to ::1 and 127.0.0.1 even with `AI_ADDRCONFIG`.
+  - Multicast to 224.0.0.251:5227 arrives from source 127.0.0.1.
+  - A pty works inside the namespace.
+- **Haskell:**
+  - `ChatClient.hs` has no export list and imports only library modules plus `ChatTests.DBUtils` and `NameResolver`, so the plan's `other-modules` is complete.
+  - `smpServerCfg` writes no shared files (stats and Prometheus intervals are `Nothing`).
+  - `NameResolver` binds a free ephemeral port.
+  - The SMP server saves its store in `finally stopServer`, so `cancel` waits for it. It binds `[::]` with `ReuseAddr` and installs a SIGINT handler.
+  - `USEDuplicateServer` compares hosts within one protocol only.
+  - The v7.0.3 assets publish SHA-256 digests, and v7.0.3 has `--mute` and `--user-display-name`.
+- **Port slots:** 108 concrete test classes fit under k < 120 in one run, provided slots are taken lazily and the counter is reset each run. Per-slot lock files would remove that dependency.
+
+My experiments are in `/tmp/claude-1000/r4feas` (`glock/`, `t.sh`, `t2.sh`, `mc.py`, `src/`).
\ No newline at end of file
diff --git a/plans/ui-tests/catalogue/verify/r4-plan-claims.md b/plans/ui-tests/catalogue/verify/r4-plan-claims.md
new file mode 100644
index 0000000000..d08d0d854e
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/r4-plan-claims.md
@@ -0,0 +1,103 @@
+**Not CLEAN.** I found 15 wrong claims. Only the first one would actually stop a run. Five more would lead an implementer to the wrong code or to tests that can't be written as specified. The rest are small corrections. All checks were made against `/home/user/wt-uitest-ref` (d72f68e6d), with simplexmq at ee66dd68 from `~/repos/simplexmq`. I re-checked the main findings myself.
+
+1. **Gradle cache locks block the inside run (plan line 323).**
+   - Quote: "`./gradlew --stop` (an outside daemon can't be asked to release `~/.gradle` locks from inside), then `./gradlew :desktop:cmakeBuildAndCopy :common:desktopTestClasses :common:uitestPrepare`"
+   - Actual: the daemon is on by default (`apps/multiplatform/gradle.properties` has no `org.gradle.daemon=false`, and there is no `~/.gradle/gradle.properties`). The second command starts a new daemon, which stays idle and keeps holding the `~/.gradle` cache locks. As the plan itself says, that daemon can't be reached from inside the namespace.
+   - Failure: the `--offline` pass inside fails with "Timeout waiting to lock … in use by another Gradle instance".
+   - Fix: "`./gradlew --no-daemon :desktop:cmakeBuildAndCopy :common:desktopTestClasses :common:uitestPrepare`, then `./gradlew --stop` (an outside daemon can't be asked to release `~/.gradle` locks from inside, so none may be left running)"
+
+2. **Drag and drop can't be driven through `onFilesAttached` (line 728).**
+   - Quote: "Drag and drop is driven by calling the compose state's `onFilesAttached` from the test (no app change)."
+   - Actual: `onFilesAttached` is an extension on `MutableState<ComposeState>` (ComposeView.kt:290). The only such state is a local in ChatView: `val composeState = rememberSaveable(...)` (ChatView.kt:148). No singleton holds it. The drop arrives through `desktopOnExternalDrag` (ChatView.kt:979-987).
+   - Failure: the test has nothing to call it on, so the dropped-.webm (AV) rows can't be written.
+   - Fix: "Dropped files are attached through the same `onFilesAttached` path by a Ctrl+V of a file list from the in-memory clipboard (PlatformTextField.desktop.kt:144-145 → ComposeView.kt:1516); the drop target itself (`desktopOnExternalDrag`, ChatView.kt:979-987) is not exercised. No app change."
+
+3. **`openFile` has no callers (lines 446, 735, 774).**
+   - Quote: "`openFile`, D/platform/Share.desktop.kt:49, called e.g. at CIImageView.kt:154"
+   - Actual: `openFile` appears only in its declarations (Share.kt:11, Share.desktop.kt:46, Share.android.kt:116). CIImageView.kt:154 is `imageView(previewBitmap, onClick = onClick)`. The only OS-open path the UI uses is `desktopOpenDir`, via `desktopOpenDatabaseDir` (Files.desktop.kt:33, DatabaseView.kt:243, DatabaseErrorView.kt:330).
+   - Failure: the open question proposes a seam for dead code, and any catalogue row IGNOREd for `openFile` describes a feature the app doesn't have.
+   - Fix for line 774: "Opening a folder in the OS (`desktopOpenDir`, D/platform/Files.desktop.kt:37-43, reached from the database-folder button via `desktopOpenDatabaseDir`, Files.desktop.kt:33, DatabaseView.kt:243, DatabaseErrorView.kt:330) can't be observed headless. `openFile` (Share.desktop.kt:46) has no callers. A fourth seam (an `internal var` folder opener) would make those rows testable; until it is approved they stay `IGNORE`."
+   - Lines 446 and 735 should name only `desktopOpenDir`, and the catalogue rows ignored for `openFile` need re-checking.
+
+4. **Peer received files don't stay in the peer's directory (line 471).**
+   - Quote: "received files go to `$HOME/Downloads`, Files.hs:31"
+   - Actual: Files.hs:30-31 is `dir <- (`combine` "Downloads") <$> getHomeDirectory; ifM (doesDirectoryExist dir) (pure dir) getChatTempDirectory`.
+   - Failure: a fresh `HOME` has no `Downloads`, so every peer writes received files to the shared system temp directory.
+   - Fix: "`HOME=<jvmDir>/peers/<name>` with `$HOME/Downloads` created before start (received files go there only if it exists, otherwise to the system temp directory, Files.hs:29-31; …)"
+
+5. **`-s` turns the names role on after a restart (line 480).**
+   - Quote: "the names server role, which `-s` doesn't enable (Operators.hs:189-193)"
+   - Actual: that holds only on first start. On later starts, Chat.hs:302-304 replaces each user's servers with `presetServerCfg True allRoles Nothing`, and `allRoles = ServerRoles True True True` (simplexmq Agent/Env/SQLite.hs:117).
+   - Failure: after a PEERCTL `stop()/start()` or a relay `-e` restart, a peer in a non-NAMES test can resolve names.
+   - Fix: "…which `-s` doesn't enable on the first start (Operators.hs:186-190); on later starts `-s` overrides the servers with all roles, names included (Chat.hs:302-304)…"
+
+6. **TTL command names are swapped against their line numbers (line 712).**
+   - Quote: "(`APISetChatItemTTL`/`APISetChatTTL`, Library/Commands.hs:1853/1891)"
+   - Actual: `APISetChatTTL` is at Commands.hs:1842 and `APISetChatItemTTL` at :1884.
+   - Fix: "(`APISetChatTTL`/`APISetChatItemTTL`, Library/Commands.hs:1842/1884)"
+
+7. **Names.hs:39 doesn't type a command (line 480).**
+   - Quote: "the harness types `/_servers 1 <json>` for them, as tests/ChatTests/Names.hs:39 does"
+   - Actual: Names.hs:39 is `mapM_ enableNamesRole [alice, bob]`. That helper (ChatClient.hs:488-505) calls the API in-process. The typed approach still works for a pty peer.
+   - Fix: "…the harness types `/_servers 1` and then `/_servers 1 <json>` with names enabled, as `enableNamesRole` (tests/ChatClient.hs:488-505, used at Names.hs:39) does in-process."
+
+8. **`BadgesPayView` does have a caller (line 661).**
+   - Quote: "composables with no caller (e.g. `BadgesPayView`)"
+   - Actual: it is called at BadgesYourLevelView.kt:149. That screen is only opened from `ChooseLevelButton` (BadgesSupportSimplexView.kt:77), which has no caller.
+   - Fix: "composables not reachable from the UI (`BadgesYourLevelView` and `BadgesPayView`, behind the uncalled `ChooseLevelButton`, BadgesSupportSimplexView.kt:77)"
+   - This also means the keys at §3.4 line 184 (BadgesYourLevelView.kt:125, BadgesPayView.kt:148) can't be tested.
+
+9. **CallSettings.kt:131 is not `SharedPreferenceRadioButton` (line 137).**
+   - Actual: :131 is a second `SharedPreferenceToggleWithIcon` overload. Only :155 is `SharedPreferenceRadioButton`, which has no callers.
+   - Failure: keying only one overload leaves one call site unkeyed.
+   - Fix: "`SharedPreferenceToggle`, `SharedPreferenceToggleWithIcon` (2 overloads) | C/views/usersettings/CallSettings.kt:85/101/131 | 1 / 2 | param on both overloads (`SharedPreferenceRadioButton` :155 has no call sites)"
+
+10. **Wrong site count for `ExposedDropDownSettingWithIcon` (line 139).**
+    - Quote: "30 + 5"
+    - Actual: it has one call site, CallView.android.kt:361, which is Android-only.
+    - Fix: "30 + 1 (Android only, CallView.android.kt:361)"
+
+11. **Two cited notification lines are dead code (line 443).**
+    - Quote: "D/model/NtfManager.desktop.kt:123/168-185"
+    - Actual: lines 168-185 are only reached from the uncalled private `displayNotification(title, text, icon)` at :162. The real path is :97-112 → `displayNotificationViaLib` :114-148.
+    - Fix: "D/model/NtfManager.desktop.kt:97-148 (`displayNotification` → `displayNotificationViaLib`, `Toast.builder()` :123)"
+
+12. **`initChatController` doesn't wait (line 363).**
+    - Quote: "waits for ctrlInitInProgress"
+    - Actual: Core.kt:73 is `if (chatModel.ctrlInitInProgress.value) return`, so it returns at once and does nothing. `stopAndCloseCore` already waits, so nothing breaks today.
+    - Fix: "returns immediately without initialising if an init is in progress (Core.kt:73), so `stopAndCloseCore` must have waited first"
+
+13. **The `chatStopped` restore step in restart does nothing (line 396).**
+    - Quote: "raw `apiStopChat` … and restore `chatStopped` to its previous value"
+    - Actual: `apiStopChat` (SimpleXAPI.kt:1093-1097) doesn't touch `chatStopped`. It also leaves `chatRunning == true`. That is harmless only because `setChatCtrl(new)` restarts the still-running receiver (SimpleXAPI.kt:550-555).
