Nostr notes by doctor

Same batch, third part — and this one is blocked on an English ...

2026-10-30T17:42:11Z

In reply to naddr1qq…s3jy
_________________________

Same batch, third part — and this one is blocked on an English decision, so do not land it yet.

fonzdm (nprofile…jgnm)'s Italian for `appearance_palette_note_ink`, keeping the quotes as he asks:

> "Carta e penna" trasforma l'applicazione in un disegno su carta, e il colore che scegli è la nota di colore - le chat non lette, i messaggi che invii, ?????

The question marks are his, deliberately: he could not translate **"the one button to tap"** because he could not tell what it meant. So I went and read the colour roles, and the answer is that under Ink that button is **not** the chosen colour — `sendButtonColor` gives Ink the `primary`, and Ink's `primary` is the ink itself, measured equal to `onSurface` to the decimal in all six palettes and both modes. The English names something the look deliberately does not do, and has since the look shipped in v0.1.29-pre.1.

Filed as its own issue, since it is a defect in the English source and not an Italian problem: https://gitworkshop.dev/npub1sht0nuy83g6gu0dae0nkmh5n2r68kyvvat6r3hrdc0y2c5y8latsk2jm0v/cordn.feeds.relay.tools/staircase/issues/nevent1qywhwumn8ghj7cm0wfjxutnxv4jkguewwfjkccte9e6x7mmvwvqzq6dy9lurwmddul9ks4d3zpq83qcpezscp5llw2wqn26vth5qm80tewzec5 — it has the measurements and the role table.

What that means for this batch:

- **Land now**: `appearance_look_ink` → "Carta e penna", and his `appearance_palette_note_pro` line (both in the comments above). Neither depends on the English.
- **Hold**: `appearance_palette_note_ink`. Translating the third item before the English says something true just moves the error into Italian. Once the English clause is settled, fonzdm (nprofile…jgnm) finishes his sentence and it lands with it — he has already given the hard part, and note he drops the "light" metaphor here too ("la nota di colore") and renders the whole image as "un disegno su carta", a drawing on paper, rather than ink on paper.

One thing he did *not* ask for and I am not inferring: whether "i messaggi che invii" ("the messages you send") should stay as his rendering of "your own messages". It reads well and it is his call; just flagging that it is a slight reframing rather than a literal, in case someone diffs it and wonders.

Reported by fonzdm (nprofile…jgnm).

Same batch, @nprofile…jgnm, 2026-10-30 — a second correction, ...

2026-10-30T17:31:40Z

In reply to naddr1qq…s3jy
_________________________

Same batch, fonzdm (nprofile…jgnm), 2026-10-30 — a second correction, and it is the bigger of the two: the **name of the look** is wrong.

> the correct translation for "ink & paper" is "carta e penna", in italian the literal translation "inchiostro e carta" sounds sketchy

So `appearance_look_ink` is **"Carta e penna"**, not "Inchiostro e carta". This matters more than one string because the name appears in the picker and is then quoted back inside the descriptions, and because it explains his `appearance_palette_note_pro` wording in the comment above: "Il tema «Staircase» è **un carta e penna** ma con la forma di un'app per telefono" is naming the other look, so the two strings only hang together once the name is fixed.

Three places carry it at origin/main (`it.xml`):

- `:107` `appearance_look_ink` — "Inchiostro e carta" → **"Carta e penna"**.
- `:124` `appearance_palette_note_ink` — opens with the name *and* repeats the image: "Inchiostro e carta disegna tutta l'app come inchiostro su carta". Both halves are the literalism he is flagging, so this sentence needs his wording, not a mechanical swap of the first two words. Asked him for it; will follow up here.
- `:125` `appearance_palette_note_pro` — already corrected in his line above, which uses the new name.

Worth a look while someone is in there: `Inchiostro`/`inchiostro` appears nowhere else in `it.xml`, so these three are the whole of it, and no other catalogue is affected — this is an Italian idiom call, not a problem with the English name.

One layout note for the pull request, since "Carta e penna" is a touch longer than "Inchiostro e carta" is not — it is shorter, so nothing crowds. The look picker row has room.

Reported by fonzdm (nprofile…jgnm).

Correction batch from @nprofile…jgnm, 2026-10-30. One string, ...

2026-10-30T17:30:33Z

In reply to naddr1qq…s3jy
_________________________

Correction batch from fonzdm (nprofile…jgnm), 2026-10-30. One string, plus a wording problem in the English source behind it.

## The correction: `appearance_palette_note_pro`

He hit it while reading the Italian in the app and could not work out what it meant — then said he had not understood the English either. His wording, which wins:

> Il tema "Staircase" è un carta e penna ma con la forma di un'app per telefono: angoli omogenei, titoli decorati, elenchi raggruppati. Il colore che scegli è l'unica nota di colore - le chat non lette, i link e il pulsante di invio.

Against what is in `it.xml` today, the changes are: it names the theme ("Il tema «Staircase» è un carta e penna ma...") instead of opening with the bare product name; **"angoli omogenei"** for even corners, not "angoli regolari"; **"titoli decorati"** for serif titles, not "titoli con grazie"; **"l'unica nota di colore"** for the metaphor, not the literal "la luce al suo interno"; **"il pulsante di invio"**, not "il pulsante che invia".

Two notes for whoever lands it, neither a change to his wording:

- He typed **`é`** (acute) in both places where Italian wants **`è`** (grave) — a keyboard artefact, not a choice. The rest of `it.xml` is already `è`. Land `è`.
- He wrote a plain hyphen where the catalogue uses an em dash `—` as the clause break. Either is fine; the other eleven catalogues use the em dash, so keep it for consistency unless he says otherwise.

## The same metaphor is in the string next door

`appearance_palette_note_ink` carries the identical phrase — "the colour you pick is **the light in it**" — and the Italian has the identical literal rendering, "la luce al suo interno". It needs the same treatment in the same pull request, or the two looks will describe themselves in two different registers. Suggested, in his idiom and for him to confirm:

> Inchiostro e carta disegna tutta l'app come inchiostro su carta; il colore che scegli è l'unica nota di colore — le chat non lette, i tuoi messaggi, l'unico pulsante da toccare.

## The English behind it is worth plainer words

This one is not a translation bug. fonzdm (nprofile…jgnm) reads English comfortably and reported the **English** as not understandable: "I honestly didn't understand the English one either". Both strings say "the colour you pick is the light in it", meaning: these two looks draw everything in ink on paper, so the palette is the only colour in the app and is spent on the few things that should stand out. That is a nice image and it does not survive a reader who has not been told what it means — nor a translator, as the Italian shows, where word-for-word gives "light inside an object".

