diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 70a0bb21..c0ea4991 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -278,6 +278,48 @@ jobs:
             Client/tauri-client/test-results/
           retention-days: 7
 
+  # Blocking e2e subset: the parity-feature specs (tagged "@parity"), covering
+  # the wire paths added in v1.2.0 (mentions/badges, per-channel mute, NSFW
+  # gate, group DMs, role change, custom-emoji autocomplete, voice moderation).
+  # These are new and authored green, so unlike the full legacy suite above they
+  # gate PRs: a regression on one of these features must fail CI. Kept as its own
+  # job (not folded into the non-blocking suite) so the legacy suite can keep
+  # earning its "few green pushes" before it too graduates to blocking.
+  client-e2e-parity:
+    name: Client E2E (parity subset, blocking)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: Client/tauri-client/
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: Client/tauri-client/package-lock.json
+
+      - name: Install npm dependencies
+        run: npm ci
+
+      - name: Install Playwright browser
+        run: npx playwright install --with-deps chromium
+
+      - name: Run parity e2e specs
+        run: npx playwright test --config=playwright.config.ts --grep "@parity"
+
+      - name: Upload Playwright report
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: playwright-report-parity
+          path: |
+            Client/tauri-client/playwright-report/
+            Client/tauri-client/test-results/
+          retention-days: 7
+
   # Image build is verification only, so it is skipped on dev to keep day-to-day
   # work on the fast check suite. Runs for main pushes and PRs targeting main.
   server-docker-build:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8c325e27..5ce6b717 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -135,6 +135,29 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         run: npm run tauri build -- --bundles appimage,deb
 
+      # linuxdeploy bundles the runner's libwayland-* into the AppImage, which
+      # breaks Mesa EGL init on newer hosts (white window on Arch/Fedora —
+      # EGL_BAD_PARAMETER). Strip them and regenerate the updater artifact +
+      # signatures for the patched image.
+      - name: Strip host-incompatible libs from AppImage and re-sign
+        working-directory: Client/tauri-client
+        shell: bash
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        run: |
+          BUNDLE_DIR="src-tauri/target/release/bundle/appimage"
+          APPIMAGE=$(find "$BUNDLE_DIR" -name "*.AppImage" ! -name "*.sig" | head -1)
+          bash scripts/strip-appimage-bundled-libs.sh "$APPIMAGE"
+          TARBALL="$APPIMAGE.tar.gz"
+          rm -f "$TARBALL" "$APPIMAGE.sig" "$TARBALL.sig"
+          tar czf "$TARBALL" -C "$(dirname "$APPIMAGE")" "$(basename "$APPIMAGE")"
+          KEY_PATH=$(mktemp)
+          printf '%s' "$TAURI_SIGNING_PRIVATE_KEY" > "$KEY_PATH"
+          trap 'rm -f "$KEY_PATH"' EXIT
+          npx tauri signer sign -f "$KEY_PATH" -p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "$APPIMAGE"
+          npx tauri signer sign -f "$KEY_PATH" -p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "$TARBALL"
+
       - name: Stage Linux release assets
         shell: bash
         run: |
@@ -266,6 +289,26 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         run: npm run tauri build -- --bundles appimage,deb
 
+      # Same strip + re-sign as the x86_64 job — see the comment there.
+      - name: Strip host-incompatible libs from AppImage and re-sign
+        working-directory: Client/tauri-client
+        shell: bash
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        run: |
+          BUNDLE_DIR="src-tauri/target/release/bundle/appimage"
+          APPIMAGE=$(find "$BUNDLE_DIR" -name "*.AppImage" ! -name "*.sig" | head -1)
+          bash scripts/strip-appimage-bundled-libs.sh "$APPIMAGE"
+          TARBALL="$APPIMAGE.tar.gz"
+          rm -f "$TARBALL" "$APPIMAGE.sig" "$TARBALL.sig"
+          tar czf "$TARBALL" -C "$(dirname "$APPIMAGE")" "$(basename "$APPIMAGE")"
+          KEY_PATH=$(mktemp)
+          printf '%s' "$TAURI_SIGNING_PRIVATE_KEY" > "$KEY_PATH"
+          trap 'rm -f "$KEY_PATH"' EXIT
+          npx tauri signer sign -f "$KEY_PATH" -p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "$APPIMAGE"
+          npx tauri signer sign -f "$KEY_PATH" -p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "$TARBALL"
+
       - name: Stage Linux ARM64 release assets
         shell: bash
         run: |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 855e26d9..68227642 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,14 +5,118 @@ tooling (`npm run changelog`) auto-generates entries from commit messages
 on each release; this file is the curated counterpart that calls out
 behavioural changes operators must know about.
 
-## Unreleased — v1.1.0-alpha series (Phase B + C)
+## v1.2.0-alpha.1 — Discord feature parity
 
 > **Project reset note:** OwnCord has re-entered alpha. The `v1.0.0` release is
-> superseded; versioning continues forward as `v1.1.0-alpha.N` so deployed
-> servers and clients keep receiving updates. Releases are published to this
+> superseded; versioning continues forward from `v1.1.0-alpha.N` so deployed
+> servers and clients keep receiving updates. This release bumps the minor to
+> `v1.2.0-alpha.1` to mark a large feature drop. Releases are published to this
 > repository's [Releases](https://github.com/J3vb/OwnCord/releases) page,
 > including a full source snapshot with every release.
 
+This release closes most of the feature gap against basic Discord (see
+[docs/plans/discord-parity.md](docs/plans/discord-parity.md) for the full
+gap analysis and per-item detail). The work landed as six phases plus a
+pre-release security and performance review.
+
+### Messaging & mentions
+
+- **Real mentions.** `@username` is now resolved server-side against unique
+  usernames (address-shaped text like `mail@example` is rejected), stored per
+  message, and carried on the wire — so a mention notifies, highlights the
+  message, and drives a red per-channel mention badge distinct from the plain
+  unread count. `@everyone` / `@here` are gated on a new `MENTION_EVERYONE`
+  permission (`@here` skips offline and invisible users). `#channel` names
+  render as clickable navigation chips, and the composer gains an `@`
+  autocomplete.
+- **Markdown rendering.** Messages render Discord-flavoured markdown — bold,
+  italic, underline, strikethrough, spoilers, block quotes, headings, lists,
+  masked links (`http(s)` only), and fenced code blocks with a language tag
+  and lightweight syntax highlighting. Rendering is a strict DOM builder with
+  no `innerHTML`. `Ctrl+B/I/U` wrap the selection in the composer.
+- **Custom emoji.** Server emoji can be uploaded and managed (admin panel,
+  `MANAGE_SERVER`); `:shortcode:` renders inline in messages (jumbo when a
+  message is emoji-only), appears in the picker and a `:`-autocomplete, and can
+  be used as a reaction.
+- **Message navigation.** Search results, pinned messages, reply previews, and
+  message permalinks (`owncord://message/…`, copyable from the hover bar) all
+  jump to the target — fetching a window around it when it is not loaded, with
+  a "Jump to Present" affordance. Reactions show a who-reacted tooltip on
+  hover, video and audio attachments get inline players, and a "NEW" divider
+  plus explicit Mark as Read / Mark All as Read round out read state.
+- **Bulk delete.** `POST /channels/{id}/messages/purge` soft-deletes the newest
+  N messages (`MANAGE_MESSAGES`), broadcasting one `chat_bulk_deleted` event.
+
+### Roles, permissions & moderation
+
+- **Role management.** Roles are now first-class: create, edit, delete, reorder,
+  and edit permission masks and colours from the admin panel, all gated on
+  `MANAGE_ROLES` and bounded by the actor's own position (you cannot touch a
+  role at or above your rank, nor grant a permission bit your own role lacks).
+- **The permission bits are live.** The six previously-decorative bits
+  (`MANAGE_CHANNELS`, `KICK_MEMBERS`, `MUTE_MEMBERS`, `MANAGE_ROLES`,
+  `MANAGE_SERVER`, `VIEW_AUDIT_LOG`) are now enforced per admin route group, so
+  a Moderator role can actually moderate without being a full Administrator.
+- **Per-user channel overrides.** Channel permissions resolve in Discord's
+  order — base role → role override → user override — with a tri-state override
+  matrix editor (role or user) in the admin panel.
+- **Voice moderation.** Holders of `MUTE_MEMBERS` can server-mute, server-deafen,
+  move, or disconnect a lower-ranked user; a server mute is enforced at the SFU.
+- **Channel management from the desktop client.** Topics render and are editable,
+  plus slowmode, an NSFW flag (with a per-session age gate), and voice
+  user/video limits. Categories are now free text (any type under any name).
+
+### Social & profiles
+
+- **Profiles.** Avatar uploads (replacing letter-initials everywhere), display
+  names (with the `@username` handle preserved for mentions), an about/bio, and
+  a custom status line.
+- **Presence.** Invisible is now a real status that never leaks to other users
+  and survives a reconnect (the previous flash-online-on-connect bug is fixed);
+  a 10-minute auto-idle that never overrides a manual status.
+- **Group DMs** (2–10 participants, name, leave), **DM calls** with ringing
+  (Call button + incoming-call banner over the existing DM voice path), and
+  **per-channel notification mutes** (mentions still notify; other noise is
+  silenced).
+- **Quick wins from phase 1.** Block/unblock from the member menu, temporary
+  bans, server-driven role colours, a mounted profile popup, and archived
+  channels that actually hide.
+
+### Security & performance review (pre-release)
+
+- Channel-override endpoints now enforce grantability: a `MANAGE_CHANNELS`
+  holder cannot grant itself or a user a permission bit its own role lacks,
+  closing a privilege-escalation path.
+- DM voice events (`voice_state`/`voice_leave`) are delivered only to the DM's
+  participants instead of every user with base `READ_MESSAGES`.
+- Voice moderation cannot reach a private DM call the actor is not part of.
+- Mention-count bookkeeping is batched (one writer exec per 500 readers instead
+  of one per reader) and resolved against a set; the markdown parser's
+  bracket matching is amortized-linear; video/audio attachment blobs are
+  LRU-capped and revoked, and cleared on logout.
+
+### Test hardening (pre-release)
+
+The hostile-input surface is now covered by Go native fuzzers and
+client-side property tests (mention/emoji parsing, FTS query sanitizing,
+permission resolution, markdown tokenizing, filename/path sanitizing,
+content sanitizing, credential validation, avatar URLs, LiveKit webhook
+identities), which found and fixed two real bugs:
+
+- **Zero-dimension images are rejected.** A GIF decoding to height 0, and a
+  VP8 keyframe with an all-zero size field, both passed the image size guard
+  as "small". `imageDimensions` now rejects non-positive dimensions centrally.
+- **Upload filenames stay safe basenames.** `/` survived sanitizing verbatim
+  (`filepath.Base("/")` is `"/"`), and over-length names were truncated
+  mid-rune into invalid UTF-8. Both are fixed at the sanitizer.
+
+Also added: a full migration-chain and pre-parity (019) upgrade round-trip
+test, a protocol-schema/generated-constant drift test, a 200-client hub
+load/soak test with `goleak` verification, and a blocking `@parity`
+Playwright job covering the new parity features. Separately, a test-quality
+audit rewired tests that asserted nothing (or a tautology) to assert their
+claimed behaviour — no product code changed and no assertion weakened.
+
 ### Phase B — Acceleration
 
 - **Event persistence layer (Step 7).** A new `events` table backs the
@@ -134,6 +238,18 @@ behavioural changes operators must know about.
 - **Plugin admin endpoints require admin session auth in addition to
   the existing IP restriction.** A previous prerelease shipped with only
   the IP gate; that has been corrected.
+- **The parity work adds nine database migrations (`020`–`028`) that apply
+  automatically on first boot.** They add the `message_mentions`,
+  `channel_user_overrides`, and emoji-supporting tables/columns, per-user
+  profile fields (`display_name`, `about`, `custom_status`), channel flags
+  (`nsfw`, `is_group`), and the `server_muted`/`server_deafened` voice-state
+  columns; a migration also seeds the new `MENTION_EVERYONE` permission bit
+  into the Owner/Admin/Moderator roles. No manual step is required, but take a
+  backup before upgrading as usual. The release also introduces new WebSocket
+  message types (`roles_update`, `emoji_update`, `chat_bulk_deleted`,
+  `voice_mod_*`, `voice_moved`, `voice_disconnected`, `mark_read`,
+  `call_ring`/`call_incoming`/`call_decline`); older clients ignore unknown
+  types, and older servers omit the new fields (the client fails safe).
 
 ### Deferred work
 
diff --git a/Client/tauri-client/package-lock.json b/Client/tauri-client/package-lock.json
index a486d67b..71d70d25 100644
--- a/Client/tauri-client/package-lock.json
+++ b/Client/tauri-client/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "owncord-client",
-  "version": "1.1.0-alpha.5",
+  "version": "1.2.0-alpha.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "owncord-client",
-      "version": "1.1.0-alpha.5",
+      "version": "1.2.0-alpha.1",
       "dependencies": {
         "@jitsi/rnnoise-wasm": "^0.2.1",
         "@tauri-apps/api": "^2.10.1",
@@ -31,6 +31,7 @@
         "@vitest/browser": "^3.2.4",
         "@vitest/coverage-v8": "^3",
         "eslint": "^10.8.0",
+        "fast-check": "^4.9.0",
         "jsdom": "^29.1.1",
         "knip": "^6.1.1",
         "oxlint": "^1.76.0",
@@ -5028,6 +5029,29 @@
         "node": ">=12.0.0"
       }
     },
+    "node_modules/fast-check": {
+      "version": "4.9.0",
+      "resolved": "https://registry.npmjs.org/fast-check/-/fast-check-4.9.0.tgz",
+      "integrity": "sha512-7ms6T7SybUev/PQITciI0yLM2pOSFy5zpG8Ty7tQofcVaQUvrMXp6CBwqF6fThLCLOrfBtuHAtwq6Yu4XPCllg==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/dubzzz"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fast-check"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "pure-rand": "^8.0.0"
+      },
+      "engines": {
+        "node": ">=12.17.0"
+      }
+    },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
@@ -6554,6 +6578,23 @@
         "node": ">=6"
       }
     },
+    "node_modules/pure-rand": {
+      "version": "8.4.2",
+      "resolved": "https://registry.npmjs.org/pure-rand/-/pure-rand-8.4.2.tgz",
+      "integrity": "sha512-vvuOGgcuPJAirlHvuQw1TrOiw7ptaIXXmIbNuiNOY6lNGJJH49PQ1Kj4nd783nPdQhQdicgOjVI2yI/9BD6/Ng==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/dubzzz"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fast-check"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/qs": {
       "version": "6.15.3",
       "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz",
diff --git a/Client/tauri-client/package.json b/Client/tauri-client/package.json
index 21a9fd9a..d52d7ac6 100644
--- a/Client/tauri-client/package.json
+++ b/Client/tauri-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "owncord-client",
   "private": true,
-  "version": "1.1.0-alpha.5",
+  "version": "1.2.0-alpha.1",
   "type": "module",
   "scripts": {
     "dev": "vite",
@@ -40,6 +40,7 @@
     "@vitest/browser": "^3.2.4",
     "@vitest/coverage-v8": "^3",
     "eslint": "^10.8.0",
+    "fast-check": "^4.9.0",
     "jsdom": "^29.1.1",
     "knip": "^6.1.1",
     "oxlint": "^1.76.0",
diff --git a/Client/tauri-client/scripts/strip-appimage-bundled-libs.sh b/Client/tauri-client/scripts/strip-appimage-bundled-libs.sh
new file mode 100755
index 00000000..ce5fea96
--- /dev/null
+++ b/Client/tauri-client/scripts/strip-appimage-bundled-libs.sh
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Strip host-incompatible libraries from a Tauri-built AppImage.
+#
+# linuxdeploy bundles the build host's (Ubuntu 22.04) libwayland-* into the
+# AppImage and AppRun forces them onto LD_LIBRARY_PATH. Newer hosts' Mesa
+# dlopens libwayland-client during EGL init — picking up the stale bundled
+# copy makes eglGetDisplay fail (EGL_BAD_PARAMETER) and WebKit aborts,
+# leaving a white window. Every supported distro ships libwayland >= the
+# 1.20 the client links against, so the host copy is always the right one.
+# Verified 2026-07-31: stock alpha.5 AppImage white-screens on Arch; the
+# same image with these libs removed renders normally on Arch and Ubuntu.
+#
+# Usage: strip-appimage-bundled-libs.sh <path-to.AppImage>
+# Rewrites the AppImage in place (same filename). Signatures and updater
+# tar.gz artifacts must be regenerated afterwards by the caller.
+set -euo pipefail
+
+APPIMAGE_PATH="${1:?usage: $0 <path-to.AppImage>}"
+APPIMAGE_PATH="$(readlink -f "$APPIMAGE_PATH")"
+WORKDIR="$(mktemp -d)"
+trap 'rm -rf "$WORKDIR"' EXIT
+
+ARCH="$(uname -m)"
+APPIMAGETOOL="$WORKDIR/appimagetool"
+curl -fsSL -o "$APPIMAGETOOL" \
+  "https://github.com/AppImage/appimagetool/releases/download/continuous/appimagetool-${ARCH}.AppImage"
+chmod +x "$APPIMAGETOOL"
+
+cd "$WORKDIR"
+"$APPIMAGE_PATH" --appimage-extract > /dev/null
+
+removed=0
+for lib in squashfs-root/usr/lib/libwayland-*.so*; do
+  [ -e "$lib" ] || continue
+  echo "removing bundled $(basename "$lib")"
+  rm -f "$lib"
+  removed=$((removed + 1))
+done
+if [ "$removed" -eq 0 ]; then
+  echo "::warning::no bundled libwayland-* found in $APPIMAGE_PATH — linuxdeploy may have stopped bundling it; strip step is now a no-op"
+  exit 0
+fi
+
+# --appimage-extract-and-run: run without FUSE (CI containers/runners).
+# ARCH is required when repacking on a host arch that differs from the
+# payload naming; here it always matches the runner.
+ARCH="$ARCH" "$APPIMAGETOOL" --appimage-extract-and-run --no-appstream \
+  squashfs-root "$WORKDIR/repacked.AppImage"
+mv "$WORKDIR/repacked.AppImage" "$APPIMAGE_PATH"
+echo "stripped $removed bundled wayland libs from $(basename "$APPIMAGE_PATH")"
diff --git a/Client/tauri-client/src-tauri/Cargo.lock b/Client/tauri-client/src-tauri/Cargo.lock
index 6fbf3776..e09c557e 100644
--- a/Client/tauri-client/src-tauri/Cargo.lock
+++ b/Client/tauri-client/src-tauri/Cargo.lock
@@ -3274,7 +3274,7 @@ dependencies = [
 
 [[package]]
 name = "owncord-client"
-version = "1.1.0-alpha.5"
+version = "1.2.0-alpha.1"
 dependencies = [
  "base64 0.22.1",
  "device_query",
@@ -3306,6 +3306,7 @@ dependencies = [
  "tokio-rustls",
  "tokio-tungstenite",
  "url",
+ "webkit2gtk",
  "webpki-roots 1.0.9",
  "windows 0.58.0",
  "windows-sys 0.60.2",
diff --git a/Client/tauri-client/src-tauri/Cargo.toml b/Client/tauri-client/src-tauri/Cargo.toml
index 7697b180..3d001158 100644
--- a/Client/tauri-client/src-tauri/Cargo.toml
+++ b/Client/tauri-client/src-tauri/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "owncord-client"
-version = "1.1.0-alpha.5"
+version = "1.2.0-alpha.1"
 edition = "2021"
 # Effective minimum: tauri 2.11 declares rust-version = "1.77.2", so the crate
 # cannot build below it. Declaring it here enables Cargo's MSRV-aware resolver
@@ -117,3 +117,11 @@ windows-sys = { version = "0.60", features = [
 
 [target.'cfg(target_os = "linux")'.dependencies]
 device_query = "2"
+# Direct access to the WebKitGTK webview for voice/video support. WebKitGTK
+# denies getUserMedia/enumerateDevices permission requests by default (wry
+# installs no handler on Linux, unlike its macOS backend which auto-grants),
+# and ships with media-stream/WebRTC settings off — so microphones and cameras
+# are invisible to the webview without this hook. Version-pinned to match
+# wry's own `=2.0.2` pin so both link the same crate build; v2_38 gates the
+# enable-webrtc setting.
+webkit2gtk = { version = "=2.0.2", features = ["v2_38"] }
diff --git a/Client/tauri-client/src-tauri/src/constants.rs b/Client/tauri-client/src-tauri/src/constants.rs
index 6e7496cd..265f2563 100644
--- a/Client/tauri-client/src-tauri/src/constants.rs
+++ b/Client/tauri-client/src-tauri/src/constants.rs
@@ -8,6 +8,16 @@ pub const IDENTITY_PINS_STORE: &str = "identity_pins.json";
 pub const SETTINGS_STORE: &str = "settings.json";
 
 /// Tauri store file for the degraded-mode credential fallback (see
-/// `secret_store`). Values are DPAPI ciphertext, never plaintext, and the file
-/// only exists on a machine whose OS credential store failed a round-trip.
+/// `secret_store`). Values are ciphertext (DPAPI on Windows, ChaCha20-Poly1305
+/// elsewhere), never plaintext, and the file only exists on a machine whose OS
+/// credential store failed a round-trip.
 pub const CREDENTIAL_FALLBACK_STORE: &str = "credential_fallback.json";
+
+/// Per-install key that seals the non-Windows credential fallback entries
+/// (see `fallback_crypto`). Written once, owner-only (0600).
+///
+/// Gated to match its only consumer: `fallback_crypto` is `cfg(not(windows))`
+/// because Windows seals fallback entries with DPAPI instead, so on Windows
+/// this constant would be dead code and `-D warnings` fails the build.
+#[cfg(not(windows))]
+pub const CREDENTIAL_FALLBACK_KEY_FILE: &str = "credential_fallback.key";
diff --git a/Client/tauri-client/src-tauri/src/credentials.rs b/Client/tauri-client/src-tauri/src/credentials.rs
index 0281f33b..7f578694 100644
--- a/Client/tauri-client/src-tauri/src/credentials.rs
+++ b/Client/tauri-client/src-tauri/src/credentials.rs
@@ -161,9 +161,10 @@ pub fn delete_credential(app: AppHandle, host: String) -> Result<(), String> {
 /// Save the long-term identity private key for `host`.
 ///
 /// The write is read back before this returns. A machine whose credential store
-/// accepts writes without keeping them falls through to the DPAPI file; if that
-/// is also unavailable this returns an error rather than reporting a success
-/// that would leave peers rejecting the user's voice announce after a restart.
+/// accepts writes without keeping them falls through to the encrypted fallback
+/// file (DPAPI on Windows, sealed per-install key elsewhere); if that is also
+/// unavailable this returns an error rather than reporting a success that would
+/// leave peers rejecting the user's voice announce after a restart.
 #[tauri::command]
 pub fn save_identity_key(app: AppHandle, host: String, key: String) -> Result<(), String> {
     require_non_empty(&host, "host")?;
diff --git a/Client/tauri-client/src-tauri/src/fallback_crypto.rs b/Client/tauri-client/src-tauri/src/fallback_crypto.rs
new file mode 100644
index 00000000..69b1ba77
--- /dev/null
+++ b/Client/tauri-client/src-tauri/src/fallback_crypto.rs
@@ -0,0 +1,235 @@
+//! Encryption for the non-Windows credential fallback file.
+//!
+//! Windows parks fallback secrets behind DPAPI, whose key lives with the OS.
+//! macOS and Linux have no DPAPI equivalent that works while the Keychain /
+//! Secret Service itself is the thing that failed, so this module seals
+//! secrets with ChaCha20-Poly1305 (via `ring`, already in the tree) under a
+//! per-install random key stored next to the app data (mode 0600).
+//!
+//! This is damage control, not a vault: an attacker who can read both the key
+//! file and the fallback store as this user has the secrets, exactly as they
+//! would with DPAPI under the same user account. What it buys is (a) secrets
+//! at rest are never plaintext, (b) a copied fallback store is useless without
+//! the key file beside it, and (c) an entry cannot be moved between accounts
+//! — the account name is bound in as AEAD associated data, mirroring the DPAPI
+//! entropy on Windows. The OS credential store always remains the primary
+//! store; this file only ever holds entries whose keychain write failed a
+//! verified round-trip (see `secret_store`).
+
+use std::fs;
+use std::io::Write;
+use std::path::Path;
+
+use ring::aead::{Aad, LessSafeKey, Nonce, UnboundKey, CHACHA20_POLY1305, NONCE_LEN};
+use ring::rand::{SecureRandom, SystemRandom};
+
+use crate::constants::CREDENTIAL_FALLBACK_KEY_FILE;
+
+/// Size of the sealing key in bytes (ChaCha20-Poly1305).
+pub const KEY_LEN: usize = 32;
+
+/// Load the per-install sealing key from `dir`, creating it on first use.
+///
+/// The key file is written with owner-only permissions (0600) and never
+/// rewritten once it exists — losing it orphans every sealed entry, which the
+/// caller treats the same as an absent entry.
+pub fn load_or_create_key(dir: &Path) -> Result<[u8; KEY_LEN], String> {
+    let path = dir.join(CREDENTIAL_FALLBACK_KEY_FILE);
+
+    match fs::read(&path) {
+        Ok(bytes) => {
+            let key: [u8; KEY_LEN] = bytes.as_slice().try_into().map_err(|_| {
+                format!(
+                    "credential fallback key file has {} bytes, expected {KEY_LEN} — \
+                     refusing to use it",
+                    bytes.len()
+                )
+            })?;
+            return Ok(key);
+        }
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+        Err(e) => return Err(format!("failed to read credential fallback key: {e}")),
+    }
+
+    let mut key = [0u8; KEY_LEN];
+    SystemRandom::new()
+        .fill(&mut key)
+        .map_err(|_| "system RNG failed generating the fallback key".to_string())?;
+
+    fs::create_dir_all(dir)
+        .map_err(|e| format!("failed to create app data dir for fallback key: {e}"))?;
+
+    let mut options = fs::OpenOptions::new();
+    options.write(true).create_new(true);
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::OpenOptionsExt;
+        options.mode(0o600);
+    }
+    match options.open(&path) {
+        Ok(mut file) => {
+            file.write_all(&key)
+                .and_then(|()| file.sync_all())
+                .map_err(|e| format!("failed to write credential fallback key: {e}"))?;
+            Ok(key)
+        }
+        // Lost the create race to another thread — use the winner's key.
+        Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => {
+            let bytes = fs::read(&path)
+                .map_err(|e| format!("failed to re-read credential fallback key: {e}"))?;
+            bytes
+                .as_slice()
+                .try_into()
+                .map_err(|_| "concurrently written fallback key has the wrong size".to_string())
+        }
+        Err(e) => Err(format!("failed to create credential fallback key: {e}")),
+    }
+}
+
+/// Seal `plaintext` under `key`, binding `aad` (the service + account name).
+///
+/// Output layout: `nonce (12 bytes) || ciphertext || tag`. The nonce is random
+/// per call; at the fallback store's write volume (a handful per login) the
+/// birthday bound on 96-bit nonces is not a concern.
+pub fn protect(key: &[u8; KEY_LEN], plaintext: &[u8], aad: &[u8]) -> Result<Vec<u8>, String> {
+    let unbound = UnboundKey::new(&CHACHA20_POLY1305, key)
+        .map_err(|_| "failed to build the fallback sealing key".to_string())?;
+    let sealing = LessSafeKey::new(unbound);
+
+    let mut nonce_bytes = [0u8; NONCE_LEN];
+    SystemRandom::new()
+        .fill(&mut nonce_bytes)
+        .map_err(|_| "system RNG failed generating a nonce".to_string())?;
+    let nonce = Nonce::assume_unique_for_key(nonce_bytes);
+
+    let mut in_out = plaintext.to_vec();
+    sealing
+        .seal_in_place_append_tag(nonce, Aad::from(aad), &mut in_out)
+        .map_err(|_| "sealing the fallback entry failed".to_string())?;
+
+    let mut blob = Vec::with_capacity(NONCE_LEN + in_out.len());
+    blob.extend_from_slice(&nonce_bytes);
+    blob.append(&mut in_out);
+    Ok(blob)
+}
+
+/// Open a blob produced by [`protect`]. Fails on tampering, a wrong key, or a
+/// blob moved to a different account's slot (AAD mismatch).
+pub fn unprotect(key: &[u8; KEY_LEN], blob: &[u8], aad: &[u8]) -> Result<Vec<u8>, String> {
+    if blob.len() < NONCE_LEN + CHACHA20_POLY1305.tag_len() {
+        return Err("fallback entry is too short to be a sealed blob".to_string());
+    }
+    let unbound = UnboundKey::new(&CHACHA20_POLY1305, key)
+        .map_err(|_| "failed to build the fallback sealing key".to_string())?;
+    let opening = LessSafeKey::new(unbound);
+
+    let nonce_bytes: [u8; NONCE_LEN] = blob[..NONCE_LEN].try_into().expect("length checked");
+    let nonce = Nonce::assume_unique_for_key(nonce_bytes);
+
+    let mut in_out = blob[NONCE_LEN..].to_vec();
+    let plaintext = opening
+        .open_in_place(nonce, Aad::from(aad), &mut in_out)
+        .map_err(|_| {
+            "fallback entry failed authentication — wrong key, tampered data, or an entry \
+             moved between accounts"
+                .to_string()
+        })?;
+    Ok(plaintext.to_vec())
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn test_key() -> [u8; KEY_LEN] {
+        let mut key = [0u8; KEY_LEN];
+        SystemRandom::new().fill(&mut key).unwrap();
+        key
+    }
+
+    #[test]
+    fn round_trips_a_secret() {
+        let key = test_key();
+        let blob = protect(&key, b"hunter2", b"aad").unwrap();
+        assert_ne!(&blob[NONCE_LEN..], b"hunter2", "blob must not be plaintext");
+        assert_eq!(unprotect(&key, &blob, b"aad").unwrap(), b"hunter2");
+    }
+
+    #[test]
+    fn rejects_a_foreign_aad() {
+        // A blob moved to another account's slot must not decrypt — the same
+        // property dpapi_entropy provides on Windows.
+        let key = test_key();
+        let blob = protect(&key, b"secret", b"com.owncord.client\x01a.example").unwrap();
+        assert!(unprotect(&key, &blob, b"com.owncord.client\x01b.example").is_err());
+    }
+
+    #[test]
+    fn rejects_a_wrong_key_and_tampering() {
+        let key = test_key();
+        let blob = protect(&key, b"secret", b"aad").unwrap();
+
+        let other = test_key();
+        assert!(unprotect(&other, &blob, b"aad").is_err());
+
+        let mut tampered = blob.clone();
+        let last = tampered.len() - 1;
+        tampered[last] ^= 0x01;
+        assert!(unprotect(&key, &tampered, b"aad").is_err());
+
+        assert!(unprotect(&key, &blob[..NONCE_LEN], b"aad").is_err(), "truncated blob");
+    }
+
+    #[test]
+    fn nonces_are_unique_per_seal() {
+        let key = test_key();
+        let a = protect(&key, b"same", b"aad").unwrap();
+        let b = protect(&key, b"same", b"aad").unwrap();
+        assert_ne!(a, b, "two seals of the same plaintext must differ");
+    }
+
+    #[test]
+    fn creates_and_reuses_the_key_file() {
+        let dir = std::env::temp_dir().join(format!(
+            "owncord-fallback-key-test-{}",
+            std::process::id()
+        ));
+        let _ = fs::remove_dir_all(&dir);
+
+        let first = load_or_create_key(&dir).unwrap();
+        let second = load_or_create_key(&dir).unwrap();
+        assert_eq!(first, second, "the key must be stable across loads");
+
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            let mode = fs::metadata(dir.join(CREDENTIAL_FALLBACK_KEY_FILE))
+                .unwrap()
+                .permissions()
+                .mode();
+            assert_eq!(mode & 0o777, 0o600, "key file must be owner-only");
+        }
+
+        let _ = fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn rejects_a_corrupt_key_file() {
+        let dir = std::env::temp_dir().join(format!(
+            "owncord-fallback-badkey-test-{}",
+            std::process::id()
+        ));
+        let _ = fs::remove_dir_all(&dir);
+        fs::create_dir_all(&dir).unwrap();
+        fs::write(dir.join(CREDENTIAL_FALLBACK_KEY_FILE), b"short").unwrap();
+
+        let err = load_or_create_key(&dir).unwrap_err();
+        assert!(err.contains("expected 32"), "unexpected error: {err}");
+
+        let _ = fs::remove_dir_all(&dir);
+    }
+}
diff --git a/Client/tauri-client/src-tauri/src/lib.rs b/Client/tauri-client/src-tauri/src/lib.rs
index 8ccb4ec5..56d4cf01 100644
--- a/Client/tauri-client/src-tauri/src/lib.rs
+++ b/Client/tauri-client/src-tauri/src/lib.rs
@@ -3,7 +3,11 @@ mod constants;
 mod credentials;
 #[cfg(windows)]
 mod dpapi;
+#[cfg(not(windows))]
+mod fallback_crypto;
 mod http_proxy;
+#[cfg(target_os = "linux")]
+mod linux_media;
 mod livekit_proxy;
 mod ptt;
 mod secret_store;
@@ -135,6 +139,10 @@ pub fn run() {
             // persistent store, every later credential symptom follows from it.
             secret_store::log_compiled_backend();
             tray::create_tray(app.handle())?;
+            // WebKitGTK denies mic/camera access by default — grant it so
+            // voice/video works on Linux (no-op elsewhere; see linux_media).
+            #[cfg(target_os = "linux")]
+            linux_media::enable_media_capture(app.handle());
             Ok(())
         })
         .build(tauri::generate_context!())
diff --git a/Client/tauri-client/src-tauri/src/linux_media.rs b/Client/tauri-client/src-tauri/src/linux_media.rs
new file mode 100644
index 00000000..444ca5f0
--- /dev/null
+++ b/Client/tauri-client/src-tauri/src/linux_media.rs
@@ -0,0 +1,54 @@
+//! Linux-only WebKitGTK media capture support.
+//!
+//! On Windows and macOS the webview grants media capture itself (wry's
+//! WKWebView delegate auto-grants; WebView2 prompts). WebKitGTK does
+//! neither: `enable-media-stream` and `enable-webrtc` default to off, and
+//! any `permission-request` signal without a handler is denied. The result
+//! is that `navigator.mediaDevices.getUserMedia` fails and
+//! `enumerateDevices` returns nothing — no microphones or cameras are ever
+//! detected on Linux without this hook.
+//!
+//! Only media-related permission requests are granted here; everything else
+//! (geolocation, web notifications, …) falls through to WebKit's default
+//! deny so this hook does not widen the webview's surface beyond capture.
+
+use tauri::{AppHandle, Manager};
+
+/// Enable media streams / WebRTC on the main window's WebKitGTK webview and
+/// auto-grant its microphone/camera permission requests.
+pub fn enable_media_capture(app: &AppHandle) {
+    let Some(window) = app.get_webview_window("main") else {
+        log::error!("linux_media: main window not found; media capture stays unavailable");
+        return;
+    };
+    let result = window.with_webview(|webview| {
+        use webkit2gtk::glib::prelude::Cast;
+        use webkit2gtk::{
+            DeviceInfoPermissionRequest, PermissionRequestExt, SettingsExt,
+            UserMediaPermissionRequest, WebViewExt,
+        };
+
+        let webview = webview.inner();
+        if let Some(settings) = webview.settings() {
+            settings.set_enable_media_stream(true);
+            settings.set_enable_webrtc(true);
+        } else {
+            log::error!("linux_media: webview has no settings object");
+        }
+        webview.connect_permission_request(|_, request| {
+            // UserMediaPermissionRequest covers getUserMedia (mic/camera);
+            // DeviceInfoPermissionRequest covers enumerateDevices labels.
+            let is_media = request.downcast_ref::<UserMediaPermissionRequest>().is_some()
+                || request.downcast_ref::<DeviceInfoPermissionRequest>().is_some();
+            if is_media {
+                request.allow();
+                return true;
+            }
+            // Unhandled — WebKit applies its default (deny).
+            false
+        });
+    });
+    if let Err(e) = result {
+        log::error!("linux_media: failed to configure webview media capture: {e}");
+    }
+}
diff --git a/Client/tauri-client/src-tauri/src/secret_store.rs b/Client/tauri-client/src-tauri/src/secret_store.rs
index feb2f7c4..6d7453fb 100644
--- a/Client/tauri-client/src-tauri/src/secret_store.rs
+++ b/Client/tauri-client/src-tauri/src/secret_store.rs
@@ -32,15 +32,20 @@
 //!
 //! The keychain is the right store; the fallback is damage control, not a
 //! default. It engages only after a write has been proven not to round-trip,
-//! and only on Windows, where DPAPI can protect the file at rest with a
-//! user-scoped key. On macOS and Linux a failing Keychain / Secret Service is
-//! reported as an error rather than silently downgraded to a file — writing a
-//! login password or an identity private key to plaintext disk there would be a
-//! worse outcome than not persisting it.
+//! on every desktop platform. On Windows the fallback file is protected by
+//! DPAPI (user-scoped, key held by the OS). On macOS and Linux — where the
+//! thing that failed *is* the OS secret store, so no OS-held key is available
+//! — entries are sealed with ChaCha20-Poly1305 under a per-install random key
+//! file (owner-only, see [`crate::fallback_crypto`]). That is honest
+//! damage-control, not a vault: same-user malware can read both files, exactly
+//! as it could call DPAPI. What it fixes is the real-world failure this module
+//! kept hitting — a Linux desktop with no Secret Service provider (no
+//! gnome-keyring / KWallet) or a locked macOS Keychain previously had nowhere
+//! to save at all, so credentials and the voice-E2EE identity key silently
+//! never survived a restart. Secrets at rest are never plaintext, and the OS
+//! credential store always wins again the moment it starts round-tripping.
 
 use serde::Serialize;
-// Only the DPAPI fallback stores JSON values, and that is Windows-only.
-#[cfg(windows)]
 use serde_json::Value;
 use tauri::AppHandle;
 use tauri_plugin_store::StoreExt;
@@ -59,11 +64,24 @@ pub const SERVICE: &str = "com.owncord.client";
 pub enum Backend {
     /// The OS credential store. The expected answer on every healthy machine.
     Keyring,
-    /// DPAPI-protected file under the app data dir, used only after the OS
-    /// credential store accepted a write and then failed to return it.
+    /// DPAPI-protected file under the app data dir (Windows), used only after
+    /// the OS credential store accepted a write and then failed to return it.
+    // Constructed only on its own platform; both variants exist everywhere so
+    // the serialized Backend union is identical across OS builds.
+    #[cfg_attr(not(windows), allow(dead_code))]
     DpapiFile,
+    /// ChaCha20-Poly1305-sealed file under the app data dir (macOS/Linux),
+    /// engaged under the same failed-round-trip condition as `DpapiFile`.
+    #[cfg_attr(windows, allow(dead_code))]
+    EncryptedFile,
 }
 
+/// The fallback backend this platform's build parks degraded secrets in.
+#[cfg(windows)]
+const FALLBACK_BACKEND: Backend = Backend::DpapiFile;
+#[cfg(not(windows))]
+const FALLBACK_BACKEND: Backend = Backend::EncryptedFile;
+
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
@@ -114,10 +132,10 @@ pub fn set(app: &AppHandle, account: &str, secret: &str) -> Result<Backend, Stri
 
     set_fallback(app, account, secret)?;
     log::warn!(
-        "{SERVICE}: account '{account}' is stored in the DPAPI fallback file, not the OS \
+        "{SERVICE}: account '{account}' is stored in the encrypted fallback file, not the OS \
          credential store. See docs/credential-storage.md"
     );
-    Ok(Backend::DpapiFile)
+    Ok(FALLBACK_BACKEND)
 }
 
 /// Load the secret for `account`, or `None` when nothing is stored.
@@ -218,25 +236,64 @@ fn keyring_delete(account: &str) -> Result<(), String> {
 }
 
 // ---------------------------------------------------------------------------
-// Degraded-mode fallback (Windows only, DPAPI-protected)
+// Degraded-mode fallback (all desktop platforms; sealing differs per OS)
 // ---------------------------------------------------------------------------
 
-/// Entropy bound into the DPAPI blob for `account`.
+/// Associated data bound into the sealed blob for `account` (the DPAPI
+/// "entropy" on Windows, the AEAD AAD elsewhere).
 ///
 /// Including the service and account means a ciphertext lifted from one entry
 /// cannot be pasted over another and still decrypt — the identity key for one
 /// host cannot be made to load as another's.
-#[cfg(windows)]
-fn dpapi_entropy(account: &str) -> Vec<u8> {
+fn fallback_aad(account: &str) -> Vec<u8> {
     format!("{SERVICE}\u{1}{account}").into_bytes()
 }
 
+/// Seal `secret` for the fallback store. Windows: DPAPI (user-scoped, OS-held
+/// key). Elsewhere: ChaCha20-Poly1305 under the per-install key file.
 #[cfg(windows)]
+fn protect_secret(_app: &AppHandle, account: &str, secret: &str) -> Result<Vec<u8>, String> {
+    crate::dpapi::protect(secret.as_bytes(), &fallback_aad(account))
+        .map_err(|code| format!("DPAPI protect failed (Win32 error {code})"))
+}
+
+#[cfg(not(windows))]
+fn protect_secret(app: &AppHandle, account: &str, secret: &str) -> Result<Vec<u8>, String> {
+    use tauri::Manager;
+    let dir = app
+        .path()
+        .app_data_dir()
+        .map_err(|e| format!("cannot resolve the app data dir for the fallback key: {e}"))?;
+    let key = crate::fallback_crypto::load_or_create_key(&dir)?;
+    crate::fallback_crypto::protect(&key, secret.as_bytes(), &fallback_aad(account))
+}
+
+/// Open a blob written by [`protect_secret`]. Errors are logged by the caller.
+#[cfg(windows)]
+fn unprotect_secret(_app: &AppHandle, account: &str, blob: &[u8]) -> Result<Vec<u8>, String> {
+    crate::dpapi::unprotect(blob, &fallback_aad(account)).map_err(|code| {
+        format!(
+            "DPAPI unprotect failed (Win32 error {code}) — the entry was written by a \
+             different Windows user or on a different machine"
+        )
+    })
+}
+
+#[cfg(not(windows))]
+fn unprotect_secret(app: &AppHandle, account: &str, blob: &[u8]) -> Result<Vec<u8>, String> {
+    use tauri::Manager;
+    let dir = app
+        .path()
+        .app_data_dir()
+        .map_err(|e| format!("cannot resolve the app data dir for the fallback key: {e}"))?;
+    let key = crate::fallback_crypto::load_or_create_key(&dir)?;
+    crate::fallback_crypto::unprotect(&key, blob, &fallback_aad(account))
+}
+
 fn set_fallback(app: &AppHandle, account: &str, secret: &str) -> Result<(), String> {
     use base64::Engine as _;
 
-    let blob = crate::dpapi::protect(secret.as_bytes(), &dpapi_entropy(account))
-        .map_err(|code| format!("DPAPI protect failed (Win32 error {code})"))?;
+    let blob = protect_secret(app, account, secret)?;
     let encoded = base64::engine::general_purpose::STANDARD.encode(blob);
 
     let store = app
@@ -258,20 +315,6 @@ fn set_fallback(app: &AppHandle, account: &str, secret: &str) -> Result<(), Stri
     Ok(())
 }
 
-#[cfg(not(windows))]
-fn set_fallback(_app: &AppHandle, account: &str, _secret: &str) -> Result<(), String> {
-    // Deliberately no file fallback here: see the module header. The Keychain
-    // and Secret Service are the right stores on these platforms, and a
-    // plaintext file holding a login password or an identity private key is a
-    // worse outcome than failing to persist.
-    Err(format!(
-        "the OS credential store did not accept '{account}' and there is no fallback store on \
-         this platform — check that the Keychain (macOS) or a Secret Service provider such as \
-         gnome-keyring / KWallet (Linux) is running and unlocked"
-    ))
-}
-
-#[cfg(windows)]
 fn get_fallback(app: &AppHandle, account: &str) -> Option<String> {
     use base64::Engine as _;
 
@@ -287,22 +330,14 @@ fn get_fallback(app: &AppHandle, account: &str) -> Option<String> {
         .decode(encoded)
         .map_err(|e| log::warn!("credential fallback entry for '{account}' is not base64: {e}"))
         .ok()?;
-    let plaintext = crate::dpapi::unprotect(&blob, &dpapi_entropy(account))
-        .map_err(|code| {
-            log::warn!("DPAPI unprotect failed for '{account}' (Win32 error {code}) — the entry \
-                        was written by a different Windows user or on a different machine")
-        })
+    let plaintext = unprotect_secret(app, account, &blob)
+        .map_err(|e| log::warn!("credential fallback entry for '{account}' did not open: {e}"))
         .ok()?;
     String::from_utf8(plaintext)
         .map_err(|_| log::warn!("credential fallback entry for '{account}' is not valid UTF-8"))
         .ok()
 }
 
-#[cfg(not(windows))]
-fn get_fallback(_app: &AppHandle, _account: &str) -> Option<String> {
-    None
-}
-
 /// Drop any fallback copy of `account`. Best-effort: a failure here is logged,
 /// never propagated, because it must not mask the outcome of the real store.
 fn clear_fallback(app: &AppHandle, account: &str) {
@@ -353,9 +388,9 @@ mod tests {
     }
 
     /// Pins the IPC wire format to the variant names, which is what
-    /// `tauri-typegen` emits into `generated/types.ts` as
-    /// `type Backend = "Keyring" | "DpapiFile"`. Renaming a variant, or adding
-    /// a serde rename, desyncs the generated union from the runtime value.
+    /// `tauri-typegen` emits into `generated/types.ts`. Renaming a variant, or
+    /// adding a serde rename, desyncs the generated union from the runtime
+    /// value.
     #[test]
     fn backend_serializes_as_its_variant_name() {
         assert_eq!(
@@ -366,26 +401,29 @@ mod tests {
             serde_json::to_string(&Backend::DpapiFile).unwrap(),
             "\"DpapiFile\""
         );
+        assert_eq!(
+            serde_json::to_string(&Backend::EncryptedFile).unwrap(),
+            "\"EncryptedFile\""
+        );
     }
 
-    #[cfg(windows)]
     #[test]
-    fn dpapi_entropy_is_account_specific() {
-        assert_ne!(dpapi_entropy("host.example"), dpapi_entropy("identity:host.example"));
-        assert_eq!(dpapi_entropy("host.example"), dpapi_entropy("host.example"));
+    fn fallback_aad_is_account_specific() {
+        assert_ne!(fallback_aad("host.example"), fallback_aad("identity:host.example"));
+        assert_eq!(fallback_aad("host.example"), fallback_aad("host.example"));
     }
 
     #[cfg(windows)]
     #[test]
     fn dpapi_round_trips_and_rejects_foreign_entropy() {
         let secret = b"eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2In0";
-        let blob = crate::dpapi::protect(secret, &dpapi_entropy("identity:a.example")).unwrap();
+        let blob = crate::dpapi::protect(secret, &fallback_aad("identity:a.example")).unwrap();
         assert_ne!(blob.as_slice(), secret.as_slice(), "blob must not be plaintext");
 
-        let back = crate::dpapi::unprotect(&blob, &dpapi_entropy("identity:a.example")).unwrap();
+        let back = crate::dpapi::unprotect(&blob, &fallback_aad("identity:a.example")).unwrap();
         assert_eq!(back, secret);
 
         // A blob moved to another account's slot must not decrypt.
-        assert!(crate::dpapi::unprotect(&blob, &dpapi_entropy("identity:b.example")).is_err());
+        assert!(crate::dpapi::unprotect(&blob, &fallback_aad("identity:b.example")).is_err());
     }
 }
diff --git a/Client/tauri-client/src-tauri/tauri.conf.json b/Client/tauri-client/src-tauri/tauri.conf.json
index d1d19905..926263cb 100644
--- a/Client/tauri-client/src-tauri/tauri.conf.json
+++ b/Client/tauri-client/src-tauri/tauri.conf.json
@@ -1,6 +1,6 @@
 {
   "productName": "OwnCord",
-  "version": "1.1.0-alpha.5",
+  "version": "1.2.0-alpha.1",
   "identifier": "com.owncord.client",
   "build": {
     "frontendDist": "../dist",
diff --git a/Client/tauri-client/src/components/AdminActions.ts b/Client/tauri-client/src/components/AdminActions.ts
index 2a6b5985..82ebe222 100644
--- a/Client/tauri-client/src/components/AdminActions.ts
+++ b/Client/tauri-client/src/components/AdminActions.ts
@@ -1,9 +1,10 @@
 /**
  * AdminActions — context menu helpers for admin operations on members and channels.
- * Provides confirmation steps for destructive actions (kick, ban, delete).
+ * Provides confirmation steps for destructive actions (force logout, ban, delete).
  */
 
 import { createElement, appendChildren, setText } from "@lib/dom";
+import { appendPurgeSection } from "./purge-prompt";
 
 // ---------------------------------------------------------------------------
 // Types
@@ -14,18 +15,51 @@ export interface MemberContextMenuOptions {
   username: string;
   currentRole: string;
   availableRoles: readonly string[];
+  /** When false, only the non-admin actions (block/unblock) are rendered. */
+  showAdminActions: boolean;
+  /**
+   * Per-action gates, each defaulting to `showAdminActions`. They mirror the
+   * server's KICK_MEMBERS / BAN_MEMBERS / MANAGE_ROLES bits so a moderator
+   * sees only the actions its role actually holds. canKick gates "Force
+   * Logout" — the KICK_MEMBERS bit buys session revocation, not removal.
+   */
+  canKick?: boolean;
+  canBan?: boolean;
+  canManageRoles?: boolean;
+  /** Whether the local user currently blocks this member (labels the toggle). */
+  isBlocked: boolean;
+  onToggleBlock(): Promise<void>;
+  /** Revokes every session the target holds (the "Force Logout" item). */
   onKick(): Promise<void>;
-  /** The reason is stored and displayed by the server; empty means "no reason given". */
-  onBan(reason: string): Promise<void>;
+  /**
+   * The reason is stored and displayed by the server; empty means "no reason
+   * given". durationHours 0 = permanent, otherwise the ban auto-expires.
+   */
+  onBan(reason: string, durationHours: number): Promise<void>;
   onChangeRole(newRole: string): Promise<void>;
 }
 