+    - Fix: "raw `apiStopChat` (it leaves `chatStopped` unchanged, unlike `stopChatAsync`, Core.kt:61-62), then set `chatModel.chatRunning` to `false`"
+
+14. **The cabal stanza is missing `StrictData` (lines 497-500).**
+    - Actual: the test-suite sets `default-extensions: StrictData` (simplex-chat.cabal:780-781). Without it `ChatClient` still builds, but its records are lazy, unlike in the Haskell tests.
+    - Fix: add "`default-extensions: StrictData` (as in the test-suite)".
+
+15. **Two of the cited loops are delay loops, not animations (line 254).**
+    - Actual: TextItemView.kt:176-183 and ChatView.kt:1264-1268 are `delay(250)` loops. Only SendMsgView.kt:534-544 is an animation. The conclusion stands either way.
+    - Fix: "…nor the finite animations restarted in a loop (SendMsgView.kt:534-544) and the `delay` loops (TextItemView.kt:176-183, the call timer ChatView.kt:1264-1268)"
+
+**Verified correct (sections 3–8 and 11, within ±3 lines):**
+- **Keys and helpers (§3):** every helper and entity-key line, the signature claims, and the site counts apart from #9–#10.
+- **Semantics and sync (§4–6):** the semantics and ad-hoc site lines, `sendCmd`, `startReceiver`, the `log = false` polls and badge redemption, and the `withBGApi`/`withApi`/`withLongRunningApi` lines. Decompiling `SkikoComposeUiTest` 1.8.2 confirms that `waitForIdle` with `autoAdvance = false` ignores idling resources and animations, and that `setContent` can be called again.
+- **Gradle (§7.1):** line 149, the compose 1.8.2 artifacts, the `uiTestJUnit4` accessor, the error-level `ExperimentalTestApi` opt-in, the pty4j 0.13.13 pin (0.14 needs stdlib 2.4), the `chat.simplex.app` exclude being safe, `cmakeBuildAndCopy`, and the `client_library` flag.
+- **Directories:** `dataDir`, `configPath` and `tmpDir` come from `user.home`/XDG and `java.io.tmpdir/simplex`.
+- **Boot, reset and restart (§7.2/7.3):**
+  - Steps match `initHaskell`/`initHS`/`runMigrations`/`ntfManager`/`windowState`.
+  - On a fresh DB, `useDatabaseKey` gives a random key, then `startChatWithoutUser` → create user → `startChat`.
+  - The `deleteStorageAndRestart` order matches, and `stopChatAsync` sets `chatStopped`.
+  - Self-destruct: chatCtrl `-1` gates init at LocalAuthView.kt:36.
+  - Prefs: `SharedPreference._state`, lazy `appPrefs`, `themeOverridesStore`, and the four prefs `ChatModel` copies once.
+  - Every `clearUiState` target exists.
+  - End modals expand to 388+590+388 = 1366 dp, and the test density is 1.
+- **Driver and surfaces (§7.4–7.6):** list keys, `keyForItem`, Escape backstack, file-text attach, `DialogState` NPE, directories-only save, Ctrl+V headless throw, call link via `LocalUriHandler`, toasts, recorder/player lines, tray and window lines, `SingleInstance`, and `LocalClipboard` used by foundation 1.8.2.
+- **Peers and servers (§8):**
+  - All CLI options and modes, the relay address output, the `--relay-web-*` pairing, and all seven peer output lines in §9.3.
+  - `minRemoteHostVersion`, the `ChatClient.hs` server configs (ports base+1/+2, quota 16, store config, TLS fingerprint), `USEDuplicateServer` comparing host only, no conditions check in `/_servers`, `NameResolver`, the SMP server's SIGINT handler, dual-stack bind, and the missing `embedDir` source.
+  - Remote desktop: `getLocalAddress` and loopback, multicast port 5227, the source-equals-host check, `localhost` not parsed as a link, and the 12 h cutoff with the 30 s/30 min expiry.
+- **§11:** all 13 pre-set prefs, the notice and AppLock functions, the fixture files, the 510 KiB auto-accept limit, the seam lines, and the IGNORE reasons (import catches only `Error`, the channel role limits, `CIGISExpired` never set, the commented-out features).
+
+**Not verified:** the pty crash messages, the version the stable CLI prints, the "replayed signature stripped" mechanism, the ~20-minute inactive-member timing, and that the updated-conditions notice appears only for preset operators.
\ No newline at end of file
diff --git a/plans/ui-tests/catalogue/verify/r4-plan-consistency.md b/plans/ui-tests/catalogue/verify/r4-plan-consistency.md
new file mode 100644
index 0000000000..a186706b96
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/r4-plan-consistency.md
@@ -0,0 +1,101 @@
+I found 18 real problems in the plan and legend, so the result is not CLEAN. Findings 1–3 would make P1 fail or break an approval boundary. Findings 4–11 are rules two implementers would read differently. Findings 12–18 are stale numbers and wording.
+
+**What checks out:** `catcheck.py` and `classmap.py summary` both pass: 1,161 tests, 38 ignored, 72 sections (70 with runnable tests), 82 class bases, at most 29 tests per class, no duplicate names. The class-map rows match the regenerated table exactly. The plan's numbers agree with the four `## Count` tables and the file headers: lines 18, 669–673, 679 (82), 692 (70), 702 (NAMES 15), 703 (RELAY 87), 724–726 (8 / 5 / 1), 752–756 and 778. Every Needs cell uses only legend codes, `S` is never combined with `RELAY`, and every `S` row also has `P`. Every "plan §x.y" reference in the legend and catalogues points to a section that exists and says what is claimed. The three §9.3 test names exist with `P, S` in the classes the map gives them. The §9.3 code matches the §9.1/§9.2 API: method names, return types, `peerVersion`, `@Category(StableCompat::class)`, package names and class names.
+
+## Most severe
+
+**1. `restart()` gives no way to apply a fixture while the core is stopped, but about 25 FIXTURE+RESTART tests need one.**
+- Plan 598: `fun restart()  // RESTART: restartCore() (7.3)`. Plan 396: restartCore runs "`chatCloseStore`; clear in-memory state …; then start", with no hook in between.
+- Legend 51: FIXTURE is "prepared before boot via `app(fixture = …)`, or between `restart()` steps for data the test produced itself (then also `RESTART`)". Plan 711 says the same.
+- Examples: 01:256 "copy her database, exchange messages, restore the copy"; 02:249 "with the core stopped, the GUI database …". Implementers will each invent a different API (`stop()`/`start()`, reflection, copying a live database).
+- **Fix, plan 598:** `fun restart(fixture: ((dbPrefix: String) -> Unit)? = null)   // RESTART: restartCore(fixture) (7.3)`
+- **Fix, plan 396:** after "`chatCloseStore`;" insert "`fixture?.invoke(dbPrefix)` (FIXTURE rows that copy, restore or edit data the test produced);".
+
+**2. The P1 stubs fail P1's own traceability check.**
+- Plan 751: "every catalogue name generated as an `@Ignore("not written")` stub". Plan 682, which applies in non-strict mode: the check fails if "an `IGNORE` name's method lacks `@Ignore`, or its reason differs from the row's".
+- All 38 IGNORE names would fail from day one.
+- **Fix, plan 751:** "every catalogue name generated as a stub in its mapped class: `@Ignore("not written")` for runnable rows, `@Ignore("<the row's IGNORE reason>")` for `IGNORE` rows".
+
+**3. `UiIdle` is new app code, but the plan says no app code is added.**
+- Plan 257: "`UiIdle` … A commonMain object, always on". It hooks `sendCmd` (SimpleXAPI.kt:936-958), `startReceiver` and `withBGApi`/`withApi` (Utils.kt:34-49).
+- That contradicts plan 337 ("No app code is added for the reset"), even though the reset calls `UiIdle.drain()` at 353.
+- It is also missing from plan 720 ("Besides keys and typed semantics (…), the catalogue needs three seams"), from the approved list at 768, and from K0 at 240.
+- **Fix, plan 720:** "Besides keys and typed semantics (which include the `PlatformTextField` key parameter of 3.3 and making `keyForItem` internal) and the `UiIdle` busy tracker of section 6 (hooks in `ChatController.sendCmd`, `startReceiver`, `withBGApi`/`withLongRunningApi`/`withApi`), the catalogue needs three seams."
+- Add `UiIdle.kt` and its hooks to the K0 row. Add a §13 entry marking UiIdle as approved or pending.
+- **Fix, plan 337:** "The reset adds no app code beyond `UiIdle` (6): it uses existing functions, public state and (for a few private fields) reflection from test code."
+
+**4. Starting a fixture that already has a user skips server setup.**
+- Plan 364: `if (chatModel.chatDbStatus.value != DBMigrationResult.OK || chatModel.currentUser.value != null) return  // fixture DB error or fixture user`. That return comes before `TestServers.configure(u)` (369), `setLastVersionDefault` and `clearUiState`.
+- Tests that boot a fixture user and need a reachable server would then use the fixture's own servers, which can't be reached in the namespace:
+  - 01:92, 94, 139, 228 (`P, FIXTURE …`);
+  - 03:131, whose upgrade needs SMP, on a database "created by a pre-short-link CLI release".
+- **Fix, plan 364–366:** `if (chatModel.chatDbStatus.value != DBMigrationResult.OK) return` / `val fixtureUser = chatModel.currentUser.value` / `if (fixtureUser == null && user == null) return` / `val u = fixtureUser ?: runBlocking { chatController.apiCreateActiveUser(null, Profile(user!!, "", null)) }!!`.
+- Then run `configure` for both cases, and call `startChat` only when `fixtureUser == null` (initChatController already started the chat for a fixture user).
+
+## Rules implementers would read differently
+
+**5. The category rule clashes with `Smoke` and `StableCompat`, and the smoke run can't include the traceability check as written.**
+- Plan 683: the check fails if "a method's JUnit categories don't match its Needs". But `Smoke` (688) and `StableCompat` (679) don't come from any Needs code, so a strict equality check fails every Smoke method.
+- Nothing checks that the `<Base>CompatStableTest` subclass exists.
+- Plan 688/692 says the Smoke run includes "the traceability check". With `includeCategories(Smoke)` an uncategorised test is excluded, so it won't run.
+- Plan 331 excludes Multicast from pass 1, so a Smoke test chosen with `MCAST` would never run.
+- **Fix, plan 683:** "a method's Needs-derived categories (method and class annotations) differ from those implied by its row (`RELAY` → `NeedsRelay`, `NAMES` → `NeedsNames`, `FIXTURE` → `NeedsFixture`, `MCAST` → `Multicast`, `SLOW` → `Slow`); `Smoke` and `StableCompat` are not compared; an `S` base lacks `<Base>CompatStableTest` with `@Category(StableCompat::class)` overriding `peerVersion`;"
+- **Fix, plan 688:** append "`CatalogueTraceabilityTest` carries `@Category(Smoke::class)`. A sub-area's Smoke test has no `MCAST`."