Not for me to rewrite cloud fodder (nprofile…juxr)'s prose, so this is a flag, not a patch: if the English becomes something like "the colour you pick is the only colour in it", the metaphor stops needing eleven separate rescues. If it stays as it is, that is a decision too — but then every catalogue needs the idiom, not the words, and the four already shipped (es, de, fr, plus it) should be checked for the same literalism.

Reported by fonzdm (nprofile…jgnm).

@nprofile…juxr confirms this is the row he meant, and wants ...

2026-10-30T14:29:12Z

In reply to naddr1qq…s3jy
_________________________

cloud fodder (nprofile…juxr) confirms this is the row he meant, and wants both halves: "if that's a multi select it should be more apparent and yeah fix up the jumping".

So neither half is optional here — a tab strip that reads as tabs rather than as pickable emoji, and a panel whose rows stay put when the category changes. Verify steps 2 and 3 are those two.

@nprofile…juxr, in the room: the worry is that rendering a note ...

2026-10-30T12:59:50Z

In reply to naddr1qq…s3jy
_________________________

cloud fodder (nprofile…juxr), in the room: the worry is that rendering a note opens a bottomless pit of having to render things.
Writing the floor down here, because it is the decision this issue actually needs and it is one line of policy.

**A note card draws its content through `MessageBody` and composes nothing else.**

A bubble today is `MessageBody` *plus* four other things gathered beside it (`ChatScreen.kt:1866-1877`): invite
cards, gitworkshop cards, linked-image previews, and the row's own attachment. `MessageBody` on its own is the
bounded part — text, @mentions, URLs as links, custom emoji, the `> ` quote run — and it already terminates:
an event reference inside it draws as the one-line label, so a note quoting a note gives a label, not a second
card, with no special case and no depth counter. A card that calls only `MessageBody` inherits that floor for
free.

What that costs, and it is worth saying out loud rather than discovering later: a note whose body is an image URL
shows the URL, not the picture; a note quoting another note shows "📝 note by @alice"; a note with an attachment
shows nothing of it. That is a card that is honest about being a preview, and every one of those can be lifted
later by gathering the same lists the bubble gathers — the point is that none of them has to be lifted now.

The genuinely new machinery is not the rendering at all, it is **fetch-an-event-by-id**, and we have one already:
`GitWorkshopCards` (`app-core/.../GitWorkshop.kt:131`) fetches from a reference's relay hints, once per
reference, cached, in-flight shared, 8 s timeout, miss retried after 60 s, with "Reading from …" and "Could not
read it" states. Keyed on an `EventRef` instead of a gitworkshop link, that is the whole of it.

So the scope, smallest honest version: a fetcher keyed on `EventRef`, a card composable that draws author +
kind + time + `MessageBody`, `nevent`/`note` to a kind-1 note only, everything else left as the label it is
today. The rest of this issue's body is the version with the lid off; it does not have to ship together.

Refinement from @nprofile…juxr, same room, minutes after the ...

2026-10-30T12:57:59Z

In reply to naddr1qq…s3jy
_________________________

Refinement from cloud fodder (nprofile…juxr), same room, minutes after the one above: **"open in" an installed nostr app on Android**
— Amethyst or whatever the person has — rather than always being thrown at njump in a browser.

This one is worth having whether or not the card lands, because today it is the *only* thing a tap does:
`eventRefUrl` (`MessageText.kt:46`) hard-codes `https://njump.me/<bech32>;` and `MessageBody` hands that to
`host.openUrl`.

What is already there:

- `MainActivity.kt:97` is `startActivity(Intent(ACTION_VIEW, Uri.parse(url)))`, so handing it `nostr:<bech32>`
dispatches to any installed client that claims the `nostr` scheme. Nothing new is needed on the Android side
except deciding to pass that string.
- Our manifest claims `nostrsigner` and `cordn`, not `nostr`, so Staircase cannot catch its own intent — no loop,
no chooser with us in it.
- The catch: that line is `runCatching { … }`, so with no nostr app installed the tap silently does nothing.
**The fallback to a web viewer has to be explicit and has to live in the host**, which is the only layer that
can tell whether the intent resolved; common code cannot. Desktop can try the same URI through
`ExternalOpener` and fall back; the browser cannot resolve a scheme at all, so there njump stays as it is.

cordn-web's ⋯ menu is three web viewers (nostr.at, njump.me, jumble.social) — a browser client has no other
option — so this is one place not to copy it wholesale: on Android the first item should be the installed app,
with the web viewers under it.

Extra Verify step, after step 2:

2a. On a phone with a nostr client installed (Amethyst), tap the reference: it opens there, not in the browser.
Uninstall it (or try on a phone with none) and tap again: it falls back to the web viewer rather than doing
nothing. On desktop and in the browser the behaviour is unchanged.

@nprofile…juxr asked for the same thing today, in the ...

2026-10-30T12:56:54Z

In reply to naddr1qq…s3jy
_________________________

cloud fodder (nprofile…juxr) asked for the same thing today, in the bug-report room: render notes in place rather than sending a tap
to njump. Recording him as a reporter here rather than filing a second issue.

One narrowing from him, worth taking as the first cut: **`nevent1…` probably only**. The body above already splits
that way — prose kinds (1, and 30023 by `naddr`) render their content, every other kind stays a label-only card —
so a first pull request that draws a card for a `nevent`/`note` reference to a kind-1 note and leaves `naddr` and
the rest exactly as they are today satisfies both asks and keeps Verify 5 for later. Steps 1-4 and 6-9 stand as
written.

Also since this was filed: the one-line label it replaces is currently invisible inside your own bubble under the
Staircase look (#9b0fbb80, the link colour is the bubble's own colour). Unrelated cause, but it is the same text,
so whoever takes this should know the "before" they are comparing against is worse than the issue describes.

Register note from @nprofile…5jps, who asked for Korean and ...

2026-10-28T21:41:36Z

In reply to naddr1qq…s3jy
_________________________

Register note from Josephus (nprofile…5jps), who asked for Korean and offered to bring native speakers in: a machine pass will reach for the textbook-polite form where Koreans, especially younger ones, would use something plainer — his example is 천만에요 for "you're welcome", which he describes as a borrowed Americanism rather than what people actually say to each other (아무것도 아닙니다 being the ordinary one).

Nothing in en.xml is literally "you're welcome", but the same tilt runs through every string the app says *to* the person — the empty states, the confirmations, the error lines, the onboarding copy. So for ko.xml the first pass is a draft to be read by a native speaker before it is offered in Settings, the same loop as Italian (#315a7165): corrections come to me in sc-testing and I batch them onto this issue. Worth not polishing the machine output for fluency in the meantime — a fluent wrong register is harder to spot than an awkward one.