+/** Ban duration choices offered in the ban flow (label → hours; 0 = permanent). */
+const BAN_DURATIONS: readonly { readonly label: string; readonly hours: number }[] = [
+  { label: "Forever", hours: 0 },
+  { label: "1 hour", hours: 1 },
+  { label: "1 day", hours: 24 },
+  { label: "7 days", hours: 24 * 7 },
+  { label: "30 days", hours: 24 * 30 },
+] as const;
+
 export interface ChannelContextMenuOptions {
   channelId: number;
   channelName: string;
   onEdit(): void;
   onDelete(): Promise<void>;
   onCreate(): void;
+  /**
+   * Bulk-delete the newest `count` messages. Omitted when the local user's
+   * role lacks MANAGE_MESSAGES — the section is then not rendered at all,
+   * mirroring the server's gate.
+   */
+  onPurge?(count: number): Promise<void>;
 }
 
 interface ContextMenuResult {
@@ -60,7 +94,7 @@ const CONFIRM_TIMEOUT_MS = 4000;
  *
  * The armed state auto-disarms after a few seconds so a menu left open doesn't
  * turn a stray second click into a ban, and the item shows progress while the
- * request is running — a slow kick used to look like nothing happened.
+ * request is running — a slow force logout used to look like nothing happened.
  */
 function withConfirmation(
   item: HTMLDivElement,
@@ -130,66 +164,155 @@ export function createMemberContextMenu(options: MemberContextMenuOptions): Cont
   const ac = new AbortController();
   const menu = createElement("div", { class: "context-menu" });
 
-  // Role submenu trigger
-  const roleItem = createElement(
+  // Block / Unblock — available to every member, not just admins. Blocking is
+  // disruptive (kills DMs both ways) so it confirms; unblocking is one click.
+  const blockItem = createElement(
     "div",
     {
-      class: "context-menu__item",
+      class: options.isBlocked
+        ? "context-menu__item"
+        : "context-menu__item context-menu__item--danger",
+      "data-testid": "block-toggle",
     },
-    "Change Role",
+    options.isBlocked ? "Unblock" : "Block",
   );
-
-  const roleSub = createElement("div", { class: "context-menu__submenu" });
-  for (const role of options.availableRoles) {
-    const cls =
-      role === options.currentRole
-        ? "context-menu__item context-menu__item--active"
-        : "context-menu__item";
-    const roleOption = createMenuItem(
-      role,
-      cls,
-      () => {
-        if (role !== options.currentRole) {
-          void options.onChangeRole(role);
-        }
+  if (options.isBlocked) {
+    let unblockRunning = false;
+    blockItem.addEventListener(
+      "click",
+      (e) => {
+        e.stopPropagation();
+        if (unblockRunning) return;
+        unblockRunning = true;
+        setText(blockItem, "Unblocking...");
+        blockItem.classList.add("context-menu__item--pending");
+        const done = (): void => {
+          unblockRunning = false;
+          blockItem.classList.remove("context-menu__item--pending");
+          setText(blockItem, "Unblock");
+        };
+        void options.onToggleBlock().then(done, done);
       },
+      { signal: ac.signal },
+    );
+  } else {
+    withConfirmation(
+      blockItem,
+      "Are you sure?",
+      () => options.onToggleBlock(),
       ac.signal,
+      "Blocking...",
     );
-    roleSub.appendChild(roleOption);
   }
 
-  roleItem.addEventListener(
-    "mouseenter",
-    () => {
-      roleSub.style.display = "";
-    },
-    { signal: ac.signal },
-  );
-  roleItem.addEventListener(
-    "mouseleave",
-    () => {
-      roleSub.style.display = "none";
-    },
-    { signal: ac.signal },
-  );
+  const canManageRoles = options.canManageRoles ?? options.showAdminActions;
+  const canKick = options.canKick ?? options.showAdminActions;
+  const canBan = options.canBan ?? options.showAdminActions;
 
-  roleSub.style.display = "none";
-  appendChildren(roleItem, roleSub);
-  menu.appendChild(roleItem);
+  if (!options.showAdminActions || (!canManageRoles && !canKick && !canBan)) {
+    menu.appendChild(blockItem);
+    return {
+      element: menu,
+      destroy(): void {
+        ac.abort();
+        menu.remove();
+      },
+    };
+  }
+
+  // Role submenu trigger
+  if (canManageRoles) {
+    const roleItem = createElement(
+      "div",
+      {
+        class: "context-menu__item",
+      },
+      "Change Role",
+    );
+
+    const roleSub = createElement("div", { class: "context-menu__submenu" });
+    for (const role of options.availableRoles) {
+      const cls =
+        role === options.currentRole
+          ? "context-menu__item context-menu__item--active"
+          : "context-menu__item";
+      const roleOption = createMenuItem(
+        role,
+        cls,
+        () => {
+          if (role !== options.currentRole) {
+            void options.onChangeRole(role);
+          }
+        },
+        ac.signal,
+      );
+      roleSub.appendChild(roleOption);
+    }
+
+    roleItem.addEventListener(
+      "mouseenter",
+      () => {
+        roleSub.style.display = "";
+      },
+      { signal: ac.signal },
+    );
+    roleItem.addEventListener(
+      "mouseleave",
+      () => {
+        roleSub.style.display = "none";
+      },
+      { signal: ac.signal },
+    );
+
+    roleSub.style.display = "none";
+    appendChildren(roleItem, roleSub);
+    menu.appendChild(roleItem);
+
+    menu.appendChild(createSeparator());
+  }
+
+  // Force Logout with confirmation. Named for what it does: the server revokes
+  // the target's sessions (KICK_MEMBERS), it does not remove a membership —
+  // there is no membership model — so the user can sign straight back in.
+  if (canKick) {
+    const kickItem = createElement(
+      "div",
+      {
+        class: "context-menu__item context-menu__item--danger",
+        "data-testid": "force-logout",
+      },
+      "Force Logout",
+    );
+    withConfirmation(
+      kickItem,
+      "Log them out?",
+      () => options.onKick(),
+      ac.signal,
+      "Logging out...",
+    );
+    menu.appendChild(kickItem);
+  }
+
+  if (canBan) appendBanFlow(menu, options, ac.signal);
 
   menu.appendChild(createSeparator());
+  menu.appendChild(blockItem);
 
-  // Kick with confirmation
-  const kickItem = createElement(
-    "div",
-    {
-      class: "context-menu__item context-menu__item--danger",
-    },
-    "Kick",
-  );
-  withConfirmation(kickItem, "Are you sure?", () => options.onKick(), ac.signal, "Kicking...");
-  menu.appendChild(kickItem);
+  function destroy(): void {
+    ac.abort();
+    menu.remove();
+  }
 
+  return { element: menu, destroy };
+}
+
+/** Ban entry plus its reason/duration form. Split out so the member menu can
+ *  omit it wholesale for an actor without BAN_MEMBERS. */
+function appendBanFlow(
+  menu: HTMLDivElement,
+  options: MemberContextMenuOptions,
+  signal: AbortSignal,
+): void {
   // Ban — collects the reason the server stores and displays alongside the ban.
   const banItem = createElement(
     "div",
@@ -210,12 +333,21 @@ export function createMemberContextMenu(options: MemberContextMenuOptions): Cont
     "data-testid": "ban-reason-input",
     style: "width:100%;font-size:12px",
   });
+  const banDurationSelect = createElement("select", {
+    class: "form-input",
+    "data-testid": "ban-duration-select",
+    style: "width:100%;font-size:12px;margin-top:4px",
+  });
+  for (const d of BAN_DURATIONS) {
+    const opt = createElement("option", { value: String(d.hours) }, d.label);
+    banDurationSelect.appendChild(opt);
+  }
   const banConfirm = createElement(
     "div",
     { class: "context-menu__item context-menu__item--danger", "data-testid": "ban-confirm" },
     "Confirm Ban",
   );
-  appendChildren(banReasonRow, banReasonInput, banConfirm);
+  appendChildren(banReasonRow, banReasonInput, banDurationSelect, banConfirm);
 
   banItem.addEventListener(
     "click",
@@ -225,12 +357,16 @@ export function createMemberContextMenu(options: MemberContextMenuOptions): Cont
       banReasonRow.style.display = "";
       banReasonInput.focus();
     },
-    { signal: ac.signal },
+    { signal },
   );
 
   // Typing a reason must not close the menu or trigger the outside-click guard.
-  banReasonInput.addEventListener("click", (e) => e.stopPropagation(), { signal: ac.signal });
-  banReasonInput.addEventListener("mousedown", (e) => e.stopPropagation(), { signal: ac.signal });
+  banReasonInput.addEventListener("click", (e) => e.stopPropagation(), { signal });
+  banReasonInput.addEventListener("mousedown", (e) => e.stopPropagation(), { signal });
+  banDurationSelect.addEventListener("click", (e) => e.stopPropagation(), { signal });
+  banDurationSelect.addEventListener("mousedown", (e) => e.stopPropagation(), {
+    signal,
+  });
 
   let banRunning = false;
   function submitBan(): void {
@@ -243,7 +379,8 @@ export function createMemberContextMenu(options: MemberContextMenuOptions): Cont
       banConfirm.classList.remove("context-menu__item--pending");
       setText(banConfirm, "Confirm Ban");
     };
-    void options.onBan(banReasonInput.value.trim()).then(done, done);
+    const durationHours = Number.parseInt(banDurationSelect.value, 10) || 0;
+    void options.onBan(banReasonInput.value.trim(), durationHours).then(done, done);
   }
 
   banConfirm.addEventListener(
@@ -252,7 +389,7 @@ export function createMemberContextMenu(options: MemberContextMenuOptions): Cont
       e.stopPropagation();
       submitBan();
     },
-    { signal: ac.signal },
+    { signal },
   );
   banReasonInput.addEventListener(
     "keydown",
@@ -262,17 +399,10 @@ export function createMemberContextMenu(options: MemberContextMenuOptions): Cont
         submitBan();
       }
     },
-    { signal: ac.signal },
+    { signal },
   );
 
   appendChildren(menu, banItem, banReasonRow);
-
-  function destroy(): void {
-    ac.abort();
-    menu.remove();
-  }
-
-  return { element: menu, destroy };
 }
 
 // ---------------------------------------------------------------------------
@@ -314,6 +444,17 @@ export function createChannelContextMenu(options: ChannelContextMenuOptions): Co
   withConfirmation(deleteItem, "Are you sure?", () => options.onDelete(), ac.signal, "Deleting...");
   menu.appendChild(deleteItem);
 
+  const onPurge = options.onPurge;
+  if (onPurge !== undefined) {
+    appendPurgeSection(menu, {
+      itemClass: "context-menu__item",
+      dangerItemClass: "context-menu__item context-menu__item--danger",
+      separatorClass: "context-menu__separator",
+      onPurge: (count) => onPurge(count),
+      signal: ac.signal,
+    });
+  }
+
   function destroy(): void {
     ac.abort();
     menu.remove();
diff --git a/Client/tauri-client/src/components/ChannelSidebar.ts b/Client/tauri-client/src/components/ChannelSidebar.ts
index 33e2ce79..f8c2448b 100644
--- a/Client/tauri-client/src/components/ChannelSidebar.ts
+++ b/Client/tauri-client/src/components/ChannelSidebar.ts
@@ -7,26 +7,28 @@
 import { createElement, setText, clearChildren, appendChildren } from "@lib/dom";
 import { createIcon, type IconName } from "@lib/icons";
 import type { MountableComponent } from "@lib/safe-render";
-import {
-  channelsStore,
-  getChannelsByCategory,
-  setActiveChannel,
-  clearUnread,
-} from "@stores/channels.store";
+import { channelsStore, getChannelsByCategory } from "@stores/channels.store";
+import { navigateToChannel } from "@lib/channel-navigation";
+import { markAllRead, unreadChannelIds } from "@lib/read-state";
+import { isChannelMuted } from "@lib/channel-mutes";
+import { dmStore } from "@stores/dm.store";
 import type { Channel } from "@stores/channels.store";
 import { authStore, getCurrentUser } from "@stores/auth.store";
 import { uiStore, toggleCategory, isCategoryCollapsed } from "@stores/ui.store";
 import { voiceStore, getChannelVoiceUsers, getPeerVerification } from "@stores/voice.store";
-import type { PeerVerification } from "@stores/voice.store";
+import type { PeerVerification, VoiceUser } from "@stores/voice.store";
 import { SCREENSHARE_TILE_ID_OFFSET } from "@lib/constants";
 import { attachStreamPreview, attachScrollCollapse } from "@lib/streamPreview";
 import { showUserVolumeMenu } from "./channel-sidebar/volume-menu";
-import { attachChannelContextMenu } from "./channel-sidebar/context-menu";
+import type { VoiceModMenuOptions } from "./channel-sidebar/volume-menu";
+import { attachChannelContextMenu, CHANNEL_MUTE_CHANGED } from "./channel-sidebar/context-menu";
 import { attachDragHandlers, releaseGlobalDragListeners } from "./channel-sidebar/drag-reorder";
 import { rePinPeerIdentity } from "@lib/livekitSession";
 import { createIdentityMismatchModal } from "./CertMismatchModal";
 import { createLogger } from "@lib/logger";
 import { membersStore } from "@stores/members.store";
+import { roleHasPermission, canManageChannels } from "@lib/permissions";
+import { Permission } from "@lib/types";
 import { importIdentityPublicKey, computeKeyFingerprint } from "@lib/e2eeCrypto";
 
 const log = createLogger("ChannelSidebar");
@@ -139,9 +141,30 @@ export interface ChannelReorderData {
   readonly newPosition: number;
 }
 
+/** Moderator actions on another user's voice session. Supplied by the page,
+ *  which owns the WS socket; the sidebar only decides whether to offer them. */
+export interface VoiceModerationCallbacks {
+  readonly onServerMute: (channelId: number, userId: number, muted: boolean) => void;
+  readonly onServerDeafen: (channelId: number, userId: number, deafened: boolean) => void;
+  readonly onMove: (userId: number, toChannelId: number) => void;
+  readonly onDisconnect: (userId: number) => void;
+}
+
+/** Whether the signed-in user's role holds MUTE_MEMBERS. The server enforces
+ *  it (and the rank rule the client cannot evaluate); this only decides whether
+ *  the menu is worth offering. Derived through the same helper as the
+ *  member-list moderation gates so the two cannot disagree about who is a
+ *  moderator. */
+export function canModerateVoice(): boolean {
+  const role = getCurrentUser()?.role ?? "";
+  return roleHasPermission(role, Permission.MUTE_MEMBERS);
+}
+
 export interface ChannelSidebarOptions {
   readonly onVoiceJoin: (channelId: number) => void;
   readonly onVoiceLeave: () => void;
+  /** Voice moderation wiring; the moderation menu section is hidden without it. */
+  readonly onVoiceModerate?: VoiceModerationCallbacks;
   /** Called when the user clicks the "+" on a category header. */
   readonly onCreateChannel?: (category: string) => void;
   /** Called when the user right-clicks a channel and selects Edit. */
@@ -150,6 +173,8 @@ export interface ChannelSidebarOptions {
   readonly onDeleteChannel?: (channel: Channel) => void;
   /** Called when the user drags a channel to a new position. */
   readonly onReorderChannel?: (reorders: readonly ChannelReorderData[]) => void;
+  /** Bulk-delete the newest `count` messages; gated on MANAGE_MESSAGES. */
+  readonly onPurgeChannel?: (channel: Channel, count: number) => Promise<void>;
   /** Called when the user clicks a voice user row to watch their stream. */
   readonly onWatchStream?: (userId: number) => void;
 }
@@ -164,6 +189,39 @@ function pickAvatarColor(username: string): string {
   return AVATAR_COLORS[Math.abs(hash) % AVATAR_COLORS.length] ?? "#5865f2";
 }
 
+/**
+ * The marker on an age-restricted channel row.
+ *
+ * A glyph plus a title rather than a coloured name: the flag is information
+ * about the channel, and recolouring the name would collide with the unread
+ * and mention states the row already encodes that way.
+ */
+function nsfwIndicator(channelId: number): HTMLSpanElement {
+  const badge = createElement("span", {
+    class: "ch-nsfw",
+    "data-testid": `channel-nsfw-${channelId}`,
+    "aria-label": "Age restricted",
+  });
+  badge.title = "Age-restricted channel";
+  badge.appendChild(createIcon("shield-alert", 13));
+  return badge;
+}
+
+/**
+ * "3/5" for a voice channel that has a user limit, or null when it is
+ * unlimited (0) — a count with no ceiling is already shown by the participant
+ * rows underneath, and "3/0" would read as a bug.
+ *
+ * Purely a readout: the server owns capacity and refuses a join over the limit
+ * with CHANNEL_FULL. The client never blocks the click, because its copy of
+ * the participant list can lag and a join it refused locally would be a
+ * mistake nobody could correct.
+ */
+function voiceCapacityLabel(channel: Channel, connected: number): string | null {
+  if (channel.voiceMaxUsers <= 0) return null;
+  return `${connected}/${channel.voiceMaxUsers}`;
+}
+
 function renderTextChannelItem(
   channel: Channel,
   isActive: boolean,
@@ -173,6 +231,7 @@ function renderTextChannelItem(
     "channel-item",
     isActive ? "active" : "",
     channel.unreadCount > 0 ? "unread" : "",
+    channel.mentionCount > 0 ? "mentioned" : "",
   ]
     .filter(Boolean)
     .join(" ");
@@ -190,29 +249,77 @@ function renderTextChannelItem(
 
   appendChildren(item, prefix, name);
 
-  if (channel.unreadCount > 0) {
-    const badge = createElement("span", { class: "unread-badge" }, String(channel.unreadCount));
+  // Age-restricted marker. Next to the name rather than replacing the "#", so
+  // the channel still reads as a channel and the mark is visible whether or
+  // not the reader has already accepted the gate this session.
+  if (channel.nsfw) {
+    item.appendChild(nsfwIndicator(channel.id));
+  }
+
+  // A muted channel still counts its unreads — it has not stopped existing,
+  // it has stopped shouting — so the badge dims rather than disappearing. The
+  // mention badge is deliberately left alone: a mute silences chatter, never
+  // something addressed to the reader.
+  const muted = isChannelMuted(channel.id);
+  if (muted) {
+    item.classList.add("muted");
+  }
+
+  // A mention badge outranks the plain unread badge: only one is shown, and
+  // it counts the mentions, not the messages.
+  if (channel.mentionCount > 0) {
+    const badge = createElement(
+      "span",
+      { class: "mention-badge", "data-testid": `channel-mentions-${channel.id}` },
+      String(channel.mentionCount),
+    );
+    badge.title = `${channel.mentionCount} mention${channel.mentionCount === 1 ? "" : "s"}`;
+    item.appendChild(badge);
+  } else if (channel.unreadCount > 0) {
+    const badge = createElement(
+      "span",
+      { class: muted ? "unread-badge muted" : "unread-badge" },
+      String(channel.unreadCount),
+    );
     item.appendChild(badge);
   }
 
-  item.addEventListener(
-    "click",
-    () => {
-      setActiveChannel(channel.id);
-      clearUnread(channel.id);
-    },
-    { signal },
-  );
+  item.addEventListener("click", () => navigateToChannel(channel.id), { signal });
 
   return item;
 }
 
+/** Moderation section for one participant row, or undefined when the local
+ *  user may not moderate voice (which hides the section entirely). Move targets
+ *  are the other voice channels; the server re-checks that the TARGET may
+ *  connect to the one picked. */
+function buildVoiceModOptions(
+  channelId: number,
+  user: VoiceUser,
+  cb?: VoiceModerationCallbacks,
+): VoiceModMenuOptions | undefined {
+  if (cb === undefined || !canModerateVoice()) return undefined;
+  const moveTargets = Array.from(channelsStore.getState().channels.values())
+    .filter((ch) => ch.type === "voice" && ch.id !== channelId)
+    .map((ch) => ({ id: ch.id, name: ch.name }));
+  return {
+    serverMuted: user.serverMuted === true,
+    serverDeafened: user.serverDeafened === true,
+    moveTargets,
+    onServerMute: (muted) => cb.onServerMute(channelId, user.userId, muted),
+    onServerDeafen: (deafened) => cb.onServerDeafen(channelId, user.userId, deafened),
+    onMove: (toChannelId) => cb.onMove(user.userId, toChannelId),
+    onDisconnect: () => cb.onDisconnect(user.userId),
+  };
+}
+
 function renderVoiceChannelItem(
   channel: Channel,
   signal: AbortSignal,
   onVoiceJoin: (channelId: number) => void,
   onVoiceLeave: () => void,
   onWatchStream?: (userId: number) => void,
+  onVoiceModerate?: VoiceModerationCallbacks,
 ): HTMLDivElement {
   const voiceState = voiceStore.getState();
   const isJoined = voiceState.currentChannelId === channel.id;
@@ -243,6 +350,22 @@ function renderVoiceChannelItem(
 
   appendChildren(item, prefix, name);
 
+  if (channel.nsfw) {
+    item.appendChild(nsfwIndicator(channel.id));
+  }
+
+  const voiceUsers = getChannelVoiceUsers(channel.id);
+  const capacity = voiceCapacityLabel(channel, voiceUsers.length);
+  if (capacity !== null) {
+    const badge = createElement(
+      "span",
+      { class: "ch-capacity", "data-testid": `channel-capacity-${channel.id}` },
+      capacity,
+    );
+    badge.title = `${voiceUsers.length} of ${channel.voiceMaxUsers} connected`;
+    item.appendChild(badge);
+  }
+
   item.addEventListener(
     "click",
     () => {
@@ -260,7 +383,6 @@ function renderVoiceChannelItem(
   wrapper.appendChild(item);
 
   // Render connected voice users below the channel
-  const voiceUsers = getChannelVoiceUsers(channel.id);
   if (voiceUsers.length > 0) {
     const usersContainer = createElement("div", { class: "voice-users-list" });
     for (const user of voiceUsers) {
@@ -293,17 +415,26 @@ function renderVoiceChannelItem(
         row.appendChild(liveBadge);
       }
 
+      // A moderator-imposed mute/deafen gets its own class and tooltip: the
+      // same mic-off glyph would otherwise read as an ordinary self-mute.
       if (user.deafened) {
-        // Deafened: show both mic-off and headphones-off
-        const muteIcon = createElement("span", { class: "vu-muted" });
+        const muteIcon = createElement("span", {
+          class: user.serverMuted === true ? "vu-muted vu-server-muted" : "vu-muted",
+        });
+        if (user.serverMuted === true) muteIcon.title = "Muted by a moderator";
         muteIcon.appendChild(createIcon("mic-off", 14));
-        const deafIcon = createElement("span", { class: "vu-muted" });
+        const deafIcon = createElement("span", {
+          class: user.serverDeafened === true ? "vu-muted vu-server-muted" : "vu-muted",
+        });
+        if (user.serverDeafened === true) deafIcon.title = "Deafened by a moderator";
         deafIcon.appendChild(createIcon("headphones-off", 14));
         row.appendChild(muteIcon);
         row.appendChild(deafIcon);
       } else if (user.muted) {
-        // Muted only: show mic-off
-        const muteIcon = createElement("span", { class: "vu-muted" });
+        const muteIcon = createElement("span", {
+          class: user.serverMuted === true ? "vu-muted vu-server-muted" : "vu-muted",
+        });
+        if (user.serverMuted === true) muteIcon.title = "Muted by a moderator";
         muteIcon.appendChild(createIcon("mic-off", 14));
         row.appendChild(muteIcon);
       }
@@ -349,6 +480,7 @@ function renderVoiceChannelItem(
               e.clientX,
               e.clientY,
               signal,
+              buildVoiceModOptions(channel.id, user, onVoiceModerate),
             );
           },
           { signal },
@@ -419,14 +551,23 @@ function renderChannelItem(
   channels?: readonly Channel[],
   onReorderChannel?: (reorders: readonly ChannelReorderData[]) => void,
   onWatchStream?: (userId: number) => void,
+  onVoiceModerate?: VoiceModerationCallbacks,
+  onPurgeChannel?: (channel: Channel, count: number) => Promise<void>,
 ): HTMLDivElement {
   let el: HTMLDivElement;
   if (channel.type === "voice") {
-    el = renderVoiceChannelItem(channel, signal, onVoiceJoin, onVoiceLeave, onWatchStream);
+    el = renderVoiceChannelItem(
+      channel,
+      signal,
+      onVoiceJoin,
+      onVoiceLeave,
+      onWatchStream,
+      onVoiceModerate,
+    );
   } else {
     el = renderTextChannelItem(channel, isActive, signal);
   }
-  attachChannelContextMenu(el, channel, signal, onEditChannel, onDeleteChannel);
+  attachChannelContextMenu(el, channel, signal, onEditChannel, onDeleteChannel, onPurgeChannel);
   if (containerEl !== undefined && channels !== undefined) {
     attachDragHandlers(el, channel, containerEl, channels, signal, onReorderChannel);
   }
@@ -445,6 +586,8 @@ function renderCategoryGroup(
   onDeleteChannel?: (channel: Channel) => void,
   onReorderChannel?: (reorders: readonly ChannelReorderData[]) => void,
   onWatchStream?: (userId: number) => void,
+  onVoiceModerate?: VoiceModerationCallbacks,
+  onPurgeChannel?: (channel: Channel, count: number) => Promise<void>,
 ): HTMLDivElement {
   const group = createElement("div", {});
 
@@ -462,11 +605,11 @@ function renderCategoryGroup(
     appendChildren(header, arrow, label);
 
     if (onCreateChannel !== undefined) {
-      const user = getCurrentUser();
-      const role = user?.role?.toLowerCase() ?? "";
-      const canManageChannels = role === "owner" || role === "admin";
-
-      if (canManageChannels) {
+      // MANAGE_CHANNELS is enforced server-side on /admin/api/channels*, so
+      // gate on the bit; the role-name check only stands in when the `ready`
+      // role list has no entry for this role. Same derivation as the channel
+      // context menu's Edit/Delete items.
+      if (canManageChannels()) {
         const addBtn = createElement(
           "span",
           {
@@ -514,6 +657,8 @@ function renderCategoryGroup(
             channels,
             onReorderChannel,
             onWatchStream,
+            onVoiceModerate,
+            onPurgeChannel,
           ),
         );
       }
@@ -536,6 +681,8 @@ function renderCategoryGroup(
           channels,
           onReorderChannel,
           onWatchStream,
+          onVoiceModerate,
+          onPurgeChannel,
         ),
       );
     }
@@ -554,11 +701,14 @@ export function createChannelSidebar(options: ChannelSidebarOptions): MountableC
     onDeleteChannel,
     onReorderChannel,
     onWatchStream,
+    onVoiceModerate,
+    onPurgeChannel,
   } = options;
   const ac = new AbortController();
   let root: HTMLDivElement | null = null;
   let channelList: HTMLDivElement | null = null;
   let serverNameEl: HTMLSpanElement | null = null;
+  let markAllBtn: HTMLButtonElement | null = null;
 
   const unsubscribers: Array<() => void> = [];
 
@@ -576,7 +726,15 @@ export function createChannelSidebar(options: ChannelSidebarOptions): MountableC
     }
   }
 
+  /** Hide Mark All as Read while nothing is unread — a header button that can
+   *  never do anything is worse than no button. */
+  function updateMarkAllBtn(): void {
+    if (markAllBtn === null) return;
+    markAllBtn.classList.toggle("visible", unreadChannelIds().length > 0);
+  }
+
   function renderChannels(): void {
+    updateMarkAllBtn();
     if (channelList === null) {
       return;
     }
@@ -613,6 +771,8 @@ export function createChannelSidebar(options: ChannelSidebarOptions): MountableC
           onDeleteChannel,
           onReorderChannel,
           onWatchStream,
+          onVoiceModerate,
+          onPurgeChannel,
         ),
       );
     }
@@ -620,8 +780,14 @@ export function createChannelSidebar(options: ChannelSidebarOptions): MountableC
     rebuildVoiceRowCache();
   }
 
+  /** Redraw when a row's mute is toggled (see CHANNEL_MUTE_CHANGED). */
+  function handleMuteChanged(): void {
+    renderChannels();
+  }
+
   function mount(container: Element): void {
     root = createElement("div", { class: "channel-sidebar", "data-testid": "channel-sidebar" });
+    root.addEventListener(CHANNEL_MUTE_CHANGED, handleMuteChanged, { signal: ac.signal });
 
     // Header
     const header = createElement("div", { class: "channel-sidebar-header" });
@@ -629,6 +795,26 @@ export function createChannelSidebar(options: ChannelSidebarOptions): MountableC
     serverNameEl = createElement("h2", {}, authState.serverName ?? "Server Name");
     header.appendChild(serverNameEl);
 
+    // Mark All as Read lives on the server header — it is a server-wide action,
+    // and it only appears while something is actually unread so the header does
+    // not carry a permanently dead button.
+    markAllBtn = createElement("button", {
+      class: "sidebar-mark-all-read",
+      title: "Mark All as Read",
+      "aria-label": "Mark All as Read",
+      "data-testid": "mark-all-read",
+    });
+    markAllBtn.appendChild(createIcon("check", 16));
+    markAllBtn.addEventListener(
+      "click",
+      (e: Event) => {
+        e.stopPropagation();
+        markAllRead();
+      },
+      { signal: ac.signal },
+    );
+    header.appendChild(markAllBtn);
+
     // Channel list
     channelList = createElement("div", { class: "channel-list" });
 
@@ -638,6 +824,10 @@ export function createChannelSidebar(options: ChannelSidebarOptions): MountableC
     // Initial render
     renderChannels();
 
+    // DM badges live in dm.store, and Mark All as Read covers them too, so the
+    // header button's visibility has to track that store as well.
+    unsubscribers.push(dmStore.subscribeSelector((s) => s.channels, updateMarkAllBtn));
+
     // Subscribe to channels store changes (channels map OR active channel)
     const unsubChannelsMap = channelsStore.subscribeSelector(
       (s) => s.channels,
@@ -692,7 +882,7 @@ export function createChannelSidebar(options: ChannelSidebarOptions): MountableC
             // Include the E2EE verification status so a verified↔unverified↔mismatch
             // flip re-renders the badge (it lives outside voiceUsers, in peerVerifications).
             const verif = state.peerVerifications?.get(uid);
-            structSig += `:${uid}${u.muted ? "m" : ""}${u.deafened ? "d" : ""}${u.camera ? "c" : ""}${u.screenshare ? "s" : ""}${verif ? `@${verif.status}` : ""}`;
+            structSig += `:${uid}${u.muted ? "m" : ""}${u.deafened ? "d" : ""}${u.camera ? "c" : ""}${u.screenshare ? "s" : ""}${u.serverMuted === true ? "M" : ""}${u.serverDeafened === true ? "D" : ""}${verif ? `@${verif.status}` : ""}`;
           }
         }
         return structSig;
@@ -730,6 +920,7 @@ export function createChannelSidebar(options: ChannelSidebarOptions): MountableC
     }
     channelList = null;
     serverNameEl = null;
+    markAllBtn = null;
   }
 
   return { mount, destroy };
diff --git a/Client/tauri-client/src/components/CreateChannelModal.ts b/Client/tauri-client/src/components/CreateChannelModal.ts
index 4622835b..d2753e54 100644
--- a/Client/tauri-client/src/components/CreateChannelModal.ts
+++ b/Client/tauri-client/src/components/CreateChannelModal.ts
@@ -1,17 +1,24 @@
 /**
- * CreateChannelModal — modal for creating a new channel under a specific
- * category. The channel type is automatically restricted based on the
- * category: voice categories only allow voice channels, text categories
- * allow text and announcement channels.
+ * CreateChannelModal — modal for creating a new channel.
+ *
+ * The category is an editable text field pre-filled with the group the "+" was
+ * clicked on, backed by a <datalist> of the categories already in use. It used
+ * to be read-only, and the channel TYPE was inferred from the category name
+ * ("voice" anywhere in it meant voice-only), which made every other category
+ * name second-class: a voice channel could not live under "Gaming", and
+ * renaming a category silently changed what could be created there. Categories
+ * are free text and grouping is a display concern, so every type is offered
+ * under every category — the server agrees (it validates the type alone).
  */
 
 import { createElement, setText, appendChildren } from "@lib/dom";
 import { createIcon } from "@lib/icons";
 import type { MountableComponent } from "@lib/safe-render";
 import type { ChannelType } from "@lib/types";
+import { getKnownCategories, UNCATEGORIZED_VOICE_CATEGORY } from "@stores/channels.store";
 
 export interface CreateChannelModalOptions {
-  /** The category this channel will be created under. */
+  /** The category the create affordance was invoked from ("" = uncategorized). */
   readonly category: string;
   /** Called when the user submits the form. */
   readonly onCreate: (data: { name: string; type: ChannelType; category: string }) => Promise<void>;
@@ -19,17 +26,18 @@ export interface CreateChannelModalOptions {
   readonly onClose: () => void;
 }
 
-/** Returns true if the category name indicates a voice section. */
-export function isVoiceCategory(category: string): boolean {
-  return category.toLowerCase().includes("voice");
-}
+/** Every channel type is creatable under every category. */
+export const CHANNEL_TYPES: readonly ChannelType[] = ["text", "voice", "announcement"] as const;
 
-/** Returns the allowed channel types for a given category. */
-export function allowedTypesForCategory(category: string): readonly ChannelType[] {
-  if (isVoiceCategory(category)) {
-    return ["voice"] as const;
-  }
-  return ["text", "announcement"] as const;
+/**
+ * The type pre-selected for a category. Only a hint for the dropdown's initial
+ * value — every type stays selectable. The one case worth guessing is the
+ * synthetic "Voice" fallback group the sidebar puts uncategorized voice
+ * channels in: creating from its "+" almost certainly means another voice
+ * channel.
+ */
+export function defaultTypeForCategory(category: string): ChannelType {
+  return category === UNCATEGORIZED_VOICE_CATEGORY ? "voice" : "text";
 }
 
 export function createCreateChannelModal(options: CreateChannelModalOptions): MountableComponent {
@@ -37,8 +45,6 @@ export function createCreateChannelModal(options: CreateChannelModalOptions): Mo
   const ac = new AbortController();
   let overlay: HTMLDivElement | null = null;
 
-  const allowedTypes = allowedTypesForCategory(category);
-
   function mount(container: Element): void {
     overlay = createElement("div", {
       class: "modal-overlay visible",
@@ -62,15 +68,23 @@ export function createCreateChannelModal(options: CreateChannelModalOptions): Mo
     // Body
     const body = createElement("div", { class: "modal-body" });
 
-    // Category (read-only display)
+    // Category — free text, with the categories already in use as suggestions.
     const categoryGroup = createElement("div", { class: "form-group" });
     const categoryLabel = createElement("label", { class: "form-label" }, "Category");
-    const categoryDisplay = createElement("div", {
+    const categoryInput = createElement("input", {
       class: "form-input",
-      style: "opacity: 0.7; cursor: default;",
+      type: "text",
+      list: "create-channel-categories",
+      autocomplete: "off",
+      placeholder: "Leave blank for no category",
+      "data-testid": "channel-category-input",
     });
-    setText(categoryDisplay, category);
-    appendChildren(categoryGroup, categoryLabel, categoryDisplay);
+    categoryInput.value = category;
+    const categoryList = createElement("datalist", { id: "create-channel-categories" });
+    for (const known of getKnownCategories()) {
+      categoryList.appendChild(createElement("option", { value: known }));
+    }
+    appendChildren(categoryGroup, categoryLabel, categoryInput, categoryList);
 
     // Channel name
     const nameGroup = createElement("div", { class: "form-group" });
@@ -78,7 +92,7 @@ export function createCreateChannelModal(options: CreateChannelModalOptions): Mo
     const nameInput = createElement("input", {
       class: "form-input",
       type: "text",
-      placeholder: isVoiceCategory(category) ? "lounge" : "general",
+      placeholder: defaultTypeForCategory(category) === "voice" ? "lounge" : "general",
       "data-testid": "channel-name-input",
     });
     appendChildren(nameGroup, nameLabel, nameInput);
@@ -91,10 +105,11 @@ export function createCreateChannelModal(options: CreateChannelModalOptions): Mo
       "data-testid": "channel-type-select",
     });
 
-    for (const t of allowedTypes) {
+    for (const t of CHANNEL_TYPES) {
       const opt = createElement("option", { value: t }, t.charAt(0).toUpperCase() + t.slice(1));
       typeSelect.appendChild(opt);
     }
+    typeSelect.value = defaultTypeForCategory(category);
     appendChildren(typeGroup, typeLabel, typeSelect);
 
     // Error display
@@ -146,7 +161,7 @@ export function createCreateChannelModal(options: CreateChannelModalOptions): Mo
           await onCreate({
             name,
             type: typeSelect.value as ChannelType,
-            category,
+            category: categoryInput.value.trim(),
           });
         } catch (err) {
           errorEl.style.display = "block";
diff --git a/Client/tauri-client/src/components/DmProfileSidebar.ts b/Client/tauri-client/src/components/DmProfileSidebar.ts
index 8db9fd18..13d490ce 100644
--- a/Client/tauri-client/src/components/DmProfileSidebar.ts
+++ b/Client/tauri-client/src/components/DmProfileSidebar.ts
@@ -49,6 +49,9 @@ const STATUS_COLORS: Readonly<Record<UserStatus, string>> = {
   online: "#3ba55d",
   idle: "#faa61a",
   dnd: "#ed4245",
+  // A DM partner is never invisible from here — the server maps it to offline
+  // for everyone but its owner — but the map has to be total over UserStatus.
+  invisible: "#747f8d",
   offline: "#747f8d",
 };
 
@@ -56,6 +59,7 @@ const STATUS_LABELS: Readonly<Record<UserStatus, string>> = {
   online: "Online",
   idle: "Idle",
   dnd: "Do Not Disturb",
+  invisible: "Invisible",
   offline: "Offline",
 };
 
diff --git a/Client/tauri-client/src/components/DmSidebar.ts b/Client/tauri-client/src/components/DmSidebar.ts
index 2c25d267..7d992af6 100644
--- a/Client/tauri-client/src/components/DmSidebar.ts
+++ b/Client/tauri-client/src/components/DmSidebar.ts
@@ -4,34 +4,65 @@
  *
  * Uses the `channel-sidebar` container class (shared with channel sidebar)
  * and DM-specific classes from app.css: dm-sidebar-header, dm-search,
- * dm-nav-item, dm-section-label, dm-add, dm-item, dm-avatar, dm-status,
+ * dm-section-label, dm-add, dm-item, dm-avatar, dm-status,
  * dm-name, dm-close, dm-unread.
+ *
+ * Rows are keyed on the DM *channel*, not on a recipient user: a group DM has
+ * no single recipient, and the same person can be in both a 1:1 and a group
+ * with you, so a user id no longer identifies a conversation.
  */
 
 import { createElement, setText, appendChildren } from "@lib/dom";
 import { createIcon } from "@lib/icons";
+import { showContextMenu } from "@lib/context-menu";
 import type { MountableComponent } from "@lib/safe-render";
 import { isSafeUrl } from "./message-list/attachments";
 
+/** One member of a group DM, as far as the sidebar needs to draw them. */
+export interface DmParticipant {
+  readonly id: number;
+  readonly username: string;
+  readonly avatar: string | null;
+}
+
 export interface DmConversation {
+  /** The DM channel. The row's identity — see the module comment. */
+  readonly channelId: number;
+  /** The other party of a 1:1 DM; for a group, the first participant. */
   readonly userId: number;
+  /** What the row is labelled: a group's name or joined members, else a user. */
   readonly username: string;
   readonly avatar: string | null;
   readonly avatarColor?: string;
   readonly status?: "online" | "idle" | "dnd" | "offline";
+  /** True for a group DM: draws stacked avatars and a participant count. */
+  readonly isGroup?: boolean;
+  /** Everyone but the current user. Drives the stack and the count. */
+  readonly participants?: readonly DmParticipant[];
   readonly lastMessage: string;
   readonly timestamp: string;
   readonly unread: boolean;
+  /** Unread message count. Drives the numeric badge; a conversation marked
+   *  `unread` with no count still shows the plain dot (older payloads). */
+  readonly unreadCount?: number;
+  /** Unread messages here that mention the current user. Outranks the unread
+   *  badge, exactly as it does in the channel list. */
+  readonly mentionCount?: number;
+  /** Muted: the unread badge renders dimmed. The mention badge does not —
+   *  a mute silences chatter, never something addressed to you. */
+  readonly muted?: boolean;
   readonly active?: boolean;
 }
 
 export interface DmSidebarOptions {
   readonly conversations: readonly DmConversation[];
-  readonly onSelectConversation: (userId: number) => void;
+  readonly onSelectConversation: (channelId: number) => void;
   readonly onNewDm: () => void;
-  readonly onCloseDm?: (userId: number) => void;
-  readonly onFriendsClick?: () => void;
-  readonly friendsActive?: boolean;
+  /** Close a 1:1 DM / leave a group. The component does not distinguish —
+   *  which one it is is the server's call, and the label says so. */
+  readonly onCloseDm?: (channelId: number) => void;
+  readonly onToggleMute?: (channelId: number) => void;
+  readonly onRenameGroup?: (channelId: number) => void;
   readonly onBack?: () => void;
   readonly serverName?: string;
 }
@@ -43,67 +74,137 @@ const STATUS_COLORS: Record<string, string> = {
   offline: "var(--text-micro)",
 };
 
+/** Fill one avatar circle: the picture if it is safe to load, else the letter. */
+function paintAvatar(el: HTMLElement, avatar: string | null, label: string): void {
+  if (avatar !== null && isSafeUrl(avatar)) {
+    const img = createElement("img", { src: avatar, alt: label });
+    img.style.width = "100%";
+    img.style.height = "100%";
+    img.style.borderRadius = "50%";
+    el.appendChild(img);
+    return;
+  }
+  setText(el, label.charAt(0).toUpperCase());
+}
+
+/**
+ * The avatar block for a row: one circle for a 1:1 DM with a presence dot, or
+ * two overlapping circles for a group.
+ *
+ * A group deliberately gets no presence dot — "is this group online" has no
+ * answer, and showing the first member's would be a fact about one person
+ * presented as a fact about the conversation.
+ */
+function buildAvatar(convo: DmConversation): HTMLDivElement {
+  const avatarBg = convo.avatarColor ?? "#5865F2";
+
+  if (convo.isGroup === true) {
+    const stack = createElement("div", {
+      class: "dm-avatar dm-avatar-stack",
+      "data-testid": `dm-avatar-stack-${convo.channelId}`,
+    });
+    const shown = (convo.participants ?? []).slice(0, 2);
+    // An empty group (every other member has left) still needs a mark, so fall
+    // back to the row's own label rather than rendering an empty circle.
+    const faces = shown.length > 0 ? shown : [{ id: 0, username: convo.username, avatar: null }];
+    faces.forEach((p, i) => {
+      const face = createElement("div", { class: `dm-avatar-face dm-avatar-face-${i}` });
+      face.style.background = avatarBg;
+      paintAvatar(face, p.avatar, p.username);
+      stack.appendChild(face);
+    });
+    return stack;
+  }
+
+  const avatar = createElement("div", { class: "dm-avatar" });
+  avatar.style.background = avatarBg;
+  paintAvatar(avatar, convo.avatar, convo.username);
+
+  const statusKey = convo.status ?? "offline";
+  const statusDot = createElement("span", { class: "dm-status" });
+  statusDot.style.background = STATUS_COLORS[statusKey] ?? "var(--text-micro)";
+  avatar.appendChild(statusDot);
+  return avatar;
+}
+
 function renderDmItem(
   convo: DmConversation,
-  onSelect: (userId: number) => void,
-  onClose: ((userId: number) => void) | undefined,
+  options: DmSidebarOptions,
   signal: AbortSignal,
 ): HTMLDivElement {
   const item = createElement("div", { class: "dm-item" });
   if (convo.active === true) {
     item.classList.add("active");
   }
+  if (convo.muted === true) {
+    item.classList.add("muted");
+  }
+  item.dataset.channelId = String(convo.channelId);
   item.dataset.userId = String(convo.userId);
 
-  // Avatar with status dot
-  const avatarBg = convo.avatarColor ?? "#5865F2";
-  const avatar = createElement("div", { class: "dm-avatar" });
-  avatar.style.background = avatarBg;
+  const avatar = buildAvatar(convo);
 
-  if (convo.avatar !== null && isSafeUrl(convo.avatar)) {
-    const img = createElement("img", {
-      src: convo.avatar,
-      alt: convo.username,
-    });
-    img.style.width = "100%";
-    img.style.height = "100%";
-    img.style.borderRadius = "50%";
-    avatar.appendChild(img);
-  } else {
-    setText(avatar, convo.username.charAt(0).toUpperCase());
-  }
-
-  // Status indicator dot
-  const statusKey = convo.status ?? "offline";
-  const statusDot = createElement("span", { class: "dm-status" });
-  statusDot.style.background = STATUS_COLORS[statusKey] ?? "var(--text-micro)";
-  avatar.appendChild(statusDot);
-
-  // Username
   const name = createElement("span", { class: "dm-name" }, convo.username);
 
-  // Close button (hidden by default, shown on hover via CSS)
+  appendChildren(item, avatar, name);
+
+  // Participant count, groups only: the label may be a name that says nothing
+  // about size, and "who else is in here" is the first thing you want to know.
+  if (convo.isGroup === true) {
+    const count = (convo.participants ?? []).length + 1;
+    const countEl = createElement(
+      "span",
+      { class: "dm-member-count", "data-testid": `dm-members-${convo.channelId}` },
+      String(count),
+    );
+    countEl.title = `${count} members`;
+    item.appendChild(countEl);
+  }
+
+  // Close / leave button (hidden by default, shown on hover via CSS)
   const closeBtn = createElement("button", {
     class: "dm-close",
-    title: "Close DM",
+    title: convo.isGroup === true ? "Leave group" : "Close DM",
   });
-  closeBtn.textContent = "";
   closeBtn.appendChild(createIcon("x", 14));
   closeBtn.addEventListener(
     "click",
     (e: Event) => {
       e.stopPropagation();
-      if (onClose !== undefined) {
-        onClose(convo.userId);
-      }
+      options.onCloseDm?.(convo.channelId);
     },
     { signal },
   );
+  item.appendChild(closeBtn);
 
-  appendChildren(item, avatar, name, closeBtn);
-
-  // Unread dot
-  if (convo.unread) {
+  // A mention badge outranks the unread badge, which in turn outranks the bare
+  // dot — the dot is only what is left when the payload carries no counts.
+  //
+  // A muted conversation dims the unread badge but NOT the mention badge: the
+  // whole point of Discord's mute is that things addressed to you still get
+  // through, so dimming both would make a mute unsafe to use.
+  const mentionCount = convo.mentionCount ?? 0;
+  const unreadCount = convo.unreadCount ?? 0;
+  if (mentionCount > 0) {
+    const badge = createElement(
+      "span",
+      { class: "dm-mention-badge", "data-testid": `dm-mentions-${convo.channelId}` },
+      String(mentionCount),
+    );
+    badge.title = `${mentionCount} mention${mentionCount === 1 ? "" : "s"}`;
+    item.appendChild(badge);
+  } else if (unreadCount > 0) {
+    const badge = createElement(
+      "span",
+      {
+        class: convo.muted === true ? "dm-unread-badge muted" : "dm-unread-badge",
+        "data-testid": `dm-unread-${convo.channelId}`,
+      },
+      String(unreadCount),
+    );
+    badge.title = `${unreadCount} unread message${unreadCount === 1 ? "" : "s"}`;
+    item.appendChild(badge);
+  } else if (convo.unread) {
     const unreadDot = createElement("span", { class: "dm-unread" });
     item.appendChild(unreadDot);
   }
@@ -118,7 +219,43 @@ function renderDmItem(
         }
       }
       item.classList.add("active");
-      onSelect(convo.userId);
+      options.onSelectConversation(convo.channelId);
+    },
+    { signal },
+  );
+
+  item.addEventListener(
+    "contextmenu",
+    (e: MouseEvent) => {
+      e.preventDefault();
+      const items = [];
+      if (options.onToggleMute !== undefined) {
+        const toggle = options.onToggleMute;
+        items.push({
+          label: convo.muted === true ? "Unmute Conversation" : "Mute Conversation",
+          testId: `dm-mute-${convo.channelId}`,
+          onClick: () => toggle(convo.channelId),
+        });
+      }
+      if (convo.isGroup === true && options.onRenameGroup !== undefined) {
+        const rename = options.onRenameGroup;
+        items.push({
+          label: "Rename Group",
+          testId: `dm-rename-${convo.channelId}`,
+          onClick: () => rename(convo.channelId),
+        });
+      }
+      if (options.onCloseDm !== undefined) {
+        const close = options.onCloseDm;
+        items.push({
+          label: convo.isGroup === true ? "Leave Group" : "Close DM",
+          danger: true,
+          testId: `dm-close-${convo.channelId}`,
+          onClick: () => close(convo.channelId),
+        });
+      }
+      if (items.length === 0) return;
+      showContextMenu({ x: e.clientX, y: e.clientY, items, signal, className: "dm-context-menu" });
     },
     { signal },
   );
@@ -141,7 +278,7 @@ export function createDmSidebar(options: DmSidebarOptions): MountableComponent {
         class: "dm-back-header",
         "data-testid": "dm-back-header",
       });
-      const arrow = createElement("span", { class: "dm-back-arrow" }, "\u2190");
+      const arrow = createElement("span", { class: "dm-back-arrow" }, "←");
       const backInfo = createElement("div", { class: "dm-back-info" });
       const backTitle = createElement(
         "div",
@@ -163,22 +300,6 @@ export function createDmSidebar(options: DmSidebarOptions): MountableComponent {
     });
     header.appendChild(searchInput);
 
-    // Friends nav item
-    const friendsNav = createElement("div", { class: "dm-nav-item" });
-    if (options.friendsActive === true) {
-      friendsNav.classList.add("active");
-    }
-    setText(friendsNav, "Friends");
-    friendsNav.addEventListener(
-      "click",
-      () => {
-        if (options.onFriendsClick !== undefined) {
-          options.onFriendsClick();
-        }
-      },
-      { signal: ac.signal },
-    );
-
     // Section label with + button
     const sectionLabel = createElement("div", { class: "dm-section-label" });
     setText(sectionLabel, "Direct Messages");
@@ -195,11 +316,9 @@ export function createDmSidebar(options: DmSidebarOptions): MountableComponent {
       (a, b) => (b.unread ? 1 : 0) - (a.unread ? 1 : 0),
     );
 