+
+**6. The legend names the Compat classes two ways.**
+- Legend 39: "the sub-area's separate `open class <SubArea>CompatTest`, whose subclass `<SubArea>CompatStableTest`".
+- Legend 111 and plan 679 use `<Base>CompatTest`, and the class map has `ChatListRequestsCompatTest`, a base inside sub-area 01 §3 "Chat list".
+- **Fix, legend 39:** "These tests live in their class base's separate `open class <Base>CompatTest` (class map), whose subclass `<Base>CompatStableTest` overrides the peer version;".
+
+**7. It is unclear what exact string an IGNORE reason must be.**
+- Legend 23: "the reason taken from plan §11.3". Plan 682: reason must not differ "from the row's". Plan 757: "`@Ignore` with an 11.3 reason".
+- The cells paraphrase §11.3, and some end with "(plan §11.3)" while others don't. Compare 04:183 "known app bug: the import error alert is never shown (plan §11.3)" with 02:111, which has no suffix.
+- **Fix, legend 23:** "…and the `Needs` cell says `IGNORE: <reason>`; the reason must fall under a plan §11.3 bullet. The `@Ignore` string is the cell text after `IGNORE: `, verbatim, including any parenthetical."
+- **Fix, plan 757:** "…or `@Ignore` with its row's reason".
+
+**8. `relay()` always registers the relay, but relay-settings tests need one that isn't registered.**
+- Plan 595: `fun relay(…): RelayPeer  // headless relay, registered in the GUI's servers`.
+- Plan 479 allows "(or the settings test does it through the UI)", and 04:135 says "the harness does not pre-register this".
+- **Fix, plan 595:** `fun relay(name: String, web: Boolean = false, register: Boolean = true): RelayPeer  // headless relay; registered in the GUI's servers unless register = false (relay-settings tests add it through the UI)`
+
+**9. The runner's two passes break the documented `--tests` usage.**
+- Plan 331: pass 2 runs `-PuiTags=Multicast` "with the user's exclusions and `--tests`". Plan 333 shows usage `scripts/uitest.sh --tests '*OneTimeLink*Test'`.
+- When a `--tests` filter ends up running zero tests, Gradle fails with "No tests found for given includes", because `failOnNoMatchingTests` defaults to true and JUnit 4 category exclusion leaves nothing to count. This is from Gradle's documented behaviour; I did not run it.
+- Likewise, `-PuiTags=Multicast` makes pass 1 empty.
+- **Fix, plan 331:** append "Pass 1 is skipped when the user's `uiTags` is exactly `Multicast`. `desktopUiTest` sets `filter.isFailOnNoMatchingTests = false` when `-PuiPass2` is given, and pass 2 passes it."
+
+**10. §11.1 lacks rows for several Needs codes, and labels the stubs with the wrong code.**
+- No §11 row covers `P`, `S`, `MCAST` or `DT`. `DT` (22 tests) has no setup described anywhere in the plan.
+- The Stubs row (713) says "Used by (Needs code)" is `—`. But `—` is itself a Needs code meaning "nothing beyond the local servers", while those stubs are `FD`, `CB`, `URI`, `NTF` and `TOAST`.
+- **Fix, row 713:** change `—` to "`FD`, `CB`, `URI`, `NTF`, `TOAST`".
+- **Add rows:**
+  - `| CLI peers | `P`, `S` | `CliPeer` (8.1): current build from `dist-uitest`; for `S`, the release binary in `…CompatStableTest` (10.1) |`
+  - `| Multicast | `MCAST` | loopback multicast route (8.3); `Multicast` category, serial second pass (7.1.1) |`
+  - `| Developer tools | `DT` | `appPrefs.developerTools.set(true)` after `app()` (the toggle itself is tested through the UI in 04 §J) |`
+
+**11. The stable CLI tag is described two ways.**
+- Plan 478: "`-PuiStableTags=v7.0.3`, defaulting to the release GitHub marks "Latest"". That is plural and decided at run time.
+- Plan 770 fixes the default at v7.0.3, plan 457 has a single `UiEnv.defaultStableTag`, and plan 679 says "JUnit 4 runs the Compat tests once per peer version".
+- One implementer will query the GitHub API, another will hard-code the tag. With several tags, only one would ever run.
+- **Fix, plan 478:** "The tag is a Gradle property, `-PuiStableTag=<tag>` (one per run), default `v7.0.3` pinned in `build.gradle.kts` and bumped by hand; to test another release, run again with another tag."
+
+## Lower severity
+
+**12. `-PuiFixtureTags` has no default.** Plan 290/711 mention it, but neither gives a default or says how a fixture picks its CLI. 03:131 needs "a pre-short-link CLI release". **Fix, plan 711:** add "`-PuiFixtureTags` defaults to the last release without short-link data (pinned in P1); a fixture gets that CLI's path from `UiEnv.fixtureCli(tag)`."
+
+**13. `SMP` and `SRVCTL` overlap.**
+- Legend 40: `SMP` is "listed only when the test controls it". Legend 48: `SRVCTL` means "stop/start a local server mid-test".
+- The catalogues use both styles: 02:232 has `P, SMP, SRVCTL`; 01:156 has only `SRVCTL`.
+- **Fix, legend 40:** "| `SMP` | local SMP server (always available; never needed in a cell — stopping or starting it is `SRVCTL`) |". Then drop `SMP` from 02:232.
+
+**14. The legend's count rule covers only one plan table.** Legend 201 says only "The plan's §10 table is regenerated". The plan also repeats derived counts at lines 18, 679, 692, 702, 703, 724–726, 752–756 and 778. **Fix:** "The plan's numbers derived from the catalogue (lines 18, §10 table, §10.1, §10.2, §11.1 NAMES/RELAY, §11.2, §12, §14) are regenerated from the four `## Count` tables, the class map and the Needs counts."
+
+**15. Stale counts in 03:302.** It says "2 need a `FIXTURE`", "`SRVCTL` ×1" and "10 need a peer, relay or server stopped". The rows give FIXTURE = 3 (131, 132, 183) and SRVCTL = 2, so the stopped total is 11. **Fix:** "3 need a `FIXTURE`; 11 need a peer, relay or server stopped or restored (`PEERCTL` ×9, `SRVCTL` ×2)".
+
+**16. "One test per sub-area" doesn't match 70.** Plan 688 says Smoke runs "one test per sub-area" (there are 72), while 692 and 752 say 70. Two sub-areas (02 §Y, 04 §N) are all-IGNORE. **Fix, plan 688:** "one test per sub-area with runnable tests (70)".
+
+**17. Plan and catalogue disagree on which notices need a restart.** Plan 715 lists two notices "checked once at first composition (SimpleX Lock notice …; app-update notice …)". Catalogue 01 line 7 lists three, adding `whatsNewVersion`, and its row `whatsNewShownAfterVersionUpgrade` is marked RESTART. **Fix, plan 715:** "(SimpleX Lock notice, App.kt:94-103; app-update notice, desktop Main.kt:79-87; What's New, ChatListView.kt:219-228)".
+
+**18. Two misleading labels.**
+- The 01 §8 heading, "Paste link and connection plans (every link type)", which the class map repeats, contradicts legend 96. That row gives group, channel, relay-address and business plans to 03, with "01: none". **Fix:** retitle it "Paste link and connection plans (contact, invitation, address, bot, name, signature, URI and link-card links)" and regenerate the class map.
+- The plan 59 diagram shows `cli("bob", CliVersion.Stable())` inside a test. Under §10.1, stable peers come only from overriding `peerVersion` in `…CompatStableTest`. Copying the diagram would pin peers to stable even in the current-build class. **Fix:** `uiTest { val alice = app("alice"); val bob = cli("bob") ... }   // peer version from peerVersion (10.1)`.
\ No newline at end of file
diff --git a/plans/ui-tests/catalogue/verify/r45-fixes-progress.md b/plans/ui-tests/catalogue/verify/r45-fixes-progress.md
new file mode 100644
index 0000000000..2df95f5c70
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/r45-fixes-progress.md
@@ -0,0 +1,49 @@
+# r45 fixes progress (reviewer C findings F1-F12, N1-N5; sweep of 03 multi-test rows)
+
+Code: master d72f68e6d (~/wt-uitest-ref).