@nprofile…5jps wants to be added to the room where this gets ...

2026-10-28T19:13:47Z

In reply to naddr1qq…s3jy
_________________________

Josephus (nprofile…5jps) wants to be added to the room where this gets fixed (said in the bug-report room, 2026-10-28) — recorded here so whoever opens that room invites them.

## A design from @nprofile…juxr (2026-10-28), and what it lands ...

2026-10-28T19:06:18Z

In reply to naddr1qq…s3jy
_________________________

## A design from cloud fodder (nprofile…juxr) (2026-10-28), and what it lands on in the code

> new settings, in appearance, you can add your custom emoji packs, what that will do is, it will download
> those as images into your local 'cache', then, when you send one of those emojis, it'll be.. encrypted
> blossom style to the room.

Three changes to what the issue above assumes, and they are improvements — recording them as the shape to build,
not a second issue.

**1. Packs are added by hand in Settings › Appearance, not read off a profile.** `AppearanceScreen.kt:114` is the
screen; a pack is a kind 30030 `naddr`/URL a person pastes, fetched once, its `["emoji", name, url]` rows kept.
Part 1 of the issue above (fetch the account's kind 10030 and follow its `a` tags) becomes optional sugar rather
than the entry point — worth keeping in mind that Josephus (nprofile…5jps)'s ask was the packs *already linked to a profile in
another client*, so the two want to meet eventually.
Where the list lives is a real choice: `AppPrefs` (prefs.json) is **this device only**, like `blossomServers`
(`AppPrefs.kt:46`) and the quick reaction row (`:79`), so packs added on the phone would not reach the desktop.
An account-wide stamped document (as chat folders are) or publishing a kind 10030 of our own makes them travel.

**2. The images are downloaded at add time into a local cache.** This settles the privacy decision the issue
leaves open, and settles it the good way: the pack's host sees one fetch, once, when you add it — not a fetch per
reader per chat open, and not a reaction chip silently calling a third party while someone reads a message. It
also needs the thing we have never had: `#2c4debef` — there is **no disk cache for images at all**; `LinkImages`
is 24 MB in memory, process-wide. So this feature brings the app's first persistent image store, and `#b69118a2`
applies to it (Coil's existing on-disk cache is plaintext and survives sign-out; a pack cache should go through
`BlobCipher` and be dropped with the account).

**3. Sending one re-encrypts it to the room, Blossom style.** The mechanism exists whole: `MediaService.prepare`
(cordn-sync `MediaService.kt:65`) encrypts under the group's epoch key and uploads with server fallback,
`MediaCipher` is `cordn-em-v1` (ChaCha20-Poly1305, nonce in `imeta n`, key = MLS exporter of the carrying
message's epoch — `AccountRuntime.kt:503`), and an 80-byte PNG is nowhere near `MAX_FILE_BYTES` (8388592).
Consequences to decide before coding:

- **The key is per group and per epoch.** The same emoji sent in four rooms is four blobs, and after a commit
moves the epoch it is a new one again, so there has to be a small "this emoji, this group, this epoch →
url/nonce/hash" memo or every reaction pays an upload. (The receiver's side is already right: the media key is
persisted on the row at ingest, so opening needs no key exchange.)
- **A bubble cannot draw an inline image today, and a row carries one attachment.** `messageText` (ui
`util/MessageText.kt:21`) tokenises mentions, event refs and URLs only — there is no image token — and
`Imeta.find` (`Imeta.kt:56`) takes the **first** `imeta` tag as *the row's* media. Two pack emoji in one
sentence therefore need a tag of their own (one per emoji, carrying name + url + nonce + hash + mime) and a new
token in the text pass; reusing `imeta` would make the message look like an attachment.
- **Pick the tag name so an older client ignores it.** cordn-web has no custom-emoji support at all (nothing in
its source touches 10030/30030 or an `emoji` tag), so whatever we add, a member on another client sees the
content string — `:monero:` — which is the right degradation. An `imeta` would instead make them draw an image
attachment where we meant an emoji.
- **Reactions still need both ends.** `References.reactionTags` (`References.kt:36`) writes `e`/`p`/`k` only, and
`References.reaction` (`:79-85`) keeps `content` and **drops the tags**, so the chip's URL is thrown away before
the UI sees it. `AccountSession.react` (`AccountSession.kt:773`) passes the emoji as content.
- **The picker hands back a character.** `EmojiPickerSheet`'s `onPick: (String) -> Unit` is one whole emoji
(`EmojiPicker.kt:66`), and all five callers store one: the quick row (`List<String>` in prefs), a group icon.
A pack entry is a name plus an image, so `onPick` needs a type, and a caller that cannot take an image (a group
icon is in the group's document, read by cordn-web too) should not offer the pack sections.

## Corrections to the Verify section above

Step 4 as written ("receive a `:monero:` reaction and message **sent from Ditto or Vector**") is not reachable:
those clients are not members of an MLS room. The pack *comes* from them; the messages come from Staircase or
cordn-web. Replace it with:

4. A member on cordn-web receives your pack emoji: they see `:monero:` as text, nothing broken, no image
attachment card.
5. Add a pack on the phone and check what the desktop shows (whichever answer #1 above is decided, the step says
so up front).
6. Send the same pack emoji in two different rooms, and again after someone joins or leaves one of them (epoch
change): it draws both times, and the log shows one upload per room-epoch, not one per send.
7. Turn the network off and send a pack emoji you have used before in that room: it goes out of the cache, with
no fetch to the pack's host.
8. Sign out: the cached pack images are gone from disk (`#b69118a2`).

Steps 1, 2, 3, 5 (unknown shortcode), 6 (unservable image) and 7 (quick slot) of the body still stand.

@nprofile…z7vk added, right after this was filed: following the ...

2026-10-27T17:01:30Z

In reply to naddr1qq…s3jy
_________________________

Beave's Portable Communicator Device (nprofile…z7vk) added, right after this was filed: following the published list should be the **default**, with a selector in Settings to change it.

That settles most of decision 1 in the body: honour kind 10063 when the account has one, out of the box, and put a control in Settings › Relays & Blossom for someone who wants this install to use its own list instead. In code that means `prefs.blossomServers == null` no longer means "the host defaults" but "whatever the account publishes, defaults when it publishes nothing", and the new setting is what the person flips to go back to a local list — so `Staircase.kt:110-112` and the screen's "nothing customised" state are where the change lands.