-    const items = sorted.map((convo) =>
-      renderDmItem(convo, options.onSelectConversation, options.onCloseDm, ac.signal),
-    );
+    const items = sorted.map((convo) => renderDmItem(convo, options, ac.signal));
 
-    appendChildren(root, header, friendsNav, sectionLabel, ...items);
+    appendChildren(root, header, sectionLabel, ...items);
     container.appendChild(root);
   }
 
diff --git a/Client/tauri-client/src/components/EditChannelModal.ts b/Client/tauri-client/src/components/EditChannelModal.ts
index 3a60ad06..6704858c 100644
--- a/Client/tauri-client/src/components/EditChannelModal.ts
+++ b/Client/tauri-client/src/components/EditChannelModal.ts
@@ -1,11 +1,101 @@
 /**
- * EditChannelModal — modal for editing an existing channel's name and topic.
- * Only visible to admin/owner users.
+ * EditChannelModal — modal for editing an existing channel's name, topic,
+ * category, slow mode, NSFW flag and (for voice channels) its capacity limits.
+ * Mounted only for actors holding MANAGE_CHANNELS; the server enforces the same
+ * bit on the PATCH behind it.
+ *
+ * Category is free text with a <datalist> of the categories already in use:
+ * moving a channel between groups is a rename, not a recreate, and no category
+ * name is special (a voice channel groups under whatever it carries).
+ *
+ * Slow mode is a preset <select> rather than a number box. The server accepts
+ * any value in 0…21600, but the useful values are a short list, and a free
+ * number field mostly produces typos ("300" meant as minutes) that only surface
+ * when a member cannot post for five hours. A stored value outside the presets
+ * — set through the admin panel, which does offer a free number — is kept and
+ * shown as its own option rather than being silently rounded to a neighbour.
  */
 
 import { createElement, setText, appendChildren } from "@lib/dom";
 import { createIcon } from "@lib/icons";
 import type { MountableComponent } from "@lib/safe-render";
+import { getKnownCategories } from "@stores/channels.store";
+
+/** The server's ceiling for `slow_mode`, mirrored so the UI cannot exceed it. */
+export const MAX_SLOW_MODE_SECONDS = 21600;
+/** The server's ceiling for both voice capacity limits. */
+export const MAX_VOICE_LIMIT = 99;
+
+/** Slow-mode presets, in seconds. 0 = off. */
+const SLOW_MODE_PRESETS: readonly { readonly seconds: number; readonly label: string }[] = [
+  { seconds: 0, label: "Off" },
+  { seconds: 5, label: "5 seconds" },
+  { seconds: 10, label: "10 seconds" },
+  { seconds: 15, label: "15 seconds" },
+  { seconds: 30, label: "30 seconds" },
+  { seconds: 60, label: "1 minute" },
+  { seconds: 120, label: "2 minutes" },
+  { seconds: 300, label: "5 minutes" },
+  { seconds: 600, label: "10 minutes" },
+  { seconds: 900, label: "15 minutes" },
+  { seconds: 1800, label: "30 minutes" },
+  { seconds: 3600, label: "1 hour" },
+  { seconds: 7200, label: "2 hours" },
+  { seconds: 21600, label: "6 hours" },
+] as const;
+
+/** Human label for a second count, for a value that is off the preset list. */
+export function formatSlowMode(seconds: number): string {
+  const preset = SLOW_MODE_PRESETS.find((p) => p.seconds === seconds);
+  if (preset !== undefined) return preset.label;
+  if (seconds % 3600 === 0) {
+    const hours = seconds / 3600;
+    return `${hours} hour${hours === 1 ? "" : "s"}`;
+  }
+  if (seconds % 60 === 0) {
+    const minutes = seconds / 60;
+    return `${minutes} minute${minutes === 1 ? "" : "s"}`;
+  }
+  return `${seconds} seconds`;
+}
+
+/**
+ * Clamp a value into the server's accepted slow-mode range.
+ * Applied to the STORED value as well as the submitted one, so a row carrying
+ * something out of range still opens the modal on a legal option.
+ */
+export function clampSlowMode(value: number): number {
+  if (!Number.isFinite(value)) return 0;
+  return Math.min(MAX_SLOW_MODE_SECONDS, Math.max(0, Math.trunc(value)));
+}
+
+/**
+ * Clamp a voice limit into the server's accepted range.
+ *
+ * A `<input type="number" max>` is advisory — typing past it, or pasting, still
+ * produces the larger value — so the bound is applied here rather than trusting
+ * the attribute and letting the server 400 a form the user had no way to fix.
+ */
+export function clampVoiceLimit(value: number): number {
+  if (!Number.isFinite(value)) return 0;
+  return Math.min(MAX_VOICE_LIMIT, Math.max(0, Math.trunc(value)));
+}
+
+/** The fields an edit submits. Mirrors the PATCH body. */
+export interface EditChannelData {
+  readonly name: string;
+  readonly topic: string;
+  readonly category: string;
+  readonly slow_mode: number;
+  readonly nsfw: boolean;
+  /**
+   * Only present for a voice channel. A text channel's PATCH omits them
+   * entirely rather than sending 0, so an edit here cannot wipe limits the
+   * channel carries.
+   */
+  readonly voice_max_users?: number;
+  readonly voice_max_video?: number;
+}
 
 export interface EditChannelModalOptions {
   /** Current channel ID. */
@@ -14,14 +104,59 @@ export interface EditChannelModalOptions {
   readonly channelName: string;
   /** Current channel type (displayed, not editable). */
   readonly channelType: string;
+  /** Current channel topic ("" = none). */
+  readonly channelTopic?: string;
+  /** Current channel category ("" = uncategorized). */
+  readonly channelCategory?: string;
+  /** Current cooldown in seconds (0 = off). */
+  readonly channelSlowMode?: number;
+  /** Whether the channel is currently flagged age-restricted. */
+  readonly channelNsfw?: boolean;
+  /** Current voice capacity limits (0 = unlimited). Voice channels only. */
+  readonly channelVoiceMaxUsers?: number;
+  readonly channelVoiceMaxVideo?: number;
   /** Called when the user saves changes. */
-  readonly onSave: (data: { name: string }) => Promise<void>;
+  readonly onSave: (data: EditChannelData) => Promise<void>;
   /** Called when the modal is closed. */
   readonly onClose: () => void;
 }
 
+/** A labelled number input constrained to 0…MAX_VOICE_LIMIT. */
+function buildVoiceLimitField(
+  labelText: string,
+  hintText: string,
+  testId: string,
+  value: number,
+): { group: HTMLDivElement; input: HTMLInputElement } {
+  const group = createElement("div", { class: "form-group" });
+  const label = createElement("label", { class: "form-label" }, labelText);
+  const input = createElement("input", {
+    class: "form-input",
+    type: "number",
+    min: "0",
+    max: String(MAX_VOICE_LIMIT),
+    "data-testid": testId,
+  });
+  input.value = String(clampVoiceLimit(value));
+  const hint = createElement("div", { class: "form-hint" }, hintText);
+  appendChildren(group, label, input, hint);
+  return { group, input };
+}
+
 export function createEditChannelModal(options: EditChannelModalOptions): MountableComponent {
-  const { channelName, channelType, onSave, onClose } = options;
+  const {
+    channelName,
+    channelType,
+    channelTopic,
+    channelCategory,
+    channelSlowMode,
+    channelNsfw,
+    channelVoiceMaxUsers,
+    channelVoiceMaxVideo,
+    onSave,
+    onClose,
+  } = options;
+  const isVoice = channelType === "voice";
   const ac = new AbortController();
   let overlay: HTMLDivElement | null = null;
 
@@ -70,14 +205,119 @@ export function createEditChannelModal(options: EditChannelModalOptions): Mounta
     nameInput.value = channelName;
     appendChildren(nameGroup, nameLabel, nameInput);
 
+    // Channel topic (optional, shown in the chat header)
+    const topicGroup = createElement("div", { class: "form-group" });
+    const topicLabel = createElement("label", { class: "form-label" }, "Topic");
+    const topicInput = createElement("input", {
+      class: "form-input",
+      type: "text",
+      placeholder: "What's this channel about? (optional)",
+      maxlength: "1024",
+      "data-testid": "edit-channel-topic-input",
+    });
+    topicInput.value = channelTopic ?? "";
+    appendChildren(topicGroup, topicLabel, topicInput);
+
+    // Channel category (free text, suggestions from the categories in use)
+    const categoryGroup = createElement("div", { class: "form-group" });
+    const categoryLabel = createElement("label", { class: "form-label" }, "Category");
+    const categoryInput = createElement("input", {
+      class: "form-input",
+      type: "text",
+      list: "edit-channel-categories",
+      autocomplete: "off",
+      placeholder: "Leave blank for no category",
+      "data-testid": "edit-channel-category-input",
+    });
+    categoryInput.value = channelCategory ?? "";
+    const categoryList = createElement("datalist", { id: "edit-channel-categories" });
+    for (const known of getKnownCategories()) {
+      categoryList.appendChild(createElement("option", { value: known }));
+    }
+    appendChildren(categoryGroup, categoryLabel, categoryInput, categoryList);
+
+    // Slow mode (presets; a stored off-preset value keeps its own option)
+    const currentSlowMode = clampSlowMode(channelSlowMode ?? 0);
+    const slowGroup = createElement("div", { class: "form-group" });
+    const slowLabel = createElement("label", { class: "form-label" }, "Slow Mode");
+    const slowSelect = createElement("select", {
+      class: "form-input",
+      "data-testid": "edit-channel-slowmode-select",
+    });
+    const choices = SLOW_MODE_PRESETS.some((p) => p.seconds === currentSlowMode)
+      ? [...SLOW_MODE_PRESETS]
+      : [
+          ...SLOW_MODE_PRESETS,
+          { seconds: currentSlowMode, label: formatSlowMode(currentSlowMode) },
+        ];
+    for (const choice of choices.toSorted((a, b) => a.seconds - b.seconds)) {
+      const opt = createElement("option", { value: String(choice.seconds) }, choice.label);
+      if (choice.seconds === currentSlowMode) opt.selected = true;
+      slowSelect.appendChild(opt);
+    }
+    const slowHint = createElement(
+      "div",
+      { class: "form-hint" },
+      "Members must wait this long between messages. Holders of Manage Messages are exempt.",
+    );
+    appendChildren(slowGroup, slowLabel, slowSelect, slowHint);
+
+    // NSFW flag. The copy states the limit of the feature: the server does not
+    // filter anything, so promising otherwise here would be a lie.
+    const nsfwGroup = createElement("div", { class: "form-group" });
+    const nsfwLabelRow = createElement("label", { class: "form-check" });
+    const nsfwInput = createElement("input", {
+      type: "checkbox",
+      "data-testid": "edit-channel-nsfw-checkbox",
+    });
+    nsfwInput.checked = channelNsfw === true;
+    const nsfwText = createElement("span", {}, "Age-restricted (NSFW)");
+    appendChildren(nsfwLabelRow, nsfwInput, nsfwText);
+    const nsfwHint = createElement(
+      "div",
+      { class: "form-hint" },
+      "Members see a one-time warning each session before opening the channel, and the channel is marked in the sidebar. Nothing is filtered.",
+    );
+    appendChildren(nsfwGroup, nsfwLabelRow, nsfwHint);
+
+    appendChildren(body, typeGroup, nameGroup, topicGroup, categoryGroup, slowGroup, nsfwGroup);
+
+    // Voice-only section. Rendered for a voice channel alone: the columns exist
+    // on every row, but on a text channel they are values nothing reads, and
+    // offering them would imply an enforcement that does not happen.
+    let maxUsersInput: HTMLInputElement | null = null;
+    let maxVideoInput: HTMLInputElement | null = null;
+    if (isVoice) {
+      const voiceSection = createElement("div", {
+        class: "form-section",
+        "data-testid": "edit-channel-voice-section",
+      });
+      const voiceHeading = createElement("div", { class: "form-section-title" }, "Voice Limits");
+      const users = buildVoiceLimitField(
+        "User Limit",
+        "How many members may be connected at once. 0 = unlimited.",
+        "edit-channel-max-users-input",
+        channelVoiceMaxUsers ?? 0,
+      );
+      const video = buildVoiceLimitField(
+        "Video Limit",
+        "How many may have a camera or screen share on at once. 0 = unlimited.",
+        "edit-channel-max-video-input",
+        channelVoiceMaxVideo ?? 0,
+      );
+      maxUsersInput = users.input;
+      maxVideoInput = video.input;
+      appendChildren(voiceSection, voiceHeading, users.group, video.group);
+      body.appendChild(voiceSection);
+    }
+
     // Error display
     const errorEl = createElement("div", {
       class: "form-group",
       style: "color: var(--red); font-size: 13px; display: none;",
       "data-testid": "edit-channel-error",
     });
-
-    appendChildren(body, typeGroup, nameGroup, errorEl);
+    body.appendChild(errorEl);
 
     // Footer
     const footer = createElement("div", { class: "modal-footer" });
@@ -114,8 +354,22 @@ export function createEditChannelModal(options: EditChannelModalOptions): Mounta
         saveBtn.setAttribute("disabled", "true");
         setText(saveBtn, "Saving...");
 
+        const data: EditChannelData = {
+          name,
+          topic: topicInput.value.trim(),
+          category: categoryInput.value.trim(),
+          slow_mode: clampSlowMode(Number.parseInt(slowSelect.value, 10)),
+          nsfw: nsfwInput.checked,
+          ...(maxUsersInput !== null
+            ? { voice_max_users: clampVoiceLimit(Number.parseInt(maxUsersInput.value, 10)) }
+            : {}),
+          ...(maxVideoInput !== null
+            ? { voice_max_video: clampVoiceLimit(Number.parseInt(maxVideoInput.value, 10)) }
+            : {}),
+        };
+
         try {
-          await onSave({ name });
+          await onSave(data);
         } catch (err) {
           errorEl.style.display = "block";
           setText(errorEl, err instanceof Error ? err.message : "Failed to update channel");
diff --git a/Client/tauri-client/src/components/EmojiAutocomplete.ts b/Client/tauri-client/src/components/EmojiAutocomplete.ts
new file mode 100644
index 00000000..01eb336c
--- /dev/null
+++ b/Client/tauri-client/src/components/EmojiAutocomplete.ts
@@ -0,0 +1,157 @@
+/**
+ * EmojiAutocomplete — inline emoji picker the composer opens on ":".
+ *
+ * Deliberately the same shape as MentionAutocomplete (setQuery / handleKeydown
+ * / destroy, mousedown-to-choose, arrow-key navigation): the composer drives
+ * both through one code path, and a user who has learned one has learned the
+ * other.
+ *
+ * Two sources in one list: the server's custom emoji, which insert their
+ * `:shortcode:` text, and the built-in unicode set, which inserts the character
+ * itself. Custom emoji come first — they are the ones a shortcode is really
+ * for, and there are far fewer of them.
+ *
+ * Uses @lib/dom helpers exclusively. Never sets innerHTML with user content.
+ */
+
+import { createElement, setText } from "@lib/dom";
+import { EMOJI_NAMES } from "@components/EmojiPicker";
+import { buildCustomEmojiImage } from "@components/message-list/custom-emoji";
+import { listCustomEmoji, type CustomEmoji } from "@stores/emoji.store";
+import {
+  createInlineAutocomplete,
+  type InlineAutocompleteComponent,
+} from "@components/inline-autocomplete";
+
+/** Maximum rows shown at once — the popup is a shortcut, not the picker. */
+export const MAX_EMOJI_SUGGESTIONS = 10;
+
+/**
+ * The shortest query that opens the popup. One character after the colon would
+ * match most of the unicode set and fire on ordinary prose ("note: a thing").
+ */
+export const MIN_EMOJI_QUERY = 2;
+
+export interface EmojiSuggestion {
+  /** Row label — the shortcode, or the unicode emoji's primary name. */
+  readonly label: string;
+  /** Text inserted into the composer, replacing the `:query` under the caret. */
+  readonly insert: string;
+  /** Secondary line: the remaining keywords, or the literal token for custom. */
+  readonly detail: string;
+  readonly kind: "custom" | "unicode";
+  /** The character to show as the preview, or null for a custom emoji image. */
+  readonly char: string | null;
+  /** The custom emoji this row stands for, or null for a unicode one. */
+  readonly emoji: CustomEmoji | null;
+}
+
+export interface EmojiAutocompleteOptions {
+  /** Called with the text to insert (`:wave:` or a unicode character). */
+  readonly onSelect: (insert: string) => void;
+  readonly onClose: () => void;
+}
+
+/** Same shape as the shared inline-autocomplete widget. */
+export type EmojiAutocompleteComponent = InlineAutocompleteComponent;
+
+function byLabel(a: EmojiSuggestion, b: EmojiSuggestion): number {
+  return a.label.localeCompare(b.label);
+}
+
+/** The preview cell for one row: the custom emoji's image, or the character. */
+function buildPreview(s: EmojiSuggestion): HTMLSpanElement {
+  const preview = createElement("span", { class: "ea-preview" });
+  if (s.emoji !== null) preview.appendChild(buildCustomEmojiImage(s.emoji));
+  else setText(preview, s.char ?? "");
+  return preview;
+}
+
+/**
+ * Suggestions for `query`, in the order the popup lists them: custom emoji
+ * first (prefix matches before substring), then unicode, alphabetical within
+ * each group.
+ *
+ * A query shorter than MIN_EMOJI_QUERY yields nothing at all, so the composer
+ * never opens a popup over a lone colon.
+ */
+export function filterEmojiSuggestions(query: string): EmojiSuggestion[] {
+  const q = query.toLowerCase();
+  if (q.length < MIN_EMOJI_QUERY) return [];
+
+  const customPrefix: EmojiSuggestion[] = [];
+  const customSubstring: EmojiSuggestion[] = [];
+  for (const emoji of listCustomEmoji()) {
+    const name = emoji.shortcode;
+    if (!name.includes(q)) continue;
+    const entry: EmojiSuggestion = {
+      label: name,
+      insert: `:${name}:`,
+      detail: "Server emoji",
+      kind: "custom",
+      char: null,
+      emoji,
+    };
+    if (name.startsWith(q)) customPrefix.push(entry);
+    else customSubstring.push(entry);
+  }
+
+  const unicodePrefix: EmojiSuggestion[] = [];
+  const unicodeSubstring: EmojiSuggestion[] = [];
+  for (const [char, keywords] of Object.entries(EMOJI_NAMES)) {
+    if (!keywords.includes(q)) continue;
+    const words = keywords.split(" ");
+    const primary = words[0] ?? keywords;
+    const entry: EmojiSuggestion = {
+      label: primary,
+      insert: char,
+      detail: words.slice(1).join(" "),
+      kind: "unicode",
+      char,
+      emoji: null,
+    };
+    // "Prefix" means some whole keyword starts with the query, not just the
+    // primary one — typing ":fire" should rank 🔥 ("fire hot flame lit") above
+    // an emoji that merely contains "fire" mid-word.
+    if (words.some((w) => w.startsWith(q))) unicodePrefix.push(entry);
+    else unicodeSubstring.push(entry);
+  }
+
+  customPrefix.sort(byLabel);
+  customSubstring.sort(byLabel);
+  unicodePrefix.sort(byLabel);
+  unicodeSubstring.sort(byLabel);
+
+  return [...customPrefix, ...customSubstring, ...unicodePrefix, ...unicodeSubstring].slice(
+    0,
+    MAX_EMOJI_SUGGESTIONS,
+  );
+}
+
+/** One emoji row: preview cell, `:label:`/name, and a keyword detail line. */
+function renderEmojiRow(s: EmojiSuggestion): HTMLElement[] {
+  const name = createElement("span", { class: "ma-name" });
+  setText(name, s.kind === "custom" ? `:${s.label}:` : s.label);
+  const detail = createElement("span", { class: "ma-detail" });
+  setText(detail, s.detail);
+  return [buildPreview(s), name, detail];
+}
+
+export function createEmojiAutocomplete(
+  options: EmojiAutocompleteOptions,
+): EmojiAutocompleteComponent {
+  return createInlineAutocomplete<EmojiSuggestion>({
+    // Shares the base class deliberately (the composer test selects
+    // `.mention-autocomplete:not(.emoji-autocomplete)` to distinguish them).
+    rootClass: "mention-autocomplete emoji-autocomplete",
+    rootTestId: "emoji-autocomplete",
+    filter: filterEmojiSuggestions,
+    valueOf: (s) => s.insert,
+    rowTestId: (s) => `emoji-option-${s.label}`,
+    renderRow: renderEmojiRow,
+    // Unlike mentions, emoji stay empty until the composer types past
+    // MIN_EMOJI_QUERY, so there is nothing to prime on create.
+    onSelect: options.onSelect,
+    onClose: options.onClose,
+  });
+}
diff --git a/Client/tauri-client/src/components/EmojiPicker.ts b/Client/tauri-client/src/components/EmojiPicker.ts
index 25f85381..d4fbc343 100644
--- a/Client/tauri-client/src/components/EmojiPicker.ts
+++ b/Client/tauri-client/src/components/EmojiPicker.ts
@@ -2,6 +2,7 @@
 // Uses @lib/dom helpers exclusively. Never sets innerHTML with user content.
 
 import { createElement, setText, clearChildren } from "@lib/dom";
+import { buildCustomEmojiNode } from "@components/message-list/custom-emoji";
 
 // ---------------------------------------------------------------------------
 // Types
@@ -13,11 +14,19 @@ export interface CustomEmoji {
 }
 
 export interface EmojiPickerOptions {
+  /**
+   * The server's custom emoji, shown as a "Server" category above the unicode
+   * ones. Selecting one inserts its `:shortcode:` — the composer sends text,
+   * and the renderer turns that text back into the image.
+   */
   readonly customEmoji?: readonly CustomEmoji[];
   readonly onSelect: (emoji: string) => void;
   readonly onClose: () => void;
 }
 
+/** The category label the server's own emoji appear under. */
+export const SERVER_CATEGORY = "Server";
+
 // ---------------------------------------------------------------------------
 // Built-in emoji data (common subset by category)
 // ---------------------------------------------------------------------------
@@ -274,8 +283,14 @@ const CATEGORIES: readonly EmojiCategory[] = [
   },
 ];
 
-/** Emoji name lookup for search. Maps emoji character → searchable keywords. */
-const EMOJI_NAMES: Readonly<Record<string, string>> = {
+/**
+ * Emoji name lookup for search. Maps emoji character → searchable keywords.
+ *
+ * Exported because the composer's `:` autocomplete searches the same list the
+ * picker does — two independently-maintained name tables would mean typing
+ * `:fire` and searching "fire" disagreeing about what exists.
+ */
+export const EMOJI_NAMES: Readonly<Record<string, string>> = {
   "😀": "grinning face happy smile",
   "😃": "smiley face happy smile",
   "😄": "smile happy grin",
@@ -555,10 +570,10 @@ export function createEmojiPicker(options: EmojiPickerOptions): {
     const recent = getRecentEmoji();
     const cats: EmojiCategory[] = [{ name: "Recent", emoji: recent }];
 
-    // Custom server emoji
+    // The server's own emoji, as the `:shortcode:` tokens a message carries.
     if (options.customEmoji && options.customEmoji.length > 0) {
       cats.push({
-        name: "Custom",
+        name: SERVER_CATEGORY,
         emoji: options.customEmoji.map((e) => `:${e.shortcode}:`),
       });
     }
@@ -582,7 +597,16 @@ export function createEmojiPicker(options: EmojiPickerOptions): {
       class: "ep-emoji",
       title: emoji,
     });
-    setText(span, emoji);
+    // A `:shortcode:` entry shows its image; everything else is the character
+    // itself. An unresolvable shortcode falls back to the text, which is what
+    // it would render as in a message anyway.
+    const image = buildCustomEmojiNode(emoji);
+    if (image !== null) {
+      span.classList.add("ep-emoji-custom");
+      span.appendChild(image);
+    } else {
+      setText(span, emoji);
+    }
     span.addEventListener("click", () => handleEmojiClick(emoji), { signal });
     return span;
   }
diff --git a/Client/tauri-client/src/components/IncomingCallBanner.ts b/Client/tauri-client/src/components/IncomingCallBanner.ts
new file mode 100644
index 00000000..650a5f60
--- /dev/null
+++ b/Client/tauri-client/src/components/IncomingCallBanner.ts
@@ -0,0 +1,97 @@
+/**
+ * IncomingCallBanner — the toast-like strip that appears when somebody rings a
+ * DM you are in.
+ *
+ * It is deliberately a banner and not a modal: a ring is an offer, not a
+ * demand, and a modal would block the app until the 30s timer expired. Accept
+ * joins the DM's voice channel; Decline tells the ringer to stop.
+ *
+ * All state lives in @lib/call-ring — this only draws whatever it is handed.
+ */
+
+import { createElement, appendChildren, setText } from "@lib/dom";
+import { createIcon } from "@lib/icons";
+import type { MountableComponent } from "@lib/safe-render";
+import type { RingState } from "@lib/call-ring";
+
+export interface IncomingCallBannerOptions {
+  readonly onAccept: () => void;
+  readonly onDecline: () => void;
+}
+
+export interface IncomingCallBannerComponent extends MountableComponent {
+  /** Show the banner for a ring, or hide it with null. */
+  readonly setRing: (state: RingState | null) => void;
+}
+
+export function createIncomingCallBanner(
+  options: IncomingCallBannerOptions,
+): IncomingCallBannerComponent {
+  const ac = new AbortController();
+
+  const root = createElement("div", {
+    class: "incoming-call-banner",
+    role: "alert",
+    "data-testid": "incoming-call-banner",
+  });
+  root.style.display = "none";
+
+  const icon = createElement("div", { class: "incoming-call-icon" });
+  icon.appendChild(createIcon("phone", 20));
+
+  const info = createElement("div", { class: "incoming-call-info" });
+  const title = createElement("div", {
+    class: "incoming-call-title",
+    "data-testid": "incoming-call-title",
+  });
+  const subtitle = createElement("div", { class: "incoming-call-subtitle" }, "Incoming call");
+  appendChildren(info, title, subtitle);
+
+  const acceptBtn = createElement(
+    "button",
+    {
+      class: "btn btn-primary incoming-call-accept",
+      type: "button",
+      "data-testid": "incoming-call-accept",
+    },
+    "Accept",
+  );
+  acceptBtn.addEventListener("click", () => options.onAccept(), { signal: ac.signal });
+
+  const declineBtn = createElement(
+    "button",
+    {
+      class: "btn btn-danger incoming-call-decline",
+      type: "button",
+      "data-testid": "incoming-call-decline",
+    },
+    "Decline",
+  );
+  declineBtn.addEventListener("click", () => options.onDecline(), { signal: ac.signal });
+
+  const actions = createElement("div", { class: "incoming-call-actions" });
+  appendChildren(actions, acceptBtn, declineBtn);
+  appendChildren(root, icon, info, actions);
+
+  function setRing(state: RingState | null): void {
+    if (state === null) {
+      root.style.display = "none";
+      setText(title, "");
+      return;
+    }
+    // setText, never innerHTML: the username is user-controlled.
+    setText(title, `${state.fromUsername} is calling`);
+    root.style.display = "";
+  }
+
+  return {
+    mount(container: Element): void {
+      container.appendChild(root);
+    },
+    destroy(): void {
+      ac.abort();
+      root.remove();
+    },
+    setRing,
+  };
+}
diff --git a/Client/tauri-client/src/components/MemberList.ts b/Client/tauri-client/src/components/MemberList.ts
index 61cef581..eedb2b0a 100644
--- a/Client/tauri-client/src/components/MemberList.ts
+++ b/Client/tauri-client/src/components/MemberList.ts
@@ -1,24 +1,47 @@
 /**
  * MemberList component — shows server members grouped by role with online status.
  * Subscribes to membersStore for reactive updates.
- * Right-click context menu for admin actions (kick, ban, role change).
+ * Right-click context menu for admin actions (force logout, ban, role change).
  */
 
 import { createElement, appendChildren, clearChildren, setText } from "@lib/dom";
 import type { MountableComponent } from "@lib/safe-render";
 import { Disposable } from "@lib/disposable";
-import { membersStore, type Member, type MembersState } from "@stores/members.store";
+import {
+  membersStore,
+  memberDisplayName,
+  type Member,
+  type MembersState,
+} from "@stores/members.store";
 import { authStore } from "@stores/auth.store";
-import { channelsStore } from "@stores/channels.store";
+import { blocksStore } from "@stores/blocks.store";
+import { channelsStore, type ChannelsState } from "@stores/channels.store";
 import { createMemberContextMenu } from "@components/AdminActions";
-import type { UserStatus } from "@lib/types";
+import {
+  createUserProfilePopup,
+  type UserProfilePopupComponent,
+} from "@components/UserProfilePopup";
+import { Permission, type ReadyRole, type UserStatus } from "@lib/types";
+import { roleHasPermission } from "@lib/permissions";
+import { createAvatarElement } from "@lib/avatar";
 
 /** Options for configuring admin action callbacks on the member list. */
 export interface MemberListOptions {
+  /** Role name of the signed-in user; resolved against the server's role list
+   *  to get the permission mask that gates the moderation menu items. */
   readonly currentUserRole: string;
+  /** Force logout: revokes the target's sessions (KICK_MEMBERS). */
   readonly onKick: (userId: number, username: string) => Promise<void>;
-  readonly onBan: (userId: number, username: string, reason: string) => Promise<void>;
+  readonly onBan: (
+    userId: number,
+    username: string,
+    reason: string,
+    durationHours: number,
+  ) => Promise<void>;
   readonly onChangeRole: (userId: number, username: string, newRole: string) => Promise<void>;
+  readonly onToggleBlock: (userId: number, username: string, block: boolean) => Promise<void>;
+  /** Start a DM with a user (wires the profile popup's Message button). */
+  readonly onMessageUser?: (userId: number) => void;
 }
 
 /** Roles offered in the "Change Role" submenu when the server hasn't sent any. */
@@ -36,18 +59,69 @@ function assignableRoleNames(): readonly string[] {
   return roles.length > 0 ? roles : FALLBACK_ASSIGNABLE_ROLES;
 }
 
-/** Ordered role groups with display names and CSS color variables. */
-const ROLE_GROUPS: readonly {
+/** Which moderation menu items the signed-in user may see. */
+interface ModerationGates {
+  readonly canKick: boolean;
+  readonly canBan: boolean;
+  readonly canManageRoles: boolean;
+}
+
+/**
+ * Menu items the signed-in user's role permits, from the permission mask the
+ * server ships in `ready`. Administrator implies all three. When the role name
+ * has no match in that list (pre-`ready`, or an older server that sent none)
+ * the legacy owner/admin name check stands in — a mask of 0 would otherwise
+ * hide moderation from every actual admin.
+ */
+function moderationGates(roleName: string): ModerationGates {
+  return {
+    canKick: roleHasPermission(roleName, Permission.KICK_MEMBERS),
+    canBan: roleHasPermission(roleName, Permission.BAN_MEMBERS),
+    canManageRoles: roleHasPermission(roleName, Permission.MANAGE_ROLES),
+  };
+}
+
+interface RoleGroup {
   readonly role: string;
   readonly label: string;
   readonly colorVar: string;
-}[] = [
-  { role: "owner", label: "OWNER", colorVar: "var(--role-owner, #e74c3c)" },
-  { role: "admin", label: "ADMIN", colorVar: "var(--role-admin, #f39c12)" },
-  { role: "moderator", label: "MODERATOR", colorVar: "var(--role-mod, #2ecc71)" },
-  { role: "member", label: "MEMBER", colorVar: "var(--role-member, #949ba4)" },
+}
+
+/** Theme-variable fallbacks for the seeded roles (used when the server sends no color). */
+const FALLBACK_ROLE_COLORS: Record<string, string> = {
+  owner: "var(--role-owner, #e74c3c)",
+  admin: "var(--role-admin, #f39c12)",
+  moderator: "var(--role-mod, #2ecc71)",
+};
+
+const MEMBER_COLOR = "var(--role-member, #949ba4)";
+
+/** Ordered role groups used when the server hasn't sent a role list. */
+const FALLBACK_ROLE_GROUPS: readonly RoleGroup[] = [
+  { role: "owner", label: "OWNER", colorVar: FALLBACK_ROLE_COLORS["owner"]! },
+  { role: "admin", label: "ADMIN", colorVar: FALLBACK_ROLE_COLORS["admin"]! },
+  { role: "moderator", label: "MODERATOR", colorVar: FALLBACK_ROLE_COLORS["moderator"]! },
+  { role: "member", label: "MEMBER", colorVar: MEMBER_COLOR },
 ] as const;
 
+/**
+ * Role groups from the server's `ready` role list (already ordered by position,
+ * highest first), colored by the server's role color when set. A hardcoded
+ * list rendered custom roles nowhere and ignored `roles.color` entirely.
+ */
+function roleGroups(): readonly RoleGroup[] {
+  const roles = channelsStore.getState().roles;
+  if (roles.length === 0) return FALLBACK_ROLE_GROUPS;
+  return roles.map((r) => {
+    const key = r.name.toLowerCase();
+    return {
+      role: key,
+      label: r.name.toUpperCase(),
+      colorVar: r.color ?? FALLBACK_ROLE_COLORS[key] ?? MEMBER_COLOR,
+    };
+  });
+}
+
 /** Status priority for sorting: lower = higher priority (shown first). */
 function statusPriority(status: UserStatus): number {
   switch (status) {
@@ -57,6 +131,10 @@ function statusPriority(status: UserStatus): number {
       return 1;
     case "dnd":
       return 2;
+    // "invisible" only ever describes the signed-in user (the server shows
+    // everyone else offline), and it sorts with offline because that is where
+    // they appear to everybody — including, in this list, to themselves.
+    case "invisible":
     case "offline":
       return 3;
     default:
@@ -72,6 +150,7 @@ function statusColor(status: UserStatus): string {
       return "var(--yellow)";
     case "dnd":
       return "var(--red)";
+    case "invisible":
     case "offline":
       return "var(--text-micro)";
     default:
@@ -79,7 +158,13 @@ function statusColor(status: UserStatus): string {
   }
 }
 
+/** True for the statuses that render a member as "not here". */
+function isAwayStatus(status: UserStatus): boolean {
+  return status === "offline" || status === "invisible";
+}
+
 let activeMenu: { element: HTMLDivElement; destroy(): void } | null = null;
+let activePopup: UserProfilePopupComponent | null = null;
 
 function closeActiveMenu(): void {
   if (activeMenu !== null) {
@@ -88,6 +173,13 @@ function closeActiveMenu(): void {
   }
 }
 
+function closeActivePopup(): void {
+  if (activePopup !== null) {
+    activePopup.destroy?.();
+    activePopup = null;
+  }
+}
+
 function handleOutsideClick(e: MouseEvent): void {
   if (activeMenu !== null && !activeMenu.element.contains(e.target as Node)) {
     closeActiveMenu();
@@ -102,15 +194,13 @@ function createMemberItem(
   signal: AbortSignal,
 ): HTMLDivElement {
   const item = createElement("div", {
-    class: member.status === "offline" ? "member-item offline" : "member-item",
+    class: isAwayStatus(member.status) ? "member-item offline" : "member-item",
     "data-testid": `member-${member.id}`,
   });
 
-  const initial = member.username.charAt(0).toUpperCase() || "?";
-  const avatar = createElement(
-    "div",
-    { class: "mi-avatar", style: `background: ${colorVar}` },
-    initial,
+  const avatar = createAvatarElement(
+    { username: member.username, displayName: member.displayName, avatar: member.avatar },
+    { className: "mi-avatar", background: colorVar },
   );
 
   const statusDot = createElement("div", {
@@ -121,10 +211,54 @@ function createMemberItem(
   });
   avatar.appendChild(statusDot);
 
+  // Name + custom status stack. The custom status is only rendered when there
+  // is one, so a member without it keeps the single-line row it always had.
+  const nameWrap = createElement("div", { class: "mi-text" });
   const name = createElement("span", { class: "mi-name", style: `color: ${colorVar}` });
-  setText(name, member.username);
+  setText(name, memberDisplayName(member));
+  nameWrap.appendChild(name);
+  const custom = member.customStatus;
+  if (typeof custom === "string" && custom.length > 0) {
+    const customEl = createElement("span", {
+      class: "mi-custom-status",
+      "data-testid": `member-custom-status-${member.id}`,
+    });
+    setText(customEl, custom);
+    nameWrap.appendChild(customEl);
+  }
 
-  appendChildren(item, avatar, name);
+  appendChildren(item, avatar, nameWrap);
+
+  // Left-click opens the profile popup (previously dead code — built and
+  // tested but never mounted from anywhere).
+  item.addEventListener(
+    "click",
+    (e) => {
+      closeActiveMenu();
+      closeActivePopup();
+      const currentUserId = authStore.getState().user?.id ?? 0;
+      const isSelf = member.id === currentUserId;
+      const onMessageUser = opts.onMessageUser;
+      activePopup = createUserProfilePopup({
+        user: {
+          id: member.id,
+          username: member.username,
+          avatar: member.avatar,
+          role: member.role,
+          status: member.status,
+          displayName: member.displayName,
+          customStatus: member.customStatus,
+        },
+        anchorX: e.clientX,
+        anchorY: e.clientY,
+        ...(isSelf || onMessageUser === undefined
+          ? {}
+          : { onMessage: (userId: number) => onMessageUser(userId) }),
+      });
+      activePopup.mount(document.body);
+    },
+    { signal },
+  );
 
   // Context menu for admin actions
   item.addEventListener(
@@ -136,9 +270,10 @@ function createMemberItem(
       const currentUserId = authStore.getState().user?.id ?? 0;
       if (member.id === currentUserId) return;
 
-      // Only admins and owners can use admin actions
-      const role = opts.currentUserRole.toLowerCase();
-      if (role !== "owner" && role !== "admin") return;
+      // Moderation actions are permission-gated per item (a role name told us
+      // nothing about what its bits allow); block/unblock is open to everyone.
+      const gates = moderationGates(opts.currentUserRole);
+      const showAdminActions = gates.canKick || gates.canBan || gates.canManageRoles;
 
       closeActiveMenu();
       document.removeEventListener("mousedown", handleOutsideClick);
@@ -147,14 +282,22 @@ function createMemberItem(
       // custom roles unreachable and, worse, unresolvable to a role id, so
       // picking one silently did nothing.
       const availableRoles = assignableRoleNames();
+      const isBlocked = blocksStore.getState().blockedByMe.has(member.id);
 
       activeMenu = createMemberContextMenu({
         userId: member.id,
         username: member.username,
         currentRole: member.role.toLowerCase(),
         availableRoles,
+        showAdminActions,
+        canKick: gates.canKick,
+        canBan: gates.canBan,
+        canManageRoles: gates.canManageRoles,
+        isBlocked,
+        onToggleBlock: () => opts.onToggleBlock(member.id, member.username, !isBlocked),
         onKick: () => opts.onKick(member.id, member.username),
-        onBan: (reason: string) => opts.onBan(member.id, member.username, reason),
+        onBan: (reason: string, durationHours: number) =>
+          opts.onBan(member.id, member.username, reason, durationHours),
         onChangeRole: (newRole: string) => opts.onChangeRole(member.id, member.username, newRole),
       });
 
@@ -208,25 +351,47 @@ function renderList(
     }
   }
 
-  for (const group of ROLE_GROUPS) {
-    const groupMembers = (buckets.get(group.role) ?? []).toSorted(
-      (a, b) => statusPriority(a.status) - statusPriority(b.status),
-    );
+  const groups = roleGroups();
+  const rendered = new Set<string>();
+  for (const group of groups) {
+    rendered.add(group.role);
+    appendGroup(root, group, buckets.get(group.role) ?? [], opts, signal, rowsByUserId);
+  }
 
-    if (groupMembers.length === 0) continue;
+  // Members whose role isn't in the server's role list (e.g. a role deleted
+  // mid-session) still render, in a gray group, instead of vanishing.
+  const leftovers = [...buckets.keys()].filter((role) => !rendered.has(role)).toSorted();
+  for (const role of leftovers) {
+    const group: RoleGroup = { role, label: role.toUpperCase(), colorVar: MEMBER_COLOR };
+    appendGroup(root, group, buckets.get(role) ?? [], opts, signal, rowsByUserId);
+  }
+}
 
-    const header = createElement(
-      "div",
-      { class: "member-role-group" },
-      `${group.label} \u2014 ${groupMembers.length}`,
-    );
-    root.appendChild(header);
+function appendGroup(
+  root: HTMLDivElement,
+  group: RoleGroup,
+  members: readonly Member[],
+  opts: MemberListOptions,
+  signal: AbortSignal,
+  rowsByUserId: Map<number, HTMLDivElement>,
+): void {
+  const groupMembers = members.toSorted(
+    (a, b) => statusPriority(a.status) - statusPriority(b.status),
+  );
 
-    for (const member of groupMembers) {
-      const item = createMemberItem(member, group.colorVar, opts, signal);
-      rowsByUserId.set(member.id, item);
-      root.appendChild(item);
-    }
+  if (groupMembers.length === 0) return;
+
+  const header = createElement(
+    "div",
+    { class: "member-role-group" },
+    `${group.label} \u2014 ${groupMembers.length}`,
+  );
+  root.appendChild(header);
+
+  for (const member of groupMembers) {
+    const item = createMemberItem(member, group.colorVar, opts, signal);
+    rowsByUserId.set(member.id, item);
+    root.appendChild(item);
   }
 }
 
@@ -246,6 +411,10 @@ function isPresenceOnlyChange(
       before.username !== member.username ||
       before.role !== member.role ||
       before.avatar !== member.avatar ||
+      before.displayName !== member.displayName ||
+      // A custom status is rendered as its own line, so a change to it is a
+      // structural change, not a dot recolor.
+      before.customStatus !== member.customStatus ||
       before.identityPublicKey !== member.identityPublicKey
     ) {
       return false;
@@ -268,7 +437,7 @@ function patchPresence(
     if (before === undefined || before.status === member.status) continue;
     const row = rowsByUserId.get(id);
     if (row === undefined) continue;
-    row.classList.toggle("offline", member.status === "offline");
+    row.classList.toggle("offline", isAwayStatus(member.status));
     const dot = row.querySelector<HTMLDivElement>(".mi-status");
     if (dot !== null) {
       dot.style.background = statusColor(member.status);
@@ -305,11 +474,26 @@ export function createMemberList(opts: MemberListOptions): MountableComponent {
       },
     );
 
+    // Role groups, their labels and their colors all come from the server's
+    // role list, which role management makes mutable at runtime (a roles_update
+    // broadcast replaces it). Without this the list kept the old grouping until
+    // some unrelated member change happened to force a re-render.
+    disposable.onStoreChange<ChannelsState, readonly ReadyRole[]>(
+      channelsStore,
+      (s) => s.roles,
+      () => {
+        if (root !== null) {
+          renderList(root, opts, disposable.signal, rowsByUserId);
+        }
+      },
+    );
+
     container.appendChild(root);
   }
 
   function destroy(): void {
     closeActiveMenu();
+    closeActivePopup();
     document.removeEventListener("mousedown", handleOutsideClick);
     disposable.destroy();
     rowsByUserId.clear();
diff --git a/Client/tauri-client/src/components/MentionAutocomplete.ts b/Client/tauri-client/src/components/MentionAutocomplete.ts
new file mode 100644
index 00000000..854668fd
--- /dev/null
+++ b/Client/tauri-client/src/components/MentionAutocomplete.ts
@@ -0,0 +1,125 @@
+/**
+ * MentionAutocomplete — inline member picker the composer opens on "@".
+ * Uses @lib/dom helpers exclusively. Never sets innerHTML with user content.
+ */
+
+import { createElement, setText } from "@lib/dom";
+import { membersStore } from "@stores/members.store";
+import { currentUserHasPermission } from "@lib/permissions";
+import { Permission } from "@lib/types";
+import { EVERYONE_TOKEN, HERE_TOKEN } from "@lib/mentions";
+import {
+  createInlineAutocomplete,
+  type InlineAutocompleteComponent,
+} from "@components/inline-autocomplete";
+
+/** Maximum rows shown at once — the popup is a shortcut, not the member list. */
+export const MAX_MENTION_SUGGESTIONS = 10;
+
+export interface MentionSuggestion {
+  /** Token inserted after the "@", e.g. "alice" or "everyone". */
+  readonly token: string;
+  /** Row label. Equal to `token` for users. */
+  readonly label: string;
+  /** Secondary line (role for users, meaning for @everyone/@here). */
+  readonly detail: string;
+  readonly kind: "user" | "broadcast";
+  /** User id, or null for @everyone/@here. */
+  readonly userId: number | null;
+}
+
+export interface MentionAutocompleteOptions {
+  /** Called with the token to insert (without the leading "@"). */
+  readonly onSelect: (token: string) => void;
+  readonly onClose: () => void;
+}
+
+/** Same shape as the shared inline-autocomplete widget. */
+export type MentionAutocompleteComponent = InlineAutocompleteComponent;
+
+function byLabel(a: MentionSuggestion, b: MentionSuggestion): number {
+  return a.label.localeCompare(b.label);
+}
+
+/**
+ * Suggestions for `query`, in the order the popup lists them: prefix matches
+ * before substring matches, alphabetical within each group.
+ *
+ * @everyone / @here are offered only when the signed-in user's role holds
+ * MENTION_EVERYONE — offering a token the server will refuse to honour would
+ * be a lie. The server still enforces.
+ */
+export function filterMentionSuggestions(query: string): MentionSuggestion[] {
+  const q = query.toLowerCase();
+  const prefix: MentionSuggestion[] = [];
+  const substring: MentionSuggestion[] = [];
+
+  for (const member of membersStore.getState().members.values()) {
+    const lower = member.username.toLowerCase();
+    if (q !== "" && !lower.includes(q)) continue;
+    const entry: MentionSuggestion = {
+      token: member.username,
+      label: member.username,
+      detail: member.role,
+      kind: "user",
+      userId: member.id,
+    };
+    if (q === "" || lower.startsWith(q)) {
+      prefix.push(entry);
+    } else {
+      substring.push(entry);
+    }
+  }
+
+  prefix.sort(byLabel);
+  substring.sort(byLabel);
+
+  const broadcasts: MentionSuggestion[] = [];
+  if (currentUserHasPermission(Permission.MENTION_EVERYONE)) {
+    const all: MentionSuggestion[] = [
+      {
+        token: EVERYONE_TOKEN,
+        label: EVERYONE_TOKEN,
+        detail: "Notify everyone in this channel",
+        kind: "broadcast",
+        userId: null,
+      },
+      {
+        token: HERE_TOKEN,
+        label: HERE_TOKEN,
+        detail: "Notify everyone who is online",
+        kind: "broadcast",
+        userId: null,
+      },
+    ];
+    broadcasts.push(...all.filter((s) => q === "" || s.token.startsWith(q)));
+  }
+
+  return [...broadcasts, ...prefix, ...substring].slice(0, MAX_MENTION_SUGGESTIONS);
+}
+
+/** One mention row: `@label` plus a role / broadcast-meaning detail line. */
+function renderMentionRow(s: MentionSuggestion): HTMLElement[] {
+  const name = createElement("span", { class: "ma-name" });
+  setText(name, `@${s.label}`);
+  const detail = createElement("span", { class: "ma-detail" });
+  setText(detail, s.detail);
+  return [name, detail];
+}
+
+export function createMentionAutocomplete(
+  options: MentionAutocompleteOptions,
+): MentionAutocompleteComponent {
+  return createInlineAutocomplete<MentionSuggestion>({
+    rootClass: "mention-autocomplete",
+    rootTestId: "mention-autocomplete",
+    filter: filterMentionSuggestions,
+    valueOf: (s) => s.token,
+    rowTestId: (s) => `mention-option-${s.token}`,
+    renderRow: renderMentionRow,
+    // Open already populated with the full member list.
+    primeOnCreate: true,
+    onSelect: options.onSelect,
+    onClose: options.onClose,
+  });
+}
diff --git a/Client/tauri-client/src/components/MessageInput.ts b/Client/tauri-client/src/components/MessageInput.ts
index adaa515c..ae032d29 100644
--- a/Client/tauri-client/src/components/MessageInput.ts
+++ b/Client/tauri-client/src/components/MessageInput.ts
@@ -8,6 +8,16 @@ import { createIcon } from "@lib/icons";
 import type { MountableComponent } from "@lib/safe-render";
 import { createEmojiPicker } from "@components/EmojiPicker";
 import { createGifPicker } from "@components/GifPicker";
+import {
+  createMentionAutocomplete,
+  type MentionAutocompleteComponent,
+} from "@components/MentionAutocomplete";
+import {
+  createEmojiAutocomplete,
+  MIN_EMOJI_QUERY,
+  type EmojiAutocompleteComponent,
+} from "@components/EmojiAutocomplete";
+import { listCustomEmoji } from "@stores/emoji.store";
 import type { GifApi } from "@lib/gifProvider";
 
 export interface MessageInputOptions {
@@ -50,6 +60,59 @@ export type MessageInputComponent = MountableComponent & {
   openFilePicker(): void;
 };
 