+
+## Done
+- (verification of all findings against code done; edits below as applied)
+
+- 04:271 F1 done: + "and bob's row is gone" (UserPicker.kt:660-664)
+- 01:46 N2 done: "New in %s" → "New in v7.0.1" (WhatsNewView.kt:946 last entry; v7.1 at :975 is commented out; isInUs :1083-1086)
+- 02:157 N5 done: per-test outcomes, "Selected 1/2", "Nothing selected", (x) restores toolbar + compose (SEL:30-36, CV:298,1170-1176)
+- 03:45 N4 done: "2 contact(s) selected" / Clear → "No contacts selected" (AddGroupMembersView.kt:272-292)
+- 01:121 F3 done; 01:124 F4 done (hide must target the NON-active user: filteredUsers keeps the active user even when hidden, UserProfilesView.kt:305-315)
+- 01:213 F11 done (added distinguishing text: info screen itself has "One-time invitation link" header at ContactConnectionInfoView.kt:134)
+- 01:227 N1 done; 01:270 F5 done; 01:278 F2 done (archive via "Only delete conversation", reconnect for the second)
+- 02:221 F6 done (CV:2594-2716, 3265-3298); 02:230 F7 done (group: "team" → "hey team", H/Groups.hs:499; goToResult closes search CV:1834-1838); 02:166 F8 done (H/Forward.hs:205-227/249-271/273-299); 02:171 F9 done (CIV:470-473)
+- 03:48 F12 done: entry path picks «New member role» = «admin» (AddGroupMembersView.kt:39 default Member, 223-240); role label is lower-case "admin" (strings:1855)
+- 04:132 F10 done. DISAGREE in detail: `json` is prettyPrint=true (SimpleXAPI.kt:6546-6551), so the Log has `"enabled": false` / `"deleted": true` (space after colon), not `"enabled":false`. Added note: both tests need a second saved SMP server (127.0.0.1) since disabling/deleting smp1 blocks save (Operators.hs:543-548); unsaved servers are removed without `deleted` (ProtocolServersView.kt:484-491)
+- 04:63 N3 done (footer texts); 04:182 N3 done ("Database passphrase", DatabaseEncryptionView.kt:120)
+- 02:171 F9: `live` is compose-state live message (CIV:124), so Forward is hidden on every item while a live message is in progress, not only "on a live item"
+
+## Part 2: 03 multi-test rows (70 rows; 30 name every test with "`name`:" -> OK; 40 checked by hand)
+Changed (outcome added, verified in code):
+- 03:30 invalidNameAlertOffersFix (WelcomeView.kt:485-499; AddGroupView.kt:141-145,167)
+- 03:43 searchFiltersContacts (getContactsToAdd AddGroupMembersView.kt:96-111)
+- 03:47 <role> resolved per test (member default :39; observer picked)
+- 03:104 readOnlyForMember (GroupPreferences.kt:241-251,282,314-327)
+- 03:110 readOnlyForNonOwner (MemberAdmission.kt:91-98,117-131)
+- 03:114 acceptedByAdmin + compose enabled (ChatModel.kt:1711-1713)
+- 03:138 preparedShowsWelcomeBeforeJoin (H/Profiles.hs:4611-4628)
+- 03:141 split OpensGroup / ShowsRole (ConnectPlan.kt:645-688)
+- 03:148 joinFromChatListMenu (ChatListNavLinkView.kt:488-510)
+- 03:178 markVerified / clearVerification (VerifyCodeView.kt:67-71,105-106,117; ChatInfoView.kt:1208-1215)
+- 03:191 incognitoMemberSharesIncognitoProfile (H/Groups.hs:5079-5083)
+- 03:192 rejectRequest + acceptIncognito (ComposeContextGroupDirectInvitationActionsView.kt:127-149)
+- 03:200 supportChat_search (MemberSupportChatView.kt:106-108,119-121)
+- 03:201 listSearchAndOpen / markRead / bannerInGroupChat / adminOpensFromMemberInfo (MemberSupportView.kt:99-103,134-145,182-212,277-282; ChatView.kt:1706-1731; GroupMemberInfoView.kt:408-424)
+- 03:219 deleteOwnForEveryone (H/Groups.hs:1466-1469)
+- 03:233 per-test mapping; memberLeftAndRemoved gains the «left» event (merge rule ChatModel.kt:3462-3470)
+- 03:234 guiJoinerReceivesHistory (H/Groups.hs:5992-6028)
+- 03:241 fromChatListMenu (ChatListNavLinkView.kt:475-484)
+- 03:261 listShowsActive -> «active» (ChannelRelaysView.kt:178-193)
+- 03:295 promoteCustomerToAdmin / removeMemberChatWording / deleteChat (GroupMemberInfoView.kt:305-311,968-985; GroupChatInfoView.kt:212-227,822-826)
+OK as is (each test has a distinct outcome, though not prefixed by its name): 03:35, 74, 76, 78, 130, 142, 146, 176, 179, 212, 227, 242, 250, 255, 257, 262, 284, 286, 294, 296; 03:174 OK (parenthetical after the name)
+
+## Checks
+- catcheck: TOTAL 1177 IGN 28, badcells 0 in all four; no row with extra cells (unescaped-| count matches header in 01-04)
+
+## Remaining
+- none
diff --git a/plans/ui-tests/catalogue/verify/r46-multitest-progress.md b/plans/ui-tests/catalogue/verify/r46-multitest-progress.md
new file mode 100644
index 0000000000..6398560790
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/r46-multitest-progress.md
@@ -0,0 +1,26 @@
+# r46 multi-test sweep progress (01, 02, 04)
+
+Code: master d72f68e6d (~/wt-uitest-ref). List recomputed: 120 multi-test rows in 01/02/04 with a test name missing from Verification; 56 already reviewed in r46c (plus 01:121, 01:270 r46c OK; 04:301/302 IGNORE rows). 62 left to check below.
+
+## Done
+- 01:27 01:28 01:30 01:34 01:56 01:59 01:66 01:67 01:71 01:79 01:80 01:88 01:90 01:91 01:97 01:98 01:127 01:130 01:132 01:141 01:145 01:173 01:213 01:223 01:239 01:255 01:261: OK (each test has its own clause)
+- 01:70 fixed: createListFromAddList chip with name; createListWithEmoji chip shows emoji in place of the label icon + Log `/_create tag` `"emoji": …` (ChatListView.kt:1336-1344; SimpleXAPI.kt:4169)
+- 01:93 fixed: contactWithRequestComposeReject confirm "Reject" -> back to chat list, row gone, CLI silent (ComposeContextContactRequestActionsView.kt:122-131; ChatListNavLinkView.kt:759-771)
+- 01:202 fixed: preparedContactSendRequestAlertAddMessage "Add message" sends nothing (ComposeView.kt:684-689 dismiss only)
+- 01:204 fixed: ChangeProfile -> CLI "alice2: contact is connected"; Incognito -> "<rand>: contact is connected" (ComposeContextProfilePickerView.kt:80-94; H/Profiles.hs:4716-4721,4780-4797)
+- 01:233 fixed: addressDeleteKeepsPendingRequests -> pre-deletion request row stays, Accept -> CLI "alice: contact is connected" (H/Profiles.hs:1853-1862)
+- 01:240 fixed: simplexNameUnsavedChangesAlert "Exit without saving" -> address screen still "Get SimpleX name (BETA)" (SetSimplexNameView.kt:102-121)
+- 01:254 fixed (also WRONG-FACT like r46 F1): Mark verified closes the code screen (VerifyCodeView.kt:40-45), info row "View security code"; ClearVerification in place -> "bob is not verified" (VerifyCodeView.kt:66-72,105-108)
+- 01:129 fixed: editProfileUnsavedChangesAlertSave was "saves and notifies" -> name changed to alice2, "Save and notify contacts" -> CLI "contact alice changed to alice2" (UserProfileView.kt:104,288-293)
+- 02:24 02:41 02:43 02:57 02:69 02:71 02:90 02:112 02:143 02:152 02:167 02:168 02:170 02:222 02:225 02:232: OK
+- 02:44 fixed: linkPreview_firstTimeAlert_enable_fetchesPreview -> "Enable" fetches; compose shows og:title + URL (CMP:479-483; LinkPreviews.kt:168-180)
+- 02:45 fixed: linkPreview_received_rendersCard "renders the card" -> "link preview image" + title/description + URL (LinkPreviews.kt:194-218)
+- 04:63 04:84 04:88 04:99 04:108 04:135 04:141: OK
+- 04:82 fixed: lock_screenOnStartup_correct had only labels -> right passcode + Submit shows "Chats" (LocalAuthView.kt:35-39; AppLock.kt:162-163; App.kt:210-224)
+- 04:149 fixed: "Log /_network with smpProxyMode" could not fail (encodeDefaults=true, SimpleXAPI.kt:6546-6551) -> "Never" => `"smpProxyMode": "never"`, Pref NetworkSMPProxyMode=Never, "Allow downgrade" disabled (AdvancedNetworkSettings.kt:235); "No" => `"smpProxyFallback": "prohibit"`, Pref NetworkSMPProxyFallback=Prohibit (SimpleXAPI.kt:364-366,3881-3882,5356-5375)
+
+## Checks
+- catcheck: TOTAL 1177 IGN 28, badcells 0 in all four; cell counts match headers in 01, 02, 04
+
+## Remaining
+- none
diff --git a/plans/ui-tests/catalogue/verify/r49-fixes-progress.md b/plans/ui-tests/catalogue/verify/r49-fixes-progress.md
new file mode 100644
index 0000000000..5d36fba6fe
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/r49-fixes-progress.md
@@ -0,0 +1,15 @@
+# r49 fixes progress (code: ~/wt-uitest-ref d72f68e6d)
+
+All 9 items verified against code before editing; edits pending.
+
+## Done (all 11 edits applied; catcheck TOTAL 1177 IGN 28, 0 bad cells)
+- 02:283 contextMenu_itemsMatrix_byItemType: done. "Expected item set…" → per-type labels: sent text Reply/Share/Copy/Edit/Forward/Info/Delete/Select; received text same minus Edit; file offer (test.pdf, not received) Reply/Download/Info/Delete/Select; marked deleted (`\ @alice hi`) Reveal/Info/Delete/Select (CIV:557-568,698-700); merged feature row Expand/Delete/Select; single profile-update event (`/p bob Bobby`) Delete/Select; call item Delete/Select (CIV:600-603,376-384); deleted content via #club full-delete moderation (`\\ #club @alice hi`) Info/Delete/Select. Note: no direct-chat path yields deleted content (full delete removes the row), so that case uses bob's #club.
+- 03:157 memberList_rolesAndStatuses: done. "Role/status text, «blocked»" → setup (alice creates #team, bob admin, cath member) + «you: creator»/«owner», «connected»/«admin», cath no role text, «blocked» after block-for-me (GCIV:772,1102-1107,1151; ChatModel.kt:2857; /ms team H/Groups.hs:437-442).
+- 03:259 channel_broadcastFile (NIT): done. → `#team> sends file <name> (<size> / <bytes> bytes) [>>]`, `use /fr <n> … to receive it [>>]` (elided `|` per 02:90 convention; H/Groups.hs:12215-12216; View.hs:2508,2513).
+- 04:140 chatRelays_toggleUseAndDelete: done. → switch "Use for new channels" under "Use relay" header; row disabled after back (ChatRelayView.kt:331,337-341); Log `/_servers` enabled false after "Save servers"; "Delete relay" closes with no alert, row gone (OperatorView.kt:150-153; ProtocolServersView.kt:93).
+- 04:193 dbEncrypt_footerStates: done. → four strings per state (random stored :69-72; own stored :73-74; not stored :79-81; toggle on not yet stored :76-77); unencrypted delegated to 04:194.
+- 04:281 linkMobile_onboardingLinkAMobile (NIT): done. "Pairing works…" → passphrase step first (SimpleXInfo.desktop.kt:19) then onboarding closes, stage OnboardingComplete (LinkAMobileView.kt:77-83; ConnectMobileView.kt:335-339).
+- 01:174 planOwnInvitationConnectToYourself: done. + "Use current profile" (ConnectPlan.kt:470-476) → dismiss "Connection request sent!" (:417-433).
+- 01:180 planAddressFullLinkConnectAlert: done. inserted "Use current profile" between the two alerts.
+- 01:90 / 01:175 / 01:182 (NIT): done. Trigger now names first paste → "Use current profile" → dismiss "Connection request sent!".
+- Needs codes: unchanged everywhere. Skipped: none.
diff --git a/plans/ui-tests/catalogue/verify/sweep-rows-progress.md b/plans/ui-tests/catalogue/verify/sweep-rows-progress.md
new file mode 100644
index 0000000000..a72fecda73
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/sweep-rows-progress.md
@@ -0,0 +1,23 @@
+# Sweep rows insertion (D1–D9 from uncited-files-sweep.md) — progress
+
+Code: ~/wt-uitest-ref (master d72f68e6d), read-only.