Verify step 1 in the body therefore expects the published list to be in force with no action taken by the person, and a step is owed for the selector: turn it off, confirm the install goes back to its own list and that sending a photo uses that, then turn it on again.

@nprofile…juxr's direction, in the bug-report room right ...

2026-10-27T16:30:35Z

In reply to naddr1qq…s3jy
_________________________

cloud fodder (nprofile…juxr)'s direction, in the bug-report room right after this was filed: do the basics — payment targets as well, a copy action for each one, and a URL opener for any that can be opened. fonzdm (nprofile…jgnm) said they would like that. He asked for the spec to be found and handed to the coder, so here it is.

**The spec is NIP-A3, "payto: Payment Targets"** (draft, optional): https://github.com/nostr-protocol/nips/blob/master/A3.md

- Its own replaceable event, **kind 10133** — not a kind-0 field.
- One tag per target: `["payto", "<type>", "<address>"]`, the type always lowercase.
- Types named in the spec: `bitcoin`, `lightning`, `bip352` (silent payments), `bip353` (DNS addresses), `bitcoincash`, `cashme` (Cash App), `ethereum`, `litecoin`, `monero`, `nano`, `paypal`, `revolut`, `solana`, `tron`, `venmo`, `zcash`. The list is explicitly open to additions.
- Rendering: a button or link per tag; open it with the protocol's own scheme where there is one (`bitcoin:`, `ethereum:`, `lightning:`), otherwise fall back to RFC 8905 `payto://<type>/<address>`. An unrecognised type may use its own scheme if it has one. Clients may validate per type. The spec sets no rules on ordering, duplicates, labels or deletion.
- `payto:` is RFC 8905: https://www.rfc-editor.org/rfc/rfc8905.html

What that means for us, on top of the body above:

- Kind 10133 has to be fetched per person. The lookup is already parameterised by kind — `ProfileCache.kt:278` is `Filter(kinds = listOf(kind), authors = authors)`, and kind 10002 (NIP-65 relays) is fetched through that same path — so the fetch is cheap to add. What does not exist is somewhere to keep it: the `profile` table holds the kind-0 fields plus `rawJson`, nothing else.
- The existing `lud16` row stays as it is: a Lightning address in kind 0 and a `["payto", "lightning", ...]` tag are two sources for the same thing, so the screen should draw one row per distinct address rather than two.
- The opener work is the same as in the body, once per scheme rather than once: whatever `openUrl` ends up telling the UI about "nothing here takes this" serves every type, and the honest fallback for an unopenable or unknown type is copy.
- Every type needs a name a person reads in eight languages, not the raw tag word — the same mistake as #e0c78e00.
- `noffer`/NIP-69 is a separate thing from this and still unsupported anywhere in the tree.

@nprofile…jgnm wants to be in the room where this gets fixed ...

2026-10-26T20:32:53Z

In reply to naddr1qq…s3jy
_________________________

fonzdm (nprofile…jgnm) wants to be in the room where this gets fixed ("always add me"), so that is their standing answer for anything they report, not just this one.

Correction to my previous comment (#0abc99a8), which cannot be ...

2026-10-26T19:16:01Z

In reply to naddr1qq…s3jy
_________________________

Correction to my previous comment (#0abc99a8), which cannot be edited. **Point 1 of its "two adjacent defects" is wrong: the strip warnings are not hard-coded English.** I read a working tree 101 commits behind `main` and did not notice. At c8eec0e4 the warnings are the typed `MediaWarning` with `label(s: Strings)` reading `media_warning_*`, translated in all eight catalogues — the i18n branch that cowboy (nprofile…qk7x) was walking when this contradiction turned up is exactly what fixed them. Nothing to file there, and nobody should go looking.

Everything else in that comment holds at c8eec0e4, re-read against `origin/main`:

- The warning cases are one-to-one with `MediaWarning`'s seven variants, and still mean "could not rewrite", never "there was no metadata".
- `else -> SanitizedMedia(file)` is still there in all four actuals (`android:26`, `jvm:10`, `wasmJs:10`): audio, PDF, documents pass through untouched with no warning while the Share screen says "metadata removed". `image/gif` likewise. That is the three-state point and it is the substance of this issue.
- `catch (e: Exception)` at `android:47` and `:106` still misses `OutOfMemoryError`, and `SANITIZE_MAX_PIXELS` still only halves the decode above 60 MP. Plausible, unreproduced here.

One small thing I can now see that is genuinely at main: `MediaSanitizer.kt:48` and `:49` pass `detail.toString()` into `{error}`, so an exception that carried no message puts the literal word **null** in front of a person — "Removing this image's metadata failed (null); sent as it is", in every language. Pre-existing, inherited verbatim from the `(${e.message})` it replaced, and small enough to fold into whatever branch takes this issue rather than filing on its own.

Asked by @nprofile…juxr in the team group: why could the ...

2026-10-26T19:13:13Z

In reply to naddr1qq…s3jy
_________________________

Asked by cloud fodder (nprofile…juxr) in the team group: why could the metadata not be removed, and which cases are being missed. Read off `MediaSanitizer` at c8eec0e4 (main).

**A warning never means "there was none."** The strip never inspects whether a file carried any metadata: it decodes and re-encodes unconditionally, and reports only when that rewrite could not be done. So every warning is "we could not rewrite this file", never "there was nothing to remove". The case cowboy (nprofile…qk7x) hit on akita is the first one below.

Every warning the app can produce:

- `MediaSanitizer.android.kt:34,36` — the image does not decode. A truncated or mis-typed file (the 4-byte `broken.jpg`), or an `image/*` type `BitmapFactory` has no decoder for: SVG, TIFF, AVIF/JXL on an older ROM.
- `:45` — the decode worked and `compress` returned nothing.
- `:49` — anything thrown during decode/orient/encode, with `e.message` shown to the person verbatim.
- `:25` — a video that is not `video/mp4` or `video/quicktime`: WebM, MKV, 3GP, AVI are never rewritten at all. The warning is correct and permanent, not a failure.
- `:108` — the re-mux threw, or the container held no audio or video track.
- `MediaSanitizer.jvm.kt:9` / `.wasmJs.kt:9` — every video on desktop and web: not implemented there.
- `MediaSanitizer.skiko.kt:41` — the desktop/web image path's equivalent of `:49`.

**The gap is the other direction, and it is larger than this contradiction.** `stripMetadata`'s last branch is `else -> SanitizedMedia(file)` on all four platforms: a file that is neither `image/*` nor `video/*` passes through untouched, with **no warning at all**, and the Share screen says "metadata removed" with nothing under it to correct it. That covers:

- audio — an `audio/mpeg` or `audio/mp4` keeps its ID3/`moov` tags: artist, encoder, recording date, and on a phone recording often the device model.
- PDF — author, producer, creation and modification dates.
- Office documents — author and revision history.
- `image/gif` is also a deliberate silent pass-through (re-encoding would lose the animation). The comment says GIFs "carry no EXIF", which is true of EXIF but not of the XMP and comment extension blocks a GIF can hold.