+/** Ctrl/Cmd shortcut → markdown marker it wraps the selection in. */
+const FORMAT_MARKERS: Readonly<Record<string, string>> = {
+  b: "**",
+  i: "*",
+  u: "__",
+};
+
+export interface WrapResult {
+  readonly value: string;
+  readonly selectionStart: number;
+  readonly selectionEnd: number;
+}
+
+/**
+ * Wrap (or unwrap) `[start, end)` of `value` in `marker`, returning the new
+ * value and where the selection should land. With an empty selection the
+ * markers are inserted around the caret so typing continues inside them.
+ *
+ * Pure so the behaviour can be tested without a DOM selection.
+ */
+export function wrapWithMarker(
+  value: string,
+  start: number,
+  end: number,
+  marker: string,
+): WrapResult {
+  const selected = value.slice(start, end);
+  const len = marker.length;
+
+  // Already wrapped — pressing the shortcut again takes the markers back off.
+  if (selected.length > 2 * len && selected.startsWith(marker) && selected.endsWith(marker)) {
+    const inner = selected.slice(len, selected.length - len);
+    return {
+      value: value.slice(0, start) + inner + value.slice(end),
+      selectionStart: start,
+      selectionEnd: start + inner.length,
+    };
+  }
+  if (value.slice(start - len, start) === marker && value.slice(end, end + len) === marker) {
+    return {
+      value: value.slice(0, start - len) + selected + value.slice(end + len),
+      selectionStart: start - len,
+      selectionEnd: start - len + selected.length,
+    };
+  }
+
+  return {
+    value: value.slice(0, start) + marker + selected + marker + value.slice(end),
+    selectionStart: start + len,
+    selectionEnd: start + len + selected.length,
+  };
+}
+
 const TYPING_THROTTLE_MS = 3_000;
 const MAX_TEXTAREA_HEIGHT = 200;
 const SEND_DEBOUNCE_MS = 200;
@@ -94,6 +157,12 @@ export function createMessageInput(options: MessageInputOptions): MessageInputCo
   let attachmentPreviewBar: HTMLDivElement | null = null;
   /** Set by mount() when file uploads are wired; backs openFilePicker(). */
   let openPicker: (() => void) | null = null;
+  let mentionPopup: MentionAutocompleteComponent | null = null;
+  /** Index of the "@" the open popup is completing; -1 when closed. */
+  let mentionStart = -1;
+  let emojiPopup: EmojiAutocompleteComponent | null = null;
+  /** Index of the ":" the open emoji popup is completing; -1 when closed. */
+  let emojiStart = -1;
 
   /** Pending attachment IDs to send with the next message. */
   const pendingAttachments: { id: string; filename: string; readonly previewEl: HTMLDivElement }[] =
@@ -105,6 +174,161 @@ export function createMessageInput(options: MessageInputOptions): MessageInputCo
   /** Timer IDs for cleanup on destroy. */
   const activeTimers: Set<ReturnType<typeof setTimeout>> = new Set();
 
+  /**
+   * The @token immediately before the caret, or null. The leading boundary
+   * mirrors the server's mention rule, so the popup never offers a completion
+   * for text ("mail@dom") that a send would not resolve as a mention.
+   */
+  function activeMentionToken(): { query: string; start: number } | null {
+    if (textarea === null) return null;
+    const caret = textarea.selectionStart;
+    const before = textarea.value.slice(0, caret);
+    const match = /(?:^|[^\p{L}\p{N}_@])@([\p{L}\p{N}_.-]{0,64})$/u.exec(before);
+    if (match === null) return null;
+    const query = match[1] ?? "";
+    return { query, start: caret - query.length - 1 };
+  }
+
+  function closeMentionPopup(): void {
+    if (mentionPopup === null) return;
+    mentionPopup.destroy();
+    mentionPopup = null;
+    mentionStart = -1;
+  }
+
+  /** Replace the token under the caret with "@token ". */
+  function insertMention(token: string): void {
+    if (textarea === null || mentionStart < 0) {
+      closeMentionPopup();
+      return;
+    }
+    const caret = textarea.selectionStart;
+    const before = textarea.value.slice(0, mentionStart);
+    const after = textarea.value.slice(caret);
+    const inserted = `@${token} `;
+    textarea.value = before + inserted + after;
+    const pos = before.length + inserted.length;
+    textarea.selectionStart = pos;
+    textarea.selectionEnd = pos;
+    closeMentionPopup();
+    autoResize();
+    textarea.focus();
+  }
+
+  /**
+   * The `:token` immediately before the caret, or null. The leading boundary
+   * keeps the popup out of ordinary prose: a colon that follows a word ("see
+   * this:thing", a "10:30" clock, an "http://" scheme) is punctuation, not the
+   * start of a shortcode. A completed `:token:` is skipped too — it is already
+   * an emoji, and re-offering completions over it would fight the user.
+   */
+  function activeEmojiToken(): { query: string; start: number } | null {
+    if (textarea === null) return null;
+    const caret = textarea.selectionStart;
+    const before = textarea.value.slice(0, caret);
+    const match = /(?:^|\s):([A-Za-z0-9_]{0,32})$/.exec(before);
+    if (match === null) return null;
+    const query = match[1] ?? "";
+    if (query.length < MIN_EMOJI_QUERY) return null;
+    return { query, start: caret - query.length - 1 };
+  }
+
+  function closeEmojiPopup(): void {
+    if (emojiPopup === null) return;
+    emojiPopup.destroy();
+    emojiPopup = null;
+    emojiStart = -1;
+  }
+
+  /** Replace the `:token` under the caret with the chosen emoji, plus a space. */
+  function insertEmoji(insert: string): void {
+    if (textarea === null || emojiStart < 0) {
+      closeEmojiPopup();
+      return;
+    }
+    const caret = textarea.selectionStart;
+    const before = textarea.value.slice(0, emojiStart);
+    const after = textarea.value.slice(caret);
+    const inserted = `${insert} `;
+    textarea.value = before + inserted + after;
+    const pos = before.length + inserted.length;
+    textarea.selectionStart = pos;
+    textarea.selectionEnd = pos;
+    closeEmojiPopup();
+    autoResize();
+    textarea.focus();
+  }
+
+  /** Open, refilter, or close the emoji popup for whatever is under the caret. */
+  function syncEmojiPopup(): void {
+    const active = disabledReason === null ? activeEmojiToken() : null;
+    if (active === null) {
+      closeEmojiPopup();
+      return;
+    }
+    if (emojiPopup === null) {
+      emojiPopup = createEmojiAutocomplete({
+        onSelect: insertEmoji,
+        onClose: closeEmojiPopup,
+      });
+      root?.appendChild(emojiPopup.element);
+    }
+    emojiStart = active.start;
+    if (!emojiPopup.setQuery(active.query)) {
+      closeEmojiPopup();
+    }
+  }
+
+  /** Apply a formatting marker to the current textarea selection. */
+  function applyFormatting(marker: string): void {
+    if (textarea === null || disabledReason !== null) return;
+    const result = wrapWithMarker(
+      textarea.value,
+      textarea.selectionStart,
+      textarea.selectionEnd,
+      marker,
+    );
+    textarea.value = result.value;
+    textarea.selectionStart = result.selectionStart;
+    textarea.selectionEnd = result.selectionEnd;
+    autoResize();
+    maybeEmitTyping();
+  }
+
+  /** Open, refilter, or close the popup for whatever is under the caret. */
+  function syncMentionPopup(): void {
+    const active = disabledReason === null ? activeMentionToken() : null;
+    if (active === null) {
+      closeMentionPopup();
+      return;
+    }
+    if (mentionPopup === null) {
+      mentionPopup = createMentionAutocomplete({
+        onSelect: insertMention,
+        onClose: closeMentionPopup,
+      });
+      root?.appendChild(mentionPopup.element);
+    }
+    mentionStart = active.start;
+    if (!mentionPopup.setQuery(active.query)) {
+      closeMentionPopup();
+    }
+  }
+
+  /**
+   * Drive both completion popups from one caret position. Only one can be open:
+   * the caret sits in exactly one token, and two stacked popups over the same
+   * textarea would race for the arrow keys.
+   */
+  function syncAutocomplete(): void {
+    syncMentionPopup();
+    if (mentionPopup !== null) {
+      closeEmojiPopup();
+      return;
+    }
+    syncEmojiPopup();
+  }
+
   function showReplyBar(username: string): void {
     if (replyBar === null || replyText === null) return;
     setText(replyText, `Replying to @${username}`);
@@ -479,12 +703,32 @@ export function createMessageInput(options: MessageInputOptions): MessageInputCo
       () => {
         autoResize();
         maybeEmitTyping();
+        syncAutocomplete();
       },
       { signal },
     );
     textarea.addEventListener(
       "keydown",
       (e: KeyboardEvent) => {
+        // Whichever popup is open owns navigation keys, so Enter completes the
+        // token instead of sending a half-typed message.
+        if (mentionPopup?.handleKeydown(e) === true) return;
+        if (emojiPopup?.handleKeydown(e) === true) return;
+
+        // Ctrl+B / Ctrl+I / Ctrl+U wrap the selection in markdown markers.
+        // The composer owns Ctrl+U while it has focus, so the propagation stop
+        // is load-bearing: without it the global upload shortcut would fire on
+        // top of the underline.
+        if ((e.ctrlKey || e.metaKey) && !e.altKey && !e.shiftKey) {
+          const marker = FORMAT_MARKERS[e.key.toLowerCase()];
+          if (marker !== undefined) {
+            e.preventDefault();
+            e.stopPropagation();
+            applyFormatting(marker);
+            return;
+          }
+        }
+
         if (e.key === "Enter" && !e.shiftKey) {
           e.preventDefault();
           handleSend();
@@ -520,6 +764,17 @@ export function createMessageInput(options: MessageInputOptions): MessageInputCo
       { signal },
     );
 
+    // Caret moves that aren't typing (click, blur) also decide the popup's fate.
+    textarea.addEventListener("click", syncAutocomplete, { signal });
+    textarea.addEventListener(
+      "blur",
+      () => {
+        closeMentionPopup();
+        closeEmojiPopup();
+      },
+      { signal },
+    );
+
     sendBtn.addEventListener("click", handleSend, { signal });
 
     // Picker state (declared together so both toggle functions can cross-close)
@@ -558,6 +813,9 @@ export function createMessageInput(options: MessageInputOptions): MessageInputCo
         return;
       }
       emojiPicker = createEmojiPicker({
+        // Read the set at open time, not at mount: an emoji_update while the
+        // composer is alive must be in the next picker the user opens.
+        customEmoji: listCustomEmoji(),
         onSelect: (emoji: string) => {
           if (textarea !== null) {
             const start = textarea.selectionStart;
@@ -649,6 +907,8 @@ export function createMessageInput(options: MessageInputOptions): MessageInputCo
     cleanupPickers = () => {
       closeEmojiPicker();
       closeGifPicker();
+      closeMentionPopup();
+      closeEmojiPopup();
     };
 
     appendChildren(inputBox, attachBtn, textarea, emojiBtn, gifBtn, sendBtn);
diff --git a/Client/tauri-client/src/components/MessageList.ts b/Client/tauri-client/src/components/MessageList.ts
index 9cc69830..33aa3fe7 100644
--- a/Client/tauri-client/src/components/MessageList.ts
+++ b/Client/tauri-client/src/components/MessageList.ts
@@ -11,13 +11,22 @@ import {
   getChannelMessages,
   hasMoreMessages,
   getHistoryLoadState,
+  isWindowDetached,
 } from "@stores/messages.store";
 import type { Message } from "@stores/messages.store";
 import { membersStore } from "@stores/members.store";
 import { unobserveMedia } from "@lib/media-visibility";
 
 const log = createLogger("message-list");
-import { shouldGroup, isSameDay, renderDayDivider, renderMessage } from "./message-list/renderers";
+import {
+  shouldGroup,
+  isSameDay,
+  renderDayDivider,
+  renderNewDivider,
+  renderMessage,
+} from "./message-list/renderers";
+import { getUnreadOnOpen } from "@stores/channels.store";
+import { isAudioMime, isVideoMime } from "./message-list/attachments";
 import { FenwickTree } from "./message-list/fenwick";
 
 // -- Options ------------------------------------------------------------------
@@ -39,6 +48,17 @@ export interface MessageListOptions {
   readonly onDeleteDraft?: (correlationId: string) => void;
   /** Retry a failed first-page history fetch. */
   readonly onRetryLoad?: () => void;
+  /**
+   * Jump to another message in this channel — the reply bar above a reply, and
+   * any other in-row affordance. May target a message outside the loaded
+   * window; the handler is expected to fetch the around-window in that case.
+   */
+  readonly onJumpToMessage?: (messageId: number) => void;
+  /**
+   * Leave a detached around-window and reload the live tail. Wired to the
+   * "Jump to Present" pill, which only appears while the window is detached.
+   */
+  readonly onJumpToPresent?: () => void;
 }
 
 // -- Constants ----------------------------------------------------------------
@@ -68,20 +88,31 @@ interface VirtualItemDivider {
   readonly timestamp: string;
 }
 
-type VirtualItem = VirtualItemMessage | VirtualItemDivider;
+/** The "NEW" line marking where the reader's unread messages begin. At most
+ *  one per list, and only for a visit that opened with unread messages. */
+interface VirtualItemNewDivider {
+  readonly kind: "new-divider";
+}
+
+type VirtualItem = VirtualItemMessage | VirtualItemDivider | VirtualItemNewDivider;
 
 // -- Smart height estimation --------------------------------------------------
 
 function estimateItemHeight(item: VirtualItem): number {
-  if (item.kind === "divider") return 32;
+  if (item.kind === "divider" || item.kind === "new-divider") return 32;
 
   // Non-grouped: min-height 2.75rem (44px @16px root) + margin-top 17px = 61px
   // Grouped: min-height 1.375rem (22px @16px root) + margin-top 0px = 22px
   let height = item.isGrouped ? 22 : 61;
 
-  // Image attachments
+  // Media attachments. Video shares the image box, so it reserves the same
+  // space; the audio player is a chip-height row.
   for (const att of item.message.attachments) {
-    if (att.mime.startsWith("image/")) {
+    if (isVideoMime(att.mime)) {
+      height += 220;
+    } else if (isAudioMime(att.mime)) {
+      height += 96;
+    } else if (att.mime.startsWith("image/")) {
       height += 220;
     }
   }
@@ -108,16 +139,24 @@ function buildVirtualItems(
   messages: readonly Message[],
   seedPrevMsg: Message | null = null,
   seedLastTimestamp: string | null = null,
+  newDividerAt = -1,
 ): readonly VirtualItem[] {
   const items: VirtualItem[] = [];
   let lastTimestamp: string | null = seedLastTimestamp;
   let prevMsg: Message | null = seedPrevMsg;
 
-  for (const msg of messages) {
+  for (const [i, msg] of messages.entries()) {
     if (lastTimestamp === null || !isSameDay(lastTimestamp, msg.timestamp)) {
       items.push({ kind: "divider", timestamp: msg.timestamp });
     }
-    const isGrouped = prevMsg !== null && shouldGroup(prevMsg, msg);
+    const isFirstUnread = i === newDividerAt;
+    if (isFirstUnread) {
+      items.push({ kind: "new-divider" });
+    }
+    // A message directly under the NEW line starts a fresh block: rendering it
+    // as a grouped continuation of a message from before the line hides both
+    // its author and the fact that the line is there.
+    const isGrouped = !isFirstUnread && prevMsg !== null && shouldGroup(prevMsg, msg);
     items.push({ kind: "message", message: msg, isGrouped });
     lastTimestamp = msg.timestamp;
     prevMsg = msg;
@@ -125,6 +164,19 @@ function buildVirtualItems(
   return items;
 }
 
+/**
+ * Index of the first unread message in `messages`, or -1 for none.
+ *
+ * Derived from the unread count the channel had when it was opened (the
+ * badge itself is cleared by the visit): the last N loaded messages are the
+ * unread ones. Clamped to 0 when the whole loaded window is unread, and
+ * suppressed at 0-length so an empty channel never renders a lone divider.
+ */
+function firstUnreadIndex(messages: readonly Message[], unreadOnOpen: number): number {
+  if (unreadOnOpen <= 0 || messages.length === 0) return -1;
+  return Math.max(0, messages.length - unreadOnOpen);
+}
+
 // -- Empty state --------------------------------------------------------------
 
 function renderEmptyState(channelName: string, channelType?: string): HTMLDivElement {
@@ -197,17 +249,39 @@ export function createMessageList(options: MessageListOptions): MessageListCompo
   let bottomSpacer: HTMLDivElement | null = null;
   let contentContainer: HTMLDivElement | null = null;
   let scrollToBottomBtn: HTMLButtonElement | null = null;
+  let jumpToPresentPill: HTMLButtonElement | null = null;
   let renderedStart = 0;
   let renderedEnd = 0;
 
+  /**
+   * Unread count this channel carried when the visit that created this list
+   * began. Read once here, not per render: the badge is cleared by the visit
+   * itself, and the divider must stay put for the whole visit rather than
+   * jumping as new messages arrive. Zero once the reader comes back, which is
+   * what makes the divider clear on the next visit.
+   *
+   * Suppressed while the window is detached (jumped to an old message): the
+   * loaded slice is then not the tail, so "the last N messages" would put the
+   * line somewhere arbitrary.
+   */
+  const unreadOnOpen = isWindowDetached(options.channelId) ? 0 : getUnreadOnOpen(options.channelId);
+
   // ---------------------------------------------------------------------------
   // Height estimation (Fenwick tree backed)
   // ---------------------------------------------------------------------------
 
+  /** Render one virtual item — the single place the three item kinds map to DOM. */
+  function renderVirtualItem(item: VirtualItem): HTMLElement {
+    if (item.kind === "divider") return renderDayDivider(item.timestamp);
+    if (item.kind === "new-divider") return renderNewDivider();
+    return renderMessage(item.message, item.isGrouped, allMessages, options, ac.signal);
+  }
+
   function itemKey(index: number): string {
     const item = virtualItems[index];
     if (item === undefined) return `idx-${index}`;
     if (item.kind === "divider") return `div-${item.timestamp}`;
+    if (item.kind === "new-divider") return "new-divider";
     return `msg-${item.message.id}`;
   }
 
@@ -271,6 +345,12 @@ export function createMessageList(options: MessageListOptions): MessageListCompo
     }
   }
 
+  /** The pill is the only signal that the bottom of the list is not "now". */
+  function updateJumpToPresentPill(): void {
+    if (jumpToPresentPill === null) return;
+    jumpToPresentPill.classList.toggle("visible", isWindowDetached(options.channelId));
+  }
+
   // ---------------------------------------------------------------------------
   // Render visible window
   // ---------------------------------------------------------------------------
@@ -410,14 +490,7 @@ export function createMessageList(options: MessageListOptions): MessageListCompo
       clearChildren(contentContainer);
       const fragment = document.createDocumentFragment();
       for (let i = start; i < end; i++) {
-        const item = virtualItems[i]!;
-        if (item.kind === "divider") {
-          fragment.appendChild(renderDayDivider(item.timestamp));
-        } else {
-          fragment.appendChild(
-            renderMessage(item.message, item.isGrouped, allMessages, options, ac.signal),
-          );
-        }
+        fragment.appendChild(renderVirtualItem(virtualItems[i]!));
       }
       contentContainer.appendChild(fragment);
 
@@ -439,7 +512,12 @@ export function createMessageList(options: MessageListOptions): MessageListCompo
 
   function rebuildItems(): void {
     allMessages = getChannelMessages(options.channelId);
-    virtualItems = buildVirtualItems(allMessages);
+    virtualItems = buildVirtualItems(
+      allMessages,
+      null,
+      null,
+      firstUnreadIndex(allMessages, unreadOnOpen),
+    );
 
     // Build Fenwick tree initialized with smart estimates / cached heights
     tree = new FenwickTree(virtualItems.length);
@@ -516,13 +594,7 @@ export function createMessageList(options: MessageListOptions): MessageListCompo
       // The rendered window includes the old tail — append the new rows.
       const fragment = document.createDocumentFragment();
       for (const item of appendedItems) {
-        if (item.kind === "divider") {
-          fragment.appendChild(renderDayDivider(item.timestamp));
-        } else {
-          fragment.appendChild(
-            renderMessage(item.message, item.isGrouped, allMessages, options, ac.signal),
-          );
-        }
+        fragment.appendChild(renderVirtualItem(item));
       }
       contentContainer.appendChild(fragment);
       renderedEnd = virtualItems.length;
@@ -676,11 +748,21 @@ export function createMessageList(options: MessageListOptions): MessageListCompo
       { signal: ac.signal },
     );
 
+    jumpToPresentPill = createElement("button", {
+      class: "jump-to-present-pill",
+      "data-testid": "jump-to-present",
+    });
+    jumpToPresentPill.textContent = "Jump to Present ↓";
+    jumpToPresentPill.addEventListener("click", () => options.onJumpToPresent?.(), {
+      signal: ac.signal,
+    });
+
     root.appendChild(topSpacer);
     root.appendChild(contentContainer);
     root.appendChild(bottomSpacer);
     root.appendChild(scrollAnchor);
     root.appendChild(scrollToBottomBtn);
+    root.appendChild(jumpToPresentPill);
 
     root.addEventListener("scroll", handleScroll, {
       signal: ac.signal,
@@ -722,6 +804,7 @@ export function createMessageList(options: MessageListOptions): MessageListCompo
     parentContainer.appendChild(root);
 
     renderAll();
+    updateJumpToPresentPill();
     scrollToBottom();
     const initialScrollRaf = requestAnimationFrame(() => scrollToBottom());
     ac.signal.addEventListener("abort", () => cancelAnimationFrame(initialScrollRaf));
@@ -750,6 +833,17 @@ export function createMessageList(options: MessageListOptions): MessageListCompo
       ),
     );
 
+    // Show/hide the pill as the window detaches from (and reattaches to) the
+    // live tail. No re-render — only the pill's visibility changes.
+    unsubscribers.push(
+      messagesStore.subscribeSelector(
+        (s) => s.detachedChannels.has(options.channelId),
+        () => {
+          updateJumpToPresentPill();
+        },
+      ),
+    );
+
     // Only re-render when member roles change, not on presence/typing updates.
     // The store bumps roleRevision solely on membership/role mutations, so
     // selecting the counter avoids rebuilding a role map per notification.
@@ -801,6 +895,7 @@ export function createMessageList(options: MessageListOptions): MessageListCompo
     topSpacer = null;
     bottomSpacer = null;
     scrollToBottomBtn = null;
+    jumpToPresentPill = null;
   }
 
   function scrollToMessage(messageId: number): boolean {
@@ -811,6 +906,10 @@ export function createMessageList(options: MessageListOptions): MessageListCompo
     if (idx === -1) return false;
 
     root.scrollTop = offsetBefore(idx);
+    // Force the rebuild path: a scroll-driven renderWindow only moves spacers,
+    // so without this the target row can sit outside the rendered window and
+    // there is nothing to flash (and nothing to look at after the scroll).
+    renderedStart = -1;
     renderWindow();
 
     // Briefly highlight the target message element
@@ -819,9 +918,11 @@ export function createMessageList(options: MessageListOptions): MessageListCompo
       const el = contentContainer.children[localIdx] as HTMLElement | undefined;
       if (el !== undefined) {
         el.classList.add("highlight-flash");
-        setTimeout(() => {
+        const timer = window.setTimeout(() => {
           el.classList.remove("highlight-flash");
         }, 1500);
+        // Unmounting mid-flash must not leave a timer pointing at a dead node.
+        ac.signal.addEventListener("abort", () => clearTimeout(timer), { once: true });
       }
     }
 
diff --git a/Client/tauri-client/src/components/NsfwGate.ts b/Client/tauri-client/src/components/NsfwGate.ts
new file mode 100644
index 00000000..41a37f81
--- /dev/null
+++ b/Client/tauri-client/src/components/NsfwGate.ts
@@ -0,0 +1,113 @@
+/**
+ * NsfwGate — the age-gate shown over a channel flagged NSFW.
+ *
+ * The server does nothing with the flag beyond storing and broadcasting it (see
+ * `@lib/nsfw-gate`), so this overlay is the whole of the feature on the reading
+ * side. It covers the message area rather than replacing it: the channel is
+ * mounted and live underneath, and accepting the warning reveals it without a
+ * refetch.
+ *
+ * Deliberately not a `.modal-overlay`: a modal is a decision about the app,
+ * while this is a property of the channel you just opened. It fills its
+ * container, so mounting it into the messages slot gates exactly the content it
+ * is warning about and leaves the sidebar and header usable.
+ */
+
+import { createElement, setText, appendChildren } from "@lib/dom";
+import { createIcon } from "@lib/icons";
+import type { MountableComponent } from "@lib/safe-render";
+import { acknowledgeNsfw } from "@lib/nsfw-gate";
+
+export interface NsfwGateOptions {
+  /** Channel being gated — its id keys the per-session acknowledgement. */
+  readonly channelId: number;
+  /** Channel name, shown without the leading '#'. */
+  readonly channelName: string;
+  /** Called after the acknowledgement is recorded. */
+  readonly onContinue: () => void;
+  /**
+   * Called when the reader declines. Optional: without it the gate offers only
+   * "Continue", which is right for a container the reader can simply navigate
+   * away from.
+   */
+  readonly onCancel?: () => void;
+}
+
+export function createNsfwGate(options: NsfwGateOptions): MountableComponent {
+  const { channelId, channelName, onContinue, onCancel } = options;
+  const ac = new AbortController();
+  let root: HTMLDivElement | null = null;
+
+  function mount(container: Element): void {
+    root = createElement("div", {
+      class: "nsfw-gate",
+      "data-testid": "nsfw-gate",
+      role: "dialog",
+      "aria-modal": "false",
+      "aria-label": `Age restricted channel ${channelName}`,
+    });
+
+    const card = createElement("div", { class: "nsfw-gate-card" });
+
+    const iconWrap = createElement("div", { class: "nsfw-gate-icon" });
+    iconWrap.appendChild(createIcon("shield-alert", 40));
+
+    const title = createElement("h2", { class: "nsfw-gate-title" });
+    setText(title, `#${channelName}`);
+
+    const body = createElement("p", { class: "nsfw-gate-body" });
+    setText(body, "This channel may contain sensitive content — Continue?");
+
+    // Says plainly what the flag is and is not, so nobody reads the gate as a
+    // promise the server is filtering something.
+    const note = createElement("p", { class: "nsfw-gate-note" });
+    setText(
+      note,
+      "The channel has been marked age-restricted by a moderator. Nothing is filtered — you are only being asked once per session.",
+    );
+
+    const actions = createElement("div", { class: "nsfw-gate-actions" });
+
+    if (onCancel !== undefined) {
+      const backBtn = createElement(
+        "button",
+        { class: "btn-modal-cancel", type: "button", "data-testid": "nsfw-gate-back" },
+        "Go Back",
+      );
+      backBtn.addEventListener("click", onCancel, { signal: ac.signal });
+      actions.appendChild(backBtn);
+    }
+
+    const continueBtn = createElement(
+      "button",
+      { class: "btn-modal-save", type: "button", "data-testid": "nsfw-gate-continue" },
+      "Continue",
+    );
+    continueBtn.addEventListener(
+      "click",
+      () => {
+        // Record first, then notify: the caller's handler tears this component
+        // down, and an acknowledgement written afterwards would race it.
+        acknowledgeNsfw(channelId);
+        onContinue();
+      },
+      { signal: ac.signal },
+    );
+    actions.appendChild(continueBtn);
+
+    appendChildren(card, iconWrap, title, body, note, actions);
+    root.appendChild(card);
+    container.appendChild(root);
+    continueBtn.focus();
+  }
+
+  function destroy(): void {
+    ac.abort();
+    if (root !== null) {
+      root.remove();
+      root = null;
+    }
+  }
+
+  return { mount, destroy };
+}
diff --git a/Client/tauri-client/src/components/SearchOverlay.ts b/Client/tauri-client/src/components/SearchOverlay.ts
index f647b0e6..8d48815e 100644
--- a/Client/tauri-client/src/components/SearchOverlay.ts
+++ b/Client/tauri-client/src/components/SearchOverlay.ts
@@ -113,7 +113,16 @@ export function createSearchOverlay(options: SearchOverlayOptions): MountableCom
 
   function doSearch(): void {
     const now = Date.now();
-    if (now - lastSearchTime < MIN_SEARCH_INTERVAL_MS) return;
+    const sinceLast = now - lastSearchTime;
+    if (sinceLast < MIN_SEARCH_INTERVAL_MS) {
+      // Too soon after the previous search. Don't drop this query — that would
+      // leave the earlier query's results on screen for what the user is now
+      // typing. Reschedule for when the rate-limit window opens, reusing the
+      // debounce timer so destroy() still tears it down.
+      if (debounceTimer !== null) window.clearTimeout(debounceTimer);
+      debounceTimer = window.setTimeout(doSearch, MIN_SEARCH_INTERVAL_MS - sinceLast);
+      return;
+    }
     lastSearchTime = now;
 
     const query = input.value.trim();
diff --git a/Client/tauri-client/src/components/SettingsOverlay.ts b/Client/tauri-client/src/components/SettingsOverlay.ts
index 4a924455..f5d3645f 100644
--- a/Client/tauri-client/src/components/SettingsOverlay.ts
+++ b/Client/tauri-client/src/components/SettingsOverlay.ts
@@ -28,7 +28,18 @@ import { createLogsTab } from "./settings/LogsTab";
 export interface SettingsOverlayOptions {
   onClose(): void;
   onChangePassword(oldPassword: string, newPassword: string): Promise<void>;
-  onUpdateProfile(username: string): Promise<void>;
+  /**
+   * Patch the signed-in user's profile. Every field is optional and omitted
+   * means "leave unchanged"; an empty string clears the nullable ones, which
+   * is how the API itself distinguishes the two.
+   */
+  onUpdateProfile(patch: {
+    username?: string;
+    display_name?: string;
+    about?: string;
+  }): Promise<void>;
+  /** Upload an avatar image. Resolves with the URL the server stored. */
+  onUploadAvatar(file: File): Promise<string>;
   onLogout(): void;
   onDeleteAccount(password: string): Promise<void>;
   onStatusChange(status: UserStatus): void;
diff --git a/Client/tauri-client/src/components/StatusPicker.ts b/Client/tauri-client/src/components/StatusPicker.ts
index 90638c86..780f0a50 100644
--- a/Client/tauri-client/src/components/StatusPicker.ts
+++ b/Client/tauri-client/src/components/StatusPicker.ts
@@ -8,6 +8,7 @@ import { createElement, appendChildren } from "@lib/dom";
 import { createIcon } from "@lib/icons";
 import type { MountableComponent } from "@lib/safe-render";
 import type { UserStatus } from "@lib/types";
+import { MAX_CUSTOM_STATUS_LEN } from "@lib/userStatus";
 
 // ---------------------------------------------------------------------------
 // Types
@@ -16,11 +17,18 @@ import type { UserStatus } from "@lib/types";
 export interface StatusPickerOptions {
   readonly currentStatus: UserStatus;
   readonly onStatusChange: (status: UserStatus) => void;
+  /** The custom status line to pre-fill the input with. */
+  readonly currentCustomStatus?: string;
+  /** Called when the user commits a custom status (Enter or blur). Passing an
+   *  empty string means "clear it". Omitted = the input is not rendered. */
+  readonly onCustomStatusChange?: (text: string) => void;
 }
 
 export type StatusPickerComponent = MountableComponent & {
   /** Update the displayed status without recreating the picker. */
   setStatus(status: UserStatus): void;
+  /** Update the custom status input without recreating the picker. */
+  setCustomStatus(text: string): void;
 };
 
 // ---------------------------------------------------------------------------
@@ -33,11 +41,17 @@ interface StatusDef {
   readonly color: string;
 }
 
+/**
+ * "invisible" is its own value now, not "offline" wearing a different label.
+ * The server stores it as chosen and shows everyone else offline, so the
+ * picker can finally send what it means — and the status survives a reconnect
+ * instead of flashing back to online.
+ */
 const STATUS_DEFS: readonly StatusDef[] = [
   { value: "online", label: "Online", color: "#3ba55d" },
   { value: "idle", label: "Idle", color: "#faa61a" },
   { value: "dnd", label: "Do Not Disturb", color: "#ed4245" },
-  { value: "offline", label: "Invisible", color: "#747f8d" },
+  { value: "invisible", label: "Invisible", color: "#747f8d" },
 ];
 
 function colorForStatus(status: UserStatus): string {
@@ -57,6 +71,11 @@ export function createStatusPicker(options: StatusPickerOptions): StatusPickerCo
   let dotEl: HTMLDivElement | null = null;
   let dropdownEl: HTMLDivElement | null = null;
   let checkEls = new Map<UserStatus, HTMLSpanElement>();
+  let customInputEl: HTMLInputElement | null = null;
+  /** Last text handed to the callback. Guards the blur-after-Enter double
+   *  send, which would otherwise cost a second presence_update against the
+   *  server's one-per-ten-seconds limit. */
+  let lastCommittedCustom = options.currentCustomStatus ?? "";
 
   // ---- Dropdown visibility --------------------------------------------------
 
@@ -144,6 +163,58 @@ export function createStatusPicker(options: StatusPickerOptions): StatusPickerCo
     return row;
   }
 
+  /**
+   * The "Set a custom status" row. Only built when a handler was supplied —
+   * an input whose value goes nowhere is worse than no input.
+   */
+  function buildCustomStatusRow(onChange: (text: string) => void): HTMLDivElement {
+    const row = createElement("div", { class: "status-picker-custom" });
+    const input = createElement("input", {
+      class: "status-picker-custom-input",
+      type: "text",
+      placeholder: "Set a custom status",
+      maxlength: String(MAX_CUSTOM_STATUS_LEN),
+      "aria-label": "Custom status",
+      "data-testid": "custom-status-input",
+    });
+    input.value = options.currentCustomStatus ?? "";
+    customInputEl = input;
+
+    const commit = (): void => {
+      const text = input.value.trim().slice(0, MAX_CUSTOM_STATUS_LEN);
+      if (text === lastCommittedCustom) return;
+      lastCommittedCustom = text;
+      input.value = text;
+      onChange(text);
+    };
+
+    input.addEventListener(
+      "keydown",
+      (e: KeyboardEvent) => {
+        // Keystrokes inside the input must not reach the dropdown's own
+        // Enter/Escape handling, which would close the menu mid-edit.
+        e.stopPropagation();
+        if (e.key === "Enter") {
+          e.preventDefault();
+          commit();
+          closeDropdown();
+        } else if (e.key === "Escape") {
+          e.preventDefault();
+          input.value = lastCommittedCustom;
+          closeDropdown();
+        }
+      },
+      { signal },
+    );
+    input.addEventListener("blur", commit, { signal });
+    // The row is inside the dropdown; clicking the input must not be treated
+    // as picking a status or as an outside click.
+    input.addEventListener("click", (e: MouseEvent) => e.stopPropagation(), { signal });
+
+    row.appendChild(input);
+    return row;
+  }
+
   // ---- MountableComponent ---------------------------------------------------
 
   function mount(container: Element): void {
@@ -186,6 +257,11 @@ export function createStatusPicker(options: StatusPickerOptions): StatusPickerCo
     for (const def of STATUS_DEFS) {
       dropdownEl.appendChild(buildOption(def));
     }
+    const onCustomStatusChange = options.onCustomStatusChange;
+    if (onCustomStatusChange !== undefined) {
+      dropdownEl.appendChild(createElement("div", { class: "status-picker-divider" }));
+      dropdownEl.appendChild(buildCustomStatusRow(onCustomStatusChange));
+    }
 
     appendChildren(root, dotEl, dropdownEl);
     container.appendChild(root);
@@ -221,11 +297,17 @@ export function createStatusPicker(options: StatusPickerOptions): StatusPickerCo
     root = null;
     dotEl = null;
     dropdownEl = null;
+    customInputEl = null;
   }
 
   function setStatus(status: UserStatus): void {
     applyStatus(status);
   }
 
-  return { mount, destroy, setStatus };
+  function setCustomStatus(text: string): void {
+    lastCommittedCustom = text;
+    if (customInputEl !== null) customInputEl.value = text;
+  }
+
+  return { mount, destroy, setStatus, setCustomStatus };
 }
diff --git a/Client/tauri-client/src/components/UserBar.ts b/Client/tauri-client/src/components/UserBar.ts
index b60f13a4..10142789 100644
--- a/Client/tauri-client/src/components/UserBar.ts
+++ b/Client/tauri-client/src/components/UserBar.ts
@@ -11,7 +11,15 @@ import { authStore } from "@stores/auth.store";
 import { openSettings, uiStore } from "@stores/ui.store";
 import { createStatusPicker, type StatusPickerComponent } from "@components/StatusPicker";
 import type { UserStatus } from "@lib/types";
-import { loadUserStatus, onUserStatusChange, saveUserStatus } from "@lib/userStatus";
+import {
+  loadCustomStatus,
+  loadUserStatus,
+  onUserStatusChange,
+  saveCustomStatus,
+  saveUserStatus,
+} from "@lib/userStatus";
+import { avatarInitial, isRenderableAvatar, resolveDisplayName } from "@lib/avatar";
+import { fetchImageAsDataUrl, resolveServerUrl } from "@components/message-list/attachments";
 import type { WsClient } from "@lib/ws";
 
 export interface UserBarOptions {
@@ -19,6 +27,15 @@ export interface UserBarOptions {
   readonly ws?: WsClient | null;
 }
 
+/** Status labels for the line under the username. */
+const STATUS_TEXT: Readonly<Record<UserStatus, string>> = {
+  online: "Online",
+  idle: "Idle",
+  dnd: "Do Not Disturb",
+  invisible: "Invisible",
+  offline: "Offline",
+};
+
 export function createUserBar(options?: UserBarOptions): MountableComponent {
   const disposable = new Disposable();
   let root: HTMLDivElement | null = null;
@@ -26,24 +43,71 @@ export function createUserBar(options?: UserBarOptions): MountableComponent {
   // Element references for targeted updates
   let avatarEl: HTMLDivElement | null = null;
   let avatarTextEl: HTMLSpanElement | null = null;
+  let avatarImgEl: HTMLImageElement | null = null;
+  /** Avatar URL currently rendered, so a re-render for an unrelated auth
+   *  change doesn't re-fetch the same picture. */
+  let renderedAvatarUrl: string | null = null;
   let nameEl: HTMLSpanElement | null = null;
   let statusEl: HTMLSpanElement | null = null;
   let statusPicker: StatusPickerComponent | null = null;
 
+  /** Swap the letter for the uploaded picture, or back again. */
+  function renderAvatar(subject: {
+    username: string;
+    displayName: string | null;
+    avatar: string | null;
+  }): void {
+    if (avatarEl === null) return;
+    if (avatarTextEl !== null) setText(avatarTextEl, avatarInitial(subject));
+
+    const url = isRenderableAvatar(subject.avatar) ? resolveServerUrl(subject.avatar) : null;
+    if (url === renderedAvatarUrl) return;
+    renderedAvatarUrl = url;
+
+    if (avatarImgEl !== null) {
+      avatarImgEl.remove();
+      avatarImgEl = null;
+    }
+    if (url === null) {
+      if (avatarTextEl !== null) avatarTextEl.style.display = "";
+      avatarEl.style.background = "var(--accent)";
+      return;
+    }
+    void fetchImageAsDataUrl(url).then((dataUrl) => {
+      // The URL may have changed again (or the bar been torn down) while the
+      // bytes were in flight.
+      if (dataUrl === null || avatarEl === null || renderedAvatarUrl !== url) return;
+      const img = createElement("img", {
+        class: "avatar-img",
+        src: dataUrl,
+        alt: subject.username,
+      });
+      avatarImgEl = img;
+      if (avatarTextEl !== null) avatarTextEl.style.display = "none";
+      avatarEl.style.background = "transparent";
+      avatarEl.insertBefore(img, avatarEl.firstChild);
+    });
+  }
+
   function updateFromState(): void {
     const state = authStore.getState();
     const user = state.user;
-    const username = user?.username ?? "Unknown";
-    const initial = username.charAt(0).toUpperCase() || "?";
+    const subject = {
+      username: user?.username ?? "Unknown",
+      displayName: user?.display_name ?? null,
+      avatar: user?.avatar ?? null,
+    };
 
-    if (avatarTextEl !== null) {
-      setText(avatarTextEl, initial);
-    }
+    renderAvatar(subject);
     if (nameEl !== null) {
-      setText(nameEl, username);
+      setText(nameEl, resolveDisplayName(subject));
     }
     if (statusEl !== null) {
-      setText(statusEl, state.isAuthenticated ? "Online" : "Offline");
+      // The bar shows the user's own chosen status, invisible included —
+      // everyone else is told offline, but lying to the owner about their own
+      // state is exactly the bug real invisible exists to fix.
+      const text = state.isAuthenticated ? (STATUS_TEXT[loadUserStatus()] ?? "Online") : "Offline";
+      setText(statusEl, text);
     }
   }
 
@@ -86,21 +150,39 @@ export function createUserBar(options?: UserBarOptions): MountableComponent {
       // Start from the stored selection, not a hardcoded "online" — otherwise
       // this picker and the settings Account tab show different statuses.
       currentStatus: loadUserStatus(),
+      currentCustomStatus: loadCustomStatus(),
       onStatusChange: (status: UserStatus) => {
         saveUserStatus(status);
+        updateFromState();
         const ws = options?.ws;
         if (ws !== null && ws !== undefined && canSetStatus()) {
+          // No custom_status field: a plain status change must leave whatever
+          // text the user set standing.
           ws.send({ type: "presence_update", payload: { status } } as never);
         }
       },
+      onCustomStatusChange: (text: string) => {
+        saveCustomStatus(text);
+        const ws = options?.ws;
+        if (ws !== null && ws !== undefined && canSetStatus()) {
+          ws.send({
+            type: "presence_update",
+            payload: { status: loadUserStatus(), custom_status: text },
+          } as never);
+        }
+      },
     });
     statusPicker.mount(statusPickerWrap);
 
     // Reflect status changes made on the settings Account tab.
     disposable.addCleanup(
-      onUserStatusChange((status) => statusPicker?.setStatus(status), {
-        signal: disposable.signal,
-      }),
+      onUserStatusChange(
+        (status) => {
+          statusPicker?.setStatus(status);
+          updateFromState();
+        },
+        { signal: disposable.signal },
+      ),
     );
 
     // Disable picker (with a reason) when the connection is down
@@ -172,6 +254,8 @@ export function createUserBar(options?: UserBarOptions): MountableComponent {
     }
     avatarEl = null;
     avatarTextEl = null;
+    avatarImgEl = null;
+    renderedAvatarUrl = null;
     nameEl = null;
     statusEl = null;
   }
diff --git a/Client/tauri-client/src/components/UserProfilePopup.ts b/Client/tauri-client/src/components/UserProfilePopup.ts
index 6e635f2b..00423a34 100644
--- a/Client/tauri-client/src/components/UserProfilePopup.ts
+++ b/Client/tauri-client/src/components/UserProfilePopup.ts
@@ -9,11 +9,12 @@
  * A11y: role="dialog", aria-label, focus trap, return focus on close.
  */
 
-import { createElement, appendChildren } from "@lib/dom";
+import { createElement, appendChildren, setText } from "@lib/dom";
 import { createIcon } from "@lib/icons";
 import type { MountableComponent } from "@lib/safe-render";
 import type { UserStatus } from "@lib/types";
-import { isSafeUrl } from "./message-list/attachments";
+import { createAvatarElement, resolveDisplayName } from "@lib/avatar";
+import { roleColorVar } from "./message-list/formatting";
 
 // ---------------------------------------------------------------------------
 // Types
@@ -25,7 +26,12 @@ export interface UserProfileData {
   readonly avatar: string | null;
   readonly role: string;
   readonly status: UserStatus;
+  /** Nickname. When set the popup shows it as the heading and the username
+   *  underneath, because the username is still the handle you @mention. */
+  readonly displayName?: string | null;
   readonly about?: string | null;
+  /** Free-text status line, shown under the name. */
+  readonly customStatus?: string | null;
   readonly joinDate?: string | null;
   readonly isDeleted?: boolean;
 }
@@ -58,6 +64,9 @@ const STATUS_COLORS: Record<UserStatus, string> = {
   online: "#3ba55d",
   idle: "#faa61a",
   dnd: "#ed4245",
+  // Only ever reached for the signed-in user looking at their own profile —
+  // the server maps invisible to offline for everyone else.
+  invisible: "#747f8d",
   offline: "#747f8d",
 };
 
@@ -65,16 +74,10 @@ const STATUS_LABELS: Record<UserStatus, string> = {
   online: "Online",
   idle: "Idle",
   dnd: "Do Not Disturb",
+  invisible: "Invisible",
   offline: "Offline",
 };
 
-const ROLE_COLORS: Record<string, string> = {
-  owner: "#e74c3c",
-  admin: "#f39c12",
-  moderator: "#2ecc71",
-  member: "#949ba4",
-};
-
 // ---------------------------------------------------------------------------
 // Component factory
 // ---------------------------------------------------------------------------
@@ -132,28 +135,22 @@ export function createUserProfilePopup(
   }
 
   function buildAvatar(user: UserProfileData): HTMLDivElement {
-    const wrapper = createElement("div", { class: "upp-avatar" });
-
-    if (user.isDeleted === true) {
-      wrapper.style.background = "#4e5058";
-      const text = createElement("span", {}, "?");
-      wrapper.appendChild(text);
-    } else if (user.avatar !== null && user.avatar.length > 0 && isSafeUrl(user.avatar)) {
-      const img = createElement("img", {
-        src: user.avatar,
-        alt: user.username,
-        class: "upp-avatar-img",
-      });
-      img.style.width = "64px";
-      img.style.height = "64px";
-      img.style.borderRadius = "50%";
-      wrapper.appendChild(img);
-    } else {
-      wrapper.style.background = "var(--accent, #5865f2)";
-      const initial = user.username.charAt(0).toUpperCase() || "?";
-      const text = createElement("span", {}, initial);
-      wrapper.appendChild(text);
-    }
+    // The shared helper is what makes uploaded avatars work here and in the
+    // message rows and member list at the same time: it fetches the
+    // authenticated file through the cert-pinned path and falls back to the
+    // letter until (or unless) the bytes arrive.
+    const wrapper = createAvatarElement(
+      {
+        username: user.username,
+        displayName: user.displayName,
+        avatar: user.avatar,
+        isDeleted: user.isDeleted,
+      },
+      {
+        className: "upp-avatar",
+        background: user.isDeleted === true ? "#4e5058" : "var(--accent, #5865f2)",
+      },
+    );
 
     // Status dot overlay
     const statusDot = createElement("div", { class: "upp-status-dot" });
@@ -167,7 +164,7 @@ export function createUserProfilePopup(
   function mount(container: Element): void {
     previousFocus = document.activeElement;
     const user = options.user;
-    const displayName = user.isDeleted === true ? "[deleted]" : user.username;
+    const displayName = user.isDeleted === true ? "[deleted]" : resolveDisplayName(user);
 
     // Overlay for outside-click detection
     overlay = createElement("div", {
@@ -207,10 +204,24 @@ export function createUserProfilePopup(
       nameEl.style.color = "var(--text-faint, #80848e)";
     }
 
+    // Username line, shown only when a display name is standing in for it.
+    // @mentions still resolve by username, so the popup has to keep telling
+    // you what to type.
+    const handleEl = createElement("div", { class: "upp-username-handle" });
+    if (user.isDeleted !== true && displayName !== user.username) {
+      setText(handleEl, `@${user.username}`);
+    }
+
+    // Custom status line — the user's own words, under the name.
+    const customStatusEl = createElement("div", { class: "upp-custom-status" });
+    if (typeof user.customStatus === "string" && user.customStatus.length > 0) {
+      setText(customStatusEl, user.customStatus);
+    }
+
     // Role badge
     const roleBadge = createElement("span", { class: "upp-role-badge" });
     const roleDot = createElement("span", { class: "upp-role-dot" });
-    roleDot.style.background = ROLE_COLORS[user.role] ?? ROLE_COLORS.member ?? "";
+    roleDot.style.background = roleColorVar(user.role.toLowerCase());
     const roleLabel = createElement(
       "span",
       {},
@@ -244,53 +255,64 @@ export function createUserProfilePopup(
     // Divider
     const divider = createElement("div", { class: "upp-divider" });
 
-    // Actions
+    // Actions — only render buttons that are actually wired up, so the popup
+    // never shows a dead control (e.g. Call before DM calls exist, or Message
+    // on your own profile).
     const actions = createElement("div", { class: "upp-actions" });
 
-    const messageBtn = createElement("button", {
-      class: "upp-action-btn",
-      "data-testid": "upp-message-btn",
-    });
-    messageBtn.appendChild(createIcon("send", 16));
-    messageBtn.appendChild(document.createTextNode(" Message"));
-    messageBtn.addEventListener(
-      "click",
-      () => {
-        options.onMessage?.(user.id);
-        close();
-      },
-      { signal },
-    );
+    if (options.onMessage !== undefined) {
+      const onMessage = options.onMessage;
+      const messageBtn = createElement("button", {
+        class: "upp-action-btn",
+        "data-testid": "upp-message-btn",
+      });
+      messageBtn.appendChild(createIcon("send", 16));
+      messageBtn.appendChild(document.createTextNode(" Message"));
+      messageBtn.addEventListener(
+        "click",
+        () => {
+          onMessage(user.id);
+          close();
+        },
+        { signal },
+      );
+      actions.appendChild(messageBtn);
+    }
 
-    const callBtn = createElement("button", {
-      class: "upp-action-btn",
-      "data-testid": "upp-call-btn",
-    });
-    callBtn.appendChild(createIcon("phone", 16));
-    callBtn.appendChild(document.createTextNode(" Call"));
-    callBtn.addEventListener(
-      "click",
-      () => {
-        options.onCall?.(user.id);
-        close();
-      },
-      { signal },
-    );
-
-    appendChildren(actions, messageBtn, callBtn);
+    if (options.onCall !== undefined) {
+      const onCall = options.onCall;
+      const callBtn = createElement("button", {
+        class: "upp-action-btn",
+        "data-testid": "upp-call-btn",
+      });
+      callBtn.appendChild(createIcon("phone", 16));
+      callBtn.appendChild(document.createTextNode(" Call"));
+      callBtn.addEventListener(
+        "click",
+        () => {
+          onCall(user.id);
+          close();
+        },
+        { signal },
+      );
+      actions.appendChild(callBtn);
+    }
 
     // Assemble popup
     appendChildren(
       popup,
       avatar,
       nameEl,
+      handleEl,
+      customStatusEl,
       roleBadge,
       statusLine,
       aboutSection,
       joinSection,
-      divider,
-      actions,
     );
+    if (actions.childElementCount > 0) {
+      appendChildren(popup, divider, actions);
+    }
 
     overlay.appendChild(popup);
     container.appendChild(overlay);
diff --git a/Client/tauri-client/src/components/VoiceWidget.ts b/Client/tauri-client/src/components/VoiceWidget.ts
index 6abbcaf0..383efcc1 100644
--- a/Client/tauri-client/src/components/VoiceWidget.ts
+++ b/Client/tauri-client/src/components/VoiceWidget.ts
@@ -11,6 +11,7 @@ import type { IconName } from "@lib/icons";
 import type { MountableComponent } from "@lib/safe-render";
 import { voiceStore, type VoiceStatus } from "@stores/voice.store";
 import { channelsStore } from "@stores/channels.store";
+import { dmStore, dmDisplayName } from "@stores/dm.store";
 import { uiStore } from "@stores/ui.store";
 import {
   createConnectionStatsPoller,
@@ -230,22 +231,44 @@ export function createVoiceWidget(options: VoiceWidgetOptions): MountableCompone
     updateStatus(voice.voiceStatus);
     updateFrozen(uiStore.getState().connectionStatus);
 