+
+## Done
+
+- D1 → 02 §A after `toolbarCall_audio_opensCallLink`: `callStart_browserUnavailable_showsAlertAndEnds`. Re-verified (CallView.desktop.kt:153-171, CallManager.kt:75-97, strings 1291-1292). Fixed citation: `APIEndCall`/`withCurrentCall` → `Library/Commands.hs:1579-1583, 4232-4240` (throws `CENoCurrentCall`). Note says the throwing mode is a harness option of the recording `LocalUriHandler` (plan §7.6); plan §7.6 row got the clause.
+- D2 → 02 §I after `edit_imageCaption_updates`: `edit_ownImage_previewWithoutCancel`, `edit_ownFile_previewWithoutCancel`. Re-verified (CMP:123-136, 264-278, 1207-1223; View.hs:2358-2362, 3066-3067). Made the new texts concrete ("hello" / "new doc") and both CLI lines explicit.
+- D3 → 02 §E after `voice_playback_playPauseProgress`: `voice_preview_playPauseAndSeek`. Re-verified; fixed ComposeVoiceView citations (:106-134; `icon_descr_file` at :65).
+- D4 → 02 §U after `featureItem_contactChangesPref_shown`: `featureItems_merged_iconRowExpandHide`. Re-verified (five items from `createFeatureEnabledItems_` on every connection path; texts via `featureText`/`timeText(null)` = "off"; ChatItemsMerger groups consecutive same category). Note updated to point at the fixed row.
+- D5 → 01 §8 after `planViaChatItemLinkCard`: `linkCardInMessageShowsNameAndSignedInfoLine`. Re-verified; added `APIShareMyAddress` (Commands.hs:1247-1259: text = link) and the CLI line as `bob <# …`.
+- D6 → 02 §U after `invalidJson_item_rendered`: `legacyDeletedItem_rendered`. Re-verified (CIV:588-598, 705-706; CIContent.hs:145-146, 591, 748; tag "sndDeleted" at :784).
+- D7 → 02 §L after `forward_notOffered_forDeletedOrLive`: `forward_destinationProhibitsContent_alert`. Re-verified; added the wait for the image to load ("Forward" is offered only for a loaded file, CIV:471, ChatModel.kt:4610-4614).
+- D8 → 04 §C after `lock_passcodeKeyboardKeys`: `lock_passcodeKeypad_digitsBackspaceClearReveal`. Re-verified; fixed "Save" disabled citation PasscodeView.kt:82 → :81.
+- D9 → 01 §7 after `oneTimeLinkUsedNoAlert`: `oneTimeLinkQrClickSavesPng`. Re-verified (QRCode.kt:89-99, Utils.desktop.kt:239-252, Share.desktop.kt:25-43 / Files.desktop.kt:77-81, NewChatView.kt:76-96, 498, 510).
+- Fixed 02 `featureItem_contactChangesPref_shown`: `/set voice @alice no` gives "Voice messages: off" (`prefEnabled`, Preferences.hs:1147-1153), which joins the connection's merged feature row; the test now right-clicks → "Expand" first; note states no message is sent in between.
+- Recount: 01 350→352, 02 274→281, 04 232 (was 231); total 1,167→1,177 (28 ignored, runnable 1,149). Class map: 8 rows synced; max class 29, no class over 30.
+- Prose tallies: 02 "Seam use" REC 8→9, AV 8→9 (added `voice_preview_playPauseAndSeek`). 03 "By Needs" unchanged (no 03 rows changed).
+- Plan numbers: Summary 1,177; §7.7 1,149 runnable / 1,185 runs / 1,200–2,370 images; §10 table 352 / 281 / 232 / 1,177; §11.2 REC 9, AV 9; §12 P3 352, P4 281, P6 232; §14 1,177. Unchanged: 82 classes, 71 smoke, NAMES 13, RELAY 90, IMGCB 1, S 36.
+
+## Remaining
+
+(none)
diff --git a/plans/ui-tests/catalogue/verify/uncited-files-sweep.md b/plans/ui-tests/catalogue/verify/uncited-files-sweep.md
new file mode 100644
index 0000000000..3a0f7fa68f
--- /dev/null
+++ b/plans/ui-tests/catalogue/verify/uncited-files-sweep.md
@@ -0,0 +1,173 @@
+# Uncited desktop UI files: coverage sweep
+
+Report only; no catalogue edits. Code: ~/wt-uitest-ref (master d72f68e6d). Paths `C/` = commonMain `chat/simplex/common/`, `D/` = desktopMain.
+
+## Remaining
+
+(none: all 21 files classified; drafted rows below)
+
+## Results
+
+Class key: **(a)** covered indirectly, **(b)** desktop-unreachable / Android-only, **(c)** out of reach in-process (§11.3), **(d)** real gap (rows drafted at the end, §Drafted rows).
+
+### call/CallView.kt — (a) + (c), plus one adjacent gap (D1)
+- `expect fun ActiveCallView()` (CallView.kt:11) is rendered on desktop by `App.kt:226-238` when `chatModel.showCallView` is true and the platform is not Android (`App.kt:236`). The desktop actual (`D/views/call/CallView.desktop.kt:32-136`) starts the local call server and opens the call page through `LocalUriHandler` (`WebRTCController`, CallView.desktop.kt:153-171).
+- Reached by 02:30 `toolbarCall_audio_opensCallLink` (outgoing: the URI stub records the call link) and 02:256 `callAlert_incoming_acceptRejectIgnore` ("Accept" opens the call view, link recorded; it cites CallView.desktop.kt:158-167).
+- `activeCallWaitDeliveryReceipt` (CallView.kt:13-28) runs only from the `WCallResponse.Capabilities` branch (CallView.desktop.kt:40-46), which the browser page sends; the stub doesn't run the page → (c) "Real WebRTC calls", already the IGNORE row 02:279 `call_webrtcSession_connects`.
+- Adjacent gap (in the desktop actual, not in CallView.kt): when `uriHandler.openUri` throws, the app shows "Error opening browser" / "The default web browser is required for calls. …" (`unable_to_open_browser_title/desc`, strings.xml:1291-1292) and ends the call (CallView.desktop.kt:161-170). No row asserts it. Drafted as **D1**; it needs the URI stub to be able to throw (a harness option, not a new Needs code).
+
+### chat/ComposeChatLinkView.kt — (a)
+- Rendered by `ComposeView.previewView` for `ComposePreview.ChatLinkPreview` (ComposeView.kt:1202-1206), which is set only from `SharedContent.ChatLink` / `SharedContent.MyAddress` after picking a destination in the share list (ComposeView.kt:1634-1665; set at GroupLinkView.kt:271, GroupChatInfoView.kt:649, UserAddressView.kt:360).
+- Covered by 01:223 `addressShareViaChat` ("bob's chat opens with the address card in the compose preview (`ComposeView.kt:1651-1665`); click send") and 03:257 `channelLink_shareViaChatToContactSigned`, `channelLink_shareViaChatToGroup`, 03:283 `subscriberInfo_shareViaChat`.
+- Not asserted: the preview's (x) (ComposeChatLinkView.kt:47-51 → `NoPreview`, nothing sent). Minor; could be added to `addressShareViaChat`'s verification rather than a new test. Not drafted.
+
+### chat/ComposeFileView.kt — (a), plus an edit-mode gap (D2)
+- Rendered for `ComposePreview.FilePreview` (ComposeView.kt:1219-1223). Covered by 02:88 `attachFile_send_peerReceivesOffer`, `attachFile_withText_peerReceivesTextAndFile`; 02:89 `attachFile_cancelPreview_nothingSent` (clicks "Cancel file preview", `icon_descr_cancel_file_preview`, ComposeFileView.kt:38-45); 02:95-96 `paste_filePathText_attachesFile`, `ctrlV_clipboardFiles_attaches`; 02:233 `draft_withAttachment_restored`.
+- Gap: `cancelEnabled = !editing && !inProgress` (ComposeView.kt:1222). Editing an own file/image message puts the file into the preview via `chatItemPreview` (ComposeView.kt:264-278) with no (x). No row edits alice's own file or image message (02 §I edits text; `edit_imageCaption_updates` is bob's edit). Drafted as **D2** (shared with ComposeImageView).
+
+### chat/ComposeImageView.kt — (a), edit-mode gap shared with D2
+- Rendered for `ComposePreview.MediaPreview` (ComposeView.kt:1207-1211). Covered by 02:90 `attachImage_send_peerReceivesCompressedImage`, `attachImages_multiple_sentAsSeparateMessages`, `attachImage_textOnLastImageOnly`; 02:91 `attachImage_cancelPreview` ("Cancel image preview", ComposeImageView.kt:63-70); 02:92 `attachGif_sentUncompressedAnimated`; the video branch (ComposeImageView.kt:37-52) by 02:93 `attachVideo_send_peerReceivesVideo` (preview frame from the AV seam); 02:98 `ctrlV_clipboardImage_attachesPng`.
+- Edit mode (no (x)) → **D2**.
+
+### chat/ComposeVoiceView.kt — (a), plus a playback gap (D3)
+- Rendered for `ComposePreview.VoicePreview` (ComposeView.kt:1212-1218). Covered by 02 §E (lines 75-76) `voice_record_send_peerReceivesVoice`, `voice_tapToRecord_stopButton_addsPreview`, `voice_preview_cancel_deletesTmpFile` (the (x) at ComposeVoiceView.kt:87-100), 02:79 `voice_disabledWhileRecording_cancels`, 02:82 `voice_notes_recordAndSave`, 02:234 `draft_voiceRecording_finishedOnSwitch`. `RecordingInProgressSlider` (:137-163) is on screen during every REC test.
+- Gap: playing the finished preview before sending — play/pause button enabled only when `finishedRecording` (ComposeVoiceView.kt:53-70, `AudioPlayer.play`/`pause`), the duration text switching to playback progress (:71-84), and seeking on `FinishedRecordingSlider` (:115-134, `AudioPlayer.seekTo`). 02:81 `voice_playback_playPauseProgress` covers playback of a *received* item (CIVoiceView) only. Drafted as **D3**. Note: the play button's content description is "File" (`icon_descr_file`, ComposeVoiceView.kt:66), so K2 needs a key for it.
+
+### chat/item/CIBrokenComposableView.kt — (c)
+- Rendered by `ChatItemViewShortHand` as the `tryOrShowError` fallback (ChatView.kt:1954-1956) only when the item's key is in `failedComposables` (Utils.kt:636-644). Keys are added only by `includeMoreFailedComposables()` from the desktop window exception handler (DesktopApp.kt:42-53), i.e. after a composition crash inside a real `Window` and the restart loop of `showApp()` (DesktopApp.kt:37-40).