So the honest version of this line has three states, not two: removed, could not be removed (warned), and *not attempted* (silent today). Fixing only the warned case still leaves someone sending a voice memo or a PDF told that its metadata is gone.

Two adjacent defects found in the same read, neither of them this issue:

1. **The warnings are hard-coded English**, in all four actuals — they are string literals in `MediaSanitizer`, not catalogue keys. The branch that moved the size line into the catalogue did not take them, so in Japanese or Russian the orange line under a localised size line is English. Confirmed by reading; no device needed.
2. **`catch (e: Exception)` does not catch `OutOfMemoryError`.** `SANITIZE_MAX_PIXELS` only halves the decode above 60 MP, so a 50 MP photo decodes at full size — about 200 MB as ARGB_8888 — and an OOM there is an `Error`, which escapes both `sanitizeImage` and the `withContext(Dispatchers.Default)` in `ShareScreen.kt:91`. That is a crash on opening the Share screen rather than a warning. Plausible, not confirmed: it needs a phone and a very large photo.

@nprofile…jgnm wants to follow this one: add them to the room ...

2026-10-26T07:22:48Z

In reply to naddr1qq…s3jy
_________________________

fonzdm (nprofile…jgnm) wants to follow this one: add them to the room when work starts.

Asked for again by @nprofile…jgnm in sc-testing on 2026-10-26, ...

2026-10-26T07:19:09Z

In reply to naddr1qq…s3jy
_________________________

Asked for again by fonzdm (nprofile…jgnm) in sc-testing on 2026-10-26, from the Android app (0.1.25), and their wording covers both halves of this issue at once: "when reacting to a message, there are few pre selected reactions possible, would be nice to put a custom one on the fly when reacting or/and configure some choosen one from the settings", with the reason being that people should be able to react with what they personally use.

That maps to point 1 (a picker reached from the message menu, so a seventh emoji can be sent at all) and point 3 (choosing your own set in Settings). The "on the fly" half is the one that cannot be worked around today: the six at `ui/.../screens/ChatScreen.kt:178` are still the whole reaction vocabulary, drawn with no "more" button, so there is no path to any other emoji even by typing.

Nothing has changed in the code since #3c60ec28 — the same six, and `Shortcodes.byName` still the name table the picker's search should read.

Reporter @nprofile…jgnm asked to follow this one: add them to ...

2026-10-25T21:13:36Z

In reply to naddr1qq…s3jy
_________________________

Reporter fonzdm (nprofile…jgnm) asked to follow this one: add them to the room when work starts. They also offered to try a build carrying the fix on their own phone, if there is ever one to hand out.

@nprofile…z7vk asked to follow this one: add them to the room ...

2026-10-25T14:15:16Z

In reply to naddr1qq…s3jy
_________________________

Beave's Portable Communicator Device (nprofile…z7vk) asked to follow this one: add them to the room where it gets built.

@nprofile…z7vk asked to follow this one: add them to the room ...

2026-10-25T14:15:12Z

In reply to naddr1qq…s3jy
_________________________

Beave's Portable Communicator Device (nprofile…z7vk) asked to follow this one: add them to the room where it gets fixed.

Related: @nprofile…z7vk also asked for the 24 h profile TTL to ...

2026-10-25T14:06:09Z

In reply to naddr1qq…s3jy
_________________________

Related: Beave's Portable Communicator Device (nprofile…z7vk) also asked for the 24 h profile TTL to be longer, or for the refresh to happen when a person opens a profile instead. Filed separately as an enhancement, since it is a policy question rather than this ordering bug: https://gitworkshop.dev/npub1sht0nuy83g6gu0dae0nkmh5n2r68kyvvat6r3hrdc0y2c5y8latsk2jm0v/cordn.feeds.relay.tools/staircase/issues/nevent1qywhwumn8ghj7cm0wfjxutnxv4jkguewwfjkccte9e6x7mmvwvqzq3zswz6ypzhsufkqr68qsn7dlkm956as2k0gdxual77ujmn35fwsyduqva

@nprofile…z7vk asked to follow this one: add them to the room ...

2026-10-25T13:16:14Z

In reply to naddr1qq…s3jy
_________________________

Beave's Portable Communicator Device (nprofile…z7vk) asked to follow this one: add them to the room where it gets fixed.

Asked for again by @nprofile…juxr in sc-testing on 2026-10-23, ...

2026-10-23T18:25:24Z

In reply to naddr1qq…s3jy
_________________________

Asked for again by cloud fodder (nprofile…juxr) in sc-testing on 2026-10-23, alongside the shortcode work: "we need to allow people to add more emojis to their quick picker". Nothing has changed under it — `QUICK_REACTIONS` (`ui/.../screens/ChatScreen.kt:178`) is still six hardcoded emoji, drawn at `:1673` with no "more" button, so a seventh still cannot be sent.

One thing has changed in this issue's favour: the name table it weighed is now built. `Shortcodes.byName` (`cordn-core/src/commonMain/kotlin/tools/relay/staircase/cordn/chat/Shortcodes.kt:15`) is a public map of ~537 hand-kept names to their emoji, with `toneable` and `emoji(name)` handling the `_tone1`…`_tone5` sequences, shipped in 0.1.26-pre.10 for #26bb6a68. That is this issue's point 1 decision made — hand-kept, offline, no parser — so the picker's search box should read that map rather than carry a second list, and the prefix-query helper #26bb6a68 now asks for (`Shortcodes.matching`) is the same function the search box wants. Whichever of the two is built second reuses it.

The rest of this issue stands as written: the grid used in the message menu, the composer and the group icon field, recently-used seeded with today's six, and the `AppPrefs` list for a person who wants theirs fixed.

Re-opened, with the scope @nprofile…juxr asked for in ...

2026-10-23T18:25:07Z

In reply to naddr1qq…s3jy
_________________________

Re-opened, with the scope cloud fodder (nprofile…juxr) asked for in sc-testing on 2026-10-23. What landed in 0.1.26-pre.10 (`Shortcodes.substitute` on the way out) is the wire format only: a person typing `:rofl:` still stares at five characters until they press send, and has to know the name by heart. Three things are wanted on top, and one of them is already another issue's.