-    // Channel name
+    // Channel name. A DM call resolves through the DM store rather than the
+    // channels store: the channels-store row for a DM is synthesised when the
+    // conversation is opened, so accepting a call for a DM the user has not
+    // looked at yet would otherwise label the call "Voice Channel".
     const channel = channelsStore.getState().channels.get(channelId);
-    setText(channelNameEl, channel?.name ?? "Voice Channel");
+    const dm = dmStore.getState().channels.find((c) => c.channelId === channelId);
+    setText(
+      channelNameEl,
+      dm !== undefined ? dmDisplayName(dm) : (channel?.name ?? "Voice Channel"),
+    );
 
     // Toggle button active states, swap icons, and update aria-pressed
     muteBtn?.classList.toggle("active-ctrl", voice.localMuted);
     deafenBtn?.classList.toggle("active-ctrl", voice.localDeafened);
     cameraBtn?.classList.toggle("active-ctrl", voice.localCamera);
 
+    // A moderator-imposed mute/deafen is not ours to lift: the server refuses
+    // the unmute, so disable the control and say why instead of letting the
+    // click bounce off with an error toast.
+    const serverMuted = voice.localServerMuted === true;
+    const serverDeafened = voice.localServerDeafened === true;
     if (muteBtn) {
       swapIcon(muteBtn, voice.localMuted ? "mic-off" : "mic");
       muteBtn.setAttribute("aria-pressed", String(voice.localMuted));
+      // Only ever tighten: updateFrozen ran above and owns the socket-down
+      // disable, which must not be relaxed here.
+      if (serverMuted) {
+        muteBtn.disabled = true;
+        muteBtn.title = "You were muted by a moderator";
+      }
     }
     if (deafenBtn) {
       swapIcon(deafenBtn, voice.localDeafened ? "headphones-off" : "headphones");
       deafenBtn.setAttribute("aria-pressed", String(voice.localDeafened));
+      if (serverDeafened) {
+        deafenBtn.disabled = true;
+        deafenBtn.title = "You were deafened by a moderator";
+      }
     }
     if (cameraBtn) {
       swapIcon(cameraBtn, voice.localCamera ? "camera-off" : "camera");
@@ -435,6 +458,8 @@ export function createVoiceWidget(options: VoiceWidgetOptions): MountableCompone
           channelId: s.currentChannelId,
           muted: s.localMuted,
           deafened: s.localDeafened,
+          serverMuted: s.localServerMuted,
+          serverDeafened: s.localServerDeafened,
           camera: s.localCamera,
           screenshare: s.localScreenshare,
           listenOnly: s.listenOnly,
@@ -445,6 +470,8 @@ export function createVoiceWidget(options: VoiceWidgetOptions): MountableCompone
           a.channelId === b.channelId &&
           a.muted === b.muted &&
           a.deafened === b.deafened &&
+          a.serverMuted === b.serverMuted &&
+          a.serverDeafened === b.serverDeafened &&
           a.camera === b.camera &&
           a.screenshare === b.screenshare &&
           a.listenOnly === b.listenOnly &&
diff --git a/Client/tauri-client/src/components/channel-sidebar/context-menu.ts b/Client/tauri-client/src/components/channel-sidebar/context-menu.ts
index db956847..1a94cd3e 100644
--- a/Client/tauri-client/src/components/channel-sidebar/context-menu.ts
+++ b/Client/tauri-client/src/components/channel-sidebar/context-menu.ts
@@ -1,26 +1,52 @@
 /**
- * Channel context menu — right-click on a channel for Edit/Delete actions.
- * Only shown to admin/owner roles.
+ * Channel context menu — right-click on a channel for Mark as Read/Edit/Delete/
+ * Purge. Mark as Read is offered to everyone (it only touches the caller's own
+ * read state); Edit and Delete follow the server's MANAGE_CHANNELS gate; Purge
+ * follows its MANAGE_MESSAGES gate.
+ *
+ * Both gates are permission bits, not role names: a custom role granted
+ * MANAGE_CHANNELS could edit a channel through the API while the client hid
+ * the menu item, because the old check asked whether the role was literally
+ * called "owner" or "admin".
  */
 
 import { createElement } from "@lib/dom";
 import type { Channel } from "@stores/channels.store";
-import { getCurrentUser } from "@stores/auth.store";
+import { hasPermission, currentUserPermissions, canManageChannels } from "@lib/permissions";
+import { Permission } from "@lib/types";
+import { markChannelRead, hasUnread } from "@lib/read-state";
+import { isChannelMuted, toggleChannelMute } from "@lib/channel-mutes";
+import { appendPurgeSection } from "@components/purge-prompt";
 
-/** Attach a right-click context menu to a channel element for edit/delete. */
+/** Bubbles from a channel row when its mute is toggled. */
+export const CHANNEL_MUTE_CHANGED = "owncord:channel-mute-changed";
+
+/** Attach a right-click context menu to a channel element for edit/delete/purge. */
 export function attachChannelContextMenu(
   el: HTMLElement,
   channel: Channel,
   signal: AbortSignal,
   onEdit?: (channel: Channel) => void,
   onDelete?: (channel: Channel) => void,
+  onPurge?: (channel: Channel, count: number) => Promise<void>,
 ): void {
-  if (onEdit === undefined && onDelete === undefined) {
-    return;
-  }
-  const user = getCurrentUser();
-  const role = user?.role?.toLowerCase() ?? "";
-  if (role !== "owner" && role !== "admin") {
+  const canManage = canManageChannels();
+
+  // Voice channels hold no messages, and the server rejects a purge in a DM,
+  // so the section is offered only where it can succeed.
+  const canPurge =
+    onPurge !== undefined &&
+    channel.type !== "voice" &&
+    hasPermission(currentUserPermissions(), Permission.MANAGE_MESSAGES);
+
+  const showEdit = canManage && onEdit !== undefined;
+  const showDelete = canManage && onDelete !== undefined;
+  // Mark as Read touches only the caller's own read state, so it needs no
+  // permission — but a voice channel holds no messages to read.
+  const showMarkRead = channel.type !== "voice";
+  // Muting silences notifications, which a voice channel does not produce.
+  const showMute = channel.type !== "voice";
+  if (!showMarkRead && !showMute && !showEdit && !showDelete && !canPurge) {
     return;
   }
 
@@ -40,7 +66,67 @@ export function attachChannelContextMenu(
       menu.style.left = `${e.clientX}px`;
       menu.style.top = `${e.clientY}px`;
 
-      if (onEdit !== undefined) {
+      if (showMarkRead) {
+        // Disabled rather than hidden: a menu whose entries move between
+        // right-clicks is harder to use than one with a greyed-out row.
+        const unread = hasUnread(channel.id);
+        const markItem = createElement(
+          "div",
+          {
+            class: unread ? "context-menu-item" : "context-menu-item disabled",
+            "data-testid": "ctx-mark-read",
+          },
+          "Mark as Read",
+        );
+        if (unread) {
+          markItem.addEventListener(
+            "click",
+            () => {
+              closeMenu();
+              markChannelRead(channel.id);
+            },
+            { signal },
+          );
+        }
+        menu.appendChild(markItem);
+      }
+
+      if (showMute) {
+        // "Until turned off": there is no timed mute, because a timed one needs
+        // a stored expiry the client would have to sweep, and the affordance it
+        // buys ("quiet for 8 hours") is one the user can reproduce by unmuting.
+        const muted = isChannelMuted(channel.id);
+        const muteItem = createElement(
+          "div",
+          { class: "context-menu-item", "data-testid": "ctx-mute-channel" },
+          muted ? "Unmute Channel" : "Mute Channel",
+        );
+        muteItem.addEventListener(
+          "click",
+          () => {
+            closeMenu();
+            toggleChannelMute(channel.id);
+            // Mute state lives in localStorage, so there is no store change to
+            // subscribe to. A bubbling DOM event lets the sidebar redraw the
+            // row without threading a callback through four layers of
+            // positional render arguments.
+            el.dispatchEvent(
+              new CustomEvent(CHANNEL_MUTE_CHANGED, {
+                bubbles: true,
+                detail: { channelId: channel.id },
+              }),
+            );
+          },
+          { signal },
+        );
+        menu.appendChild(muteItem);
+      }
+
+      if ((showMarkRead || showMute) && (showEdit || showDelete || canPurge)) {
+        menu.appendChild(createElement("div", { class: "context-menu-sep" }));
+      }
+
+      if (showEdit && onEdit !== undefined) {
         const editItem = createElement(
           "div",
           { class: "context-menu-item", "data-testid": "ctx-edit-channel" },
@@ -57,8 +143,8 @@ export function attachChannelContextMenu(
         menu.appendChild(editItem);
       }
 
-      if (onDelete !== undefined) {
-        if (onEdit !== undefined) {
+      if (showDelete && onDelete !== undefined) {
+        if (showEdit) {
           menu.appendChild(createElement("div", { class: "context-menu-sep" }));
         }
         const deleteItem = createElement(
@@ -77,6 +163,17 @@ export function attachChannelContextMenu(
         menu.appendChild(deleteItem);
       }
 
+      if (canPurge && onPurge !== undefined) {
+        appendPurgeSection(menu, {
+          itemClass: "context-menu-item",
+          dangerItemClass: "context-menu-item danger",
+          separatorClass: showEdit || showDelete ? "context-menu-sep" : "",
+          onPurge: (count) => onPurge(channel, count),
+          signal,
+          onDone: () => closeMenu(),
+        });
+      }
+
       document.body.appendChild(menu);
 
       // Close menu on click elsewhere — use a per-menu AbortController
diff --git a/Client/tauri-client/src/components/channel-sidebar/volume-menu.ts b/Client/tauri-client/src/components/channel-sidebar/volume-menu.ts
index d6989c46..f799bf67 100644
--- a/Client/tauri-client/src/components/channel-sidebar/volume-menu.ts
+++ b/Client/tauri-client/src/components/channel-sidebar/volume-menu.ts
@@ -1,17 +1,33 @@
 /**
- * Per-user volume context menu — right-click on a voice user row
- * to adjust their playback volume locally.
+ * Per-user context menu on a voice participant row: local playback volume for
+ * everyone, plus a moderation section for users whose role holds MUTE_MEMBERS.
  */
 
 import { createElement, setText, appendChildren } from "@lib/dom";
 import { setUserVolume, getUserVolume } from "@lib/livekitSession";
 
+/** Moderation section wiring. Passed only when the local user may moderate
+ *  voice; the menu renders the section iff this is present, so the permission
+ *  decision stays with the caller (which knows the role list). */
+export interface VoiceModMenuOptions {
+  /** Current moderator-imposed state of the target, for the toggle labels. */
+  readonly serverMuted: boolean;
+  readonly serverDeafened: boolean;
+  /** Voice channels the target can be moved to (the current one excluded). */
+  readonly moveTargets: readonly { readonly id: number; readonly name: string }[];
+  readonly onServerMute: (muted: boolean) => void;
+  readonly onServerDeafen: (deafened: boolean) => void;
+  readonly onMove: (toChannelId: number) => void;
+  readonly onDisconnect: () => void;
+}
+
 export function showUserVolumeMenu(
   userId: number,
   username: string,
   x: number,
   y: number,
   signal: AbortSignal,
+  mod?: VoiceModMenuOptions,
 ): void {
   // Remove any existing context menus and abort their dismiss controllers
   document.querySelectorAll(".user-vol-menu").forEach((el) => {
@@ -85,6 +101,12 @@ export function showUserVolumeMenu(
   });
   menu.appendChild(resetBtn);
 
+  if (mod !== undefined) {
+    appendModerationSection(menu, mod, () => {
+      menu.remove();
+    });
+  }
+
   menu.style.left = `${x}px`;
   menu.style.top = `${y}px`;
   document.body.appendChild(menu);
@@ -112,3 +134,78 @@ export function showUserVolumeMenu(
     dismissAc.abort();
   });
 }
+
+/** Builds the moderation rows. close() runs after any action so the menu does
+ *  not linger showing stale labels while the server round-trip is in flight. */
+function appendModerationSection(
+  menu: HTMLElement,
+  mod: VoiceModMenuOptions,
+  close: () => void,
+): void {
+  menu.appendChild(createElement("div", { class: "context-menu-sep" }));
+
+  const muteItem = createElement(
+    "div",
+    { class: "context-menu-item", "data-action": "server-mute" },
+    mod.serverMuted ? "Server Unmute" : "Server Mute",
+  );
+  muteItem.addEventListener("click", () => {
+    mod.onServerMute(!mod.serverMuted);
+    close();
+  });
+  menu.appendChild(muteItem);
+
+  const deafenItem = createElement(
+    "div",
+    { class: "context-menu-item", "data-action": "server-deafen" },
+    mod.serverDeafened ? "Server Undeafen" : "Server Deafen",
+  );
+  deafenItem.addEventListener("click", () => {
+    mod.onServerDeafen(!mod.serverDeafened);
+    close();
+  });
+  menu.appendChild(deafenItem);
+
+  if (mod.moveTargets.length > 0) {
+    // Hover-revealed flyout, same shape as the AdminActions role submenu.
+    const moveWrap = createElement("div", {
+      class: "context-menu-item context-menu-item--submenu",
+      "data-action": "move-to",
+    });
+    moveWrap.appendChild(createElement("span", {}, "Move to"));
+    const sub = createElement("div", { class: "context-menu__submenu" });
+    sub.style.display = "none";
+    moveWrap.addEventListener("mouseenter", () => {
+      sub.style.display = "";
+    });
+    moveWrap.addEventListener("mouseleave", () => {
+      sub.style.display = "none";
+    });
+    for (const ch of mod.moveTargets) {
+      const item = createElement(
+        "div",
+        { class: "context-menu-item", "data-move-channel": String(ch.id) },
+        ch.name,
+      );
+      item.addEventListener("click", (e) => {
+        e.stopPropagation();
+        mod.onMove(ch.id);
+        close();
+      });
+      sub.appendChild(item);
+    }
+    moveWrap.appendChild(sub);
+    menu.appendChild(moveWrap);
+  }
+
+  const kickItem = createElement(
+    "div",
+    { class: "context-menu-item danger", "data-action": "voice-disconnect" },
+    "Disconnect",
+  );
+  kickItem.addEventListener("click", () => {
+    mod.onDisconnect();
+    close();
+  });
+  menu.appendChild(kickItem);
+}
diff --git a/Client/tauri-client/src/components/inline-autocomplete.ts b/Client/tauri-client/src/components/inline-autocomplete.ts
new file mode 100644
index 00000000..f76748f5
--- /dev/null
+++ b/Client/tauri-client/src/components/inline-autocomplete.ts
@@ -0,0 +1,147 @@
+/**
+ * inline-autocomplete — the shared listbox the composer opens over the textarea
+ * for "@" mentions and ":" emoji. Both popups are the same widget: a filtered,
+ * keyboard-navigable list whose rows are chosen on mousedown (never click, so
+ * the textarea keeps focus). Only the suggestion source, the row contents, and
+ * a couple of flags differ, so those are injected and everything else — arrow
+ * navigation, Enter/Tab/Escape handling, AbortController cleanup — lives here
+ * once instead of being duplicated in each popup.
+ *
+ * Uses @lib/dom helpers exclusively. Never sets innerHTML with user content.
+ */
+
+import { createElement, clearChildren, appendChildren } from "@lib/dom";
+
+export interface InlineAutocompleteConfig<T> {
+  /**
+   * CSS class(es) on the root element. Mentions use `"mention-autocomplete"`;
+   * emoji use `"mention-autocomplete emoji-autocomplete"` (sharing the base
+   * class deliberately — a composer test selects
+   * `.mention-autocomplete:not(.emoji-autocomplete)` to tell them apart).
+   */
+  readonly rootClass: string;
+  /** `data-testid` on the root element. */
+  readonly rootTestId: string;
+  /** Suggestions for the text typed after the trigger, already ordered/capped. */
+  readonly filter: (query: string) => T[];
+  /** The value passed to onSelect when a row is chosen (token / insert text). */
+  readonly valueOf: (item: T) => string;
+  /** `data-testid` for one row. */
+  readonly rowTestId: (item: T) => string;
+  /** The children of one row (name/detail spans, an optional preview, …). */
+  readonly renderRow: (item: T) => readonly HTMLElement[];
+  /**
+   * When true, prime the list with `setQuery("")` on creation so the popup
+   * opens already populated (mentions list every member; emoji stay empty
+   * until the composer types past the minimum query).
+   */
+  readonly primeOnCreate?: boolean;
+  /** Called with `valueOf(picked)` when a row is chosen. */
+  readonly onSelect: (value: string) => void;
+  /** Called when the user dismisses the popup (Escape). */
+  readonly onClose: () => void;
+}
+
+export interface InlineAutocompleteComponent {
+  readonly element: HTMLDivElement;
+  /**
+   * Re-filter for `query`. Returns false when nothing matches, which the
+   * composer treats as "close the popup" rather than leaving an empty box.
+   */
+  setQuery(query: string): boolean;
+  /** Handle a composer keydown. Returns true when the key was consumed. */
+  handleKeydown(e: KeyboardEvent): boolean;
+  destroy(): void;
+}
+
+export function createInlineAutocomplete<T>(
+  cfg: InlineAutocompleteConfig<T>,
+): InlineAutocompleteComponent {
+  const ac = new AbortController();
+  const signal = ac.signal;
+
+  let suggestions: T[] = [];
+  let activeIndex = 0;
+
+  const root = createElement("div", {
+    class: cfg.rootClass,
+    role: "listbox",
+    "data-testid": cfg.rootTestId,
+  });
+  const list = createElement("div", { class: "ma-list" });
+  root.appendChild(list);
+
+  function choose(index: number): void {
+    const picked = suggestions[index];
+    if (picked === undefined) return;
+    cfg.onSelect(cfg.valueOf(picked));
+  }
+
+  function render(): void {
+    clearChildren(list);
+    for (let i = 0; i < suggestions.length; i++) {
+      const s = suggestions[i]!;
+      const row = createElement("div", {
+        class: i === activeIndex ? "ma-item ma-item--active" : "ma-item",
+        role: "option",
+        "aria-selected": i === activeIndex ? "true" : "false",
+        "data-testid": cfg.rowTestId(s),
+      });
+      appendChildren(row, ...cfg.renderRow(s));
+      // mousedown, not click: the textarea must not lose focus before the
+      // insertion runs.
+      row.addEventListener(
+        "mousedown",
+        (e: MouseEvent) => {
+          e.preventDefault();
+          choose(i);
+        },
+        { signal },
+      );
+      list.appendChild(row);
+    }
+  }
+
+  function setQuery(query: string): boolean {
+    suggestions = cfg.filter(query);
+    activeIndex = 0;
+    render();
+    return suggestions.length > 0;
+  }
+
+  function handleKeydown(e: KeyboardEvent): boolean {
+    if (suggestions.length === 0) return false;
+    switch (e.key) {
+      case "ArrowDown":
+        e.preventDefault();
+        activeIndex = (activeIndex + 1) % suggestions.length;
+        render();
+        return true;
+      case "ArrowUp":
+        e.preventDefault();
+        activeIndex = (activeIndex - 1 + suggestions.length) % suggestions.length;
+        render();
+        return true;
+      case "Enter":
+      case "Tab":
+        e.preventDefault();
+        choose(activeIndex);
+        return true;
+      case "Escape":
+        e.preventDefault();
+        cfg.onClose();
+        return true;
+      default:
+        return false;
+    }
+  }
+
+  function destroy(): void {
+    ac.abort();
+    root.remove();
+  }
+
+  if (cfg.primeOnCreate === true) setQuery("");
+
+  return { element: root, setQuery, handleKeydown, destroy };
+}
diff --git a/Client/tauri-client/src/components/message-list/attachments.ts b/Client/tauri-client/src/components/message-list/attachments.ts
index c2e41a7b..fe92dfaf 100644
--- a/Client/tauri-client/src/components/message-list/attachments.ts
+++ b/Client/tauri-client/src/components/message-list/attachments.ts
@@ -10,6 +10,7 @@ import { loadPref } from "@components/settings/helpers";
 import { createLogger } from "@lib/logger";
 import { fetch as tauriFetch } from "@tauri-apps/plugin-http";
 import { ensureHttpProxy } from "@lib/httpProxy";
+import { getToken } from "@stores/auth.store";
 import { save } from "@tauri-apps/plugin-dialog";
 
 const log = createLogger("attachments");
@@ -55,8 +56,48 @@ export function formatFileSize(bytes: number): string {
   return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
 }
 
+/** Strip any `; codecs=…` parameters and normalise case before matching. */
+function baseMime(mime: string): string {
+  return (mime.split(";")[0] ?? "").trim().toLowerCase();
+}
+
+/** Whether the attachment should render as an inline <img>.
+ *  image/svg+xml is excluded: an SVG can carry script, and it is the one image
+ *  type the data-URI allowlist already refuses — inlining it only ever produced
+ *  a permanently-loading placeholder, so it belongs on the download chip. */
 export function isImageMime(mime: string): boolean {
-  return mime.startsWith("image/");
+  const base = baseMime(mime);
+  return base.startsWith("image/") && base !== "image/svg+xml";
+}
+
+/** Container MIME types we are willing to hand to a <video> element.
+ *  An allowlist, not a `video/` prefix test: an unknown container gets the
+ *  download chip rather than a player that silently fails to decode. */
+const INLINE_VIDEO_MIMES = new Set(["video/mp4", "video/webm", "video/ogg"]);
+
+/** Container MIME types we are willing to hand to an <audio> element.
+ *  Includes the common aliases servers emit for MP3 and WAV. */
+const INLINE_AUDIO_MIMES = new Set([
+  "audio/mpeg",
+  "audio/mp3",
+  "audio/ogg",
+  "audio/opus",
+  "audio/wav",
+  "audio/wave",
+  "audio/x-wav",
+  "audio/webm",
+]);
+
+/** Whether the attachment should render as an inline <video> player.
+ *  image/svg+xml can never reach here — SVG stays excluded from every inline
+ *  path because it can carry script. */
+export function isVideoMime(mime: string): boolean {
+  return INLINE_VIDEO_MIMES.has(baseMime(mime));
+}
+
+/** Whether the attachment should render as an inline <audio> player. */
+export function isAudioMime(mime: string): boolean {
+  return INLINE_AUDIO_MIMES.has(baseMime(mime));
 }
 
 export function isSafeUrl(url: string): boolean {
@@ -81,6 +122,11 @@ export function clearAttachmentCaches(): void {
   attachmentCacheGeneration += 1;
   memoryCache.clear();
   inFlight.clear();
+  for (const objectUrl of mediaObjectUrls.values()) {
+    revokeObjectUrl(objectUrl);
+  }
+  mediaObjectUrls.clear();
+  mediaInFlight.clear();
 }
 
 /** Safe MIME types allowed in data: URIs — blocks script injection via crafted Content-Type. */
@@ -125,16 +171,23 @@ export function isTrustedServerUrl(url: string): boolean {
 }
 
 /**
- * If `url` targets the OwnCord server, return an equivalent URL pointing at the
- * Rust HTTP TOFU proxy's loopback origin (cert-pinned) with the same path and
- * query. Non-server URLs (external images) are returned unchanged so they use a
- * normal validated HTTPS fetch.
+ * Fetch `url`, routing OwnCord-server URLs through the Rust HTTP TOFU proxy's
+ * loopback origin (cert-pinned) with the session bearer token attached —
+ * /api/v1/files/{id} enforces channel ACLs, so an unauthenticated request
+ * would 401. The token is only ever sent to the configured server host;
+ * non-server URLs (external images) get a normal validated HTTPS fetch with
+ * no credentials.
  */
-async function toFetchUrl(url: string): Promise<string> {
-  if (!isServerUrl(url)) return url;
+async function fetchServerFile(url: string): Promise<Response> {
+  if (!isServerUrl(url)) return tauriFetch(url);
   const parsed = new URL(url);
   const origin = await ensureHttpProxy(parsed.host);
-  return `${origin}${parsed.pathname}${parsed.search}`;
+  const headers: Record<string, string> = {};
+  const token = getToken();
+  if (token !== null) {
+    headers["Authorization"] = `Bearer ${token}`;
+  }
+  return tauriFetch(`${origin}${parsed.pathname}${parsed.search}`, { headers });
 }
 
 /** In-flight fetch promises to prevent duplicate concurrent requests. */
@@ -253,7 +306,7 @@ export function fetchImageAsDataUrl(url: string): Promise<string | null> {
     // use a normal validated HTTPS fetch. isSafeUrl restricts to http/https and
     // responses are only used as image data, never executed.
     try {
-      const res = await tauriFetch(await toFetchUrl(url));
+      const res = await fetchServerFile(url);
       if (!res.ok) return null;
 
       const rawCt = res.headers.get("content-type") ?? "";
@@ -291,11 +344,183 @@ export function fetchImageAsDataUrl(url: string): Promise<string | null> {
   return promise;
 }
 
+// ---------------------------------------------------------------------------
+// Media (video/audio) sources
+// ---------------------------------------------------------------------------
+
+/** Resolved blob: URLs keyed by attachment URL, so re-rendering a row (virtual
+ *  scroll rebuilds the window constantly) reuses one download. */
+const mediaObjectUrls = new Map<string, string>();
+/** In-flight media fetches, deduplicated the same way images are. */
+const mediaInFlight = new Map<string, Promise<string | null>>();
+/** FIFO cap mirroring memoryCache's CACHE_MAX, kept far lower: each entry
+ *  pins a whole video/audio Blob (not a small base64 thumbnail string), so an
+ *  unbounded map here quietly holds every clip ever viewed in the session. */
+const MEDIA_CACHE_MAX = 20;
+
+function createObjectUrl(blob: Blob): string | null {
+  // jsdom (and any non-browser host) may not implement the object-URL API.
+  if (typeof URL.createObjectURL !== "function") return null;
+  return URL.createObjectURL(blob);
+}
+
+function revokeObjectUrl(objectUrl: string): void {
+  if (typeof URL.revokeObjectURL !== "function") return;
+  URL.revokeObjectURL(objectUrl);
+}
+
+/**
+ * Fetch a video/audio attachment through the same authenticated,
+ * cert-pinned path images use (fetchServerFile attaches the session bearer
+ * token, which /api/v1/files/{id} requires) and hand back a blob: URL.
+ *
+ * Deliberately not the image path: a data: URI means base64-inflating the whole
+ * file into a string and parking it in the LRU + IndexedDB caches, which is
+ * fine for a 200 KB thumbnail and ruinous for a 50 MB video. The Content-Type
+ * goes through the same allowlist so a crafted header cannot turn a
+ * permission-checked download into an executable type.
+ */
+export function fetchMediaAsObjectUrl(url: string): Promise<string | null> {
+  const generation = attachmentCacheGeneration;
+
+  const cached = mediaObjectUrls.get(url);
+  if (cached !== undefined) return Promise.resolve(cached);
+
+  const existing = mediaInFlight.get(url);
+  if (existing !== undefined) return existing;
+
+  const promise = (async (): Promise<string | null> => {
+    try {
+      const res = await fetchServerFile(url);
+      if (!res.ok) return null;
+      const contentType = sanitizeContentType(res.headers.get("content-type") ?? "");
+      const buffer = await res.arrayBuffer();
+      const objectUrl = createObjectUrl(new Blob([buffer], { type: contentType }));
+      if (objectUrl === null) return null;
+      // A cache clear (channel switch, logout) during the fetch means this
+      // blob belongs to a session that is gone — release it rather than
+      // resurrecting it into the fresh cache.
+      if (generation !== attachmentCacheGeneration) {
+        revokeObjectUrl(objectUrl);
+        return null;
+      }
+      if (mediaObjectUrls.size >= MEDIA_CACHE_MAX) {
+        const firstKey = mediaObjectUrls.keys().next().value;
+        if (firstKey !== undefined) {
+          const evicted = mediaObjectUrls.get(firstKey);
+          mediaObjectUrls.delete(firstKey);
+          if (evicted !== undefined) revokeObjectUrl(evicted);
+        }
+      }
+      mediaObjectUrls.set(url, objectUrl);
+      return objectUrl;
+    } catch (err) {
+      log.error("Failed to fetch media attachment", { url, error: String(err) });
+      return null;
+    }
+  })();
+
+  mediaInFlight.set(url, promise);
+  void promise.finally(() => {
+    if (mediaInFlight.get(url) === promise) {
+      mediaInFlight.delete(url);
+    }
+  });
+
+  return promise;
+}
+
 // -- Attachment rendering -----------------------------------------------------
 
+/** The filename + size + download row shared by the audio player and the
+ *  generic file chip. */
+function buildFileMeta(att: Attachment, resolvedUrl: string): HTMLDivElement {
+  const info = createElement("div", { class: "msg-file-meta" });
+  const nameEl = createElement("div", { class: "msg-file-name" }, att.filename);
+  nameEl.addEventListener("click", () => {
+    void downloadFile(resolvedUrl, att.filename);
+  });
+  const sizeEl = createElement("div", { class: "msg-file-size" }, formatFileSize(att.size));
+  appendChildren(info, nameEl, sizeEl);
+  return info;
+}
+
+/** The circular download button used by every non-image attachment shape. */
+function buildDownloadButton(att: Attachment, resolvedUrl: string): HTMLButtonElement {
+  const btn = createElement("button", {
+    class: "msg-file-download",
+    title: "Download",
+    "aria-label": `Download ${att.filename}`,
+  });
+  btn.appendChild(createIcon("download", 16));
+  btn.addEventListener("click", () => {
+    void downloadFile(resolvedUrl, att.filename);
+  });
+  return btn;
+}
+
+/** Inline <video> player. Sized by the same .msg-image box as images so a
+ *  video never blows the message column out; the source arrives asynchronously
+ *  because it needs the session token attached. */
+function renderVideoAttachment(att: Attachment, resolvedUrl: string): HTMLDivElement {
+  const wrap = createElement("div", { class: "msg-image msg-video" });
+
+  const video = createElement("video", { preload: "metadata" });
+  video.controls = true;
+  video.setAttribute("aria-label", att.filename);
+  wrap.appendChild(video);
+
+  const overlay = createElement("div", { class: "msg-media-overlay" });
+  overlay.appendChild(buildDownloadButton(att, resolvedUrl));
+  wrap.appendChild(overlay);
+
+  void fetchMediaAsObjectUrl(resolvedUrl).then((objectUrl) => {
+    if (objectUrl !== null) {
+      video.src = objectUrl;
+    } else {
+      wrap.classList.add("msg-media-failed");
+    }
+  });
+
+  return wrap;
+}
+
+/** Inline <audio> player: a compact row carrying the player plus the same
+ *  filename / size / download affordances as the file chip. */
+function renderAudioAttachment(att: Attachment, resolvedUrl: string): HTMLDivElement {
+  const wrap = createElement("div", { class: "msg-file msg-audio" });
+  const inner = createElement("div", { class: "msg-file-inner" });
+
+  const info = buildFileMeta(att, resolvedUrl);
+  const audio = createElement("audio", { preload: "metadata" });
+  audio.controls = true;
+  audio.setAttribute("aria-label", att.filename);
+  info.appendChild(audio);
+
+  appendChildren(inner, info, buildDownloadButton(att, resolvedUrl));
+  wrap.appendChild(inner);
+
+  void fetchMediaAsObjectUrl(resolvedUrl).then((objectUrl) => {
+    if (objectUrl !== null) {
+      audio.src = objectUrl;
+    } else {
+      wrap.classList.add("msg-media-failed");
+    }
+  });
+
+  return wrap;
+}
+
 export function renderAttachment(att: Attachment): HTMLDivElement {
   const resolvedUrl = resolveServerUrl(att.url);
-  if (isImageMime(att.mime) && isSafeUrl(resolvedUrl)) {
+  const inlineable = isSafeUrl(resolvedUrl);
+  if (inlineable && isVideoMime(att.mime)) {
+    return renderVideoAttachment(att, resolvedUrl);
+  }
+  if (inlineable && isAudioMime(att.mime)) {
+    return renderAudioAttachment(att, resolvedUrl);
+  }
+  if (isImageMime(att.mime) && inlineable) {
     const wrap = createElement("div", { class: "msg-image" });
 
     // Reserve space using server-provided dimensions to prevent layout shift.
@@ -383,22 +608,12 @@ export function renderAttachment(att: Attachment): HTMLDivElement {
   const inner = createElement("div", { class: "msg-file-inner" });
   const icon = createElement("div", { class: "msg-file-icon" });
   icon.appendChild(createIcon("file-text", 20));
-  const nameEl = createElement("div", { class: "msg-file-name" }, att.filename);
-  nameEl.addEventListener("click", () => {
-    void downloadFile(resolvedUrl, att.filename);
-  });
-  const sizeEl = createElement("div", { class: "msg-file-size" }, formatFileSize(att.size));
-  const info = createElement("div", {});
-  appendChildren(info, nameEl, sizeEl);
-  const downloadBtn = createElement("button", {
-    class: "msg-file-download",
-    title: "Download",
-  });
-  downloadBtn.appendChild(createIcon("download", 16));
-  downloadBtn.addEventListener("click", () => {
-    void downloadFile(resolvedUrl, att.filename);
-  });
-  appendChildren(inner, icon, info, downloadBtn);
+  appendChildren(
+    inner,
+    icon,
+    buildFileMeta(att, resolvedUrl),
+    buildDownloadButton(att, resolvedUrl),
+  );
   wrap.appendChild(inner);
   return wrap;
 }
@@ -413,8 +628,9 @@ async function downloadFile(url: string, filename: string): Promise<void> {
     const filePath = await save({ defaultPath: filename });
     if (filePath === null) return; // User cancelled
 
-    // Fetch file data — server downloads go through the cert-pinned HTTP proxy.
-    const res = await tauriFetch(await toFetchUrl(url));
+    // Fetch file data — server downloads go through the cert-pinned HTTP proxy
+    // with the session bearer token (the files endpoint requires auth).
+    const res = await fetchServerFile(url);
     if (!res.ok) {
       log.error("Download failed", { filename, status: res.status });
       alert(`Download failed: server returned ${res.status}`);
diff --git a/Client/tauri-client/src/components/message-list/content-parser.ts b/Client/tauri-client/src/components/message-list/content-parser.ts
index 7d461db9..bb9b24dc 100644
--- a/Client/tauri-client/src/components/message-list/content-parser.ts
+++ b/Client/tauri-client/src/components/message-list/content-parser.ts
@@ -1,41 +1,162 @@
 /**
- * Text content parsing — XSS-safe DOM builders for message text including
- * inline code, code blocks, @mentions, and URL linkification.
+ * Text content parsing — XSS-safe DOM builders for message text.
+ *
+ * This is the *only* renderer for message content: Discord-flavoured markdown
+ * (inline styles, spoilers, quotes, headings, lists, masked links, fenced code
+ * with language tags), plus @mentions, #channel links and URL linkification.
+ *
+ * Everything here builds DOM nodes — never innerHTML — and every href is
+ * checked with isSafeUrl before it reaches an anchor.
  */
 
 import { createElement, setText } from "@lib/dom";
+import { navigateToChannel, findChannelByName, findChannelById } from "@lib/channel-navigation";
+import { parseMessageLink } from "@lib/deep-link";
+import { jumpToMessage } from "@lib/message-navigation";
+import { authStore } from "@stores/auth.store";
+import {
+  CHANNEL_TOKEN_REGEX,
+  MENTION_TOKEN_REGEX,
+  isEveryoneToken,
+  resolveMentionUserId,
+  type MentionInfo,
+} from "@lib/mentions";
 import { isSafeUrl } from "./attachments";
+import { EMOJI_TOKEN_REGEX, buildCustomEmojiNode, isEmojiOnlyMessage } from "./custom-emoji";
+import {
+  parseInline,
+  parseBlocks,
+  type BlockNode,
+  type InlineNode,
+  type InlineStyle,
+} from "./markdown";
+import { highlightCode, resolveLanguage } from "./syntax-highlight";
 
 // -- Regex constants ----------------------------------------------------------
 
-export const MENTION_REGEX = /@(\w+)/g;
 export const CODE_BLOCK_REGEX = /```([\s\S]*?)```/g;
 export const INLINE_CODE_REGEX = /`([^`]+)`/g;
 export const URL_REGEX = /https?:\/\/[^\s<>"']+/g;
+/** `[text](url)` — used to keep masked links from spawning link embeds. */
+export const MASKED_LINK_REGEX = /\[[^\]\n]+\]\((?:[^()\s]|\([^()\s]*\))+\)/g;
+/** `owncord://message/<channelId>/<messageId>` pasted into a message. */
+export const MESSAGE_LINK_REGEX = /owncord:\/\/message\/\d+\/\d+/g;
 
-// -- Content rendering --------------------------------------------------------
+export type { MentionInfo };
 
-export function renderInlineContent(text: string): DocumentFragment {
-  const fragment = document.createDocumentFragment();
-  let lastIndex = 0;
-  for (const match of text.matchAll(INLINE_CODE_REGEX)) {
-    const idx = match.index;
-    if (idx === undefined) continue;
-    if (idx > lastIndex) {
-      fragment.appendChild(renderMentions(text.slice(lastIndex, idx)));
+/** Quotes may contain blocks, but a quote inside a quote inside a quote is a
+ * fight the renderer does not need to have. */
+const MAX_BLOCK_DEPTH = 2;
+
+// -- Inline rendering ---------------------------------------------------------
+
+const STYLE_TAGS = {
+  strong: "strong",
+  em: "em",
+  underline: "u",
+  strike: "s",
+} as const satisfies Record<Exclude<InlineStyle, "spoiler">, keyof HTMLElementTagNameMap>;
+
+const STYLE_CLASSES = {
+  strong: "md-bold",
+  em: "md-italic",
+  underline: "md-underline",
+  strike: "md-strike",
+} as const;
+
+/** A spoiler: obscured until the reader asks for it, one span at a time. */
+function buildSpoiler(
+  node: { readonly children: readonly InlineNode[] },
+  info?: MentionInfo,
+): HTMLSpanElement {
+  const span = createElement("span", {
+    class: "msg-spoiler",
+    role: "button",
+    tabindex: "0",
+    "aria-pressed": "false",
+    "aria-label": "Spoiler — click to reveal",
+  });
+  appendInline(span, node.children, info);
+
+  const reveal = (e: Event): void => {
+    if (span.classList.contains("revealed")) return;
+    // Swallow the activation that revealed the text: a link hiding under a
+    // spoiler must not open on the same click that uncovers it.
+    e.preventDefault();
+    e.stopPropagation();
+    span.classList.add("revealed");
+    span.setAttribute("aria-pressed", "true");
+    span.setAttribute("aria-label", "Spoiler — revealed");
+  };
+  span.addEventListener("click", reveal);
+  span.addEventListener("keydown", (e: KeyboardEvent) => {
+    if (e.key === "Enter" || e.key === " ") reveal(e);
+  });
+  return span;
+}
+
+/** A `[text](url)` anchor, or null when the URL is not a safe http(s) one. */
+function buildMaskedLink(
+  node: { readonly url: string; readonly children: readonly InlineNode[] },
+  info?: MentionInfo,
+): HTMLAnchorElement | null {
+  // Absolute http(s) only: isSafeUrl resolves relatives against the app
+  // origin, which is not something a message author gets to link to.
+  if (!/^https?:\/\//i.test(node.url) || !isSafeUrl(node.url)) return null;
+  const link = createElement("a", {
+    class: "msg-link",
+    href: node.url,
+    title: node.url,
+    target: "_blank",
+    rel: "noopener noreferrer",
+  });
+  appendInline(link, node.children, info);
+  return link;
+}
+
+/** Turn inline nodes into DOM under `parent`. */
+function appendInline(parent: Node, nodes: readonly InlineNode[], info?: MentionInfo): void {
+  for (const node of nodes) {
+    switch (node.type) {
+      case "text":
+        // Plain runs are where mentions, #channels and bare URLs live.
+        parent.appendChild(renderMentions(node.value, info));
+        break;
+      case "code": {
+        const code = createElement("code", {});
+        setText(code, node.value);
+        parent.appendChild(code);
+        break;
+      }
+      case "link": {
+        const link = buildMaskedLink(node, info);
+        if (link !== null) parent.appendChild(link);
+        else parent.appendChild(document.createTextNode(node.raw));
+        break;
+      }
+      case "spoiler":
+        parent.appendChild(buildSpoiler(node, info));
+        break;
+      default: {
+        const el = createElement(STYLE_TAGS[node.type], { class: STYLE_CLASSES[node.type] });
+        appendInline(el, node.children, info);
+        parent.appendChild(el);
+      }
     }
-    const code = createElement("code", {});
-    setText(code, match[1]!);
-    fragment.appendChild(code);
-    lastIndex = idx + match[0].length;
-  }
-  if (lastIndex < text.length) {
-    fragment.appendChild(renderMentions(text.slice(lastIndex)));
   }
+}
+
+/**
+ * Render one run of inline text: markdown styles, code spans, masked links,
+ * mentions and autolinked URLs.
+ */
+export function renderInlineContent(text: string, info?: MentionInfo): DocumentFragment {
+  const fragment = document.createDocumentFragment();
+  appendInline(fragment, parseInline(text), info);
   return fragment;
 }
 
-export function renderMentions(text: string): DocumentFragment {
+export function renderMentions(text: string, info?: MentionInfo): DocumentFragment {
   // First pass: split by URLs, then handle mentions in non-URL segments
   const fragment = document.createDocumentFragment();
   let lastIndex = 0;
@@ -43,7 +164,7 @@ export function renderMentions(text: string): DocumentFragment {
     const idx = match.index;
     if (idx === undefined) continue;
     if (idx > lastIndex) {
-      fragment.appendChild(renderMentionSegment(text.slice(lastIndex, idx)));
+      fragment.appendChild(renderMentionSegment(text.slice(lastIndex, idx), info));
     }
     // Strip trailing punctuation that is likely sentence-level, not part of the URL
     const rawUrl = match[0];
@@ -68,25 +189,158 @@ export function renderMentions(text: string): DocumentFragment {
     lastIndex = idx + rawUrl.length;
   }
   if (lastIndex < text.length) {
-    fragment.appendChild(renderMentionSegment(text.slice(lastIndex)));
+    fragment.appendChild(renderMentionSegment(text.slice(lastIndex), info));
   }
   return fragment;
 }
 
-/** Render @mentions within a text segment (no URLs). */
-export function renderMentionSegment(text: string): DocumentFragment {
-  const fragment = document.createDocumentFragment();
-  let lastIndex = 0;
-  for (const match of text.matchAll(MENTION_REGEX)) {
+/** One recognised token in a prose segment, with the span it renders to. */
+interface TokenMatch {
+  readonly start: number;
+  readonly end: number;
+  readonly node: Node;
+}
+
+/** Build the highlight span for a resolved @token, or null to leave it as text. */
+function buildMentionNode(raw: string, token: string, info?: MentionInfo): HTMLSpanElement | null {
+  if (isEveryoneToken(token)) {
+    // A token the sender lacked MENTION_EVERYONE for carries no mention
+    // semantics at all — the server says so, and it must not read as one.
+    if (info?.mentionsEveryone !== true) return null;
+    const span = createElement("span", { class: "mention mention-everyone mention-self" });
+    setText(span, raw);
+    return span;
+  }
+  const userId = resolveMentionUserId(token, info);
+  if (userId === null) return null;
+  const isSelf = authStore.getState().user?.id === userId;
+  const span = createElement("span", {
+    class: isSelf ? "mention mention-self" : "mention",
+    "data-user-id": String(userId),
+  });
+  setText(span, raw);
+  return span;
+}
+
+/** Build the clickable chip for a `#name` that resolves, or null. */
+function buildChannelNode(name: string): HTMLSpanElement | null {
+  const channel = findChannelByName(name);
+  if (channel === null) return null;
+  const chip = createElement("span", {
+    class: "channel-mention",
+    role: "link",
+    tabindex: "0",
+    "data-channel-id": String(channel.id),
+    title: `Go to #${channel.name}`,
+  });
+  setText(chip, `#${channel.name}`);
+  // Listeners are attached per node with no signal, matching the code-block
+  // copy button above: these spans live and die with the message row.
+  chip.addEventListener("click", () => navigateToChannel(channel.id));
+  chip.addEventListener("keydown", (e: KeyboardEvent) => {
+    if (e.key === "Enter" || e.key === " ") {
+      e.preventDefault();
+      navigateToChannel(channel.id);
+    }
+  });
+  return chip;
+}
+
+/**
+ * Build the compact chip for a pasted `owncord://message/…` permalink, or null
+ * when the link does not parse or points at a channel this user cannot see —
+ * an unreachable jump reads better as the raw text it was typed as.
+ */
+function buildMessageLinkNode(url: string): HTMLSpanElement | null {
+  const link = parseMessageLink(url);
+  if (link === null) return null;
+  const channel = findChannelById(link.channelId);
+  if (channel === null) return null;
+
+  const chip = createElement("span", {
+    class: "message-link-chip",
+    role: "link",
+    tabindex: "0",
+    "data-channel-id": String(link.channelId),
+    "data-message-id": String(link.messageId),
+    title: `Jump to message in #${channel.name}`,
+  });
+  const label = createElement("span", { class: "mlc-channel" });
+  setText(label, `#${channel.name}`);
+  const action = createElement("span", { class: "mlc-action" });
+  setText(action, "Jump");
+  chip.appendChild(label);
+  chip.appendChild(action);
+
+  const go = (): void => jumpToMessage(link.channelId, link.messageId);
+  // Per-node listeners with no signal, like the #channel chip above: these
+  // spans live and die with the message row.
+  chip.addEventListener("click", go);
+  chip.addEventListener("keydown", (e: KeyboardEvent) => {
+    if (e.key === "Enter" || e.key === " ") {
+      e.preventDefault();
+      go();
+    }
+  });
+  return chip;
+}
+
+/**
+ * Render @mentions, #channel links and message permalinks within a text
+ * segment (no http URLs). Tokens that resolve to nothing are left as plain text.
+ */
+export function renderMentionSegment(text: string, info?: MentionInfo): DocumentFragment {
+  const matches: TokenMatch[] = [];
+
+  for (const match of text.matchAll(MESSAGE_LINK_REGEX)) {
     const idx = match.index;
     if (idx === undefined) continue;
-    if (idx > lastIndex) {
-      fragment.appendChild(document.createTextNode(text.slice(lastIndex, idx)));
+    const node = buildMessageLinkNode(match[0]);
+    if (node !== null) matches.push({ start: idx, end: idx + match[0].length, node });
+  }
+
+  for (const match of text.matchAll(MENTION_TOKEN_REGEX)) {
+    const idx = match.index;
+    const lead = match[1];
+    const token = match[2];
+    if (idx === undefined || lead === undefined || token === undefined) continue;
+    if (match[3] === "@") continue; // address-shaped, e.g. "@bob@example.com"
+    const start = idx + lead.length;
+    const node = buildMentionNode(`@${token}`, token, info);
+    if (node !== null) matches.push({ start, end: start + token.length + 1, node });
+  }
+
+  for (const match of text.matchAll(CHANNEL_TOKEN_REGEX)) {
+    const idx = match.index;
+    const lead = match[1];
+    const name = match[2];
+    if (idx === undefined || lead === undefined || name === undefined) continue;
+    const start = idx + lead.length;
+    const node = buildChannelNode(name);
+    if (node !== null) matches.push({ start, end: start + name.length + 1, node });
+  }
+
+  // `:shortcode:` custom emoji. This runs on prose segments only — code spans
+  // never reach here (appendInline renders them verbatim) and fenced blocks are
+  // split off before any of this, so a shortcode inside code stays code.
+  for (const match of text.matchAll(EMOJI_TOKEN_REGEX)) {
+    const idx = match.index;
+    const shortcode = match[1];
+    if (idx === undefined || shortcode === undefined) continue;
+    const node = buildCustomEmojiNode(shortcode);
+    if (node !== null) matches.push({ start: idx, end: idx + match[0].length, node });
+  }
+
+  const fragment = document.createDocumentFragment();
+  matches.sort((a, b) => a.start - b.start);
+  let lastIndex = 0;
+  for (const m of matches) {
+    if (m.start < lastIndex) continue; // overlapping token, keep the first
+    if (m.start > lastIndex) {
+      fragment.appendChild(document.createTextNode(text.slice(lastIndex, m.start)));
     }
-    const span = createElement("span", { class: "mention" });
-    setText(span, match[0]);
-    fragment.appendChild(span);
-    lastIndex = idx + match[0].length;
+    fragment.appendChild(m.node);
+    lastIndex = m.end;
   }
   if (lastIndex < text.length) {
     fragment.appendChild(document.createTextNode(text.slice(lastIndex)));
@@ -94,57 +348,176 @@ export function renderMentionSegment(text: string): DocumentFragment {
   return fragment;
 }
 
-export function renderMessageContent(content: string): DocumentFragment {
-  const fragment = document.createDocumentFragment();
+// -- Block rendering ----------------------------------------------------------
 
-  // Split on triple-backtick boundaries to avoid ReDoS from greedy regex.
-  // Odd-indexed segments are code block contents; even-indexed are prose.
-  const parts = content.split("```");
+/** Render list items, folding indented ones into a single nested level. */
+function buildList(
+  block: Extract<BlockNode, { type: "list" }>,
+  info: MentionInfo | undefined,
+): HTMLElement {
+  const root = createElement(block.ordered ? "ol" : "ul", { class: "md-list" });
+  if (block.ordered && block.start !== 1) root.setAttribute("start", String(block.start));
+  let sublist: HTMLElement | null = null;
 