+- That is §11.3 "the crash-restart loop and crash alert"; already the IGNORE row 04:301 `window_crashRestartLoop`. No new row. (A unit test could cover `tryOrShowError` by seeding `failedComposables`, but that is not a UI feature path.)
+
+### chat/item/CIChatFeatureView.kt — (a) for single items; gap for the merged icon row (D4)
+- Rendered for Rcv/SndChatFeature, SndChatPreference, Rcv/SndGroupFeature and Rcv*FeatureRejected (ChatItemView.kt:757-788).
+- Single items (`FullFeatureView`, CIChatFeatureView.kt:117-135) are covered by 02:253 `featureItem_contactChangesPref_shown` (cites CIV:757-789), 03:104 `groupPrefs_receivedUpdateShownAsEvent`, 03:31 `createGroup_opensChatAndInviteSheet` ("with its feature items"), 02:70 `timed_chatPref_receivedMessagesDisappear` ("Disappearing messages: 3 sec").
+- Gap: consecutive feature items share `CIMergeCategory.ChatFeature` (ChatModel.kt:3457-3461) and, unless revealed, collapse into one row of feature icons (`mergedFeatures`, CIChatFeatureView.kt:75-92; `FeatureIconView` :104-114, the timed feature shows its TTL text); the item menu then offers "Expand"/"Hide" (ChatItemView.kt:529-541, `expand_verb`/`hide_verb`). Every new contact gets one such run: on connection the core creates a `CIRcvChatFeature` item for each of the five UI features (`createFeatureEnabledItems_`, Library/Internal.hs:3253-3257, called at Library/Subscriber.hs:679; `allChatFeatures`, Types/Preferences.hs:82-91). No row asserts the icon row or expanding it (03:233 `groupEvents_expandCollapsed` covers group *events*, a different category). Drafted as **D4**.
+- Risk for an existing row (not changed here): in 02:253 `featureItem_contactChangesPref_shown`, bob's `/set voice @alice no` adds a feature item; if it directly follows the connection's feature run it is merged into the icon row, and the text "Voice messages: …" is visible only after "Expand". The row should either expand first or put a message between.
+
+### chat/item/CIChatLinkHeader.kt — (a); card contents not asserted (D5)
+- Rendered for `MsgContent.MCChat` items (FramedItemView.kt:402-416); a click runs `planAndConnect` with the owner signature.
+- Reached by 01:193 `planViaChatItemLinkCard` (taps the card in a message; verification "Plan alert"), by the sent items of 01:223 `addressShareViaChat` and 03:257 `channelLink_shareViaChatToContactSigned` / `channelLink_shareViaChatToGroup`.
+- Not asserted anywhere: the card itself — display name, the info line (`MsgChatLink.infoLine`, ChatModel.kt:5111-5121: "Contact address" / "Business address" / "Group link" / "Channel link" / "One-time link", plus " (from owner)" when signed, strings.xml:577-582) and "Tap to open" (strings.xml:576). Drafted as **D5** (one test; it could instead be folded into `planViaChatItemLinkCard`'s verification).
+
+### chat/item/CIEventView.kt — (a)
+- `EventItemView()` (ChatItemView.kt:640-643) renders it for group events, direct connection events and the merged-event text (`mergedGroupEventText`, :605-622).
+- Covered by 03:233 `groupEvents_memberConnectedMerged`, `groupEvents_roleChangeItems`, `groupEvents_memberLeftAndRemoved`, `groupEvents_groupProfileUpdated`, `groupEvents_expandCollapsed` (the row cites "CIEventView"), 02:258 `events_merged_deleteRange`, 02:157 `select_mergedEvents_selectsWholeRange`, 02:260 decryption/sync event rows, 03:112 review rows (pending-review events).
+
+### chat/item/DeletedItemView.kt — (d), low priority (D6)
+- Real caller only `LegacyDeletedItem()` (ChatItemView.kt:588-598) for `CIContent.SndDeleted`/`RcvDeleted` (:705-706); MarkedDeletedItemView.kt:120 is a `@Preview`.
+- The core never creates these contents any more ("legacy - since v4.3.0 item_deleted field is used", Messages/CIContent.hs:145-146; no producer under `src/Simplex/Chat/`), but still decodes them from the database (`DBJCISndDeleted`/`DBJCIRcvDeleted`, CIContent.hs:591-592, `singleFieldJSON`, :748), so pre-4.3 databases render them. Reachable only from a fixture row, like 02:262 `invalidJson_item_rendered`. Drafted as **D6**; drop it if pre-4.3 data is considered out of scope.
+
+### chat/item/EmojiItemView.kt — (a)
+- Rendered for a plain short-emoji `MCText` item with no quote, forward, deletion or live flag (ChatItemView.kt:574-576; `isShortEmoji` EmojiItemView.kt:58).
+- Covered by 02:41 `emojiOnly_rendersLargeEmoji` (cites CIV:575). `EmojiText` is also used by FramedItemView.kt:349-357 (emoji-only text with a quote/forward), reached by 02 §H/§L rows only when their text is an emoji; not separately needed.
+
+### chatlist/ShareListNavLinkView.kt — (a); prohibited destination not asserted (D7)
+- One row per destination in `ShareListView` (ShareListView.kt:214). Reached by every forward and share-via-chat test: 02 §L `forward_contactToContact_peerSeesForwarded`, `forward_contactToGroup`, `forward_toNotes_showsSavedFrom`, … (02:162-168), 01:223 `addressShareViaChat`, 03:257, 03:283 `subscriberInfo_shareViaChat`.
+- Gap: a destination whose preferences prohibit the content (group with "Files and media" off for a file/image, "SimpleX links" off for a message with a SimpleX link, voice prohibited for a voice message) is shown greyed and its click shows "Cannot send message" / "Selected chat preferences prohibit this message." (ShareListNavLinkView.kt:30-58, 70-75; strings.xml:573-574). No row covers it. Drafted as **D7**. (The rows are also disabled while the chat is stopped, :26, 82 — not drafted: the share list can't be opened with the chat stopped in a normal flow.)
+
+### chat/ScanCodeView.kt — (b)
+- Only caller VerifyCodeView.kt:109-115, inside `if (appPlatform.isAndroid)`; the desktop `QRCodeScanner` actual is empty (`D/views/newchat/QRCodeScanner.desktop.kt`). Desktop rows for the same screen assert only "Mark verified"/"Clear verification" (01:251, 03:178); 01:283 lists "Scan code" under "Not on desktop".
+- 05 covers it: 05:165 `verifyCode_androidScanCodeButtonOpensScanner`, 05:166 `qrScan_verifySecurityCode` (IGNORE, no camera).
+
+### localauth/PasswordEntry.kt — (a); on-screen keypad not asserted (D8)
+- `PasscodeEntry` (PasswordEntry.kt:22-37) is the digit display plus keypad of every passcode screen: `PasscodeView.kt:77` (vertical, the only layout on desktop: `PasscodeView.kt:130-131`), used by `LocalAuthView.kt:26` (lock screen) and `SetAppPasscodeView.kt:32` (new / confirm / change / self-destruct passcodes).
+- Rendered by every 04 §C row: 04:76 `lock_enable_setsPasscode`, 04:80 `lock_changePasscode_success`, `lock_changePasscode_wrongCurrent`, 04:81 `lock_disable_requiresPasscode`, 04:82 `lock_screenOnStartup_correct`, `lock_screenOnStartup_wrong_showsUnlock`, 04:87-93 self-destruct rows. Those rows type the digits from the keyboard ("digits + Enter"); 04:86 `lock_passcodeKeyboardKeys` covers only `PasscodeView.handleKeyboard` (PasscodeView.kt:34-62).
+- Gap: the keypad itself — digit buttons (`PasswordDigit`, PasswordEntry.kt:118-136, max 16 digits), clear (x) and backspace (`PasswordEdit`, :59-67), and the click on the masked display that toggles "●" vs digits, grouped by 8 below 8 digits (`PasscodeView`/`splitPassword`, :40-48, :101-104). Drafted as **D8**. The clear and backspace icons have no content description (`Icon(image, null, …)`, :140), and the digits are plain `Text`, so K2 needs keys for them.
+- `VerticalDivider` (PasswordEntry.kt:157-181) is also the pane divider of the desktop layout (App.kt:445, :464; UserPicker.kt:323), on screen in every test.
+
+### newchat/QRCode.kt — (a); click-to-save not covered (D9)
+- `SimpleXCreatedLinkQRCode` / `SimpleXLinkQRCode` / `QRCode` are drawn by: NewChatView.kt:498/510 → 01:151 `createOneTimeLinkShowsLinkAndQr`; ContactConnectionInfoView.kt:137 → 01:209 `pendingInfoInvitedShowsLinkQrShare`; UserAddressView.kt:338/347 → 01:222 `addressQrAndShareAddress`; GroupLinkView.kt:239 → 03:122 `groupLink_createdAutomatically`, 03:123 `groupLink_toggleFullShortLink`, 03:35 `createGroupIncognito_opensGroupLinkStep`; GroupMemberInfoView.kt:578 → 03:184 `memberInfo_memberAddressConnect`; GroupChatInfoView.kt:1276 → 03:283 `subscriberInfo_rows`; VerifyCodeView.kt:75 → 01:251 `contactInfoVerifyCodeMatchesCli`, 03:178; ProtocolServerView.kt:207 → 04:133 `serverView_addToAnotherDeviceQr`; ConnectMobileView.kt:195 → 01:38 `onboardingLinkAMobileShowsQrAndDeviceName`, 04:268 `linkMobile_newPairing_verifyAndConnect`, 04:273, 04:275; MigrateFromDevice.kt:370 → 04:210 (IGNORE). `ImageBitmap.replaceColor` has its desktop actual in `D/views/newchat/QRCode.desktop.kt` and runs on every render.
+- Gap: clicking any QR code (QRCode.kt:89-99): `saveTempImageUncompressed(image, asPng = true)` opens a directories-only save dialog and writes `IMG_<ts>.png` there (`D/views/helpers/Utils.desktop.kt:239-252`; DefaultDialog.desktop.kt:98-101), then `shareFile` opens a second save dialog for a copy (`D/platform/Share.desktop.kt:25-43` → `FileChooserLauncher(false)`, Files.desktop.kt:77-81), and `onShare` marks the 1-time invitation used (NewChatView.kt:498/510 → ChatModel.kt:1249-1251), which suppresses "Keep unused invitation?" on close (NewChatView.kt:76-96). `saveTempImageUncompressed` has no other caller. Plan §7.6 already names this dialog; no row drives it. Drafted as **D9** (in 01 §7; the click is the same on every screen).