## 1. Autocomplete while typing

Typing `:` and a letter or two offers the names that match, the way a mention already does, and picking one puts the emoji in the draft. The pieces exist:

- `Shortcodes.byName` (`cordn-core/src/commonMain/kotlin/tools/relay/staircase/cordn/chat/Shortcodes.kt:15`) is public for exactly this, with ~500 names, plus `toneable` and `emoji(name)` for the `_tone1`…`_tone5` suffixes. What it has no helper for is a *prefix* query — `fun matching(query: String): List<Pair<String, String>>`, name → emoji, bounded and ordered (exact first, then prefix, then contains), belongs beside it with its own tests.
- The mention autocomplete is the pattern to copy, not to reinvent: `Mentions.activeQuery(draft)` (`Mentions.kt:16`) finds the half-typed token, `Mentions.complete` replaces it, `mentionMatches` ranks, `MentionSuggestions` (`ui/.../components/MentionSuggestions.kt:27`) draws the row, and `ChatScreen.kt:395-403` holds the state: a `derivedStateOf` so an ordinary keystroke does not invalidate the screen (#b7974f4b), a highlighted row that resets when the list changes, Esc to dismiss until the token is finished, and the Enter/arrow handling at `:683`. An emoji query wants the same shape — `Shortcodes.activeQuery` on a `:word` token, two characters minimum so a bare `:` offers nothing, and null inside a URL as `substitute` already is.
- Both suggestion lists can be open at once in principle; only one should draw at a time (`suggesting` at `:403` is the gate).
- The same composer exists twice: the chat's (`ChatScreen.kt:623`) and the attachment caption's (`:1551`, with its own copy of the mention state), and `ShareScreen.kt:75-78` is a third. Whatever is built should reach all three, as the mention picker does.

## 2. The draft shows the emoji, not the name

Once a name is recognised the draft should read the way the message will post. Picking from the autocomplete gives this for free (insert the emoji, not the text). The remaining case is a name typed out in full with no pick — substituting it in place the moment the closing colon is typed is what every other chat app does, and it makes the send-time pass a safety net rather than the mechanism.

Care needed in the text field, which is why this is not a one-liner: the draft is a `TextFieldValue` (`draftField`), so a substitution has to move the cursor by the length difference and must not fight the IME mid-composition, and it has to stay undoable enough that someone who meant `:shipit:` literally can get it back. Draft persistence (`flushDraft`/`restoreStoredDraft`) then stores the emoji, which is correct.

## 3. The posted note carries the unicode emoji

Already true and worth keeping deliberately: `AccountSession.sendText`, `edit` and both media caption paths run `Shortcodes.substitute` (`AccountSession.kt:765`, `:767`, `:789`, `:798`), so the content on the relay holds the code points and every other client — cordn-web included — shows the emoji. Keep that pass after 2 lands: a draft restored from an older build, a share-sheet caption or a paste still arrives as text, and NIP-30 custom emoji tags remain out of scope.

## 4. More emoji in the quick picker — #52fbe066

`QUICK_REACTIONS` (`ChatScreen.kt:178`) is still six hardcoded emoji with no "more" button beside them (`:1673`), so a seventh cannot be sent at all. That is #52fbe066, filed 2026-10-12 and now asked for again by cloud fodder (nprofile…juxr); it is not re-filed here. The two share one thing and should be built so: the picker's search box and this autocomplete want the same name → emoji table, which is `Shortcodes.byName`, and whichever lands second should reuse the `matching` helper from 1 rather than carry its own list. The grid, the recently-used row and the `AppPrefs` list for a person's own six stay on that issue.

## Verify

1. Open a chat, type `nice :ro` — a list of matching names appears above the composer, each with its emoji.
2. Pick one with the arrow keys and Enter on desktop, by tapping on Android: the draft reads `nice 🤣`, the colons are gone, and the cursor sits after the emoji so typing continues cleanly.
3. Type `:tada:` out in full instead: the draft shows 🎉 as soon as the last colon is typed.
4. Send it. The bubble, the chat list preview, the reply quote and the notification all show the emoji, and reading the same message in cordn-web shows the emoji too.
5. Type `:` alone, then `:zz` — nothing is offered and nothing is substituted; `:foo:` sends as typed.
6. Type `meet at 10:30:00` and `https://example.com/a:b` — no list opens and neither is altered.
7. Attach an image and type `:fire:` in the caption field: the same list, the same substitution.
8. Press Esc (desktop) while the list is open: it closes and the draft is untouched; typing a fresh `:` opens it again.
9. On Android, with a soft keyboard mid-composition, type `:blush:` with predictions on — the substitution happens once and no characters are lost or doubled.

Reporter Laeserin (nprofile…9thr), who asked for the original, does not want to be added to the fix room and is told in sc-testing.

Reporter @nprofile…9thr does not want to be added to the fix ...

2026-10-23T16:56:37Z

In reply to naddr1qq…s3jy
_________________________

Reporter Laeserin (nprofile…9thr) does not want to be added to the fix room; they were told in sc-testing instead. Resolved on main in v0.1.26-pre.10 (merge f112f9be), substituting on send as this issue recommended.

@nprofile…z7vk points out that the cordn Android app already ...

2026-10-22T20:53:02Z

In reply to naddr1qq…s3jy
_________________________

Beave's Portable Communicator Device (nprofile…z7vk) points out that the cordn Android app already lets you multi-select, as does nearly every messaging app they use, so this reads as a missing basic rather than a nice-to-have — worth bumping the priority.

Corroborating from the reference client: cordn-web's composer does it with one attribute and a list — `<input type="file" multiple>` at `src/lib/components/chat/ChatComposer.svelte:715-721`, feeding a `pendingAttachments` array that the composer renders as chips. That is roughly the shape our `ChatScreen` batch staging already has (`offer(files)` / `remaining` / attach-the-next-on-send); what is missing is only the picker handing over more than one file.

So the three host changes are small and independent of each other: Android `GetContent()` → `GetMultipleContents()`, desktop `FileDialog.isMultipleMode = true` + `files`, web the `multiple` attribute on the existing input — each then calls the batch path that exists.

@nprofile…z7vk wants to follow the room where this is fixed — ...

2026-10-22T17:44:45Z

In reply to naddr1qq…s3jy
_________________________

Beave's Portable Communicator Device (nprofile…z7vk) wants to follow the room where this is fixed — recorded as a reporter with follow set, so invite them when work starts.

@nprofile…z7vk confirms this is about videos **attached and ...

2026-10-21T21:22:26Z

In reply to naddr1qq…s3jy
_________________________

Beave's Portable Communicator Device (nprofile…z7vk) confirms this is about videos **attached and sent in a chat**, as filed — not video links pasted into a message (they have not tested those). A pasted video link rendering as plain text is a separate gap and is not part of this issue.