-  for (let i = 0; i < parts.length; i++) {
-    const segment = parts[i]!;
-    if (i % 2 === 0) {
-      // Prose segment
-      const trimmed = i === 0 ? segment : i === parts.length - 1 ? segment.trim() : segment;
-      if (trimmed.length > 0) {
-        const text = createElement("div", { class: "msg-text" });
-        text.appendChild(renderInlineContent(trimmed));
-        fragment.appendChild(text);
+  for (const item of block.items) {
+    const li = createElement("li", { class: "md-li" });
+    appendInline(li, parseInline(item.text), info);
+
+    const parentLi = root.lastElementChild;
+    if (item.level === 1 && parentLi !== null) {
+      if (sublist === null) {
+        sublist = createElement(item.ordered ? "ol" : "ul", { class: "md-list md-list-nested" });
+        parentLi.appendChild(sublist);
+      }
+      sublist.appendChild(li);
+      continue;
+    }
+    sublist = null;
+    root.appendChild(li);
+  }
+  return root;
+}
+
+/** Append the block structure of `text` to `parent`. */
+function appendBlocks(parent: HTMLElement, text: string, info?: MentionInfo, depth = 0): void {
+  for (const block of parseBlocks(text)) {
+    switch (block.type) {
+      case "heading": {
+        const heading = createElement(`h${block.level}`, {
+          class: `md-heading md-h${block.level}`,
+        });
+        appendInline(heading, parseInline(block.text), info);
+        parent.appendChild(heading);
+        break;
+      }
+      case "quote": {
+        const quote = createElement("blockquote", { class: "md-quote" });
+        if (depth + 1 >= MAX_BLOCK_DEPTH) {
+          const para = createElement("div", { class: "md-p" });
+          appendInline(para, parseInline(block.text), info);
+          quote.appendChild(para);
+        } else {
+          appendBlocks(quote, block.text, info, depth + 1);
+        }
+        parent.appendChild(quote);
+        break;
+      }
+      case "list":
+        parent.appendChild(buildList(block, info));
+        break;
+      default: {
+        const para = createElement("div", { class: "md-p" });
+        appendInline(para, parseInline(block.text), info);
+        parent.appendChild(para);
       }
-    } else {
-      // Code block segment
-      const codeContent = segment.trim();
-      const codeWrap = createElement("div", { class: "msg-codeblock-wrap" });
-      const codeBlock = createElement("div", { class: "msg-codeblock" });
-      setText(codeBlock, codeContent);
-      const copyBtn = createElement("button", { class: "msg-codeblock-copy" });
-      setText(copyBtn, "Copy");
-      copyBtn.addEventListener("click", () => {
-        void navigator.clipboard
-          .writeText(codeContent)
-          .then(() => {
-            setText(copyBtn, "Copied!");
-            setTimeout(() => setText(copyBtn, "Copy"), 2000);
-          })
-          .catch(() => {
-            setText(copyBtn, "Failed");
-            setTimeout(() => setText(copyBtn, "Copy"), 2000);
-          });
-      });
-      codeWrap.appendChild(codeBlock);
-      codeWrap.appendChild(copyBtn);
-      fragment.appendChild(codeWrap);
     }
   }
+}
 
-  // If there were no code blocks at all, ensure at least one text node
-  if (parts.length === 1) {
-    const text = createElement("div", { class: "msg-text" });
-    text.appendChild(renderInlineContent(content));
-    // Replace the fragment content (it already has the same, but handle empty edge case)
-    if (fragment.childNodes.length === 0) {
-      fragment.appendChild(text);
+// -- Code fences --------------------------------------------------------------
+
+interface Segment {
+  readonly kind: "prose" | "code";
+  readonly text: string;
+  /** Raw fence tag, e.g. "ts" — present only on code segments that had one. */
+  readonly lang: string | null;
+}
+
+const FENCE = "```";
+const LANG_TAG_REGEX = /^[A-Za-z][\w+#-]{0,19}$/;
+
+/** Split a message into prose and fenced-code segments. */
+export function splitCodeFences(content: string): Segment[] {
+  const segments: Segment[] = [];
+  let i = 0;
+  while (i < content.length) {
+    const open = content.indexOf(FENCE, i);
+    const close = open < 0 ? -1 : content.indexOf(FENCE, open + FENCE.length);
+    if (open < 0 || close < 0) break;
+
+    if (open > i) segments.push({ kind: "prose", text: content.slice(i, open), lang: null });
+
+    const inner = content.slice(open + FENCE.length, close);
+    const newline = inner.indexOf("\n");
+    const tag = newline > 0 ? inner.slice(0, newline).trim() : "";
+    if (tag.length > 0 && LANG_TAG_REGEX.test(tag)) {
+      segments.push({
+        kind: "code",
+        text: inner.slice(newline + 1).replace(/\s+$/, ""),
+        lang: tag,
+      });
+    } else {
+      segments.push({ kind: "code", text: inner.trim(), lang: null });
     }
+    i = close + FENCE.length;
+  }
+  if (i < content.length) segments.push({ kind: "prose", text: content.slice(i), lang: null });
+  return segments;
+}
+
+/** A code block: language label, highlighted body, copy button. */
+function renderCodeBlock(code: string, lang: string | null): HTMLDivElement {
+  const wrap = createElement("div", { class: "msg-codeblock-wrap" });
+
+  if (lang !== null) {
+    const label = createElement("span", { class: "msg-codeblock-lang" });
+    setText(label, lang);
+    wrap.appendChild(label);
+  }
+
+  const block = createElement("div", { class: "msg-codeblock" });
+  const canonical = resolveLanguage(lang);
+  if (canonical !== null) block.setAttribute("data-lang", canonical);
+  for (const token of highlightCode(code, canonical)) {
+    if (token.cls === null) {
+      block.appendChild(document.createTextNode(token.text));
+      continue;
+    }
+    const span = createElement("span", { class: `tok-${token.cls}` });
+    setText(span, token.text);
+    block.appendChild(span);
+  }
+
+  const copyBtn = createElement("button", { class: "msg-codeblock-copy" });
+  setText(copyBtn, "Copy");
+  copyBtn.addEventListener("click", () => {
+    void navigator.clipboard
+      .writeText(code)
+      .then(() => {
+        setText(copyBtn, "Copied!");
+        setTimeout(() => setText(copyBtn, "Copy"), 2000);
+      })
+      .catch(() => {
+        setText(copyBtn, "Failed");
+        setTimeout(() => setText(copyBtn, "Copy"), 2000);
+      });
+  });
+
+  wrap.appendChild(block);
+  wrap.appendChild(copyBtn);
+  return wrap;
+}
+
+export function renderMessageContent(content: string, info?: MentionInfo): DocumentFragment {
+  const fragment = document.createDocumentFragment();
+
+  // A message that is nothing but emoji renders them large, the way Discord
+  // does. Decided once over the whole content — the class is what sizes both
+  // the unicode glyphs and the custom-emoji images, so nothing downstream has
+  // to be told about it.
+  const jumboClass = isEmojiOnlyMessage(content) ? "msg-text msg-text-jumbo" : "msg-text";
+
+  for (const segment of splitCodeFences(content)) {
+    if (segment.kind === "code") {
+      fragment.appendChild(renderCodeBlock(segment.text, segment.lang));
+      continue;
+    }
+    // Blank lines hugging a fence are formatting, not content.
+    const prose = segment.text.replace(/^\n+/, "").replace(/\n+$/, "");
+    if (prose.trim().length === 0) continue;
+    const text = createElement("div", { class: jumboClass });
+    appendBlocks(text, prose, info);
+    fragment.appendChild(text);
   }
 
   return fragment;
diff --git a/Client/tauri-client/src/components/message-list/custom-emoji.ts b/Client/tauri-client/src/components/message-list/custom-emoji.ts
new file mode 100644
index 00000000..19cb6765
--- /dev/null
+++ b/Client/tauri-client/src/components/message-list/custom-emoji.ts
@@ -0,0 +1,114 @@
+/**
+ * Custom-emoji tokens in message content.
+ *
+ * `:shortcode:` renders as an inline image when the server knows that
+ * shortcode and as the literal text it was typed as when it does not — the
+ * same rule @mentions follow, and the reason a message full of colons never
+ * turns into a wall of broken images.
+ *
+ * The image itself is behind the session token (GET /api/v1/emoji/{id}/image
+ * is authenticated), so it is fetched through the same cert-pinned,
+ * bearer-token path attachments use and swapped in as a data: URI. Assigning
+ * the server URL straight to `img.src` would 401.
+ */
+
+import { createElement } from "@lib/dom";
+import { resolveEmoji, type CustomEmoji } from "@stores/emoji.store";
+import { fetchImageAsDataUrl, resolveServerUrl } from "./attachments";
+
+/**
+ * A `:shortcode:` token. Case-insensitive on the way in (the store lowercases
+ * before lookup) so `:WAVE:` finds the same emoji `:wave:` does; the length
+ * bounds mirror the server's validator, so a token this matches is one the
+ * server could actually have stored.
+ */
+export const EMOJI_TOKEN_REGEX = /:([A-Za-z0-9_]{2,32}):/g;
+
+/**
+ * How many emoji a message may hold and still render jumbo. Discord's number.
+ * Past it the message is a picture wall, not an expression, and 48px each
+ * would push the rest of the channel off screen.
+ */
+export const MAX_JUMBO_EMOJI = 27;
+
+/** One unicode emoji, including skin tones, ZWJ sequences, flags and keycaps. */
+const UNICODE_EMOJI = new RegExp(
+  "^(?:" +
+    // Keycap: digit/#/* + optional VS16 + the combining enclosing keycap.
+    "[0-9#*]\\uFE0F?\\u{20E3}" +
+    "|" +
+    // Regional-indicator pair (flags) or any pictographic base.
+    "(?:[\\u{1F1E6}-\\u{1F1FF}]|\\p{Extended_Pictographic})" +
+    // Modifiers, variation selectors and ZWJ-joined continuations.
+    "(?:\\uFE0F|\\u{20E3}|[\\u{1F3FB}-\\u{1F3FF}]|\\u200D(?:[\\u{1F1E6}-\\u{1F1FF}]|\\p{Extended_Pictographic})(?:\\uFE0F|[\\u{1F3FB}-\\u{1F3FF}])*)*" +
+    ")",
+  "u",
+);
+
+/** A single `:shortcode:` anchored at the start of the remaining text. */
+const LEADING_EMOJI_TOKEN = /^:([A-Za-z0-9_]{2,32}):/;
+
+/**
+ * Whether a message is nothing but emoji, which is what earns the jumbo size.
+ *
+ * "Nothing but" is literal: whitespace, unicode emoji, and `:shortcodes:` that
+ * actually resolve. An unresolved shortcode is plain text, so `:nosuch:` alone
+ * is a normal message — sizing it jumbo would promise an image that is never
+ * going to appear.
+ */
+export function isEmojiOnlyMessage(content: string): boolean {
+  let rest = content.trim();
+  if (rest === "") return false;
+
+  let count = 0;
+  while (rest.length > 0) {
+    const ws = /^\s+/.exec(rest);
+    if (ws !== null) {
+      rest = rest.slice(ws[0].length);
+      continue;
+    }
+    const token = LEADING_EMOJI_TOKEN.exec(rest);
+    if (token !== null && resolveEmoji(token[1] ?? "") !== null) {
+      count++;
+      rest = rest.slice(token[0].length);
+      continue;
+    }
+    const unicode = UNICODE_EMOJI.exec(rest);
+    if (unicode !== null && unicode[0].length > 0) {
+      count++;
+      rest = rest.slice(unicode[0].length);
+      continue;
+    }
+    return false;
+  }
+  return count > 0 && count <= MAX_JUMBO_EMOJI;
+}
+
+/**
+ * The inline image for one custom emoji. The element is returned immediately
+ * with no `src`; the bytes arrive asynchronously and are swapped in when they
+ * do. Until then (and forever, if the fetch fails) the `alt` text is the
+ * shortcode, so the message still reads correctly.
+ */
+export function buildCustomEmojiImage(emoji: CustomEmoji): HTMLImageElement {
+  const img = createElement("img", {
+    class: "custom-emoji",
+    alt: `:${emoji.shortcode}:`,
+    title: `:${emoji.shortcode}:`,
+    "data-shortcode": emoji.shortcode,
+    draggable: "false",
+  });
+  void fetchImageAsDataUrl(resolveServerUrl(emoji.url)).then((dataUrl) => {
+    if (dataUrl !== null) img.src = dataUrl;
+  });
+  return img;
+}
+
+/**
+ * The image node for `token` (with or without colons), or null when no such
+ * emoji exists — the caller leaves an unresolved token as plain text.
+ */
+export function buildCustomEmojiNode(token: string): HTMLImageElement | null {
+  const emoji = resolveEmoji(token);
+  return emoji === null ? null : buildCustomEmojiImage(emoji);
+}
diff --git a/Client/tauri-client/src/components/message-list/formatting.ts b/Client/tauri-client/src/components/message-list/formatting.ts
index bf2ac931..8ab750ee 100644
--- a/Client/tauri-client/src/components/message-list/formatting.ts
+++ b/Client/tauri-client/src/components/message-list/formatting.ts
@@ -3,6 +3,7 @@
  * Pure functions for timestamp parsing, display formatting, and role resolution.
  */
 
+import { channelsStore } from "@stores/channels.store";
 import { membersStore } from "@stores/members.store";
 import type { Message } from "@stores/messages.store";
 import { loadPref } from "@components/settings/helpers";
@@ -123,10 +124,49 @@ export function getUserRole(userId: number): string {
   return membersStore.getState().members.get(userId)?.role ?? "member";
 }
 
+/**
+ * The author identity to render for a message, resolved against the member
+ * store first and the message payload second.
+ *
+ * The store is preferred because it is the live copy: a rename or an avatar
+ * change arrives as a `user_update` and patches every member, while the
+ * messages already on screen keep whatever the author looked like when they
+ * posted. The payload is the fallback for someone who is not in the member
+ * list at all — a deleted account, or a poster from before this session.
+ */
+export function resolveAuthor(user: {
+  id: number;
+  username: string;
+  avatar: string | null;
+  display_name?: string | null;
+}): { username: string; displayName: string | null; avatar: string | null } {
+  const member = membersStore.getState().members.get(user.id);
+  if (member !== undefined) {
+    return {
+      username: member.username,
+      displayName: member.displayName ?? null,
+      avatar: member.avatar,
+    };
+  }
+  return {
+    username: user.username,
+    displayName: user.display_name ?? null,
+    avatar: user.avatar,
+  };
+}
+
 export function roleColorVar(role: string): string {
   if (!roleColorsEnabled) {
     return "var(--role-member)";
   }
+  // Prefer the server's role color (shipped in `ready`); the theme variables
+  // below are the fallback for the seeded roles when no color is set.
+  const serverRole = channelsStore
+    .getState()
+    .roles.find((r) => r.name.toLowerCase() === role.toLowerCase());
+  if (serverRole?.color != null && serverRole.color !== "") {
+    return serverRole.color;
+  }
   switch (role) {
     case "owner":
       return "var(--role-owner)";
diff --git a/Client/tauri-client/src/components/message-list/markdown.ts b/Client/tauri-client/src/components/message-list/markdown.ts
new file mode 100644
index 00000000..3a055129
--- /dev/null
+++ b/Client/tauri-client/src/components/message-list/markdown.ts
@@ -0,0 +1,422 @@
+/**
+ * Discord-flavoured inline markdown tokenizer.
+ *
+ * Pure and DOM-free on purpose: this module only decides *what* the text
+ * means, `content-parser.ts` decides what nodes it becomes. Keeping the two
+ * apart is what lets the renderer stay a strict DOM builder (no innerHTML)
+ * while the grammar gets tested on its own.
+ *
+ * The tokenizer is a single left-to-right scan with recursive descent into
+ * matched delimiter pairs — not a stack of regexes — so nesting
+ * (`**bold *and italic* **`), escaping (`\*literal\*`) and "markdown is dead
+ * inside code" all fall out of one rule set instead of fighting each other.
+ */
+
+/** Emphasis-style wrappers, in the flavour Discord uses. */
+export type InlineStyle = "strong" | "em" | "underline" | "strike" | "spoiler";
+
+export type InlineNode =
+  | { readonly type: "text"; readonly value: string }
+  | { readonly type: "code"; readonly value: string }
+  | {
+      readonly type: "link";
+      readonly url: string;
+      readonly raw: string;
+      readonly children: readonly InlineNode[];
+    }
+  | { readonly type: InlineStyle; readonly children: readonly InlineNode[] };
+
+/** Characters a backslash can neutralise. Anything else keeps its backslash. */
+const ESCAPABLE = "\\`*_~|[]()>#-+.!";
+
+/** Nesting cap — a guard against pathological input, not a style choice. */
+const MAX_DEPTH = 6;
+
+/** Bare-URL shape, kept in sync with URL_REGEX in content-parser. */
+const URL_START = /^https?:\/\//i;
+
+/** Shared empty map for `parseInline` calls with nothing to bracket-match. */
+const EMPTY_MATCHES: ReadonlyMap<number, number> = new Map();
+
+interface DelimSpec {
+  readonly marker: string;
+  /** Outermost style first; `***x***` is bold wrapping italic. */
+  readonly styles: readonly InlineStyle[];
+}
+
+/** Longest markers first — `***` must win over `**`, and `**` over `*`. */
+const DELIMS: readonly DelimSpec[] = [
+  { marker: "***", styles: ["strong", "em"] },
+  { marker: "___", styles: ["underline", "em"] },
+  { marker: "**", styles: ["strong"] },
+  { marker: "__", styles: ["underline"] },
+  { marker: "~~", styles: ["strike"] },
+  { marker: "||", styles: ["spoiler"] },
+  { marker: "*", styles: ["em"] },
+  { marker: "_", styles: ["em"] },
+];
+
+function isWordChar(ch: string | undefined): boolean {
+  return ch !== undefined && /[A-Za-z0-9]/.test(ch);
+}
+
+function runLength(src: string, i: number, ch: string): number {
+  let n = 0;
+  while (i + n < src.length && src[i + n] === ch) n++;
+  return n;
+}
+
+/**
+ * End index (exclusive) of the code span opening at `i`, or -1 when it never
+ * closes. Supports single and double backtick fences.
+ */
+function codeSpanEnd(src: string, i: number): number {
+  const run = Math.min(runLength(src, i, "`"), 2);
+  const fence = "`".repeat(run);
+  const close = src.indexOf(fence, i + run);
+  if (close < 0) return -1;
+  return close + run;
+}
+
+/**
+ * End index (exclusive) of a bare URL starting at `i`, or `i` when there is
+ * none. Trailing delimiter runs are given back so `**https://a/b**` still
+ * closes its bold — a URL swallowing the closer is worse than a URL losing a
+ * trailing asterisk it almost certainly never had.
+ */
+function urlEnd(src: string, i: number): number {
+  if (!URL_START.test(src.slice(i, i + 8))) return i;
+  let end = i;
+  while (end < src.length && !/[\s<>"'`]/.test(src[end]!)) end++;
+  const min = i + 8;
+  for (;;) {
+    const tail = src.slice(min, end);
+    const run = /([*_~|])\1+$/.exec(tail);
+    if (run !== null) {
+      end -= run[0].length;
+      continue;
+    }
+    if (end > min && src[end - 1] === "*") {
+      end--;
+      continue;
+    }
+    break;
+  }
+  return end;
+}
+
+/** The delimiter opening at `i`, or null. */
+function matchDelim(src: string, i: number): DelimSpec | null {
+  for (const d of DELIMS) {
+    if (!src.startsWith(d.marker, i)) continue;
+    // `snake_case_names` must stay literal: an underscore only opens emphasis
+    // on a word boundary.
+    if (d.marker[0] === "_" && isWordChar(src[i - 1])) continue;
+    return d;
+  }
+  return null;
+}
+
+/**
+ * Index of the delimiter run that closes `marker`, searching from `from`, or
+ * -1. Escapes, code spans and bare URLs are skipped so a closer hiding inside
+ * them is not mistaken for the real one.
+ */
+function scanClose(src: string, from: number, marker: string): number {
+  const ch = marker[0]!;
+  const len = marker.length;
+  let j = from;
+  while (j < src.length) {
+    const c = src[j]!;
+    if (c === "\\") {
+      j += 2;
+      continue;
+    }
+    if (c === "`") {
+      const end = codeSpanEnd(src, j);
+      if (end > 0) {
+        j = end;
+        continue;
+      }
+    }
+    const u = urlEnd(src, j);
+    if (u > j) {
+      j = u;
+      continue;
+    }
+    if (c === ch) {
+      const run = runLength(src, j, ch);
+      const usable = len > 1 ? run >= len : run === 1;
+      if (usable && (ch !== "_" || !isWordChar(src[j + len]))) return j;
+      j += run;
+      continue;
+    }
+    j++;
+  }
+  return -1;
+}
+
+/**
+ * Matches for every `openCh` in `src` to its balanced `closeCh`, computed in
+ * one linear pass with a stack (an opener that never closes just never gets
+ * an entry). A run's mismatched openers therefore cost O(1) each to look up
+ * instead of a fresh O(n) rescan apiece — the same semantics as calling a
+ * depth-counting scan from every individual opener (nesting balances the
+ * same way, escapes swallow the following character unconditionally, and a
+ * bare newline strands whatever is still open across it), just computed once
+ * per `parseInline` invocation instead of once per opener.
+ */
+function buildMatches(src: string, openCh: string, closeCh: string): ReadonlyMap<number, number> {
+  const matches = new Map<number, number>();
+  const stack: number[] = [];
+  for (let j = 0; j < src.length; j++) {
+    const c = src[j]!;
+    if (c === "\\") {
+      j++;
+      continue;
+    }
+    if (c === "\n") {
+      // Nothing left open can span a newline; abandon it rather than let it
+      // match something on a later line.
+      stack.length = 0;
+      continue;
+    }
+    if (c === openCh) stack.push(j);
+    else if (c === closeCh) {
+      const open = stack.pop();
+      if (open !== undefined) matches.set(open, j);
+    }
+  }
+  return matches;
+}
+
+/** Parse `[text](url)` at `i`. The URL is *not* validated here — that is the
+ * renderer's job, which is why the raw source travels with the node. */
+function parseLink(
+  src: string,
+  i: number,
+  depth: number,
+  bracketMatches: ReadonlyMap<number, number>,
+  parenMatches: ReadonlyMap<number, number>,
+): { node: InlineNode; end: number } | null {
+  const close = bracketMatches.get(i) ?? -1;
+  if (close < 0 || src[close + 1] !== "(") return null;
+  const urlClose = parenMatches.get(close + 1) ?? -1;
+  if (urlClose < 0) return null;
+  const url = src.slice(close + 2, urlClose).trim();
+  if (url.length === 0 || /\s/.test(url)) return null;
+  const text = src.slice(i + 1, close);
+  if (text.length === 0) return null;
+  return {
+    node: {
+      type: "link",
+      url,
+      raw: src.slice(i, urlClose + 1),
+      children: parseInline(text, depth + 1),
+    },
+    end: urlClose + 1,
+  };
+}
+
+/**
+ * Tokenize one run of inline text (no block constructs, no newline meaning).
+ */
+export function parseInline(src: string, depth = 0): InlineNode[] {
+  const out: InlineNode[] = [];
+  let buf = "";
+  const flush = (): void => {
+    if (buf.length > 0) {
+      out.push({ type: "text", value: buf });
+      buf = "";
+    }
+  };
+
+  // Built once per invocation (not once per `[`) — see buildMatches. Skipped
+  // entirely when the substring has nothing to match, which is the common
+  // case for recursive calls into styled/link text.
+  const bracketMatches = src.includes("[") ? buildMatches(src, "[", "]") : EMPTY_MATCHES;
+  const parenMatches = src.includes("(") ? buildMatches(src, "(", ")") : EMPTY_MATCHES;
+
+  let i = 0;
+  while (i < src.length) {
+    const c = src[i]!;
+
+    if (c === "\\" && i + 1 < src.length && ESCAPABLE.includes(src[i + 1]!)) {
+      buf += src[i + 1]!;
+      i += 2;
+      continue;
+    }
+
+    if (c === "`") {
+      const end = codeSpanEnd(src, i);
+      if (end > i) {
+        const run = Math.min(runLength(src, i, "`"), 2);
+        flush();
+        out.push({ type: "code", value: src.slice(i + run, end - run) });
+        i = end;
+        continue;
+      }
+    }
+
+    // A bare URL is opaque: its underscores and asterisks are address, not
+    // markup, and it is autolinked later by the renderer.
+    const u = urlEnd(src, i);
+    if (u > i) {
+      buf += src.slice(i, u);
+      i = u;
+      continue;
+    }
+
+    if (depth < MAX_DEPTH && c === "[") {
+      const link = parseLink(src, i, depth, bracketMatches, parenMatches);
+      if (link !== null) {
+        flush();
+        out.push(link.node);
+        i = link.end;
+        continue;
+      }
+    }
+
+    if (depth < MAX_DEPTH) {
+      const d = matchDelim(src, i);
+      if (d !== null) {
+        const innerStart = i + d.marker.length;
+        const close = scanClose(src, innerStart, d.marker);
+        if (close > innerStart) {
+          flush();
+          const children = parseInline(src.slice(innerStart, close), depth + 1);
+          let node: InlineNode = { type: d.styles[d.styles.length - 1]!, children };
+          for (let k = d.styles.length - 2; k >= 0; k--) {
+            node = { type: d.styles[k]!, children: [node] };
+          }
+          out.push(node);
+          i = close + d.marker.length;
+          continue;
+        }
+      }
+    }
+
+    buf += c;
+    i++;
+  }
+
+  flush();
+  return out;
+}
+
+// -- Block constructs ---------------------------------------------------------
+
+export type BlockNode =
+  | { readonly type: "paragraph"; readonly text: string }
+  | { readonly type: "heading"; readonly level: 1 | 2 | 3; readonly text: string }
+  | { readonly type: "quote"; readonly text: string }
+  | {
+      readonly type: "list";
+      readonly ordered: boolean;
+      readonly start: number;
+      readonly items: readonly ListItem[];
+    };
+
+export interface ListItem {
+  readonly text: string;
+  /** 0 for a top-level item, 1 for a single level of indentation. */
+  readonly level: 0 | 1;
+  readonly ordered: boolean;
+}
+
+const HEADING_RE = /^(#{1,3}) +(.*)$/;
+const QUOTE_RE = /^> ?(.*)$/;
+const BLOCK_QUOTE_ALL_RE = /^>>> ?(.*)$/;
+const BULLET_RE = /^( *)([-*]) +(.*)$/;
+const ORDERED_RE = /^( *)(\d{1,9})[.)] +(.*)$/;
+
+function listItemAt(line: string): ListItem | null {
+  const bullet = BULLET_RE.exec(line);
+  if (bullet !== null) {
+    return { text: bullet[3]!, level: bullet[1]!.length >= 2 ? 1 : 0, ordered: false };
+  }
+  const ordered = ORDERED_RE.exec(line);
+  if (ordered !== null) {
+    return { text: ordered[3]!, level: ordered[1]!.length >= 2 ? 1 : 0, ordered: true };
+  }
+  return null;
+}
+
+function orderedStart(line: string): number {
+  const m = ORDERED_RE.exec(line);
+  return m === null ? 1 : Number(m[2]);
+}
+
+/**
+ * Split a prose segment into block nodes. Block markers are only recognised at
+ * the start of a line, exactly like Discord; everything else joins the
+ * surrounding paragraph so inline styles may span line breaks.
+ */
+export function parseBlocks(text: string): BlockNode[] {
+  const lines = text.split("\n");
+  const out: BlockNode[] = [];
+  let para: string[] = [];
+
+  const flushPara = (): void => {
+    if (para.length > 0) {
+      out.push({ type: "paragraph", text: para.join("\n") });
+      para = [];
+    }
+  };
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i]!;
+
+    const all = BLOCK_QUOTE_ALL_RE.exec(line);
+    if (all !== null) {
+      flushPara();
+      const rest = [all[1]!, ...lines.slice(i + 1)].join("\n");
+      out.push({ type: "quote", text: rest });
+      return out;
+    }
+
+    const quote = QUOTE_RE.exec(line);
+    if (quote !== null) {
+      flushPara();
+      const collected = [quote[1]!];
+      while (i + 1 < lines.length) {
+        const next = QUOTE_RE.exec(lines[i + 1]!);
+        if (next === null) break;
+        collected.push(next[1]!);
+        i++;
+      }
+      out.push({ type: "quote", text: collected.join("\n") });
+      continue;
+    }
+
+    const heading = HEADING_RE.exec(line);
+    if (heading !== null) {
+      flushPara();
+      out.push({ type: "heading", level: heading[1]!.length as 1 | 2 | 3, text: heading[2]! });
+      continue;
+    }
+
+    const item = listItemAt(line);
+    if (item !== null) {
+      flushPara();
+      const items: ListItem[] = [item];
+      const ordered = item.ordered;
+      const start = ordered ? orderedStart(line) : 1;
+      while (i + 1 < lines.length) {
+        const next = listItemAt(lines[i + 1]!);
+        // A list ends when the marker style changes at the top level; nested
+        // items may differ from their parent.
+        if (next === null || (next.level === 0 && next.ordered !== ordered)) break;
+        items.push(next);
+        i++;
+      }
+      out.push({ type: "list", ordered, start, items });
+      continue;
+    }
+
+    para.push(line);
+  }
+
+  flushPara();
+  return out;
+}
diff --git a/Client/tauri-client/src/components/message-list/media.ts b/Client/tauri-client/src/components/message-list/media.ts
index d4246769..731de188 100644
--- a/Client/tauri-client/src/components/message-list/media.ts
+++ b/Client/tauri-client/src/components/message-list/media.ts
@@ -11,7 +11,12 @@ import { observeMedia } from "@lib/media-visibility";
 import { loadPref } from "@components/settings/helpers";
 import { fetch as tauriFetch } from "@tauri-apps/plugin-http";
 import { isSafeUrl } from "./attachments";
-import { CODE_BLOCK_REGEX, INLINE_CODE_REGEX, URL_REGEX } from "./content-parser";
+import {
+  CODE_BLOCK_REGEX,
+  INLINE_CODE_REGEX,
+  MASKED_LINK_REGEX,
+  URL_REGEX,
+} from "./content-parser";
 import { renderGenericLinkPreview } from "./embeds";
 
 const log = createLogger("media");
@@ -494,8 +499,12 @@ export function openImageLightbox(src: string, alt: string): void {
 
 /** Extract all URLs from a message content string. */
 export function extractUrls(content: string): string[] {
-  // Skip URLs inside code blocks
-  const withoutCodeBlocks = content.replace(CODE_BLOCK_REGEX, "").replace(INLINE_CODE_REGEX, "");
+  // Skip URLs inside code blocks, and inside masked links: `[text](url)` is a
+  // deliberate act of hiding the address, so it gets no embed either.
+  const withoutCodeBlocks = content
+    .replace(CODE_BLOCK_REGEX, "")
+    .replace(INLINE_CODE_REGEX, "")
+    .replace(MASKED_LINK_REGEX, "");
   const matches = withoutCodeBlocks.match(URL_REGEX);
   return matches ?? [];
 }
diff --git a/Client/tauri-client/src/components/message-list/reaction-tooltip.ts b/Client/tauri-client/src/components/message-list/reaction-tooltip.ts
new file mode 100644
index 00000000..bee2f1bc
--- /dev/null
+++ b/Client/tauri-client/src/components/message-list/reaction-tooltip.ts
@@ -0,0 +1,281 @@
+/**
+ * Who-reacted tooltip — hovering a reaction pill names the people behind the
+ * count.
+ *
+ * The reactor list is not part of the message payload (a page of chat carries
+ * dozens of pills and almost none are ever hovered), so it is fetched on demand
+ * from GET /channels/{id}/messages/{messageId}/reactions/{emoji}/users and
+ * cached per message+emoji. The cache is invalidated by `reaction_update` for
+ * that message, which is the only event that can change the answer.
+ *
+ * Hover is debounced 300ms, mirroring lib/streamPreview.ts: a pointer crossing
+ * a row of pills must not fire a request per pill.
+ */
+
+import { createElement, setText, appendChildren } from "@lib/dom";
+import { createLogger } from "@lib/logger";
+import type { ReactionUser } from "@lib/types";
+
+const log = createLogger("reaction-tooltip");
+
+/** Debounce before the hover turns into a fetch + tooltip. */
+export const REACTION_TOOLTIP_DEBOUNCE_MS = 300;
+
+/** How many names are spelled out before collapsing into "and N others". */
+const MAX_NAMES = 3;
+
+// ---------------------------------------------------------------------------
+// Fetcher injection
+// ---------------------------------------------------------------------------
+
+export type ReactionUsersFetcher = (
+  channelId: number,
+  messageId: number,
+  emoji: string,
+) => Promise<readonly ReactionUser[]>;
+
+let fetcher: ReactionUsersFetcher | null = null;
+
+/**
+ * Register the transport used to fetch reactor lists. Called once from
+ * MainPage with the live ApiClient, the same way setServerHost is. Until it is
+ * set, hovering a pill is a no-op rather than an error — the renderer is used
+ * by tests and previews that have no server.
+ */
+export function setReactionUsersFetcher(next: ReactionUsersFetcher | null): void {
+  fetcher = next;
+}
+
+// ---------------------------------------------------------------------------
+// Cache
+// ---------------------------------------------------------------------------
+
+/** NUL separator: the server rejects control characters in an emoji, so no
+ *  emoji can contain it and no two (message, emoji) pairs can collide. */
+function cacheKey(messageId: number, emoji: string): string {
+  return `${messageId}\u0000${emoji}`;
+}
+
+/** Resolved reactor lists, keyed by message+emoji. */
+const cache = new Map<string, readonly ReactionUser[]>();
+/** In-flight requests, so a re-hover during the fetch does not duplicate it. */
+const inFlight = new Map<string, Promise<readonly ReactionUser[] | null>>();
+
+/**
+ * Drop every cached reactor list for a message. Called from the `reaction_update`
+ * dispatch: any add/remove on that message makes all of its lists stale, and
+ * the event carries only the one emoji that changed, so scoping the eviction to
+ * that emoji would leave the others silently wrong after a race.
+ */
+export function invalidateReactionUsers(messageId: number): void {
+  // Deleting the key currently being visited is well-defined for a Map
+  // iterator, so no snapshot of the key set is needed.
+  const prefix = `${messageId}\u0000`;
+  for (const key of cache.keys()) {
+    if (key.startsWith(prefix)) cache.delete(key);
+  }
+  for (const key of inFlight.keys()) {
+    if (key.startsWith(prefix)) inFlight.delete(key);
+  }
+}
+
+/** Drop every cached reactor list (channel switch, logout, reconnect). */
+export function clearReactionUsersCache(): void {
+  cache.clear();
+  inFlight.clear();
+}
+
+/** Cached reactor list for a message+emoji, or undefined when not fetched. */
+export function getCachedReactionUsers(
+  messageId: number,
+  emoji: string,
+): readonly ReactionUser[] | undefined {
+  return cache.get(cacheKey(messageId, emoji));
+}
+
+/**
+ * Reactor list for a message+emoji, from cache when present. Returns null when
+ * there is no fetcher registered or the request failed — callers show nothing
+ * rather than an error, since this is a hover affordance.
+ */
+export function loadReactionUsers(
+  channelId: number,
+  messageId: number,
+  emoji: string,
+): Promise<readonly ReactionUser[] | null> {
+  const key = cacheKey(messageId, emoji);
+
+  const cached = cache.get(key);
+  if (cached !== undefined) return Promise.resolve(cached);
+
+  const existing = inFlight.get(key);
+  if (existing !== undefined) return existing;
+
+  const activeFetcher = fetcher;
+  if (activeFetcher === null) return Promise.resolve(null);
+
+  const promise = activeFetcher(channelId, messageId, emoji).then(
+    (users) => {
+      // A concurrent invalidation dropped this key: the response describes a
+      // state that has already changed, so it must not repopulate the cache.
+      if (inFlight.get(key) === promise) {
+        cache.set(key, users);
+      }
+      return users;
+    },
+    (err: unknown) => {
+      log.warn("failed to load reaction users", {
+        messageId,
+        emoji,
+        error: String(err),
+      });
+      return null;
+    },
+  );
+
+  inFlight.set(key, promise);
+  void promise.finally(() => {
+    if (inFlight.get(key) === promise) {
+      inFlight.delete(key);
+    }
+  });
+
+  return promise;
+}
+
+// ---------------------------------------------------------------------------
+// Text
+// ---------------------------------------------------------------------------
+
+/**
+ * "A", "A and B", "A, B and C", "A, B, C and 4 others".
+ *
+ * `totalCount` is the pill's count, which can exceed the fetched list (the
+ * server caps it at 100) — the overflow phrasing is driven by it so a pill
+ * reading 250 does not claim only 100 people reacted.
+ */
+export function formatReactorNames(
+  usernames: readonly string[],
+  totalCount = usernames.length,
+): string {
+  if (usernames.length === 0) return "";
+
+  const total = Math.max(totalCount, usernames.length);
+  const shown = usernames.slice(0, MAX_NAMES);
+  const others = total - shown.length;
+
+  if (others > 0) {
+    return `${shown.join(", ")} and ${others} ${others === 1 ? "other" : "others"}`;
+  }
+  if (shown.length === 1) return shown[0]!;
+  return `${shown.slice(0, -1).join(", ")} and ${shown[shown.length - 1]!}`;
+}
+
+// ---------------------------------------------------------------------------
+// Tooltip DOM
+// ---------------------------------------------------------------------------
+
+/** Build the tooltip body. Text only — usernames are user-controlled, so they
+ *  go in via textContent, never markup. */
+export function buildReactionTooltip(
+  emoji: string,
+  users: readonly ReactionUser[],
+  totalCount: number,
+): HTMLDivElement {
+  const tip = createElement("div", {
+    class: "reaction-tooltip",
+    role: "tooltip",
+    "data-testid": "reaction-tooltip",
+  });
+  const names = createElement("span", { class: "reaction-tooltip-names" });
+  setText(
+    names,
+    formatReactorNames(
+      users.map((u) => u.username),
+      totalCount,
+    ),
+  );
+  const reacted = createElement("span", { class: "reaction-tooltip-emoji" });
+  setText(reacted, `reacted with ${emoji}`);
+  appendChildren(tip, names, reacted);
+  return tip;
+}
+
+// ---------------------------------------------------------------------------
+// Hover wiring
+// ---------------------------------------------------------------------------
+
+export interface ReactionTooltipTarget {
+  readonly channelId: number;
+  readonly messageId: number;
+  readonly emoji: string;
+  /** The pill's displayed count, used for the "and N others" tail. */
+  readonly count: number;
+}
+
+interface HoverState {
+  timer: number;
+  /** Bumped on every hide so a late fetch cannot show a stale tooltip. */
+  generation: number;
+}
+
+const hoverStates = new WeakMap<HTMLElement, HoverState>();
+
+function removeTooltip(chip: HTMLElement): void {
+  chip.querySelector(".reaction-tooltip")?.remove();
+}
+
+function hide(chip: HTMLElement): void {
+  const state = hoverStates.get(chip);
+  if (state !== undefined) {
+    clearTimeout(state.timer);
+    state.generation += 1;
+  }
+  removeTooltip(chip);
+}
+
+/**
+ * Attach who-reacted hover behaviour to a reaction pill. Listeners are removed
+ * with the message list's AbortSignal; the debounce timer is cleared on
+ * mouseleave/focusout and on abort.
+ */
+export function attachReactionTooltip(
+  chip: HTMLElement,
+  target: ReactionTooltipTarget,
+  signal: AbortSignal,
+): void {
+  const show = (): void => {
+    const state = hoverStates.get(chip);
+    if (state === undefined) return;
+    const generation = state.generation;
+
+    void loadReactionUsers(target.channelId, target.messageId, target.emoji).then((users) => {
+      if (users === null || users.length === 0) return;
+      // The pointer left (or the row was rebuilt) while the fetch was in
+      // flight — do not pop a tooltip nobody is hovering.
+      const current = hoverStates.get(chip);
+      if (current === undefined || current.generation !== generation) return;
+      if (!chip.isConnected) return;
+      removeTooltip(chip);
+      chip.appendChild(buildReactionTooltip(target.emoji, [...users], target.count));
+    });
+  };
+
+  const start = (): void => {
+    hide(chip);
+    const existing = hoverStates.get(chip);
+    const generation = existing === undefined ? 0 : existing.generation;
+    const timer = window.setTimeout(show, REACTION_TOOLTIP_DEBOUNCE_MS);
+    hoverStates.set(chip, { timer, generation });
+  };
+
+  const stop = (): void => hide(chip);
+
+  chip.addEventListener("mouseenter", start, { signal });
+  chip.addEventListener("mouseleave", stop, { signal });
+  // Keyboard accessibility: focus mirrors hover.
+  chip.addEventListener("focusin", start, { signal });
+  chip.addEventListener("focusout", stop, { signal });
+
+  signal.addEventListener("abort", () => hide(chip));
+}
diff --git a/Client/tauri-client/src/components/message-list/reactions.ts b/Client/tauri-client/src/components/message-list/reactions.ts
index 3d7c8d36..c7962a4f 100644
--- a/Client/tauri-client/src/components/message-list/reactions.ts
+++ b/Client/tauri-client/src/components/message-list/reactions.ts
@@ -5,6 +5,8 @@
 import { createElement } from "@lib/dom";
 import type { Message } from "@stores/messages.store";
 import type { MessageListOptions } from "../MessageList";
+import { attachReactionTooltip } from "./reaction-tooltip";
+import { buildCustomEmojiNode } from "./custom-emoji";
 
 // -- Reaction rendering -------------------------------------------------------
 
@@ -17,12 +19,30 @@ export function renderReactions(
   for (const reaction of msg.reactions) {
     const chip = createElement("span", {
       class: reaction.me ? "reaction-chip me" : "reaction-chip",
+      // Focusable so the who-reacted tooltip is reachable without a pointer.
+      tabindex: "0",
+      "data-emoji": reaction.emoji,
     });
-    const emoji = document.createTextNode(reaction.emoji);
+    // Reaction strings are free-form, so a custom reaction is stored as the
+    // literal ":shortcode:" text. Render the image when that resolves; when it
+    // does not (the emoji was deleted, or the reaction predates it) the plain
+    // text is exactly what the reaction is, and toggling it still works.
+    const emoji: Node =
+      buildCustomEmojiNode(reaction.emoji) ?? document.createTextNode(reaction.emoji);
     const count = createElement("span", { class: "rc-count" }, String(reaction.count));
     chip.appendChild(emoji);
     chip.appendChild(count);
     chip.addEventListener("click", () => opts.onReactionClick(msg.id, reaction.emoji), { signal });
+    attachReactionTooltip(
+      chip,
+      {
+        channelId: msg.channelId,
+        messageId: msg.id,
+        emoji: reaction.emoji,
+        count: reaction.count,
+      },
+      signal,
+    );
     container.appendChild(chip);
   }
   const addBtn = createElement("span", { class: "reaction-chip add-reaction" }, "+");
diff --git a/Client/tauri-client/src/components/message-list/renderers.ts b/Client/tauri-client/src/components/message-list/renderers.ts
index 3f0cab7b..bee8592e 100644
--- a/Client/tauri-client/src/components/message-list/renderers.ts
+++ b/Client/tauri-client/src/components/message-list/renderers.ts
@@ -10,6 +10,7 @@ import { createIcon } from "@lib/icons";
 import { loadPref } from "@lib/preferences";
 import { canManageMessages } from "@lib/permissions";
 import { showToast } from "@lib/toast";
+import { formatMessageLink } from "@lib/deep-link";
 import type { Message } from "@stores/messages.store";
 import type { MessageListOptions } from "../MessageList";
 
@@ -47,8 +48,10 @@ export { setServerHost } from "./attachments";
 // -- Imports for composite functions ------------------------------------------
 
 import { formatTime, formatFullDate, formatMessageTimestamp } from "./formatting";
-import { getUserRole, roleColorVar } from "./formatting";
+import { getUserRole, resolveAuthor, roleColorVar } from "./formatting";
+import { createAvatarElement, resolveDisplayName } from "@lib/avatar";
 import { renderMentions, renderMessageContent } from "./content-parser";
+import { highlightsCurrentUser } from "@lib/mentions";
 import { renderUrlEmbeds } from "./media";
 import { renderAttachment } from "./attachments";
 import { renderReactions } from "./reactions";
@@ -66,24 +69,70 @@ export function renderDayDivider(iso: string): HTMLDivElement {
   return divider;
 }
 
-function renderReplyRef(replyToId: number, allMessages: readonly Message[]): HTMLDivElement {
+/**
+ * The "NEW" line above the first message the reader has not seen. Built exactly
+ * like the day divider — same rule/label/rule shape — so the two read as one
+ * family; only the accent colour distinguishes them.
+ */
+export function renderNewDivider(): HTMLDivElement {
+  const divider = createElement("div", {
+    class: "msg-new-divider",
+    role: "separator",
+    "data-testid": "new-messages-divider",
+  });
+  appendChildren(
+    divider,
+    createElement("span", { class: "line" }),
+    createElement("span", { class: "label" }, "NEW"),
+    createElement("span", { class: "line" }),
+  );
+  return divider;
+}
+
+/**
+ * The quoted bar above a reply. Clicking it jumps to the replied-to message —
+ * including when that message is outside the loaded window, which is why the
+ * bar stays clickable even in the "unknown message" case: the id is known, and
+ * the jump path can fetch the window around it.
+ */
+function renderReplyRef(
+  replyToId: number,
+  allMessages: readonly Message[],
+  opts: MessageListOptions,
+  signal: AbortSignal,
+): HTMLDivElement {
   const ref = allMessages.find((m) => m.id === replyToId);
-  const bar = createElement("div", { class: "msg-reply-ref" });
+  const bar = createElement("div", {
+    class: "msg-reply-ref",
+    role: "button",
+    tabindex: "0",
+    "data-reply-to": String(replyToId),
+    title: "Jump to the replied-to message",
+  });
+  const jump = (): void => opts.onJumpToMessage?.(replyToId);
+  bar.addEventListener("click", jump, { signal });
+  bar.addEventListener(
+    "keydown",
+    (e: KeyboardEvent) => {
+      if (e.key === "Enter" || e.key === " ") {
+        e.preventDefault();
+        jump();
+      }
+    },
+    { signal },
+  );
   if (ref) {
     const preview = ref.deleted ? "[message deleted]" : ref.content.slice(0, 100);
     const role = getUserRole(ref.user.id);
-    const miniAvatar = createElement(
-      "div",
-      {
-        class: "rr-avatar",
-        style: `background: ${roleColorVar(role)}`,
-      },
-      ref.user.username.charAt(0).toUpperCase(),
-    );
+    const author = resolveAuthor(ref.user);
+    const miniAvatar = createAvatarElement(author, {
+      className: "rr-avatar",
+      background: roleColorVar(role),
+    });
     appendChildren(
       bar,
       miniAvatar,
-      createElement("span", { class: "rr-author" }, ref.user.username),
+      createElement("span", { class: "rr-author" }, resolveDisplayName(author)),
       createElement("span", { class: "rr-text" }, preview),
     );
   } else {
@@ -136,21 +185,23 @@ export function renderMessage(
 
   const statusClass =
     msg.status === "pending" ? " pending" : msg.status === "failed" ? " failed" : "";
+  const mentionInfo = { mentions: msg.mentions, mentionsEveryone: msg.mentionsEveryone };
+  // A deleted row shows no content, so it must not keep the mention accent.
+  const mentionedClass =
+    !msg.deleted && highlightsCurrentUser(msg.content, mentionInfo) ? " mentioned" : "";
   const el = createElement("div", {
-    class: (isGrouped ? "message grouped" : "message") + statusClass,
+    class: (isGrouped ? "message grouped" : "message") + statusClass + mentionedClass,
     "data-testid": `message-${msg.id}`,
   });
 
   const role = getUserRole(msg.user.id);
-  const initial = msg.user.username.charAt(0).toUpperCase();
-  const avatar = createElement(
-    "div",
-    {
-      class: "msg-avatar",
-      style: `background: ${roleColorVar(role)}`,
-    },
-    initial,
-  );
+  // The author's current identity, not the one frozen into the payload: a
+  // rename or a new avatar has to show up on the messages already on screen.
+  const author = resolveAuthor(msg.user);
+  const avatar = createAvatarElement(author, {
+    className: "msg-avatar",
+    background: roleColorVar(role),
+  });
   el.appendChild(avatar);
 
   if (isGrouped) {
@@ -166,24 +217,27 @@ export function renderMessage(
   }
 
   if (msg.replyTo !== null) {
-    el.appendChild(renderReplyRef(msg.replyTo, allMessages));
+    el.appendChild(renderReplyRef(msg.replyTo, allMessages, opts, signal));
   }
 
   const header = createElement("div", { class: "msg-header" });
-  const author = createElement(
+  const authorEl = createElement(
     "span",
     {
       class: "msg-author",
+      // The username stays as the title so the handle you would @mention is
+      // one hover away even when a display name is standing in for it.
+      title: author.username,
       style: `color: ${roleColorVar(role)}`,
     },
-    msg.user.username,
+    resolveDisplayName(author),
   );
   const time = createElement(
     "span",
     { class: "msg-time", title: formatFullDate(msg.timestamp) },
     formatMessageTimestamp(msg.timestamp),
   );
-  appendChildren(header, author, time);
+  appendChildren(header, authorEl, time);
   el.appendChild(header);
 
   if (msg.deleted) {
@@ -193,7 +247,7 @@ export function renderMessage(
     setText(text, "[message deleted]");
     el.appendChild(text);
   } else {
-    el.appendChild(renderMessageContent(msg.content));
+    el.appendChild(renderMessageContent(msg.content, mentionInfo));
     if (msg.editedAt !== null) {
       el.appendChild(createElement("span", { class: "msg-edited" }, "(edited)"));
     }
@@ -293,6 +347,26 @@ export function renderMessage(
       actionsBar.appendChild(deleteBtn);
     }
 