+
+### newchat/QRCodeScanner.kt — (b)
+- The desktop actual is empty (`D/views/newchat/QRCodeScanner.desktop.kt`, body `//LALAL`), and every caller is behind `appPlatform.isAndroid`: NewChatView.kt:652-656, MigrateToDevice.kt:206-208, BadgesRedeemCodeView.kt:143-144, ScanCodeView (VerifyCodeView.kt:109), ScanProtocolServer (ProtocolServersView.kt:281), ConnectDesktopView (UserPicker.kt:354).
+- 05 §5 covers it (05:148-150 permission/hidden states; 05:164-171 scan rows, IGNORE "no camera on the test runtime"). Desktop absence is stated at 01:283.
+
+### onboarding/OnboardingLayout.kt — (a)
+- `DesktopOnboardingShell` (OnboardingLayout.kt:131-161) wraps every desktop onboarding stage except LinkAMobile (App.kt:274-292), with a per-stage image; `OnboardingShrinkingLayout` (:39-84) lays out SimpleXInfo.kt:114, YourNetwork.kt:63, ChooseServerOperators.kt:59; `OnboardingImage` (:86) also WelcomeView.kt:254.
+- Covered by 01 §1: 01:27 `onboardingWelcomeShowsDesktopActions`, 01:28 `onboardingCreateProfileValidName` …, 01:30 `onboardingSetDatabasePassphrase`, 01:32 `onboardingYourNetworkShowsSetupRouters`, 01:33 `onboardingChooseOperatorsToggle`, 01:34 `onboardingAcceptConditionsCompletesOnboarding`; and 04 §J `help_aboutSimplex` (SimpleXInfo outside onboarding). The images and shrink layout are visual only (screenshots, plan §7.7); nothing else to assert.
+
+### remote/ConnectDesktopView.kt — (b)
+- Its only entry is the user-picker row "Use from desktop", shown only on Android (UserPicker.kt:354-366); desktop shows "Link a mobile"/"Linked mobiles" instead (:367-370), which is 04 §K.
+- 05 §12 covers it fully (05:315-329, 16 tests), plus 05:169 `qrScan_desktopAddress` (IGNORE). 05:415 notes `showUnlinkDesktopAlert` has no caller.
+
+### SplashView.kt — (a)
+- `SplashView()` (App.kt:156) is the blank surface while `chatDbEncrypted`/`localUserCreated` are still unknown at boot — every test passes through it, and the harness's boot wait (plan §7.2) ends after it. `SplashView(true)` (App.kt:220-223) is the opaque cover behind the passcode while the app is locked.
+- Covered by 04:82 `lock_screenOnStartup_correct`, `lock_screenOnStartup_wrong_showsUnlock` and 04:83 `lock_relocksAfterDelay` (lock screen shown). It has no text or controls.
+- Suggestion (not a new row): the main screen stays composed beneath the cover (App.kt:142-173 runs before the `unauthorized` block), so a semantics query still finds the chat list while locked. If a lock row should prove that content is hidden, it has to use the screenshot (plan §7.7) or a click at a chat row's position that must not open the chat (the `Surface` consumes pointer input), not node absence.
+
+### usersettings/MarkdownHelpView.kt — (a)
+- Only real caller ChatHelpView.kt:72 (section "Markdown in messages"), shown by `HelpView` (HelpView.kt:18-28) from Settings > "How to use it" (SettingsView.kt:159).
+- Covered by 04:247 `help_howToUse` ("Welcome <name>!" + help text). Static text only (`*bold*`, `_italic_`, `~strike~`, `` `a + b` ``, `!1 colored!`, `#secret#`, MarkdownHelpView.kt:24-57). Optionally add these six syntax lines to `help_howToUse`'s verification; no new test.
+
+### usersettings/networkAndServers/ScanProtocolServer.kt — (b)
+- `ScanProtocolServer` is opened only from the "Add server" alert's "Scan server QR code" item, inside `if (appPlatform.isAndroid)` (ProtocolServersView.kt:281-299). The desktop actual (`ScanProtocolServer.desktop.kt:8`) delegates to the layout but has no entry point, and its scanner is the empty desktop `QRCodeScanner`.
+- 04:307 lists "Scan server QR code" as Android-only; 05:153 `scanServer_requestsCameraPermission` and 05:167 `qrScan_serverAddress` (IGNORE) cover it.
+
+## Summary
+
+| Class | Files |
+|---|---|
+| (a) covered indirectly | ComposeChatLinkView, ComposeFileView, ComposeImageView, ComposeVoiceView, CIChatFeatureView, CIChatLinkHeader, CIEventView, EmojiItemView, ShareListNavLinkView, PasswordEntry, QRCode, OnboardingLayout, SplashView, MarkdownHelpView, CallView (ActiveCallView) — 15 |
+| (b) Android-only, covered by 05 | ScanCodeView, QRCodeScanner, ConnectDesktopView, ScanProtocolServer — 4 |
+| (c) out of reach (§11.3, existing IGNORE rows) | CIBrokenComposableView (crash-restart loop, 04:301), CallView's `activeCallWaitDeliveryReceipt` (WebRTC, 02:279) — 1 file + 1 function |
+| (d) real gap with no existing coverage | DeletedItemView (legacy items) — 1 |
+
+Partial gaps inside (a) files: D1–D5, D7–D9. Possible problem in an existing row: 02:253 `featureItem_contactChangesPref_shown` (merged feature items, see CIChatFeatureView).
+
+## Drafted rows
+
+Each row uses its target catalogue's columns and naming style. Names were checked to be unused across 01–05. Recount and class map need regenerating when they are added (`tools/recount.py`, `tools/classmap.py table`).
+
+**D1 → 02 §A (Chat view shell, toolbar, banner), after `toolbarCall_audio_opensCallLink`** (calls are owned by 02)
+
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Toolbar | Call when no browser can be opened | The `LocalUriHandler` stub is set to throw; call icon → "Audio call" | `D/views/call/CallView.desktop.kt:153-171`, `C/views/call/CallManager.kt:75-97`, `C/App.kt:226-238` | `callStart_browserUnavailable_showsAlertAndEnds` | Alert "Error opening browser" / "The default web browser is required for calls. Please configure the default browser in the system, and share more information with the developers." (`unable_to_open_browser_title`/`_desc`, strings.xml:1291-1292); the call ends at once (`endCall` sets `showCallView` false and `activeCall` null, CallManager.kt:81-86), so no outgoing-call waiting state remains under the alert. bob prints nothing: the invitation is sent only from the `Capabilities` response (CallView.desktop.kt:40-46), and `apiEndCall` fails silently with no current call (`withCurrentCall`, `Library/Commands.hs:1579-1584`; `apiEndCall` returns false, `C/model/SimpleXAPI.kt:2160-2163`) | P, URI | Needs a throwing mode in the recording `LocalUriHandler` (harness option, no new code). `endCall` also calls `AppLock.appWasHidden()` (CallManager.kt:82); irrelevant with the lock off |
+
+**D2 → 02 §I (Edit and history), after `edit_imageCaption_updates`**
+
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Edit | Edit the caption of alice's own image or file | alice sends `test.jpg` with the text "hi" ("Image" → dialog), and `test.pdf` with "doc" ("File" → dialog); "Edit" on each → change the text → Enter | CIV:464-469, CMP:123-136, CMP:264-278, CMP:1207-1223, `C/views/chat/ComposeImageView.kt:63-70`, `C/views/chat/ComposeFileView.kt:37-46` | `edit_ownImage_previewWithoutCancel`, `edit_ownFile_previewWithoutCancel` | While editing, the compose area shows the image thumbnail / the file name "test.pdf" with no "Cancel image preview" / "Cancel file preview" button (`cancelEnabled = !editing && !inProgress`, CMP:1210, 1222) and the field holds "hi" / "doc"; after Enter bob prints `bob <# "alice> [edited] hello"` (resp. the new file text) — `ttyFromContactEdited` + `ttyMsgContent` (`src/Simplex/Chat/View.hs:3066-3067`, :2431-2438); the image/file itself is not re-sent | P, XFTP, FD | Voice items are not editable (CIV:464), so ComposeVoiceView never appears in edit mode; MCChat items get no preview while editing (CMP:276) |
+
+**D3 → 02 §E (Voice messages), after `voice_playback_playPauseProgress`**
+
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Record | Play the recorded preview before sending | In notes: "Record voice message" (tap), stop → preview; play, pause, drag the slider | CMP:1212-1218, `C/views/chat/ComposeVoiceView.kt:53-84, 104-134` | `voice_preview_playPauseAndSeek` | While recording the play button is disabled and the duration counts up (`RecordingInProgressSlider`); after stop the button is enabled and shows the total duration; play → pause icon and the text follows playback progress; pause keeps the position; dragging the slider seeks (`AudioPlayer.seekTo`); the item is not sent | REC, AV | The play button's content description is "File" (`icon_descr_file`, ComposeVoiceView.kt:66): K2 key needed. Notes chat avoids a peer (as `voice_notes_recordAndSave`) |
+
+**D4 → 02 §U (Special items), next to `featureItem_contactChangesPref_shown`**
+
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Features | Merged feature items: icon row, Expand, Hide | alice connects with bob; open the chat; right-click the feature row → "Expand", then right-click an item → "Hide" | CIV:529-541, CIV:757-788, `C/views/chat/item/CIChatFeatureView.kt:28-48, 75-114`, `C/model/ChatModel.kt:3453-3461` | `featureItems_merged_iconRowExpandHide` | After connecting, alice's chat shows one row of five feature icons (one `CIRcvChatFeature` per UI feature, `createFeatureEnabledItems_`, `Library/Internal.hs:3253-3257`, `Types/Preferences.hs:82-91`); "Expand" (`expand_verb`) shows five items "Disappearing messages: off", "Delete for everyone: off", "Message reactions: enabled", "Voice messages: enabled", "Audio/video calls: enabled" (`featureText`, ChatModel.kt:4329-4339; defaults `defaultChatPrefs`, Types/Preferences.hs:553-564); "Hide" (`hide_verb`) collapses them back to the icon row | P | The icons have no content description (CIChatFeatureView.kt:105): K2 key needed. A later feature item that directly follows this run joins the row, which affects `featureItem_contactChangesPref_shown` |
+
+**D5 → 01 §8 (Paste link and connection plans), after `planViaChatItemLinkCard`** (the link card is owned by 01)