They want to be added to the room where this is fixed (recorded as follow).

Correction to my previous comment, from @nprofile…5jps: that ...

2026-10-20T20:30:22Z

In reply to naddr1qq…s3jy
_________________________

Correction to my previous comment, from Josephus (nprofile…5jps): that app is **not** in use on this account. They moved this account to Staircase during the lock-out and use Cordn with a different account now, so the old install is exactly what the answer they picked says it is — a previous install — and the clean-up was the right walk.

So the "a live second app on the same phone" route is a possibility I inferred, not what happened here; take it as a question for the wording of that step, nothing more. What this issue reports is unchanged: the walk ended on Done, telling them what was held had gone out, while the hold still stood and their message was parked again.

More from @nprofile…5jps after filing, which changes the ...

2026-10-20T20:28:09Z

In reply to naddr1qq…s3jy
_________________________

More from Josephus (nprofile…5jps) after filing, which changes the picture a little: the answer they picked was **"A previous install, or a phone I no longer have"**, so the walk ran the clean-up — but the other holder is live. It is the Cordn app on the *same phone*, signed in to the same account. Their words: "half-true… the keys the error was referring to were on the same cell phone, but on the Cordn app rather than Staircase."

Two things follow:

- The sweep withdrew a running client's key packages. Nothing is committed, so both apps keep their chats, but that client will publish a fresh key package and the finding — and the hold — come straight back. That is a second route into the loop this issue is about, and it needs no unreachable coordinator at all.
- The question's three answers are read against "another *device*". For a second app on the phone in your hand, "a previous install, or a phone I no longer have" is the easy one to pick and the wrong one; "Yes, and I still use it" (link) is the answer that settles it. Worth a word on that step naming apps on this phone as well as other devices.

Reporter @nprofile…m7xa asked to be added to the room where ...

2026-10-19T20:48:56Z

In reply to naddr1qq…s3jy
_________________________

Reporter BITKARROT (nprofile…m7xa) asked to be added to the room where this gets fixed.

Reporter @nprofile…m7xa asked to be added to the room where ...

2026-10-19T20:48:52Z

In reply to naddr1qq…s3jy
_________________________

Reporter BITKARROT (nprofile…m7xa) asked to be added to the room where this gets fixed.

Reporter @nprofile…m7xa asked to be added to the room where ...

2026-10-19T20:48:48Z

In reply to naddr1qq…s3jy
_________________________

Reporter BITKARROT (nprofile…m7xa) asked to be added to the room where this gets fixed.

Closed out, with the corrected Verify satisfied as written. The ...

2026-10-17T20:43:36Z

In reply to naddr1qq…s3jy
_________________________

Closed out, with the corrected Verify satisfied as written.

The fix is on main at dbfa09dfb815e3f155a5fff1e8b58b84ac3b17e9 (v0.1.24-pre.18), from https://gitworkshop.dev/npub1sht0nuy83g6gu0dae0nkmh5n2r68kyvvat6r3hrdc0y2c5y8latsk2jm0v/cordn.feeds.relay.tools/staircase/prs/nevent1qywhwumn8ghj7cm0wfjxutnxv4jkguewwfjkccte9e6x7mmvwvqzqrtkz2s8tjrauxkc3dpuge83725w04ehfavfcvjf8s4dkshxkrh446uztq.

The three steps of the superseding Verify above were walked on raven at tip edc5b81d, build md5 6a189b60, by cowboy (nprofile…qk7x): a bubble with the photo, its name, the caption and a live progress bar the moment Send is tapped; the stage line moving through Encrypting / Uploading / Checking / Sending; the placeholder becoming the real bubble in place without the timeline jumping.

The upload-failure case is covered by tests rather than a device step, as asked: one in cordn-sync (a send whose upload throws leaves the row failed with a readable reason, keeps the file on the device, and Retry sends that same file) and one in the ui render test (the chat still names the file, says why it failed, and offers Retry and Discard with the progress bar gone). The airplane-mode arm was also walked on the phone before the correction reached the coder, so it stands as evidence on the pull request even though it is no longer asked for.

What a person will see in the next preview build: a photo or file shows up in the chat the instant you send it, with its progress, and a failed one tells you why and offers Retry.

@nprofile…z7vk asked to follow this one: add them to the room ...

2026-10-17T20:14:29Z

In reply to naddr1qq…s3jy
_________________________

Beave's Portable Communicator Device (nprofile…z7vk) asked to follow this one: add them to the room when the fix starts.

@nprofile…z7vk asked to follow this one: add them to the room ...

2026-10-17T20:14:28Z

In reply to naddr1qq…s3jy
_________________________

Beave's Portable Communicator Device (nprofile…z7vk) asked to follow this one: add them to the room when the fix starts.

@nprofile…z7vk asked to follow this one: add them to the room ...

2026-10-17T20:14:25Z

In reply to naddr1qq…s3jy
_________________________

Beave's Portable Communicator Device (nprofile…z7vk) asked to follow this one: add them to the room when the fix starts.

@nprofile…z7vk asked to follow this one: add them to the room ...

2026-10-17T20:14:24Z

In reply to naddr1qq…s3jy
_________________________

Beave's Portable Communicator Device (nprofile…z7vk) asked to follow this one: add them to the room when the fix starts.

## Verify (supersedes the body's, at @nprofile…2nhh's ...

2026-10-17T18:16:21Z

In reply to naddr1qq…s3jy
_________________________

## Verify (supersedes the body's, at cloud (nprofile…2nhh)'s request)

1. Open a chat, + › File, pick a large photo or a short video; Send.
2. From the tap on Send until the message lands, the chat shows the send in progress — a placeholder where the message will be, with the stage it is in — and it is clear which file it is.
3. The placeholder turns into the real message bubble when it lands, without the timeline jumping.

The body's step 4 (airplane mode) is dropped: too cumbersome on the phone. Failure handling is still worth covering, in a JVM test rather than on the device — a media send whose upload throws must leave something in the chat the person can see, not just the swallowed `error = "attach: …"` string. The body's step 5 (desktop) stays out of scope: no display on the build box.

@nprofile…z7vk asked to be added to the room where this gets ...

2026-10-17T18:15:12Z

In reply to naddr1qq…s3jy
_________________________

Beave's Portable Communicator Device (nprofile…z7vk) asked to be added to the room where this gets fixed. cloud fodder (nprofile…juxr) has not said either way yet.

Open question answered by @nprofile…juxr: an explicitly muted ...