+    const copyLinkBtn = createElement("button", {
+      "data-testid": `msg-copy-link-${msg.id}`,
+      "aria-label": "Copy Message Link",
+    });
+    copyLinkBtn.appendChild(createIcon("link", 16));
+    copyLinkBtn.title = "Copy Message Link";
+    copyLinkBtn.addEventListener(
+      "click",
+      () => {
+        // No silent success: a copy with no feedback is indistinguishable
+        // from a clipboard that refused.
+        void navigator.clipboard.writeText(formatMessageLink(msg.channelId, msg.id)).then(
+          () => showToast("Message link copied", "success"),
+          () => showToast("Couldn't copy the message link", "error"),
+        );
+      },
+      { signal },
+    );
+    actionsBar.appendChild(copyLinkBtn);
+
     if (developerModeEnabled) {
       const copyIdBtn = createElement("button", {
         "data-testid": `msg-copy-id-${msg.id}`,
diff --git a/Client/tauri-client/src/components/message-list/syntax-highlight.ts b/Client/tauri-client/src/components/message-list/syntax-highlight.ts
new file mode 100644
index 00000000..9ab3d7e9
--- /dev/null
+++ b/Client/tauri-client/src/components/message-list/syntax-highlight.ts
@@ -0,0 +1,250 @@
+/**
+ * A small, dependency-free syntax highlighter for fenced code blocks.
+ *
+ * The client ships no highlighting library (checked against package.json) and
+ * a message list is the wrong place to pull one in, so this is a deliberately
+ * shallow tokenizer: comments, strings, numbers and keywords — the four things
+ * that make code scannable — and nothing that pretends to be a parser.
+ *
+ * Pure and DOM-free; the renderer turns tokens into spans.
+ */
+
+export type TokenClass = "keyword" | "string" | "comment" | "number";
+
+export interface CodeToken {
+  readonly text: string;
+  /** null renders as plain text. */
+  readonly cls: TokenClass | null;
+}
+
+interface Pattern {
+  /** Sticky: matched only at the current index. */
+  readonly re: RegExp;
+  readonly cls: TokenClass;
+}
+
+interface LangSpec {
+  readonly patterns: readonly Pattern[];
+  readonly keywords: ReadonlySet<string>;
+  readonly ident?: RegExp;
+}
+
+const kw = (words: string): ReadonlySet<string> => new Set(words.split(" "));
+
+// -- Shared token patterns ----------------------------------------------------
+
+const SLASH_LINE_COMMENT: Pattern = { re: /\/\/[^\n]*/y, cls: "comment" };
+const C_BLOCK_COMMENT: Pattern = { re: /\/\*[\s\S]*?(?:\*\/|$)/y, cls: "comment" };
+const HASH_COMMENT: Pattern = { re: /#[^\n]*/y, cls: "comment" };
+const DQ_STRING: Pattern = { re: /"(?:\\.|[^"\\\n])*"?/y, cls: "string" };
+const SQ_STRING: Pattern = { re: /'(?:\\.|[^'\\\n])*'?/y, cls: "string" };
+const BACKTICK_STRING: Pattern = { re: /`(?:\\.|[^`\\])*`?/y, cls: "string" };
+const NUMBER: Pattern = {
+  re: /(?:0[xXbBoO][0-9a-fA-F_]+|\d[\d_]*(?:\.\d[\d_]*)?(?:[eE][+-]?\d+)?)[a-zA-Z_]*/y,
+  cls: "number",
+};
+
+const JS_LIKE: readonly Pattern[] = [
+  SLASH_LINE_COMMENT,
+  C_BLOCK_COMMENT,
+  DQ_STRING,
+  SQ_STRING,
+  BACKTICK_STRING,
+  NUMBER,
+];
+
+const LANGS: Readonly<Record<string, LangSpec>> = {
+  javascript: {
+    patterns: JS_LIKE,
+    keywords: kw(
+      "const let var function return if else for while do break continue class extends new this " +
+        "typeof instanceof in of null undefined true false async await import export from default " +
+        "try catch finally throw switch case yield static get set delete void super",
+    ),
+  },
+  typescript: {
+    patterns: JS_LIKE,
+    keywords: kw(
+      "const let var function return if else for while do break continue class extends new this " +
+        "typeof instanceof in of null undefined true false async await import export from default " +
+        "try catch finally throw switch case yield static get set delete void super " +
+        "interface type enum implements public private protected readonly as satisfies keyof " +
+        "namespace declare abstract infer never unknown any string number boolean",
+    ),
+  },
+  go: {
+    patterns: [SLASH_LINE_COMMENT, C_BLOCK_COMMENT, DQ_STRING, BACKTICK_STRING, SQ_STRING, NUMBER],
+    keywords: kw(
+      "func package import var const type struct interface map chan go defer select switch case " +
+        "if else for range return break continue fallthrough default goto nil true false iota " +
+        "make new len cap append copy delete panic recover string int int8 int16 int32 int64 uint " +
+        "uint8 uint16 uint32 uint64 float32 float64 bool byte rune error any",
+    ),
+  },
+  python: {
+    patterns: [
+      HASH_COMMENT,
+      { re: /(?:"""[\s\S]*?"""|'''[\s\S]*?''')/y, cls: "string" },
+      { re: /[rbfu]{0,2}"(?:\\.|[^"\\\n])*"?/y, cls: "string" },
+      { re: /[rbfu]{0,2}'(?:\\.|[^'\\\n])*'?/y, cls: "string" },
+      NUMBER,
+    ],
+    keywords: kw(
+      "def class return if elif else for while import from as pass break continue try except " +
+        "finally raise with lambda None True False and or not in is global nonlocal yield async " +
+        "await del assert self print len range str int float bool list dict set tuple",
+    ),
+  },
+  rust: {
+    patterns: [
+      SLASH_LINE_COMMENT,
+      C_BLOCK_COMMENT,
+      { re: /r#*"[\s\S]*?"#*/y, cls: "string" },
+      DQ_STRING,
+      { re: /'(?:\\.|[^'\\\n])'/y, cls: "string" },
+      NUMBER,
+    ],
+    keywords: kw(
+      "fn let mut const static struct enum impl trait use pub mod match if else for while loop " +
+        "return break continue as where type dyn ref move unsafe crate in true false self Self " +
+        "async await Some None Ok Err String Vec Option Result Box i8 i16 i32 i64 u8 u16 u32 u64 " +
+        "usize isize f32 f64 bool str char",
+    ),
+  },
+  json: {
+    patterns: [DQ_STRING, NUMBER],
+    keywords: kw("true false null"),
+  },
+  bash: {
+    patterns: [
+      HASH_COMMENT,
+      DQ_STRING,
+      SQ_STRING,
+      { re: /\$(?:\{[^}\n]*\}|[A-Za-z_][A-Za-z0-9_]*|[0-9?@#*])/y, cls: "keyword" },
+      NUMBER,
+    ],
+    keywords: kw(
+      "if then else elif fi for while until do done case esac function return in export local " +
+        "readonly source alias unset shift trap eval exec set echo cd exit sudo apt npm git make",
+    ),
+  },
+  css: {
+    patterns: [
+      C_BLOCK_COMMENT,
+      DQ_STRING,
+      SQ_STRING,
+      { re: /@[-a-zA-Z]+/y, cls: "keyword" },
+      { re: /!important/y, cls: "keyword" },
+      { re: /[-a-zA-Z]+(?= *:)/y, cls: "keyword" },
+      { re: /#[0-9a-fA-F]{3,8}\b/y, cls: "number" },
+      {
+        re: /-?\d[\d.]*(?:px|em|rem|ex|ch|%|vh|vw|vmin|vmax|s|ms|deg|turn|fr|pt)?/y,
+        cls: "number",
+      },
+    ],
+    keywords: kw(""),
+  },
+  html: {
+    patterns: [
+      { re: /<!--[\s\S]*?(?:-->|$)/y, cls: "comment" },
+      { re: /<!DOCTYPE[^>\n]*>?/iy, cls: "keyword" },
+      { re: /<\/?[A-Za-z][\w:-]*/y, cls: "keyword" },
+      DQ_STRING,
+      SQ_STRING,
+    ],
+    keywords: kw(""),
+  },
+};
+
+/** Aliases accepted after the opening fence. */
+const ALIASES: Readonly<Record<string, string>> = {
+  js: "javascript",
+  jsx: "javascript",
+  mjs: "javascript",
+  cjs: "javascript",
+  node: "javascript",
+  javascript: "javascript",
+  ts: "typescript",
+  tsx: "typescript",
+  typescript: "typescript",
+  go: "go",
+  golang: "go",
+  py: "python",
+  python: "python",
+  python3: "python",
+  rs: "rust",
+  rust: "rust",
+  json: "json",
+  jsonc: "json",
+  sh: "bash",
+  bash: "bash",
+  zsh: "bash",
+  shell: "bash",
+  console: "bash",
+  css: "css",
+  scss: "css",
+  html: "html",
+  xml: "html",
+  svg: "html",
+};
+
+const DEFAULT_IDENT = /[A-Za-z_$][A-Za-z0-9_$]*/y;
+
+/** Canonical language id for a fence tag, or null when unknown. */
+export function resolveLanguage(tag: string | null): string | null {
+  if (tag === null) return null;
+  return ALIASES[tag.toLowerCase()] ?? null;
+}
+
+/**
+ * Tokenize `code` for `lang` (a canonical id from {@link resolveLanguage}).
+ * Unknown languages return a single plain token, so the caller never has to
+ * branch on support.
+ */
+export function highlightCode(code: string, lang: string | null): CodeToken[] {
+  const spec = lang === null ? undefined : LANGS[lang];
+  if (spec === undefined) return code.length > 0 ? [{ text: code, cls: null }] : [];
+
+  const tokens: CodeToken[] = [];
+  let plain = "";
+  const flush = (): void => {
+    if (plain.length > 0) {
+      tokens.push({ text: plain, cls: null });
+      plain = "";
+    }
+  };
+  const ident = spec.ident ?? DEFAULT_IDENT;
+
+  let i = 0;
+  outer: while (i < code.length) {
+    for (const p of spec.patterns) {
+      p.re.lastIndex = i;
+      const m = p.re.exec(code);
+      if (m !== null && m[0].length > 0) {
+        flush();
+        tokens.push({ text: m[0], cls: p.cls });
+        i += m[0].length;
+        continue outer;
+      }
+    }
+
+    ident.lastIndex = i;
+    const word = ident.exec(code);
+    if (word !== null && word[0].length > 0) {
+      if (spec.keywords.has(word[0])) {
+        flush();
+        tokens.push({ text: word[0], cls: "keyword" });
+      } else {
+        plain += word[0];
+      }
+      i += word[0].length;
+      continue;
+    }
+
+    plain += code[i]!;
+    i++;
+  }
+
+  flush();
+  return tokens;
+}
diff --git a/Client/tauri-client/src/components/purge-prompt.ts b/Client/tauri-client/src/components/purge-prompt.ts
new file mode 100644
index 00000000..46acd33f
--- /dev/null
+++ b/Client/tauri-client/src/components/purge-prompt.ts
@@ -0,0 +1,136 @@
+/**
+ * Shared "Purge Messages" context-menu section — the count prompt used by both
+ * channel menus (the sidebar right-click menu and AdminActions'
+ * createChannelContextMenu). The two menus predate each other and use different
+ * class conventions, so the caller supplies the class names; the clamp, the
+ * confirm step and the in-flight state live here once.
+ */
+
+import { createElement, appendChildren, setText } from "@lib/dom";
+
+/** Server-side bounds on one purge request (docs/api.md). */
+export const PURGE_MIN_COUNT = 1;
+export const PURGE_MAX_COUNT = 100;
+export const PURGE_DEFAULT_COUNT = 50;
+
+export interface PurgeSectionOptions {
+  /** Class for ordinary rows in the host menu. */
+  readonly itemClass: string;
+  /** Class for the destructive confirm row. */
+  readonly dangerItemClass: string;
+  /** Class for the separator above the section, or "" to omit the separator. */
+  readonly separatorClass: string;
+  /** Runs the purge. Rejections are swallowed by the caller's toast handling. */
+  readonly onPurge: (count: number) => void | Promise<void>;
+  /** Aborts the section's listeners when the host menu is torn down. */
+  readonly signal: AbortSignal;
+  /** Called once the purge settles, so the host can close itself. */
+  readonly onDone?: () => void;
+}
+
+/** Clamp a raw input value into the server's accepted range. */
+export function clampPurgeCount(raw: string): number {
+  const parsed = Number.parseInt(raw, 10);
+  if (Number.isNaN(parsed)) return PURGE_DEFAULT_COUNT;
+  return Math.min(PURGE_MAX_COUNT, Math.max(PURGE_MIN_COUNT, parsed));
+}
+
+/**
+ * Append the trigger row plus its hidden count prompt to `menu`. The prompt is
+ * revealed in place (rather than opening a modal) so the menu's outside-click
+ * dismissal keeps working; typing in the input does not close it.
+ */
+export function appendPurgeSection(menu: HTMLElement, opts: PurgeSectionOptions): void {
+  const { signal } = opts;
+
+  if (opts.separatorClass !== "") {
+    menu.appendChild(createElement("div", { class: opts.separatorClass }));
+  }
+
+  const trigger = createElement(
+    "div",
+    { class: opts.itemClass, "data-testid": "ctx-purge-messages" },
+    "Purge Messages…",
+  );
+
+  const form = createElement("div", {
+    class: "context-menu__reason",
+    style: "display:none;padding:6px 8px",
+    "data-testid": "purge-form",
+  });
+  const countInput = createElement("input", {
+    class: "form-input",
+    type: "number",
+    min: String(PURGE_MIN_COUNT),
+    max: String(PURGE_MAX_COUNT),
+    value: String(PURGE_DEFAULT_COUNT),
+    "data-testid": "purge-count-input",
+    style: "width:100%;font-size:12px",
+  });
+  const hint = createElement(
+    "div",
+    { style: "font-size:11px;color:var(--text-muted);margin-top:4px" },
+    `Deletes the newest ${PURGE_MIN_COUNT}–${PURGE_MAX_COUNT} messages.`,
+  );
+  const confirm = createElement(
+    "div",
+    { class: opts.dangerItemClass, "data-testid": "purge-confirm" },
+    "Confirm Purge",
+  );
+  appendChildren(form, countInput, hint, confirm);
+
+  trigger.addEventListener(
+    "click",
+    (e) => {
+      e.stopPropagation();
+      trigger.style.display = "none";
+      form.style.display = "";
+      countInput.focus();
+    },
+    { signal },
+  );
+
+  // Typing a count must not trip the host menu's outside-click dismissal.
+  for (const event of ["click", "mousedown"] as const) {
+    countInput.addEventListener(event, (e: Event) => e.stopPropagation(), { signal });
+  }
+
+  let running = false;
+  function submit(): void {
+    if (running) return;
+    running = true;
+    setText(confirm, "Purging…");
+    const done = (): void => {
+      running = false;
+      setText(confirm, "Confirm Purge");
+      opts.onDone?.();
+    };
+    const result = opts.onPurge(clampPurgeCount(countInput.value));
+    if (result instanceof Promise) {
+      void result.then(done, done);
+    } else {
+      done();
+    }
+  }
+
+  confirm.addEventListener(
+    "click",
+    (e) => {
+      e.stopPropagation();
+      submit();
+    },
+    { signal },
+  );
+  countInput.addEventListener(
+    "keydown",
+    (e: KeyboardEvent) => {
+      if (e.key === "Enter") {
+        e.preventDefault();
+        submit();
+      }
+    },
+    { signal },
+  );
+
+  appendChildren(menu, trigger, form);
+}
diff --git a/Client/tauri-client/src/components/settings/AccountTab.ts b/Client/tauri-client/src/components/settings/AccountTab.ts
index 0a7957b1..48631b78 100644
--- a/Client/tauri-client/src/components/settings/AccountTab.ts
+++ b/Client/tauri-client/src/components/settings/AccountTab.ts
@@ -8,8 +8,19 @@ import { createElement, appendChildren, setText } from "@lib/dom";
 import type { UserStatus } from "@lib/types";
 import { authStore } from "@stores/auth.store";
 import { loadUserStatus, saveUserStatus } from "@lib/userStatus";
+import { avatarInitial, isRenderableAvatar, resolveDisplayName } from "@lib/avatar";
+import { fetchImageAsDataUrl, resolveServerUrl } from "@components/message-list/attachments";
 import type { SettingsOverlayOptions } from "../SettingsOverlay";
 
+/** Mirrors the server's caps so the form can bound itself instead of learning
+ *  about the limits from a rejected request. */
+const MAX_DISPLAY_NAME_LEN = 32;
+const MAX_ABOUT_LEN = 300;
+/** Mirrors maxAvatarFileBytes / maxAvatarDimension on the server. */
+const MAX_AVATAR_BYTES = 1024 * 1024;
+const MAX_AVATAR_DIMENSION = 1024;
+const ACCEPTED_AVATAR_TYPES = "image/png,image/jpeg,image/webp";
+
 // ---------------------------------------------------------------------------
 // Types
 // ---------------------------------------------------------------------------
@@ -20,13 +31,15 @@ interface ProfileCardResult {
   readonly usernameValue: HTMLDivElement;
   readonly editUserProfileBtn: HTMLButtonElement;
   readonly editUsernameBtn: HTMLButtonElement;
+  /** The big avatar; the uploader swaps its contents on success. */
+  readonly avatarLarge: HTMLDivElement;
 }
 
 // ---------------------------------------------------------------------------
 // Profile card builder
 // ---------------------------------------------------------------------------
 
-function buildProfileCard(username: string): ProfileCardResult {
+function buildProfileCard(displayName: string, username: string): ProfileCardResult {
   const card = createElement("div", { class: "account-card" });
   const banner = createElement("div", { class: "account-banner" });
 
@@ -34,15 +47,15 @@ function buildProfileCard(username: string): ProfileCardResult {
   const avatarWrap = createElement("div", { class: "account-avatar-wrap" });
   const avatarLarge = createElement(
     "div",
-    { class: "account-avatar-large" },
-    username.charAt(0).toUpperCase(),
+    { class: "account-avatar-large", "data-testid": "account-avatar" },
+    avatarInitial({ username, displayName }),
   );
   const statusDot = createElement("div", { class: "account-status-dot" });
   appendChildren(avatarWrap, avatarLarge, statusDot);
 
   // Header row
   const accountHeader = createElement("div", { class: "account-header" });
-  const headerName = createElement("div", { class: "account-header-name" }, username);
+  const headerName = createElement("div", { class: "account-header-name" }, displayName);
   const editUserProfileBtn = createElement("button", { class: "ac-btn" }, "Edit User Profile");
   appendChildren(accountHeader, headerName, editUserProfileBtn);
 
@@ -59,7 +72,247 @@ function buildProfileCard(username: string): ProfileCardResult {
 
   appendChildren(card, banner, avatarWrap, accountHeader, fieldsContainer);
 
-  return { card, headerName, usernameValue, editUserProfileBtn, editUsernameBtn };
+  return { card, headerName, usernameValue, editUserProfileBtn, editUsernameBtn, avatarLarge };
+}
+
+// ---------------------------------------------------------------------------
+// Avatar preview + uploader
+// ---------------------------------------------------------------------------
+
+/**
+ * Draw `url` into the big avatar, replacing the letter. Falls back to the
+ * letter when there is nothing to draw or the fetch fails, because the file
+ * route is authenticated and `<img src>` cannot carry the session token.
+ */
+function paintAvatar(
+  target: HTMLDivElement,
+  url: string | null,
+  alt: string,
+  initial: string,
+): void {
+  const showInitial = (): void => {
+    target.replaceChildren(document.createTextNode(initial));
+    target.style.background = "";
+  };
+  if (url === null) {
+    showInitial();
+    return;
+  }
+  void fetchImageAsDataUrl(url).then((dataUrl) => {
+    if (dataUrl === null || !target.isConnected) return;
+    const img = createElement("img", { class: "avatar-img", src: dataUrl, alt });
+    target.replaceChildren(img);
+    target.style.background = "transparent";
+  });
+}
+
+/**
+ * Read a File into an object URL and measure it, so an image the server would
+ * refuse is caught before a megabyte goes over the wire — and so the preview
+ * shows what was actually picked rather than a spinner that ends in a 400.
+ */
+function measureImage(file: File): Promise<{ width: number; height: number } | null> {
+  return new Promise((resolve) => {
+    const url = URL.createObjectURL(file);
+    const img = new Image();
+    img.addEventListener(
+      "load",
+      () => {
+        URL.revokeObjectURL(url);
+        resolve({ width: img.naturalWidth, height: img.naturalHeight });
+      },
+      { once: true },
+    );
+    img.addEventListener(
+      "error",
+      () => {
+        URL.revokeObjectURL(url);
+        resolve(null);
+      },
+      { once: true },
+    );
+    img.src = url;
+  });
+}
+
+/** Local validation mirroring the server's rules. Returns an error message. */
+export function validateAvatarFile(
+  file: { size: number; type: string },
+  dimensions: { width: number; height: number } | null,
+): string | null {
+  if (!ACCEPTED_AVATAR_TYPES.split(",").includes(file.type)) {
+    return "Avatar must be a PNG, JPEG or WebP image.";
+  }
+  if (file.size > MAX_AVATAR_BYTES) {
+    return `Avatar must be at most ${MAX_AVATAR_BYTES / 1024} KB.`;
+  }
+  if (dimensions === null) {
+    return "That file could not be read as an image.";
+  }
+  if (dimensions.width > MAX_AVATAR_DIMENSION || dimensions.height > MAX_AVATAR_DIMENSION) {
+    return `Avatar must be at most ${MAX_AVATAR_DIMENSION}x${MAX_AVATAR_DIMENSION} pixels.`;
+  }
+  return null;
+}
+
+function buildAvatarUploader(
+  options: SettingsOverlayOptions,
+  avatarLarge: HTMLDivElement,
+  signal: AbortSignal,
+): HTMLDivElement {
+  const wrapper = createElement("div", { class: "account-avatar-upload" });
+  const input = createElement("input", {
+    type: "file",
+    accept: ACCEPTED_AVATAR_TYPES,
+    style: "display:none",
+    "data-testid": "avatar-file-input",
+  });
+  const uploadBtn = createElement(
+    "button",
+    { class: "ac-btn", "data-testid": "avatar-upload-btn" },
+    "Change Avatar",
+  );
+  const errorEl = createElement("div", {
+    style: "color:var(--red);font-size:13px;margin-top:6px",
+    "data-testid": "avatar-error",
+  });
+
+  uploadBtn.addEventListener("click", () => input.click(), { signal });
+
+  input.addEventListener(
+    "change",
+    () => {
+      const file = input.files?.[0];
+      if (file === undefined) return;
+      setText(errorEl, "");
+      void (async () => {
+        const dimensions = await measureImage(file);
+        const problem = validateAvatarFile(file, dimensions);
+        if (problem !== null) {
+          setText(errorEl, problem);
+          input.value = "";
+          return;
+        }
+        uploadBtn.disabled = true;
+        setText(uploadBtn, "Uploading...");
+        try {
+          const url = await options.onUploadAvatar(file);
+          const user = authStore.getState().user;
+          paintAvatar(
+            avatarLarge,
+            resolveServerUrl(url),
+            user?.username ?? "avatar",
+            avatarInitial({
+              username: user?.username ?? "?",
+              displayName: user?.display_name ?? null,
+            }),
+          );
+        } catch (err) {
+          setText(errorEl, err instanceof Error ? err.message : "Failed to upload avatar.");
+        } finally {
+          input.value = "";
+          uploadBtn.disabled = false;
+          setText(uploadBtn, "Change Avatar");
+        }
+      })();
+    },
+    { signal },
+  );
+
+  appendChildren(wrapper, input, uploadBtn, errorEl);
+  return wrapper;
+}
+
+// ---------------------------------------------------------------------------
+// Display name + about
+// ---------------------------------------------------------------------------
+
+function buildProfileFields(
+  options: SettingsOverlayOptions,
+  onSaved: (displayName: string) => void,
+  signal: AbortSignal,
+): HTMLDivElement {
+  const wrapper = createElement("div", {});
+  const separator = createElement("div", { class: "settings-separator" });
+  const header = createElement("div", { class: "settings-section-title" }, "Profile");
+
+  const user = authStore.getState().user;
+
+  const nameLabel = createElement("div", { class: "account-field-label" }, "Display Name");
+  const nameInput = createElement("input", {
+    class: "form-input",
+    type: "text",
+    placeholder: "Shown instead of your username",
+    maxlength: String(MAX_DISPLAY_NAME_LEN),
+    style: "margin-bottom:12px",
+    "data-testid": "display-name-input",
+  });
+  nameInput.value = user?.display_name ?? "";
+
+  const aboutLabel = createElement("div", { class: "account-field-label" }, "About Me");
+  const aboutInput = createElement("textarea", {
+    class: "form-input",
+    rows: "3",
+    placeholder: "A little about you",
+    maxlength: String(MAX_ABOUT_LEN),
+    style: "margin-bottom:8px;resize:vertical",
+    "data-testid": "about-input",
+  });
+  aboutInput.value = user?.about ?? "";
+
+  const statusEl = createElement("div", {
+    style: "color:var(--red);font-size:13px;margin-bottom:8px",
+    "data-testid": "profile-error",
+  });
+  const saveBtn = createElement(
+    "button",
+    { class: "ac-btn", "data-testid": "profile-save-btn" },
+    "Save Profile",
+  );
+
+  saveBtn.addEventListener(
+    "click",
+    () => {
+      const displayName = nameInput.value.trim();
+      const about = aboutInput.value.trim();
+      // Both are sent unconditionally, empty string included: "" is how the
+      // API says "clear it", and omitting a field means "leave it alone".
+      statusEl.style.color = "var(--red)";
+      setText(statusEl, "");
+      saveBtn.disabled = true;
+      setText(saveBtn, "Saving...");
+      void options
+        .onUpdateProfile({ display_name: displayName, about })
+        .then(() => {
+          statusEl.style.color = "var(--green)";
+          setText(statusEl, "Profile saved.");
+          onSaved(
+            displayName.length > 0 ? displayName : (authStore.getState().user?.username ?? ""),
+          );
+        })
+        .catch((err: unknown) => {
+          setText(statusEl, err instanceof Error ? err.message : "Failed to save profile.");
+        })
+        .finally(() => {
+          saveBtn.disabled = false;
+          setText(saveBtn, "Save Profile");
+        });
+    },
+    { signal },
+  );
+
+  appendChildren(
+    wrapper,
+    separator,
+    header,
+    nameLabel,
+    nameInput,
+    aboutLabel,
+    aboutInput,
+    statusEl,
+    saveBtn,
+  );
+  return wrapper;
 }
 
 // ---------------------------------------------------------------------------
@@ -580,8 +833,10 @@ const STATUS_OPTIONS: readonly StatusOption[] = [
     color: "#ed4245",
   },
   {
-    value: "offline",
-    label: "Offline",
+    // Its own status now, not "offline" relabeled: the server stores it as
+    // chosen, shows everyone else offline, and honours it across reconnects.
+    value: "invisible",
+    label: "Invisible",
     description: "You will appear offline but still have full access",
     color: "#747f8d",
   },
@@ -804,12 +1059,38 @@ export function buildAccountTab(
   const section = createElement("div", { class: "settings-pane active" });
   const user = authStore.getState().user;
   const username = user?.username ?? "Unknown";
+  const displayName = resolveDisplayName({
+    username,
+    displayName: user?.display_name ?? null,
+  });
 
   // Profile card
-  const { card, headerName, usernameValue, editUserProfileBtn, editUsernameBtn } =
-    buildProfileCard(username);
+  const { card, headerName, usernameValue, editUserProfileBtn, editUsernameBtn, avatarLarge } =
+    buildProfileCard(displayName, username);
   section.appendChild(card);
 
+  // Existing avatar, if any — the letter is only a fallback now.
+  if (isRenderableAvatar(user?.avatar)) {
+    paintAvatar(
+      avatarLarge,
+      resolveServerUrl(user.avatar),
+      username,
+      avatarInitial({ username, displayName: user?.display_name ?? null }),
+    );
+  }
+  section.appendChild(buildAvatarUploader(options, avatarLarge, signal));
+
+  // Display name + about
+  section.appendChild(
+    buildProfileFields(
+      options,
+      (name) => {
+        setText(headerName, name);
+      },
+      signal,
+    ),
+  );
+
   // Status selector
   section.appendChild(buildStatusSelector(options, signal));
 
@@ -822,6 +1103,7 @@ export function buildAccountTab(
     class: "form-input",
     type: "text",
     placeholder: "New username",
+    "data-testid": "username-edit-input",
   });
   const saveBtn = createElement("button", { class: "ac-btn" }, "Save");
   const cancelBtn = createElement(
@@ -864,7 +1146,7 @@ export function buildAccountTab(
       }
       setText(usernameError, "");
       void options
-        .onUpdateProfile(newName)
+        .onUpdateProfile({ username: newName })
         .then(() => {
           setText(headerName, newName);
           setText(usernameValue, newName);
diff --git a/Client/tauri-client/src/components/settings/KeybindsTab.ts b/Client/tauri-client/src/components/settings/KeybindsTab.ts
index 8184000c..63aec02f 100644
--- a/Client/tauri-client/src/components/settings/KeybindsTab.ts
+++ b/Client/tauri-client/src/components/settings/KeybindsTab.ts
@@ -176,6 +176,9 @@ export function buildKeybindsTab(signal: AbortSignal): HTMLDivElement {
   const msgBinds: [string, string][] = [
     ["Upload File", "Ctrl + U"],
     ["Edit Last Message", "Arrow Up"],
+    ["Bold", "Ctrl + B"],
+    ["Italic", "Ctrl + I"],
+    ["Underline", "Ctrl + U"],
   ];
   for (const [label, shortcut] of msgBinds) {
     const row = createElement("div", { class: "keybind-row" });
@@ -187,5 +190,15 @@ export function buildKeybindsTab(signal: AbortSignal): HTMLDivElement {
     section.appendChild(row);
   }
 
+  section.appendChild(
+    createElement(
+      "div",
+      {
+        style: "font-size: 11px; color: var(--text-micro); margin: 4px 0 0 0; line-height: 1.4;",
+      },
+      "Formatting shortcuts wrap the selected text while the message box has focus; Ctrl + U uploads a file everywhere else.",
+    ),
+  );
+
   return section;
 }
diff --git a/Client/tauri-client/src/components/settings/NotificationsTab.ts b/Client/tauri-client/src/components/settings/NotificationsTab.ts
index eb04983c..b4cfe846 100644
--- a/Client/tauri-client/src/components/settings/NotificationsTab.ts
+++ b/Client/tauri-client/src/components/settings/NotificationsTab.ts
@@ -2,8 +2,11 @@
  * Notifications settings tab — desktop notifications, taskbar flash, sounds.
  */
 
-import { createElement, appendChildren } from "@lib/dom";
+import { createElement, appendChildren, clearChildren, setText } from "@lib/dom";
 import { loadPref, savePref, createToggle } from "./helpers";
+import { listMutedChannels, unmuteChannel } from "@lib/channel-mutes";
+import { channelsStore } from "@stores/channels.store";
+import { dmStore, dmDisplayName } from "@stores/dm.store";
 
 export function buildNotificationsTab(signal: AbortSignal): HTMLDivElement {
   const section = createElement("div", { class: "settings-pane active" });
@@ -24,7 +27,7 @@ export function buildNotificationsTab(signal: AbortSignal): HTMLDivElement {
     {
       key: "suppressEveryone",
       label: "Suppress @everyone",
-      desc: "Mute @everyone and @here mentions",
+      desc: "Mute @everyone and @here — messages that name you still notify",
       fallback: false,
     },
     {
@@ -54,5 +57,82 @@ export function buildNotificationsTab(signal: AbortSignal): HTMLDivElement {
     section.appendChild(row);
   }
 
+  section.appendChild(buildMutedChannelsSection(signal));
   return section;
 }
+
+/** Best name available for a muted id: a channel, a DM, or neither. */
+function mutedChannelName(channelId: number): string {
+  const ch = channelsStore.getState().channels.get(channelId);
+  if (ch !== undefined && ch.type !== "dm") return `#${ch.name}`;
+  const dm = dmStore.getState().channels.find((c) => c.channelId === channelId);
+  if (dm !== undefined) return `@${dmDisplayName(dm)}`;
+  // A mute can outlive the channel it names (deleted channel, left group). It
+  // is shown rather than hidden so the user can clear it.
+  return `Channel ${channelId}`;
+}
+
+/**
+ * The muted-channel list.
+ *
+ * Mutes are set from a right-click on a row, which makes them easy to set and
+ * easy to forget — a channel muted six weeks ago is silent for a reason nobody
+ * remembers. This is the one place that answers "what have I silenced", and
+ * the only place to undo it without finding the row again.
+ */
+function buildMutedChannelsSection(signal: AbortSignal): HTMLDivElement {
+  const wrapper = createElement("div", { class: "setting-row", style: "display:block;" });
+  const label = createElement("div", { class: "setting-label" }, "Muted Channels");
+  const desc = createElement(
+    "div",
+    { class: "setting-desc" },
+    "Muted channels never notify you, but messages that mention you still do.",
+  );
+  const list = createElement("div", {
+    class: "settings-muted-list",
+    "data-testid": "muted-channel-list",
+  });
+  appendChildren(wrapper, label, desc, list);
+
+  function render(): void {
+    clearChildren(list);
+    const muted = listMutedChannels();
+    if (muted.length === 0) {
+      list.appendChild(
+        createElement(
+          "div",
+          { class: "setting-desc", "data-testid": "muted-empty" },
+          "Nothing is muted.",
+        ),
+      );
+      return;
+    }
+    for (const channelId of muted) {
+      const row = createElement("div", { class: "settings-muted-row" });
+      const name = createElement("span", { class: "settings-muted-name" });
+      setText(name, mutedChannelName(channelId));
+      const btn = createElement(
+        "button",
+        {
+          class: "btn btn-secondary",
+          type: "button",
+          "data-testid": `unmute-${channelId}`,
+        },
+        "Unmute",
+      );
+      btn.addEventListener(
+        "click",
+        () => {
+          unmuteChannel(channelId);
+          render();
+        },
+        { signal },
+      );
+      appendChildren(row, name, btn);
+      list.appendChild(row);
+    }
+  }
+
+  render();
+  return wrapper;
+}
diff --git a/Client/tauri-client/src/lib/admin-panel.ts b/Client/tauri-client/src/lib/admin-panel.ts
new file mode 100644
index 00000000..51d757a8
--- /dev/null
+++ b/Client/tauri-client/src/lib/admin-panel.ts
@@ -0,0 +1,33 @@
+/**
+ * Opening the server's admin panel in the user's browser.
+ *
+ * The audit log stays admin-panel-only: it is a long, filterable, paginated
+ * table over a REST endpoint the desktop client has no other use for, and
+ * rebuilding it here would mean maintaining two of them. What the desktop
+ * client owes its moderators is a way to *reach* it — hence this, rather than
+ * a port of the view.
+ *
+ * The panel is opened in the real browser at `https://{host}/admin`, NOT
+ * through the local TOFU proxy the REST client uses: that proxy exists so the
+ * webview can talk to a self-signed server, and its loopback origin means
+ * nothing to an external browser. A self-signed deployment therefore shows the
+ * browser's certificate warning, which is the honest outcome — the operator is
+ * the one who chose the certificate.
+ */
+
+/** The admin-panel URL for `host`, deep-linked to `section` when given. */
+export function adminPanelUrl(host: string, section?: string): string {
+  const base = `https://${host}/admin`;
+  return section === undefined || section === "" ? base : `${base}#${section}`;
+}
+
+/**
+ * Open the admin panel in the user's default browser.
+ *
+ * The opener plugin is imported lazily so this module can be loaded (and the
+ * URL builder tested) in an environment with no Tauri runtime.
+ */
+export async function openAdminPanel(host: string, section?: string): Promise<void> {
+  const { openUrl } = await import("@tauri-apps/plugin-opener");
+  await openUrl(adminPanelUrl(host, section));
+}
diff --git a/Client/tauri-client/src/lib/api.ts b/Client/tauri-client/src/lib/api.ts
index 74547982..73056b70 100644
--- a/Client/tauri-client/src/lib/api.ts
+++ b/Client/tauri-client/src/lib/api.ts
@@ -9,6 +9,9 @@ import type {
   RegisterResponse,
   HealthResponse,
   MessagesResponse,
+  MessagesAroundResponse,
+  ReactionUsersResponse,
+  PurgeResponse,
   SearchResponse,
   ApiError,
   ChannelType,
@@ -22,6 +25,7 @@ import type {
   MemberResponse,
   DmChannelsResponse,
   CreateDmResponse,
+  GroupDmResponse,
   BlockedUsersResponse,
   GifSearchResponse,
 } from "./types";
@@ -276,12 +280,52 @@ export function createApiClient(initialConfig: ApiClientConfig, onUnauthorized?:
     },
 
     updateProfile(
-      data: { username?: string; avatar?: string; identity_public_key?: string },
+      data: {
+        username?: string;
+        avatar?: string;
+        identity_public_key?: string;
+        /** Omit to leave unchanged; "" clears the field. */
+        display_name?: string;
+        about?: string;
+      },
       signal?: AbortSignal,
     ): Promise<MemberResponse> {
       return request<MemberResponse>("PATCH", "/users/me", data, signal);
     },
 
+    /**
+     * Upload an avatar image (PNG/JPEG/WebP, max 1 MB, max 1024x1024).
+     *
+     * Multipart rather than JSON for the same reason attachments are, and it
+     * shares uploadFile's shape: no Content-Type header (the browser has to
+     * set the multipart boundary) and the bearer token attached by hand.
+     * On success the server has already pointed the user's avatar at the
+     * served file and broadcast a user_update.
+     */
+    async uploadAvatar(file: File, signal?: AbortSignal): Promise<UploadResponse> {
+      const formData = new FormData();
+      formData.append("file", file);
+
+      const url = `${await baseUrl()}/users/me/avatar`;
+      const h: Record<string, string> = {};
+      if (config.token) {
+        h["Authorization"] = `Bearer ${config.token}`;
+      }
+
+      const res = await fetch(url, { method: "POST", headers: h, body: formData, signal });
+
+      if (res.status === 401) {
+        onUnauthorized?.();
+        const err = await parseError(res);
+        throw new ApiClientError(401, err.error, err.message);
+      }
+      if (!res.ok) {
+        const err = await parseError(res);
+        throw new ApiClientError(res.status, err.error, err.message);
+      }
+      return res.json() as Promise<UploadResponse>;
+    },
+
     changePassword(
       currentPassword: string,
       newPassword: string,
@@ -337,6 +381,67 @@ export function createApiClient(initialConfig: ApiClientConfig, onUnauthorized?:
       );
     },
 
+    /**
+     * The window of history centred on `messageId`, for jumping to a message
+     * outside the loaded page. Messages come back oldest-first (already in
+     * render order) — see MessagesAroundResponse. 404 when the message does
+     * not live in this channel or has been deleted.
+     */
+    getMessagesAround(
+      channelId: number,
+      messageId: number,
+      options?: { limit?: number },
+      signal?: AbortSignal,
+    ): Promise<MessagesAroundResponse> {
+      const params = new URLSearchParams();
+      if (options?.limit !== undefined) params.set("limit", String(options.limit));
+      const qs = params.toString();
+      return request<MessagesAroundResponse>(
+        "GET",
+        `/channels/${channelId}/messages/around/${messageId}${qs ? `?${qs}` : ""}`,
+        undefined,
+        signal,
+      );
+    },
+
+    /**
+     * Bulk-delete the newest `limit` messages in a channel (1-100). Requires
+     * MANAGE_MESSAGES; the server broadcasts one chat_bulk_deleted event, so
+     * the local store is updated by the dispatcher rather than here.
+     */
+    purgeMessages(
+      channelId: number,
+      limit: number,
+      options?: { before?: number },
+      signal?: AbortSignal,
+    ): Promise<PurgeResponse> {
+      return request<PurgeResponse>(
+        "POST",
+        `/channels/${channelId}/messages/purge`,
+        { limit, ...(options?.before !== undefined ? { before: options.before } : {}) },
+        signal,
+      );
+    },
+
+    /**
+     * The users who reacted to a message with one emoji, for the who-reacted
+     * tooltip. Oldest reaction first, capped at 100 server-side. The emoji is a
+     * path segment, so it must be percent-encoded.
+     */
+    getReactionUsers(
+      channelId: number,
+      messageId: number,
+      emoji: string,
+      signal?: AbortSignal,
+    ): Promise<ReactionUsersResponse> {
+      return request<ReactionUsersResponse>(
+        "GET",
+        `/channels/${channelId}/messages/${messageId}/reactions/${encodeURIComponent(emoji)}/users`,
+        undefined,
+        signal,
+      );
+    },
+
     getPins(channelId: number, signal?: AbortSignal): Promise<MessagesResponse> {
       return request<MessagesResponse>("GET", `/channels/${channelId}/pins`, undefined, signal);
     },
@@ -439,12 +544,47 @@ export function createApiClient(initialConfig: ApiClientConfig, onUnauthorized?:
       return request<void>("DELETE", `/invites/${code}`, undefined, signal);
     },
 
-    // ── Emoji ─────────────────────────────────────────────
+    // ── Custom emoji ──────────────────────────────────────
+    //
+    // Reading is open to any member; upload and delete require MANAGE_SERVER
+    // and are refused server-side with 403 regardless of what the UI offers.
 
-    getEmoji(signal?: AbortSignal): Promise<EmojiResponse[]> {
+    /** The server's whole custom-emoji set. */
+    listEmoji(signal?: AbortSignal): Promise<EmojiResponse[]> {
       return request<EmojiResponse[]>("GET", "/emoji", undefined, signal);
     },
 
+    /**
+     * Upload one custom emoji. The image is validated server-side (PNG/JPEG/
+     * GIF/WebP, at most 512 KB and 128x128), so the only thing this promises
+     * is to send it; a rejection arrives as an ApiClientError with the reason.
+     */
+    async uploadEmoji(shortcode: string, file: File, signal?: AbortSignal): Promise<EmojiResponse> {
+      const formData = new FormData();
+      formData.append("shortcode", shortcode);
+      formData.append("file", file);
+
+      const url = `${await baseUrl()}/emoji`;
+      const h: Record<string, string> = {};
+      if (config.token) {
+        h["Authorization"] = `Bearer ${config.token}`;
+      }
+      // Don't set Content-Type — browser sets multipart boundary
+
+      const res = await fetch(url, { method: "POST", headers: h, body: formData, signal });
+
+      if (res.status === 401) {
+        onUnauthorized?.();
+        const err = await parseError(res);
+        throw new ApiClientError(401, err.error, err.message);
+      }
+      if (!res.ok) {
+        const err = await parseError(res);
+        throw new ApiClientError(res.status, err.error, err.message);
+      }
+      return res.json() as Promise<EmojiResponse>;
+    },
+
     deleteEmoji(emojiId: number, signal?: AbortSignal): Promise<void> {
       return request<void>("DELETE", `/emoji/${emojiId}`, undefined, signal);
     },
@@ -471,7 +611,30 @@ export function createApiClient(initialConfig: ApiClientConfig, onUnauthorized?:
       return request<CreateDmResponse>("POST", "/dms", { recipient_id: recipientId }, signal);
     },
 
-    /** Close a DM (hide from sidebar). */
+    /** Create a group DM with 2..8 other users (3..10 total). */
+    createGroupDm(
+      recipientIds: readonly number[],
+      name?: string,
+      signal?: AbortSignal,
+    ): Promise<GroupDmResponse> {
+      return request<GroupDmResponse>(
+        "POST",
+        "/dms/group",
+        { recipient_ids: [...recipientIds], name: name ?? "" },
+        signal,
+      );
+    },
+
+    /** Set or clear a group DM's name. Any participant may; 1:1 DMs refuse. */
+    renameGroupDm(channelId: number, name: string, signal?: AbortSignal): Promise<GroupDmResponse> {
+      return request<GroupDmResponse>("PATCH", `/dms/${channelId}`, { name }, signal);
+    },
+
+    /**
+     * Remove a DM from the sidebar. For a 1:1 this only hides it — the next
+     * message from either side brings it back. For a group it is a *leave*:
+     * the caller comes out of the participant list and cannot return unaided.
+     */
     closeDm(channelId: number, signal?: AbortSignal): Promise<void> {
       return request<void>("DELETE", `/dms/${channelId}`, undefined, signal);
     },
@@ -481,6 +644,16 @@ export function createApiClient(initialConfig: ApiClientConfig, onUnauthorized?:
       return request<BlockedUsersResponse>("GET", "/blocks", undefined, signal);
     },
 
+    /** Block a user (prevents DMs in both directions). */
+    blockUser(userId: number, signal?: AbortSignal): Promise<void> {
+      return request<void>("PUT", `/blocks/${userId}`, undefined, signal);
+    },
+
+    /** Unblock a previously blocked user. */
+    unblockUser(userId: number, signal?: AbortSignal): Promise<void> {
+      return request<void>("DELETE", `/blocks/${userId}`, undefined, signal);
+    },
+
     // ── Voice ─────────────────────────────────────────────
 
     getVoiceCredentials(signal?: AbortSignal): Promise<VoiceCredentialsResponse> {
@@ -527,9 +700,24 @@ export function createApiClient(initialConfig: ApiClientConfig, onUnauthorized?:
       data: {
         name?: string;
         topic?: string;
+        // Moving a channel between categories is a rename of free text; an
+        // omitted field keeps the channel's current category server-side.
+        category?: string;
         slow_mode?: number;
         position?: number;
         archived?: boolean;
+        /**
+         * Age-restriction label. Stored, broadcast and audited by the server,
+         * which applies no content behaviour of its own to a flagged channel.
+         */
+        nsfw?: boolean;
+        /**
+         * Voice capacity limits (0 = unlimited), enforced by the server on
+         * join. Omit them on a text channel rather than sending 0 — every
+         * field the body leaves out keeps its stored value.
+         */
+        voice_max_users?: number;
+        voice_max_video?: number;
       },
       signal?: AbortSignal,
     ): Promise<ChannelResponse> {
@@ -546,13 +734,22 @@ export function createApiClient(initialConfig: ApiClientConfig, onUnauthorized?:
       return adminRequest<void>("DELETE", `/users/${userId}/sessions`, undefined, signal);
     },
 