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Card | Link card contents | CLI `/ad`, then `/share address @alice`; open the chat with bob | `C/views/chat/item/CIChatLinkHeader.kt:18-78`; `C/views/chat/item/FramedItemView.kt:402-416`; `C/model/ChatModel.kt:5111-5121` | `linkCardInMessageShowsNameAndSignedInfoLine` | The received item shows the card: "bob", the info line "Contact address (from owner)" (`chat_link_contact_address` + `chat_link_from_owner`, strings.xml:580-582) and "Tap to open" (strings.xml:576); no text below the card (the message text equals the link). bob printed `@alice contact address of @bob (signed):` and the link (as in `testShareAddressViaChat`, tests/ChatTests/Profiles.hs:3944-3946) | P | Same setup as `planSignedAddressCardVerified`; could instead extend `planViaChatItemLinkCard`'s verification |
+
+**D6 → 02 §U (Special items), after `invalidJson_item_rendered`** (low priority)
+
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Other | Legacy deleted item | alice sends "hi" to bob; between two `restart()` steps alice's row is rewritten: `UPDATE chat_items SET item_content = '{"sndDeleted":{"deleteMode":"broadcast"}}', item_content_tag = 'sndDeleted' WHERE item_text = 'hi'` | CIV:588-598, 705-706; `C/views/chat/item/DeletedItemView.kt:19-43` | `legacyDeletedItem_rendered` | The item shows italic "deleted" (`deleted_description`, strings.xml:49; ChatModel.kt:4261) in a sent bubble with its meta; its menu has only "Info", "Delete" and "Select" | P, RESTART, FIXTURE (legacy deleted item) | The core no longer creates these contents (`Messages/CIContent.hs:145-146`) but still decodes them (`DBJCISndDeleted`, :591, `singleFieldJSON`, :748), so only pre-4.3 databases have them |
+
+**D7 → 02 §L (Forwarding), after `forward_notOffered_forDeletedOrLive`**
+
+| Area | Feature | Trigger | File:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Rules | Destination whose preferences prohibit the content | bob hosts group `team` with alice and runs `/set files #team off`; bob `/img @alice tests/fixtures/test.jpg`; alice: "Forward" on the image → pick "team" | `C/views/chatlist/ShareListView.kt:30-56`; `C/views/chatlist/ShareListNavLinkView.kt:43-58, 70-75` | `forward_destinationProhibitsContent_alert` | "team" is listed but disabled-looking; clicking it shows "Cannot send message" / "Selected chat preferences prohibit this message." (strings.xml:573-574); the group chat doesn't open and no forwarding bar appears; bob prints nothing in `#team` | P, XFTP | After bob's `/set files #team off` (CLI `Files and media: off`, `testProhibitFiles`, tests/ChatTests/Files.hs:1248-1259) alice's group gets a "Files and media: off" feature item; wait for it before forwarding. The same alert covers voice to a contact that prohibits voice and SimpleX links (also "Share via chat" of an address or channel link, which always counts as a SimpleX link, ShareListView.kt:54-56) to a group with "SimpleX links" off |
+
+**D8 → 04 §C (SimpleX Lock), after `lock_passcodeKeyboardKeys`**
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Lock | On-screen keypad | Settings > Your privacy > "SimpleX Lock" > "Enable lock" → "New Passcode": click 1 2 3 4 5, backspace, the dots, clear (x), then 1 2 3 4 → "Save" → "Confirm passcode": 1 2 3 4 → "Confirm" | `C/views/localauth/PasswordEntry.kt:22-48, 50-69, 101-145`; `C/views/localauth/PasscodeView.kt:64-84, 130-131` | `lock_passcodeKeypad_digitsBackspaceClearReveal` | Five clicks show "●●●●●"; backspace leaves "●●●●"; clicking the dots shows "1234" and clicking again masks it; clear (x) empties the field and "Save" is disabled (fewer than 4 digits, PasscodeView.kt:82); after confirming, "Passcode set!" and PerformLA=true as in `lock_enable_setsPasscode` | — | Desktop always uses the vertical keypad (PasscodeView.kt:130-131). Clear and backspace have no content description and digits are plain text: K2 keys needed |
+
+**D9 → 01 §7 (1-time link), after `oneTimeLinkUsedNoAlert`**
+
+| Area | Feature | Entry path | Main file:line | Test case(s) | Verification | Needs | Notes |
+|---|---|---|---|---|---|---|---|
+| Invite | Save the QR code by clicking it | "Create 1-time link" → click the QR code ("QR Code", `image_descr_qr_code`, strings.xml:897) → choose a folder → choose a file for the copy → close the sheet | `C/views/newchat/QRCode.kt:89-99`; `D/views/helpers/Utils.desktop.kt:239-252`; `D/platform/Share.desktop.kt:25-43`; `NewChatView.kt:498,510,76-96` | `oneTimeLinkQrClickSavesPng` | The first save dialog is directories-only; after `respondSave(<dir>)` the folder holds one `IMG_<ts>.png`; a second save dialog awaits and `respondSave(<file>)` writes a copy there; closing the sheet shows no "Keep unused invitation?" alert (`onShare` → `markShowingInvitationUsed`, ChatModel.kt:1249-1251). Optionally decode the PNG with BoofCV (already an app dependency, QRCode.kt) and compare it with `chatModel.showingInvitation`'s short link | FD | The same click exists on every QR code (address, group link, member address, server, Link a mobile); one row covers the code path |
diff --git a/simplex-chat.cabal b/simplex-chat.cabal
index c9a29b3ac8..f1f02a4087 100644
--- a/simplex-chat.cabal
+++ b/simplex-chat.cabal
@@ -34,6 +34,11 @@ flag client_postgres
   manual: True
   default: False
 
+flag uitest
+  description: Build uitest-servers, the local servers of the desktop UI tests
+  manual: True
+  default: False
+
 library
   exposed-modules:
       Simplex.Chat
@@ -676,6 +681,82 @@ executable simplex-directory-service
         bytestring ==0.10.*
       , text >=1.2.4.0 && <1.3
 
+executable uitest-servers
+  if !flag(uitest) || flag(client_library)
+    buildable: False
+  main-is: UITestServers.hs
+  other-modules:
+      ChatClient
+      ChatTests.DBUtils
+      NameResolver
+  if flag(client_postgres)
+    other-modules:
+        ChatTests.DBUtils.Postgres
+    build-depends:
+        postgresql-simple ==0.7.*
+    cpp-options: -DdbPostgres
+  else
+    other-modules:
+        ChatTests.DBUtils.SQLite
+    build-depends:
+        sqlcipher-simple ==0.4.*
+  hs-source-dirs:
+      tests
+  default-extensions:
+      StrictData
+  ghc-options: -threaded
+  build-depends:
+      QuickCheck ==2.14.*
+    , aeson ==2.2.*
+    , ansi-terminal >=0.10 && <0.12
+    , async ==2.2.*
+    , attoparsec ==0.14.*
+    , base >=4.7 && <5
+    , base64-bytestring >=1.0 && <1.3
+    , composition ==1.0.*
+    , containers ==0.6.*
+    , crypton ==0.34.*
+    , deepseq ==1.4.*
+    , directory ==1.3.*
+    , filepath ==1.4.*
+    , generic-random ==1.5.*
+    , http-client ==0.7.*
+    , http-client-tls ==0.3.*
+    , http-types ==0.12.*
+    , ini ==0.4.1
+    , memory ==0.18.*
+    , mtl >=2.3.1 && <3.0
+    , network ==3.1.*
+    , optparse-applicative >=0.15 && <0.17
+    , random >=1.1 && <1.3
+    , scientific ==0.3.*
+    , silently ==1.2.*
+    , simple-logger ==0.1.*
+    , simplex-chat
+    , simplexmq >=6.3
+    , stm ==2.5.*
+    , terminal ==0.2.*
+    , time ==1.12.*
+    , unicode-transforms ==0.4.*
+    , unliftio ==0.2.*
+    , uri-bytestring >=0.3.3.1 && <0.4
+    , wai ==3.2.*
+    , warp ==3.3.*
+  if impl(ghc >= 9.6.2)
+    build-depends:
+        bytestring ==0.11.*
+      , hspec ==2.11.*
+      , process ==1.6.*
+      , text >=2.0.1 && <2.2
+  if impl(ghc < 9.6.2)
+    build-depends:
+        bytestring ==0.10.*
+      , hspec ==2.7.*
+      , hspec-core ==2.7.*
+      , process >=1.6 && <1.6.18
+      , text >=1.2.4.0 && <1.3
+  default-language: Haskell2010
+
 test-suite simplex-chat-test
   if flag(swift)
     cpp-options: -DswiftJSON
diff --git a/tests/UITestServers.hs b/tests/UITestServers.hs
new file mode 100644
index 0000000000..6dde929591
--- /dev/null
+++ b/tests/UITestServers.hs
@@ -0,0 +1,46 @@
+{-# LANGUAGE LambdaCase #-}
+{-# LANGUAGE NamedFieldPuns #-}
+
+module Main (main) where
+
+import ChatClient (persistentServerStoreCfg, smpServerCfg, testServerKeyHash)
+import ChatTests.DBUtils
+import Control.Concurrent.Async (async, cancel)
+import Control.Concurrent.STM
+import qualified Simplex.Messaging.TMap as TM
+import Simplex.Messaging.Server (runSMPServerBlocking)
+import Simplex.Messaging.Server.Env.STM (ServerConfig (..))
+import System.Directory (createDirectoryIfMissing)
+import System.Environment (getArgs)
+import System.Exit (die)
+import System.IO
+
+main :: IO ()
+main = do
+  hSetBuffering stdout LineBuffering
+  (dir, base) <-
+    getArgs >>= \case
+      [d, b] -> pure (d, read b :: Int)
+      _ -> die "usage: uitest-servers <servers dir> <port base>"
+  chatQueryStats <- TM.emptyIO
+  agentQueryStats <- TM.emptyIO
+  let tmpPath = dir <> "/smp1"
+      ps = TestParams {tmpPath, portBase = base, printOutput = False, chatQueryStats, agentQueryStats}
+      cfg =
+        (smpServerCfg ps)
+          { serverStoreCfg = persistentServerStoreCfg tmpPath,
+            serverStatsLogFile = tmpPath <> "/smp-server-stats.daily.log",
+            prometheusMetricsFile = tmpPath <> "/smp-server-metrics.txt"
+          }
+  createDirectoryIfMissing True tmpPath
+  started <- newEmptyTMVarIO
+  server <- async $ runSMPServerBlocking started cfg Nothing
+  ok <- atomically $ takeTMVar started
+  putStrLn $
+    if ok
+      then "ready smp1 smp://" <> testServerKeyHash <> "@localhost:" <> show (base + 1)
+      else "error smp1 did not start"
+  waitForEOF
+  cancel server
+  where
+    waitForEOF = hIsEOF stdin >>= \eof -> if eof then pure () else getLine >> waitForEOF