2026-10-16T03:06:10Z

In reply to naddr1qq…s3jy
_________________________

Open question answered by cloud fodder (nprofile…juxr): an explicitly muted two-person chat should still be silenced.

So "a two-person chat counts as a mention" applies to the app-wide "mentions only" setting only, not to the `MENTIONS` scope a mute produces (`NotifyScope.effective`, `AppPrefs.kt:141`). A mute stays what it is today: only a real `p`-tag mention gets through it, in a DM as in a group. In practice that means the one-to-one rule cannot live inside `NotifyScope.alerts` keyed on the scope string alone — the caller has to say whether this scope came from the setting or from a mute.

Add to the ## Verify: mute a two-person chat, have the other person send a plain message — nothing alerts and no badge appears; then have them @-pick your name — that one alerts.

@nprofile…juxr pointed me at the source ...

2026-10-14T14:52:16Z

In reply to naddr1qq…s3jy
_________________________

cloud fodder (nprofile…juxr) pointed me at the source (https://github.com/Cordn-msg/cordn-web), so the "could not check here" section above is resolved — here is cordn-web's actual implementation. Read at `a925723` (v0.5.5, 2026-10-13). Polls landed in `a511037` (2026-10-12, "add NIP-88 polls with tap-to-vote and rich results") with three follow-ups: `c2893c3` (tallies dropped every vote on deadline polls), `118f306` (card contrast on own bubbles), `80860e1` (NIP-31 alt summaries and readable vote content). Files: `src/lib/chat/polls.ts` (+ `polls.test.ts`), `kinds.ts`, `references.ts`, `registry.ts`, `inline/PollInline.svelte`, `rich/PollRich.svelte`, `components/chat/PollComposerDialog.svelte`, `ChatComposerActions.svelte`, `chatGroupDisplay.ts`.

## Wire format to mirror

NIP-88 semantics carried as cordn envelopes (no signatures), sealed as ordinary MLS group messages. NIP-88 `relay` tags are deliberately dropped — cordn routes through the group's coordinator.

Kind **1068** (poll), `ChatKinds.Poll`:
- `content` = the question.
- `option` tags, one per option, exactly 3 elements: `["option", <id>, <label>]`. Ids are assigned in display order on the send side — `["option","0","Pizza"]`, `["option","1","Sushi"]`.
- `polltype` tag: `singlechoice` | `multiplechoice`; absent means singlechoice. At most one.
- `endsAt` tag: unix **seconds** deadline, positive integer, at most one; absent means the poll never closes.
- `alt` tag (NIP-31): `Poll: <question>`.

Kind **1018** (response), `ChatKinds.PollResponse`:
- The house target triple, same shape as reaction tags: `["e", <pollId>, "", <pollAuthor>]`, `["p", <pollAuthor>]`, `["k","1068"]`.
- One `["response", <optionId>]` tag per selected option.
- `content` = `Voted: <labels joined by ", ">` (or bare `Voted`) — a readable fallback for clients with no poll support, so they do not render an empty bubble. `alt` tag = `Poll vote`.

Limits (`polls.ts`): 2–10 options, question ≤ 1024 bytes, option label ≤ 256 bytes, option id ≤ 64 bytes and alphanumeric only, lifetime ≤ 30 days, ≤ 32 tags on receive. Question and labels must be trimmed, non-empty, and free of control and bidi-override characters (labels are a spoofing surface); a known tag of the wrong shape makes the whole poll unparseable, while unknown extension tags are ignored.

## Fold rules to mirror

- A response is a **complete-selection replacement, never a delta**: exactly one id for singlechoice, 1..N unique ids for multiplechoice. An empty selection is not an unvote — there is no unvote at all (re-tapping your single choice keeps it; dropping your last multi-choice pick is refused).
- One vote per account, latest `(createdAt, cursor)` wins, so a second device's response collapses into one vote.
- A response is counted only inside the poll's window: never before the poll row, never after `endsAt`.
- A response selecting an unknown option id, or more than one id on a singlechoice poll, is dropped.
- Kind-5 deletions do **not** retract votes (NIP-88 integrity advice), and this is marked as a deliberate limit, not an oversight.
- The votes are the poll's **sparse aggregate**: the poll's own renderer self-queries the group's messages for its responses. cordn-web's README is explicit that the shell's annotation fold is never extended with a new kind — worth keeping in our port, where the equivalent would be tempting to bolt onto `AnnotationIndex`.

## Two things for the Kotlin port specifically

1. **Which clock.** `buildPollTally` compares on `StoredChatMessage.createdAt`, which in cordn-web is the **coordinator `at` in milliseconds**, not the event's `created_at` — the comment at that compare says so, and `c2893c3` is the bug fixed there (`endsAt` is seconds, stored time is ms; comparing them directly dropped every vote on a deadline poll). Our `message` table carries both columns separately (`created_at` = author clock, `at` = coordinator timestamp), so the fold must read `at`, divided by 1000 before any `endsAt` compare. Getting this wrong fails exactly one way: deadline polls look like nobody voted.
2. **Which kinds are hidden.** cordn-web adds `isStreamHiddenKind = isAnnotationKind(kind) || kind === PollResponse`: the poll renders as a row, the response never does. So in `ChatKinds.kt`, 1068 joins `isPrimary` and 1018 goes in a hidden-but-not-annotation bucket (it is not folded by the shell either). `Message.sq` `countUnread` counts `kind IN (9, 1111)` — add 1068, not 1018. Group-card and notification preview text in cordn-web is `📊 Poll: <question>` for 1068 and `🗳️ Voted` for 1018 (`chatGroupDisplay.ts`), which is the string our group-summary preview should match.

## Behaviour the UI shows

Entry point is a "Poll" item in the composer's attach menu, opening a poll composer dialog. The inline card shows the question, each option as a tap-to-vote button with its count and a share bar, your pick ticked, `N votes` underneath, and a `Closed` badge once `endsAt` passes — the card closes its own controls on a 30-second tick rather than waiting for a message. Counts are visible to everyone before voting, and the vote shows optimistically until the real response ingests (stored always beats optimistic). Voting is disabled on a closed poll and on a queued poll that has no event id yet.

Worth saying out loud for whoever reviews the feature: **votes are not secret**. Every response is an ordinary group message attributable to its sender, and cordn-web's rich view lists voter name chips under each option. That is cordn-web's choice to copy, not a defect, but it belongs in the UI copy if we show anything less than the voter list.

Steps 5 and 6 of ## Verify are the real parity test; the rest can be walked without cordn-web. The desktop step (7) is out of scope on the current rig — no display on the build box.

A clone of cordn-web is now at `repos/cordn-web` in my workspace, so I can diff against it on the next report.