-    adminBanMember(userId: number, reason?: string, signal?: AbortSignal): Promise<void> {
+    adminBanMember(
+      userId: number,
+      reason?: string,
+      durationHours?: number,
+      signal?: AbortSignal,
+    ): Promise<void> {
       return adminRequest<void>(
         "PATCH",
         `/users/${userId}`,
         {
           banned: true,
           ban_reason: reason ?? "",
+          // Omitted/0 = permanent; otherwise the ban expires after this many hours.
+          ...(durationHours !== undefined && durationHours > 0
+            ? { ban_duration_hours: durationHours }
+            : {}),
         },
         signal,
       );
diff --git a/Client/tauri-client/src/lib/audioElements.ts b/Client/tauri-client/src/lib/audioElements.ts
index b78580b3..cf3fad2e 100644
--- a/Client/tauri-client/src/lib/audioElements.ts
+++ b/Client/tauri-client/src/lib/audioElements.ts
@@ -72,10 +72,16 @@ export class AudioElements {
     publication: RemoteTrackPublication,
     participant: RemoteParticipant,
   ): void {
-    // Guard: do not attach any remote audio while locally deafened.
+    // Guard: do not attach remote voice audio while locally deafened.
     // applyRemoteAudioSubscriptionState() only covers participants present at
     // the time of deafen — this guard catches participants who join afterward.
-    if (voiceStore.getState().localDeafened) {
+    // Screen-share/stream audio is exempt: muting or deafening yourself gates
+    // voices, not the content someone is streaming — that stays under its own
+    // per-tile mute/volume controls.
+    if (
+      voiceStore.getState().localDeafened &&
+      publication.source !== Track.Source.ScreenShareAudio
+    ) {
       publication.setSubscribed(false);
       return;
     }
@@ -157,6 +163,10 @@ export class AudioElements {
     if (this.room === null) return;
     for (const participant of this.room.remoteParticipants.values()) {
       for (const publication of participant.audioTrackPublications.values()) {
+        // Deafen gates voices only. Screen-share/stream audio keeps playing
+        // when the user mutes/deafens themselves — it has its own per-tile
+        // mute and volume controls.
+        if (publication.source === Track.Source.ScreenShareAudio) continue;
         publication.setSubscribed(!deafened);
       }
     }
diff --git a/Client/tauri-client/src/lib/autoIdle.ts b/Client/tauri-client/src/lib/autoIdle.ts
new file mode 100644
index 00000000..fc5170d0
--- /dev/null
+++ b/Client/tauri-client/src/lib/autoIdle.ts
@@ -0,0 +1,147 @@
+/**
+ * Auto-idle: flip to Idle after ten quiet minutes, back to Online on the first
+ * sign of life.
+ *
+ * Entirely client-side. The server has no idea whether anyone is at the
+ * keyboard, and giving it one would mean a heartbeat carrying activity data it
+ * has no other use for; the client already knows, and a presence_update is the
+ * message that already says so.
+ *
+ * The rule that makes this safe to leave running is narrow: it only ever moves
+ * a status the *timer itself* is responsible for.
+ *
+ *  - Manually chosen Idle, Do Not Disturb and Invisible are never touched.
+ *    Someone who set Do Not Disturb to be left alone would be dragged back to
+ *    Online by their own mouse otherwise, which is the opposite of what they
+ *    asked for.
+ *  - Only a manual Online becomes an automatic Idle, and only an automatic
+ *    Idle becomes Online again. A manual Idle is a statement, not a timeout.
+ *
+ * Input listening is throttled to one bookkeeping call per second: mousemove
+ * fires hundreds of times a second and the timer's resolution is minutes, so
+ * anything finer is pure cost.
+ */
+
+import type { UserStatus } from "./types";
+import { loadUserStatus, loadUserStatusOrigin, saveUserStatus } from "./userStatus";
+
+/** How long without input before the status flips to idle. Discord's number. */
+export const AUTO_IDLE_DELAY_MS = 10 * 60 * 1000;
+
+/** Minimum gap between two activity bookkeeping runs. */
+export const ACTIVITY_THROTTLE_MS = 1000;
+
+/** Events that count as "the user is here". */
+const ACTIVITY_EVENTS = ["mousemove", "mousedown", "keydown", "wheel", "touchstart"] as const;
+
+export interface AutoIdleOptions {
+  /** Called when the timer decides the status should change. The caller sends
+   *  the presence_update and updates its own stores — this module owns the
+   *  decision, not the transport. */
+  readonly onStatusChange: (status: UserStatus) => void;
+  /** Injected in tests. Defaults to `window`. */
+  readonly target?: Pick<Window, "addEventListener" | "removeEventListener">;
+  /** Injected in tests. Defaults to AUTO_IDLE_DELAY_MS. */
+  readonly delayMs?: number;
+}
+
+export interface AutoIdleController {
+  /** Report activity explicitly (e.g. after sending a message). */
+  notifyActivity(): void;
+  /** Stop listening and cancel the pending timer. */
+  destroy(): void;
+}
+
+/**
+ * Whether the timer may move the status right now, and to what.
+ *
+ * Exported because it is the entire policy, and a policy worth testing is
+ * worth testing without a DOM and a ten-minute clock.
+ */
+export function nextAutoStatus(
+  current: UserStatus,
+  origin: "manual" | "auto",
+  idle: boolean,
+): UserStatus | null {
+  if (idle) {
+    // Only a manual Online is eligible to become automatically idle. An
+    // already-idle status (either origin) has nowhere to go, and dnd/invisible
+    // are deliberate.
+    return current === "online" && origin === "manual" ? "idle" : null;
+  }
+  // Coming back: only undo what the timer itself did.
+  return current === "idle" && origin === "auto" ? "online" : null;
+}
+
+/**
+ * Start the idle watcher. Returns a controller; call `destroy` on teardown.
+ */
+export function startAutoIdle(options: AutoIdleOptions): AutoIdleController {
+  const target = options.target ?? window;
+  const delayMs = options.delayMs ?? AUTO_IDLE_DELAY_MS;
+  const ac = new AbortController();
+
+  let timer: ReturnType<typeof setTimeout> | null = null;
+  let lastActivityRun = 0;
+  let destroyed = false;
+  /** True while the timer is the reason the status is idle. Kept in memory so
+   *  the hot path (one mousemove per pixel) is a boolean check rather than a
+   *  preference read. */
+  let idleByTimer = false;
+
+  function apply(idle: boolean): void {
+    const next = nextAutoStatus(loadUserStatus(), loadUserStatusOrigin(), idle);
+    if (next === null) return;
+    // The timer's writes are marked "auto" so a later return-to-activity knows
+    // it is undoing its own work rather than a choice the user made.
+    saveUserStatus(next, idle ? "auto" : "manual");
+    idleByTimer = idle;
+    options.onStatusChange(next);
+  }
+
+  function arm(): void {
+    if (timer !== null) clearTimeout(timer);
+    timer = setTimeout(() => {
+      timer = null;
+      if (destroyed) return;
+      apply(true);
+    }, delayMs);
+  }
+
+  function onActivity(): void {
+    if (destroyed) return;
+    // Coming back is handled first and unthrottled: the very first event after
+    // an idle flip has to restore Online even though it lands inside the
+    // throttle window that follows.
+    if (idleByTimer) {
+      apply(false);
+      idleByTimer = false;
+      lastActivityRun = Date.now();
+      arm();
+      return;
+    }
+    const now = Date.now();
+    if (now - lastActivityRun < ACTIVITY_THROTTLE_MS) return;
+    lastActivityRun = now;
+    arm();
+  }
+
+  for (const evt of ACTIVITY_EVENTS) {
+    target.addEventListener(evt, onActivity, { passive: true, signal: ac.signal });
+  }
+  arm();
+
+  return {
+    notifyActivity(): void {
+      onActivity();
+    },
+    destroy(): void {
+      destroyed = true;
+      ac.abort();
+      if (timer !== null) {
+        clearTimeout(timer);
+        timer = null;
+      }
+    },
+  };
+}
diff --git a/Client/tauri-client/src/lib/avatar.ts b/Client/tauri-client/src/lib/avatar.ts
new file mode 100644
index 00000000..a6b67b69
--- /dev/null
+++ b/Client/tauri-client/src/lib/avatar.ts
@@ -0,0 +1,126 @@
+/**
+ * The one place that answers "how do I draw this user".
+ *
+ * Before phase 6 there were four answers: message rows, the reply preview, the
+ * member list and the user bar each built a coloured `<div>` with a letter in
+ * it, while `UserProfilePopup` alone knew how to render an actual image. Now
+ * that avatars can be uploaded, every one of those surfaces has to be able to
+ * show a picture — and the letter has to remain the fallback, because most
+ * users will never upload one.
+ *
+ * Two rules the helper exists to enforce:
+ *
+ *  - The image is fetched, not linked. `/api/v1/files/{id}` is authenticated,
+ *    and `<img src>` cannot carry an Authorization header, so assigning the
+ *    server URL directly would 401. Bytes go through the same cert-pinned,
+ *    bearer-token, cached path attachments and custom emoji use, and are
+ *    swapped in as a data: URI once they arrive.
+ *  - The letter is what renders until (and if) the bytes arrive. An avatar that
+ *    fails to load leaves a normal-looking row rather than a broken image.
+ */
+
+import { createElement } from "@lib/dom";
+import {
+  fetchImageAsDataUrl,
+  isSafeUrl,
+  resolveServerUrl,
+} from "@components/message-list/attachments";
+
+/** Everything the helper needs to know about the user it is drawing. */
+export interface AvatarSubject {
+  readonly username: string;
+  /** Nickname, when set. Used for the initial and the alt text, so a row shows
+   *  the letter of the name the reader actually sees. */
+  readonly displayName?: string | null;
+  /** Avatar URL: a server-relative `/api/v1/files/{id}` or an https:// URL. */
+  readonly avatar?: string | null;
+  /** Renders as "?" on a neutral background and never fetches an image. */
+  readonly isDeleted?: boolean;
+}
+
+export interface AvatarOptions {
+  /** Class applied to the wrapper — each surface keeps its own sizing rules. */
+  readonly className: string;
+  /** CSS background for the letter fallback (usually the user's role color). */
+  readonly background?: string;
+  /** Extra attributes for the wrapper (data-testid, title, …). */
+  readonly attrs?: Record<string, string>;
+}
+
+/** The name to render for a user: display name when set, username otherwise. */
+export function resolveDisplayName(subject: AvatarSubject): string {
+  const display = subject.displayName;
+  if (typeof display === "string" && display.trim().length > 0) return display;
+  return subject.username;
+}
+
+/** The single letter a user with no avatar is drawn as. */
+export function avatarInitial(subject: AvatarSubject): string {
+  if (subject.isDeleted === true) return "?";
+  return resolveDisplayName(subject).charAt(0).toUpperCase() || "?";
+}
+
+/**
+ * Whether `url` is something worth trying to load as an avatar. Empty, absent
+ * and non-http(s) values all fall back to the letter rather than producing an
+ * `<img>` that can only fail.
+ *
+ * The shape check comes first and is deliberate: `resolveServerUrl` prefixes
+ * anything that does not already start with a scheme, so a bare
+ * `javascript:alert(1)` would come back as `https://host` + that string and
+ * sail through `isSafeUrl`. Only a server-relative path or an already-absolute
+ * http(s) URL is a candidate.
+ */
+export function isRenderableAvatar(url: string | null | undefined): url is string {
+  if (typeof url !== "string" || url.length === 0) return false;
+  const absolute = url.startsWith("http://") || url.startsWith("https://");
+  if (!absolute && !url.startsWith("/")) return false;
+  return isSafeUrl(resolveServerUrl(url));
+}
+
+/**
+ * Build an avatar element: the letter fallback immediately, the image swapped
+ * in asynchronously when there is one to fetch.
+ *
+ * The returned element is usable synchronously — callers append it and move on.
+ */
+export function createAvatarElement(
+  subject: AvatarSubject,
+  options: AvatarOptions,
+): HTMLDivElement {
+  const wrapper = createElement("div", {
+    class: options.className,
+    ...options.attrs,
+  });
+  if (options.background !== undefined) {
+    wrapper.style.background = options.background;
+  }
+
+  const letter = createElement("span", { class: "avatar-initial" }, avatarInitial(subject));
+  wrapper.appendChild(letter);
+
+  if (subject.isDeleted === true || !isRenderableAvatar(subject.avatar)) {
+    return wrapper;
+  }
+
+  const resolved = resolveServerUrl(subject.avatar);
+  void fetchImageAsDataUrl(resolved).then((dataUrl) => {
+    // The row may have been torn down while the fetch was in flight; an
+    // element with no parent is one nobody is looking at.
+    if (dataUrl === null || !wrapper.isConnected) return;
+    const img = createElement("img", {
+      class: "avatar-img",
+      src: dataUrl,
+      alt: resolveDisplayName(subject),
+      loading: "lazy",
+      decoding: "async",
+    });
+    // Replacing rather than hiding keeps the letter out of the accessibility
+    // tree once a real picture is there.
+    letter.remove();
+    wrapper.style.background = "transparent";
+    wrapper.insertBefore(img, wrapper.firstChild);
+  });
+
+  return wrapper;
+}
diff --git a/Client/tauri-client/src/lib/call-ring.ts b/Client/tauri-client/src/lib/call-ring.ts
new file mode 100644
index 00000000..d6170a22
--- /dev/null
+++ b/Client/tauri-client/src/lib/call-ring.ts
@@ -0,0 +1,127 @@
+/**
+ * Incoming-call ring state.
+ *
+ * A "call" in a DM is not a server-side object — it is somebody being present
+ * in that DM's voice channel. Ringing is the ephemeral nudge that says "come
+ * look", and this module is the whole of its client-side lifetime:
+ *
+ *      (none) --call_incoming--> ringing --accept---> (none)  [+ join voice]
+ *                                       --decline--> (none)  [+ call_decline]
+ *                                       --timeout--> (none)   after 30s
+ *                                       --ringer left-> (none)
+ *
+ * It is kept apart from the banner that draws it because the interesting part
+ * is the transitions, and a statechart with no DOM in it is a statechart that
+ * can be tested without one. Every exit runs through `stopRinging`, so there
+ * is exactly one place that can leave the chime playing.
+ */
+
+export const RING_TIMEOUT_MS = 30_000;
+
+/** A ring in flight. */
+export interface RingState {
+  readonly channelId: number;
+  readonly fromUserId: number;
+  readonly fromUsername: string;
+}
+
+/** Why a ring ended. Reported so the caller knows whether to answer back. */
+export type RingEndReason = "accepted" | "declined" | "timeout" | "ringer-left" | "superseded";
+
+export interface RingControllerOptions {
+  /** Draw (or clear, with null) the incoming-call banner. */
+  readonly onRingStateChange: (state: RingState | null) => void;
+  /** Start/stop the repeating chime. */
+  readonly onChime: (playing: boolean) => void;
+  /** Join the DM's voice channel — the accept action. */
+  readonly onAccept: (channelId: number) => void;
+  /** Tell the ringer we are not picking up. Not sent on timeout: a timeout is
+   *  "nobody was there", and the ringer's own 30s window covers it. */
+  readonly onDecline: (channelId: number) => void;
+  /** Test seam for the 30s timer. */
+  readonly setTimer?: (fn: () => void, ms: number) => ReturnType<typeof setTimeout>;
+  readonly clearTimer?: (handle: ReturnType<typeof setTimeout>) => void;
+}
+
+export interface RingController {
+  /** A call_incoming arrived. */
+  readonly incoming: (state: RingState) => void;
+  /** The user accepted. No-op when nothing is ringing. */
+  readonly accept: () => void;
+  /** The user declined. No-op when nothing is ringing. */
+  readonly decline: () => void;
+  /**
+   * A call_declined arrived, or the ringer left the DM's voice channel — both
+   * mean "stop ringing for this channel". Ignored when the current ring is for
+   * a different channel, so a stale signal cannot silence a live call.
+   */
+  readonly cancel: (channelId: number, reason?: RingEndReason) => void;
+  /** The ring in flight, or null. */
+  readonly current: () => RingState | null;
+  /** Tear down: stops the chime and the timer. */
+  readonly destroy: () => void;
+}
+
+export function createRingController(opts: RingControllerOptions): RingController {
+  const setTimer = opts.setTimer ?? ((fn, ms) => setTimeout(fn, ms));
+  const clearTimer = opts.clearTimer ?? ((h) => clearTimeout(h));
+
+  let state: RingState | null = null;
+  let timer: ReturnType<typeof setTimeout> | null = null;
+
+  function stopRinging(): void {
+    if (timer !== null) {
+      clearTimer(timer);
+      timer = null;
+    }
+    if (state === null) return;
+    state = null;
+    opts.onChime(false);
+    opts.onRingStateChange(null);
+  }
+
+  function incoming(next: RingState): void {
+    // A second ring replaces the first rather than queueing: two banners at
+    // once is two decisions the user did not ask to make, and the newer ring
+    // is the one they can still answer.
+    if (state !== null && state.channelId !== next.channelId) {
+      stopRinging();
+    }
+    state = next;
+    if (timer !== null) clearTimer(timer);
+    timer = setTimer(() => {
+      // Timeout is silent by design — see onDecline's comment.
+      stopRinging();
+    }, RING_TIMEOUT_MS);
+    opts.onRingStateChange(next);
+    opts.onChime(true);
+  }
+
+  function accept(): void {
+    const active = state;
+    if (active === null) return;
+    stopRinging();
+    opts.onAccept(active.channelId);
+  }
+
+  function decline(): void {
+    const active = state;
+    if (active === null) return;
+    stopRinging();
+    opts.onDecline(active.channelId);
+  }
+
+  function cancel(channelId: number): void {
+    if (state === null || state.channelId !== channelId) return;
+    stopRinging();
+  }
+
+  return {
+    incoming,
+    accept,
+    decline,
+    cancel,
+    current: () => state,
+    destroy: () => stopRinging(),
+  };
+}
diff --git a/Client/tauri-client/src/lib/channel-mutes.ts b/Client/tauri-client/src/lib/channel-mutes.ts
new file mode 100644
index 00000000..78a8cb19
--- /dev/null
+++ b/Client/tauri-client/src/lib/channel-mutes.ts
@@ -0,0 +1,113 @@
+/**
+ * Per-channel notification mutes.
+ *
+ * A mute silences the *noise* a channel makes and nothing else. Discord's
+ * semantics, which this follows exactly:
+ *
+ *   - no desktop notification, no chime, no taskbar flash;
+ *   - the unread badge still counts, but renders dimmed — the channel has not
+ *     stopped existing, it has stopped shouting;
+ *   - a message that mentions you STILL notifies and still shows the red
+ *     mention badge. A mute is "stop telling me about the chatter", not "hide
+ *     things addressed to me", and a mute that swallowed a direct mention
+ *     would be a mute nobody could safely use.
+ *
+ * It is a client-side preference on purpose. The server has no per-user
+ * channel settings table, and "which of my devices bothers me" is a property
+ * of the device, not of the account — the same reason `desktopNotifications`
+ * and `notificationSounds` live in localStorage next to it.
+ */
+
+import { loadPref, savePref } from "./preferences";
+
+/** localStorage key (under the shared settings prefix). */
+const MUTED_KEY = "mutedChannels";
+
+/**
+ * Cached parse of the stored list. Notification gating runs on every incoming
+ * message, and a JSON.parse per message for a list that changes on a menu
+ * click is work nobody asked for. Invalidated by the pref-change event
+ * `savePref` already dispatches, so a mute set in another part of the app (or
+ * another tab, via `storage`) is picked up without a reload.
+ */
+let cache: ReadonlySet<number> | null = null;
+
+function readMuted(): ReadonlySet<number> {
+  if (cache !== null) return cache;
+  const raw = loadPref<unknown[]>(MUTED_KEY, []);
+  const ids = new Set<number>();
+  if (Array.isArray(raw)) {
+    for (const v of raw) {
+      // Corrupted storage is treated as absent rather than fatal: a bad entry
+      // must not cost the user their other mutes.
+      if (typeof v === "number" && Number.isInteger(v) && v > 0) ids.add(v);
+    }
+  }
+  cache = ids;
+  return ids;
+}
+
+function writeMuted(ids: ReadonlySet<number>): void {
+  cache = ids;
+  savePref(MUTED_KEY, [...ids]);
+}
+
+/** Drop the cached parse. Exported for tests and for logout. */
+export function invalidateMuteCache(): void {
+  cache = null;
+}
+
+if (typeof window !== "undefined") {
+  window.addEventListener("owncord:pref-change", (e) => {
+    const detail = (e as CustomEvent<{ key?: string }>).detail;
+    if (detail?.key === MUTED_KEY) invalidateMuteCache();
+  });
+  // Cross-tab: the native storage event fires only in the *other* tab.
+  window.addEventListener("storage", () => invalidateMuteCache());
+}
+
+/** Whether a channel (or DM) is muted. */
+export function isChannelMuted(channelId: number): boolean {
+  return readMuted().has(channelId);
+}
+
+/** Every muted channel id, ascending — a stable order for the settings list. */
+export function listMutedChannels(): readonly number[] {
+  return [...readMuted()].toSorted((a, b) => a - b);
+}
+
+/** Mute a channel. Idempotent. */
+export function muteChannel(channelId: number): void {
+  const next = new Set(readMuted());
+  next.add(channelId);
+  writeMuted(next);
+}
+
+/** Unmute a channel. Idempotent. */
+export function unmuteChannel(channelId: number): void {
+  const next = new Set(readMuted());
+  next.delete(channelId);
+  writeMuted(next);
+}
+
+/** Flip a channel's mute and report the new state. */
+export function toggleChannelMute(channelId: number): boolean {
+  if (isChannelMuted(channelId)) {
+    unmuteChannel(channelId);
+    return false;
+  }
+  muteChannel(channelId);
+  return true;
+}
+
+/**
+ * Whether an incoming message in `channelId` may raise a notification, given
+ * whether it mentions the reader.
+ *
+ * This is the whole mute rule in one place, so the desktop popup, the chime
+ * and the taskbar flash cannot end up applying three slightly different
+ * versions of it.
+ */
+export function notificationAllowed(channelId: number, mentioned: boolean): boolean {
+  return mentioned || !isChannelMuted(channelId);
+}
diff --git a/Client/tauri-client/src/lib/channel-navigation.ts b/Client/tauri-client/src/lib/channel-navigation.ts
new file mode 100644
index 00000000..795a3782
--- /dev/null
+++ b/Client/tauri-client/src/lib/channel-navigation.ts
@@ -0,0 +1,45 @@
+/**
+ * Single entry point for "open this channel", so every affordance that can
+ * navigate (sidebar item, quick switcher, #channel link in a message) clears
+ * the same badges and leaves the app in the same state.
+ */
+
+import { setActiveChannel, clearUnread, channelsStore } from "@stores/channels.store";
+
+/**
+ * Activate `channelId`, clearing its unread and mention badges.
+ *
+ * No-op for an id the channel store does not know: the caller resolved a name
+ * that no longer exists, and blanking the active channel would be worse than
+ * staying put.
+ */
+export function navigateToChannel(channelId: number): void {
+  if (!channelsStore.getState().channels.has(channelId)) return;
+  setActiveChannel(channelId);
+  clearUnread(channelId);
+}
+
+/**
+ * Resolve a visible channel by id, for affordances that carry an id rather
+ * than a name (message permalinks). Returns null when the channel is not in
+ * this user's channel list — a permalink to somewhere they cannot see must
+ * degrade quietly, not render a chip that goes nowhere.
+ */
+export function findChannelById(channelId: number): { id: number; name: string } | null {
+  const ch = channelsStore.getState().channels.get(channelId);
+  return ch === undefined ? null : { id: ch.id, name: ch.name };
+}
+
+/**
+ * Resolve a channel by name (case-insensitive), as written in a `#name` token.
+ * DM channels are excluded — they are addressed through the DM sidebar and
+ * have no user-visible `#name`.
+ */
+export function findChannelByName(name: string): { id: number; name: string } | null {
+  const wanted = name.toLowerCase();
+  for (const ch of channelsStore.getState().channels.values()) {
+    if (ch.type === "dm") continue;
+    if (ch.name.toLowerCase() === wanted) return { id: ch.id, name: ch.name };
+  }
+  return null;
+}
diff --git a/Client/tauri-client/src/lib/constants.ts b/Client/tauri-client/src/lib/constants.ts
index 20c10dc8..01ab27b2 100644
--- a/Client/tauri-client/src/lib/constants.ts
+++ b/Client/tauri-client/src/lib/constants.ts
@@ -1,2 +1,9 @@
 /** Offset added to userId to produce a unique tile ID for screenshare tiles in the video grid. */
 export const SCREENSHARE_TILE_ID_OFFSET = 1_000_000;
+
+/**
+ * Total participants a group DM holds, creator included. Mirrors
+ * `db.MaxGroupDMParticipants` on the server, which is the authority — this
+ * copy exists so the picker can refuse a 12th selection without a round trip.
+ */
+export const MAX_GROUP_DM_PARTICIPANTS = 10;
diff --git a/Client/tauri-client/src/lib/deep-link.ts b/Client/tauri-client/src/lib/deep-link.ts
index cfacc181..4243d68f 100644
--- a/Client/tauri-client/src/lib/deep-link.ts
+++ b/Client/tauri-client/src/lib/deep-link.ts
@@ -1,13 +1,18 @@
 /**
  * owncord:// deep links.
  *
- * OwnCord invites are *registration* invites (a code you supply when creating
- * an account on a server), so a deep link can only pre-fill and open the
- * register form — it cannot complete a join on its own. Accepted forms:
+ * Two routes share the scheme:
  *
- *   owncord://invite/<code>
+ *   owncord://invite/<code>              registration invite
  *   owncord://invite/<code>?host=<host>
- *   owncord://<code>                     (bare code)
+ *   owncord://<code>                     (bare code — invite)
+ *   owncord://message/<channelId>/<messageId>   message permalink
+ *
+ * OwnCord invites are *registration* invites (a code you supply when creating
+ * an account on a server), so an invite link can only pre-fill and open the
+ * register form — it cannot complete a join on its own. A message link opens
+ * the channel and jumps to the message, and is ignored when the channel is not
+ * visible to this user.
  *
  * Cold starts are handled via getCurrent(); while the app is already running,
  * the single-instance plugin (built with the "deep-link" feature) forwards the
@@ -20,31 +25,78 @@ const log = createLogger("deep-link");
 
 const SCHEME = "owncord";
 const PREFIX = `${SCHEME}://`;
+/** Route segment that owns the message-permalink form. */
+const MESSAGE_ROUTE = "message";
 
 export interface InviteLink {
   readonly code: string;
   readonly host?: string;
 }
 
-/**
- * Parse an owncord:// invite link. Returns null if the URL isn't an owncord://
- * link or carries no code. Pure — no side effects, safe to unit test.
- */
-export function parseInviteLink(url: string): InviteLink | null {
+export interface MessageLink {
+  readonly channelId: number;
+  readonly messageId: number;
+}
+
+/** Split an owncord:// URL into its path segments, or null for other schemes. */
+function linkSegments(url: string): { segments: string[]; query: string } | null {
   if (!url.startsWith(PREFIX)) return null;
-
   let rest = url.slice(PREFIX.length);
-  let host: string | undefined;
-
+  let query = "";
   const queryStart = rest.indexOf("?");
   if (queryStart !== -1) {
-    const params = new URLSearchParams(rest.slice(queryStart + 1));
-    const h = params.get("host")?.trim();
-    if (h) host = h;
+    query = rest.slice(queryStart + 1);
     rest = rest.slice(0, queryStart);
   }
+  return { segments: rest.replace(/\/+$/, "").split("/").filter(Boolean), query };
+}
 
-  const segments = rest.replace(/\/+$/, "").split("/").filter(Boolean);
+/** Parse a positive integer segment, or null when it is anything else. */
+function parseIdSegment(raw: string | undefined): number | null {
+  if (raw === undefined || !/^\d+$/.test(raw)) return null;
+  const n = Number(raw);
+  return Number.isSafeInteger(n) && n > 0 ? n : null;
+}
+
+/**
+ * Build the canonical permalink for a message. The inverse of
+ * {@link parseMessageLink}.
+ */
+export function formatMessageLink(channelId: number, messageId: number): string {
+  return `${PREFIX}${MESSAGE_ROUTE}/${channelId}/${messageId}`;
+}
+
+/**
+ * Parse an `owncord://message/<channelId>/<messageId>` permalink. Returns null
+ * for any other owncord:// route, another scheme, or non-numeric ids. Pure.
+ */
+export function parseMessageLink(url: string): MessageLink | null {
+  const parts = linkSegments(url);
+  if (parts === null || parts.segments[0] !== MESSAGE_ROUTE) return null;
+  const channelId = parseIdSegment(parts.segments[1]);
+  const messageId = parseIdSegment(parts.segments[2]);
+  if (channelId === null || messageId === null) return null;
+  return { channelId, messageId };
+}
+
+/**
+ * Parse an owncord:// invite link. Returns null if the URL isn't an owncord://
+ * link, is a different route (e.g. a message permalink), or carries no code.
+ * Pure — no side effects, safe to unit test.
+ */
+export function parseInviteLink(url: string): InviteLink | null {
+  const parts = linkSegments(url);
+  if (parts === null) return null;
+
+  let host: string | undefined;
+  if (parts.query !== "") {
+    const h = new URLSearchParams(parts.query).get("host")?.trim();
+    if (h) host = h;
+  }
+
+  const segments = parts.segments;
+  // A message permalink is not a bare invite code.
+  if (segments[0] === MESSAGE_ROUTE) return null;
   // `owncord://invite/<code>` or bare `owncord://<code>`.
   const codeSegment = segments[0] === "invite" ? segments[1] : segments[0];
   if (!codeSegment) return null;
@@ -63,10 +115,12 @@ export function parseInviteLink(url: string): InviteLink | null {
 
 /**
  * Wire owncord:// deep links. No-op outside Tauri. `onInvite` is called once per
- * recognized invite link, on both cold start and warm launches.
+ * recognized invite link and `onMessage` once per message permalink, on both
+ * cold start and warm launches.
  */
 export async function initDeepLinks(
   onInvite: (code: string, host?: string) => void,
+  onMessage?: (channelId: number, messageId: number) => void,
 ): Promise<void> {
   let plugin: typeof import("@tauri-apps/plugin-deep-link");
   try {
@@ -77,6 +131,12 @@ export async function initDeepLinks(
 
   function dispatch(urls: readonly string[] | null): void {
     for (const url of urls ?? []) {
+      const message = parseMessageLink(url);
+      if (message !== null) {
+        log.info("Deep-link message permalink received");
+        onMessage?.(message.channelId, message.messageId);
+        continue;
+      }
       const invite = parseInviteLink(url);
       if (invite) {
         log.info("Deep-link invite received", { hasHost: invite.host !== undefined });
diff --git a/Client/tauri-client/src/lib/dispatcher.ts b/Client/tauri-client/src/lib/dispatcher.ts
index 16c11428..57a9a05f 100644
--- a/Client/tauri-client/src/lib/dispatcher.ts
+++ b/Client/tauri-client/src/lib/dispatcher.ts
@@ -14,12 +14,14 @@ import {
   updateChannel,
   removeChannel,
   incrementUnread,
+  incrementMention,
 } from "@stores/channels.store";
 import { channelsStore } from "@stores/channels.store";
 import {
   addMessage,
   editMessage,
   deleteMessage,
+  bulkDeleteMessages,
   updateReaction,
   confirmSend,
   markSendFailed,
@@ -51,14 +53,19 @@ import {
   removeDmChannel,
   updateDmLastMessage,
   updateDmLastMessagePreview,
+  dmDisplayName,
 } from "@stores/dm.store";
 import type { DmChannel } from "@stores/dm.store";
 import { setBlockedByMe, setUserBlockedByThem, clearBlockedByThem } from "@stores/blocks.store";
+import { setCustomEmoji } from "@stores/emoji.store";
 import type { DmChannelPayload } from "./types";
 import type { ApiClient } from "./api";
+import { invalidateReactionUsers } from "@components/message-list/reaction-tooltip";
 import { notifyIncomingMessage } from "./notifications";
+import { highlightsCurrentUser } from "./mentions";
 import { ensureIdentityKeyPublished } from "@lib/identity";
 import { createLogger } from "./logger";
+import { showToast } from "./toast";
 import { ServerMessageType as S } from "./protocolTypes";
 
 const log = createLogger("dispatcher");
@@ -70,20 +77,34 @@ function livekitSession(): Promise<typeof import("@lib/livekitSession")> {
   return import("@lib/livekitSession");
 }
 
+/** Map one DM participant from the wire shape to the store's. */
+function mapDmUser(u: DmChannelPayload["recipient"]): DmChannel["recipient"] {
+  return {
+    id: u.id,
+    username: u.username,
+    avatar: u.avatar,
+    status: u.status,
+    displayName: u.display_name ?? "",
+  };
+}
+
 /** Map a server DM channel payload to the client DmChannel type. */
 function mapDmPayload(p: DmChannelPayload): DmChannel {
+  // A pre-group server sends only `recipient`, which for it *is* the whole
+  // membership — so the fallback is a one-element list rather than an empty
+  // one, and every group-aware call site keeps working against an old server.
+  const participants = (p.recipients ?? [p.recipient]).map(mapDmUser);
   return {
     channelId: p.channel_id,
-    recipient: {
-      id: p.recipient.id,
-      username: p.recipient.username,
-      avatar: p.recipient.avatar,
-      status: p.recipient.status,
-    },
+    recipient: participants[0] ?? mapDmUser(p.recipient),
+    participants,
+    name: p.name ?? "",
+    isGroup: p.is_group ?? false,
     lastMessageId: p.last_message_id,
     lastMessage: p.last_message,
     lastMessageAt: p.last_message_at,
     unreadCount: p.unread_count,
+    mentionCount: p.mention_count ?? 0,
   };
 }
 
@@ -109,7 +130,8 @@ export function wireConnectionStatus(ws: Pick<WsClient, "onStateChange">): () =>
  */
 export function wireDispatcher(
   ws: WsClient,
-  api?: Pick<ApiClient, "listBlocks"> & Partial<Pick<ApiClient, "updateProfile" | "getConfig">>,
+  api?: Pick<ApiClient, "listBlocks"> &
+    Partial<Pick<ApiClient, "updateProfile" | "getConfig" | "listEmoji">>,
 ): DispatcherCleanup {
   const unsubs: Array<() => void> = [];
 
@@ -200,6 +222,17 @@ export function wireDispatcher(
           .catch((err) => log.warn("Failed to load block list", { error: String(err) }));
       }
 
+      // Custom emoji are not in the ready payload (they are server-wide and
+      // change rarely, so they do not belong in the per-session dump). Load
+      // them once here; `emoji_update` keeps them fresh from then on. A
+      // failure is non-fatal — unresolved shortcodes stay plain text.
+      if (api?.listEmoji !== undefined) {
+        api
+          .listEmoji()
+          .then((list) => setCustomEmoji(list))
+          .catch((err) => log.warn("Failed to load custom emoji", { error: String(err) }));
+      }
+
       log.info("Ready payload applied", {
         channels: payload.channels.length,
         members: payload.members.length,
@@ -214,7 +247,21 @@ export function wireDispatcher(
   unsubs.push(
     ws.on(S.DM_CHANNEL_OPEN, (payload) => {
       log.info("DM channel opened", { channelId: payload.channel_id });
-      addDmChannel(mapDmPayload(payload));
+      const dm = mapDmPayload(payload);
+      addDmChannel(dm);
+
+      // A DM's channels-store row is synthesised from the DM store, and this
+      // event is also how a *membership* change arrives (group renamed, member
+      // left). Without this the chat header would keep the name the DM had
+      // when it was first opened, until the user navigated away and back.
+      channelsStore.setState((prev) => {
+        const existing = prev.channels.get(dm.channelId);
+        const name = dmDisplayName(dm);
+        if (existing === undefined || existing.name === name) return prev;
+        const next = new Map(prev.channels);
+        next.set(dm.channelId, { ...existing, name });
+        return { ...prev, channels: next };
+      });
     }),
   );
 
@@ -251,6 +298,15 @@ export function wireDispatcher(
       // applied here for defence-in-depth.
       if (payload.channel_id !== activeId && !isOwnMessage && !ws.isReplaying()) {
         incrementUnread(payload.channel_id);
+        // A mention is an unread too — the mention badge just outranks it.
+        if (
+          highlightsCurrentUser(payload.content, {
+            mentions: payload.mentions,
+            mentionsEveryone: payload.mentions_everyone,
+          })
+        ) {
+          incrementMention(payload.channel_id);
+        }
       }
 
       // Update DM store last message if this message belongs to a DM channel.
@@ -287,6 +343,12 @@ export function wireDispatcher(
     }),
   );
 
+  unsubs.push(
+    ws.on(S.CHAT_BULK_DELETED, (payload) => {
+      bulkDeleteMessages(payload);
+    }),
+  );
+
   unsubs.push(
     ws.on(S.CHAT_SEND_OK, (payload, id) => {
       if (id) {
@@ -301,6 +363,9 @@ export function wireDispatcher(
     ws.on(S.REACTION_UPDATE, (payload) => {
       const userId = authStore.getState().user?.id ?? 0;
       updateReaction(payload, userId);
+      // The who-reacted tooltip caches the reactor list per message+emoji; any
+      // add/remove on this message makes those lists stale.
+      invalidateReactionUsers(payload.message_id);
     }),
   );
 
@@ -316,7 +381,10 @@ export function wireDispatcher(
 
   unsubs.push(
     ws.on(S.PRESENCE, (payload) => {
-      updatePresence(payload.user_id, payload.status);
+      // custom_status is passed through verbatim, undefined included: the
+      // store treats "field absent" as "leave the text alone", which is what
+      // an older server's presence event means.
+      updatePresence(payload.user_id, payload.status, payload.custom_status);
     }),
   );
 
@@ -381,22 +449,49 @@ export function wireDispatcher(
     }),
   );
 
+  // Roles changed server-side (created, edited, deleted or reordered). The
+  // payload is the whole list, so the store is replaced rather than patched —
+  // name colors, the member-list groups and every permission-gated affordance
+  // re-derive from it without a reconnect.
+  unsubs.push(
+    ws.on(S.ROLES_UPDATE, (payload) => {
+      log.info("Roles updated", { count: payload.roles?.length ?? 0 });
+      setRoles(payload.roles ?? []);
+    }),
+  );
+
+  // Custom emoji changed server-side (uploaded or deleted). Whole set, like
+  // roles_update: the store is replaced so a deleted emoji stops rendering in
+  // messages, pickers and reaction pills without a reconnect.
+  unsubs.push(
+    ws.on(S.EMOJI_UPDATE, (payload) => {
+      log.info("Custom emoji updated", { count: payload.emoji?.length ?? 0 });
+      setCustomEmoji(payload.emoji ?? []);
+    }),
+  );
+
   unsubs.push(
     ws.on(S.USER_UPDATE, (payload) => {
       log.info("User profile updated", { userId: payload.user_id, username: payload.username });
-      updateMemberProfile(
-        payload.user_id,
-        payload.username,
-        payload.avatar,
-        payload.identity_public_key,
-      );
+      updateMemberProfile(payload.user_id, {
+        username: payload.username,
+        avatar: payload.avatar,
+        displayName: payload.display_name,
+        identityPublicKey: payload.identity_public_key,
+      });
 
       // Update auth store if the current user changed their own profile.
       const currentUser = authStore.getState().user;
       if (currentUser && payload.user_id === currentUser.id) {
         setAuth(
           authStore.getState().token ?? "",
-          { ...currentUser, username: payload.username, avatar: payload.avatar },
+          {
+            ...currentUser,
+            username: payload.username,
+            avatar: payload.avatar,
+            display_name: payload.display_name,
+            about: payload.about,
+          },
           authStore.getState().serverName ?? "",
           authStore.getState().motd ?? "",
         );
@@ -411,12 +506,52 @@ export function wireDispatcher(
       updateVoiceState(payload);
       // Auto-join voice channel if the event is for the current user
       const currentUserId = authStore.getState().user?.id ?? 0;
-      if (payload.user_id === currentUserId) {
-        joinVoiceChannel(payload.channel_id);
+      if (payload.user_id !== currentUserId) return;
+      joinVoiceChannel(payload.channel_id);
+      // Honor a moderator's mute/deafen locally. Mute is also enforced at the
+      // SFU, but deafen governs what WE play back, so the client is the only
+      // place it can take effect. Both apply through one lazy import so the
+      // two effects cannot land in different ticks.
+      const voice = voiceStore.getState();
+      const applyDeafen = payload.server_deafened === true && !voice.localDeafened;
+      const applyMute = payload.server_muted === true && !voice.localMuted;
+      if (applyDeafen || applyMute) {
+        void livekitSession().then(({ setDeafened, setMuted }) => {
+          if (applyDeafen) setDeafened(true);
+          if (applyMute) setMuted(true);
+        });
       }
     }),
   );
 
+  // A moderator moved this client: tear the media session down and re-join the
+  // destination through the ordinary join path (the server already removed us
+  // from the old room and broadcast voice_leave).
+  unsubs.push(
+    ws.on(S.VOICE_MOVED, (payload) => {
+      log.info("Moved to another voice channel by a moderator", {
+        toChannelId: payload.to_channel_id,
+      });
+      void livekitSession().then(({ leaveVoice }) => {
+        leaveVoice(false);
+        leaveVoiceChannel();
+        joinVoiceChannel(payload.to_channel_id);
+        ws.send({ type: "voice_join", payload: { channel_id: payload.to_channel_id } });
+      });
+    }),
+  );
+
+  // A moderator disconnected this client from voice. voice_leave has already
+  // cleared the store; this only surfaces the reason.
+  unsubs.push(
+    ws.on(S.VOICE_DISCONNECTED, (payload) => {
+      log.info("Disconnected from voice by a moderator", { channelId: payload.channel_id });
+      void livekitSession().then(({ leaveVoice }) => leaveVoice(false));
+      leaveVoiceChannel();
+      showToast(payload.reason || "You were disconnected from voice", "error");
+    }),
+  );
+
   unsubs.push(
     ws.on(S.VOICE_LEAVE, (payload) => {
       removeVoiceUser(payload);
@@ -484,6 +619,18 @@ export function wireDispatcher(
         reason: payload.reason,
         delaySeconds: payload.delay_seconds,
       });
+      if (payload.reason === "shutdown") {
+        // GracefulStop broadcast: the server is going down, not briefly
+        // restarting in place. Kick back to the login screen instead of
+        // spinning the reconnect loop against a dead host. clearAuth also
+        // leaves voice — stopping any live camera/screenshare tracks and
+        // resetting their toggles to off. "server_shutdown" keeps the saved
+        // credential (the token is still valid), so auto-login can resume
+        // when the server comes back.
+        setTransientError("The server was shut down — you have been signed out.");
+        clearAuth("server_shutdown");
+        return;
+      }
       setTransientError(`Server is restarting: ${payload.reason ?? "maintenance"}`);
     }),
   );
@@ -533,6 +680,20 @@ export function wireDispatcher(
         markSendFailed(id, payload.code);
         return;
       }
+      // Voice capacity refusals. The server owns the limits (voice_max_users /
+      // voice_max_video) and refuses the join or the camera; the client never
+      // pre-blocks the click, because its copy of the participant list can lag
+      // and a refusal it invented would be uncorrectable. So the only job here
+      // is to say what happened — without this the click was a silent no-op
+      // with an explanation buried in the log.
+      if (payload.code === "CHANNEL_FULL") {
+        showToast(payload.message || "That voice channel is full", "error");
+        return;
+      }
+      if (payload.code === "VIDEO_LIMIT") {
+        showToast(payload.message || "That voice channel has reached its video limit", "error");
+        return;
+      }
       if (payload.code === "RATE_LIMITED" || payload.code === "FORBIDDEN") {
         setTransientError(payload.message || "Server error");
       }
diff --git a/Client/tauri-client/src/lib/icons.ts b/Client/tauri-client/src/lib/icons.ts
index 4a3430c0..4999fa16 100644
--- a/Client/tauri-client/src/lib/icons.ts
+++ b/Client/tauri-client/src/lib/icons.ts
@@ -49,6 +49,7 @@ export type IconName =
   | "pause"
   | "check"
   | "external-link"
+  | "link"
   | "loader"
   | "arrow-right"
   | "hash"
@@ -169,6 +170,9 @@ const ICON_PATHS: Record<IconName, string> = {
   // External link arrow out of box
   "external-link": `<path d="M15 3h6v6"/><path d="M10 14 21 3"/><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/>`,
 
+  // Chain link — message permalinks ("Copy Message Link")
+  link: `<path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71"/><path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71"/>`,
+
   // Loading spinner circle (partial arc with rotating convention)
   loader: `<path d="M21 12a9 9 0 1 1-6.219-8.56"/>`,
 
diff --git a/Client/tauri-client/src/lib/mentions.ts b/Client/tauri-client/src/lib/mentions.ts
new file mode 100644
index 00000000..10647471
--- /dev/null
+++ b/Client/tauri-client/src/lib/mentions.ts
@@ -0,0 +1,121 @@
+/**
+ * Mention token parsing and resolution, shared by message rendering, the
+ * unread/mention badges, and the notification gate so all three agree on what
+ * counts as a mention.
+ *
+ * The server is the authority: `mentions` / `mentions_everyone` on the wire
+ * decide the outcome whenever they are present. The local token parse only
+ * stands in for servers that predate those fields.
+ */
+
+import { authStore } from "@stores/auth.store";
+import { membersStore } from "@stores/members.store";
+
+/**
+ * An @token that stands alone as a word. Group 1 is the preceding character,
+ * which must be start-of-string or a non-word non-`@` rune, so "mail@example"
+ * and "@@name" never match; group 3 captures a trailing "@" so address-shaped
+ * text like "@bob@example.com" is rejected whole. Mirrors the server's
+ * mentionTokenRe — a token the server would not resolve must not be
+ * highlighted here either.
+ */
+export const MENTION_TOKEN_REGEX = /(^|[^\p{L}\p{N}_@])@([\p{L}\p{N}_.-]{1,64})(@?)/gu;
+
+/** A `#name` channel token. Same word-boundary rule as @tokens. */
+export const CHANNEL_TOKEN_REGEX = /(^|[^\p{L}\p{N}_#])#([\p{L}\p{N}_-]{1,64})/gu;
+
+/** Reserved: a user literally named "everyone" is not reachable via @everyone. */
+export const EVERYONE_TOKEN = "everyone";
+export const HERE_TOKEN = "here";
+
+/** Server-resolved mention state of one message, as carried on the wire. */
+export interface MentionInfo {
+  /** Mentioned user IDs. Undefined = the server did not send them. */
+  readonly mentions?: readonly number[];
+  /** Whether an @everyone/@here cleared the sender's MENTION_EVERYONE gate. */
+  readonly mentionsEveryone?: boolean;
+}
+
+/** Whether `token` (without the leading @) is @everyone or @here. */
+export function isEveryoneToken(token: string): boolean {
+  const lower = token.toLowerCase();
+  return lower === EVERYONE_TOKEN || lower === HERE_TOKEN;
+}
+
+/**
+ * Username spellings a token may resolve to, in preference order. The trailing
+ * `.`/`-` are dropped in the second spelling so "@bob." resolves to bob when no
+ * user is literally named "bob." — same fallback the server applies.
+ */
+export function mentionSpellings(token: string): readonly string[] {
+  const lower = token.toLowerCase();
+  const trimmed = lower.replace(/[.-]+$/, "");
+  return trimmed !== "" && trimmed !== lower ? [lower, trimmed] : [lower];
+}
+
+/**
+ * Resolve an @token to a user ID, or null when nothing owns that name.
+ * Unresolvable tokens stay plain text — "@ hey" and "@nobody" must not read as
+ * mentions.
+ *
+ * Two sources, in order: the user IDs the server resolved for this message
+ * (preferred, so an ambiguous spelling lands on the user the server actually
+ * notified), then the member list by username. A server-listed ID that the
+ * member list cannot name — a user who has since left — stays unresolved and
+ * therefore unhighlighted; nothing else can spell it.
+ */
+export function resolveMentionUserId(token: string, info?: MentionInfo): number | null {
+  if (isEveryoneToken(token)) return null;
+  const spellings = mentionSpellings(token);
+  const members = membersStore.getState().members;
+  const matches = (username: string): boolean => spellings.includes(username.toLowerCase());
+
+  for (const id of info?.mentions ?? []) {
+    const member = members.get(id);
+    if (member !== undefined && matches(member.username)) return id;
+  }
+  for (const member of members.values()) {
+    if (matches(member.username)) return member.id;
+  }
+  // The signed-in user is not always in the member map (DM-only views), but a
+  // mention of oneself must still highlight.
+  const me = authStore.getState().user;
+  if (me != null && matches(me.username)) return me.id;
+  return null;
+}
+
+/** IDs of every @token in `content` that resolves to a known user. */
+export function resolveMentionsFromContent(content: string): number[] {
+  const ids: number[] = [];
+  for (const match of content.matchAll(MENTION_TOKEN_REGEX)) {
+    if (match[3] === "@") continue;
+    const token = match[2];
+    if (token === undefined || isEveryoneToken(token)) continue;
+    const id = resolveMentionUserId(token);
+    if (id !== null && !ids.includes(id)) ids.push(id);
+  }
+  return ids;
+}
+
+/**
+ * Whether this message mentions the signed-in user by name. @everyone/@here is
+ * deliberately excluded — callers that treat it as a mention say so explicitly,
+ * because the two are suppressed independently.
+ */
+export function mentionsCurrentUser(content: string, info?: MentionInfo): boolean {
+  const me = authStore.getState().user;
+  if (me == null) return false;
+  if (info?.mentions !== undefined) return info.mentions.includes(me.id);
+  return resolveMentionsFromContent(content).includes(me.id);
+}
+
+/**
+ * Whether this message should highlight for the signed-in user: a direct
+ * mention, or an @everyone/@here the server honoured. An @everyone token from
+ * a sender without MENTION_EVERYONE carries no mention semantics, so it never
+ * highlights.
+ */
+export function highlightsCurrentUser(content: string, info?: MentionInfo): boolean {
+  if (info?.mentionsEveryone === true) return true;
+  return mentionsCurrentUser(content, info);
+}
diff --git a/Client/tauri-client/src/lib/message-navigation.ts b/Client/tauri-client/src/lib/message-navigation.ts
new file mode 100644
index 00000000..5652890d
--- /dev/null
+++ b/Client/tauri-client/src/lib/message-navigation.ts
@@ -0,0 +1,48 @@
+/**
+ * Single entry point for "jump to this message", mirroring channel-navigation.
+ *
+ * Every affordance that can jump — a search hit, a pinned entry, a reply bar,
+ * an `owncord://message/…` permalink pasted into chat, a permalink opened from
+ * the OS — routes through jumpToMessage so they all share one implementation:
+ * open the channel if needed, fetch the around-window when the target is not
+ * loaded, scroll to it and flash it.
+ *
+ * The real implementation lives in the main page (it needs the API client and
+ * the mounted MessageList), so it registers itself here at mount time. Before
+ * registration — and in unit tests that never mount a page — jumping is a
+ * logged no-op rather than a crash.
+ */
+
+import { createLogger } from "./logger";
+
+const log = createLogger("message-nav");
+
+export type MessageJumpHandler = (channelId: number, messageId: number) => void;
+
+let handler: MessageJumpHandler | null = null;
+
+/**
+ * Install the jump implementation. Returns an unregister function; calling it
+ * only clears the handler if it is still the one installed here, so a late
+ * teardown cannot wipe a newer page's handler.
+ */
+export function setMessageJumpHandler(fn: MessageJumpHandler): () => void {
+  handler = fn;
+  return () => {
+    if (handler === fn) handler = null;
+  };
+}
+
+/** Jump to a message. No-op (logged) when no page has registered a handler. */
+export function jumpToMessage(channelId: number, messageId: number): void {
+  if (handler === null) {
+    log.debug("Jump requested with no handler registered", { channelId, messageId });
+    return;
+  }
+  handler(channelId, messageId);
+}
+
+/** Whether a jump would currently reach a handler. Used by tests and guards. */
+export function hasMessageJumpHandler(): boolean {
+  return handler !== null;
+}
diff --git a/Client/tauri-client/src/lib/modalFactory.ts b/Client/tauri-client/src/lib/modalFactory.ts
index 942424c3..e593048f 100644
--- a/Client/tauri-client/src/lib/modalFactory.ts
+++ b/Client/tauri-client/src/lib/modalFactory.ts
@@ -138,3 +138,97 @@ export function createModal(
     destroy: handleClose,
   };
 }
+
+// ---------------------------------------------------------------------------
+// Prompt modal
+// ---------------------------------------------------------------------------
+
+export interface PromptModalOptions {
+  readonly title: string;
+  readonly label?: string;
+  readonly initialValue?: string;
+  readonly placeholder?: string;
+  readonly maxLength?: number;
+  readonly confirmLabel?: string;
+  /** Called with the trimmed value. Not called when the user cancels. */
+  readonly onSubmit: (value: string) => void;
+  readonly onClose?: () => void;
+  readonly testId?: string;
+}
+
+/**
+ * A one-field prompt: title, text input, confirm/cancel.
+ *
+ * Exists because `window.prompt` is unavailable in the Tauri webview and
+ * because a hand-rolled overlay per caller is three chances to forget Escape
+ * handling. An empty value is a legitimate submission — clearing a group DM's
+ * name is exactly how you say "go back to listing the members".
+ */
+export function createPromptModal(
+  options: PromptModalOptions,
+  container: Element = document.body,
+): ModalInstance {
+  const content = createElement("div", { style: "padding:20px;min-width:280px;" });
+  const heading = createElement("h3", {}, options.title);
+  content.appendChild(heading);
+
+  if (options.label !== undefined) {
+    content.appendChild(
+      createElement(
+        "p",
+        { style: "color:var(--text-secondary);font-size:0.85rem;margin:0 0 8px;" },
+        options.label,
+      ),
+    );
+  }
+
+  const input = createElement("input", {
+    type: "text",
+    class: "modal-prompt-input",
+    placeholder: options.placeholder ?? "",
+    maxlength: String(options.maxLength ?? 100),
+    "data-testid": options.testId ?? "prompt-input",
+    style: "width:100%;",
+  });
+  input.value = options.initialValue ?? "";
+  content.appendChild(input);
+
+  const row = createElement("div", {
+    style: "display:flex;gap:8px;margin-top:12px;",
+  });
+  const confirm = createElement(
+    "button",
+    { class: "btn btn-primary", style: "flex:1;", "data-testid": "prompt-confirm" },
+    options.confirmLabel ?? "Save",
+  );
+  const cancel = createElement(
+    "button",
+    { class: "btn btn-secondary", style: "flex:1;", "data-testid": "prompt-cancel" },
+    "Cancel",
+  );
+  row.appendChild(confirm);
+  row.appendChild(cancel);
+  content.appendChild(row);
+
+  const instance = createModal(
+    { content, onClose: options.onClose, className: "modal-prompt" },
+    container,
+  );
+
+  const submit = (): void => {
+    const value = input.value.trim();
+    instance.close();
+    options.onSubmit(value);
+  };
+  confirm.addEventListener("click", submit);
+  cancel.addEventListener("click", () => instance.close());
+  input.addEventListener("keydown", (e: KeyboardEvent) => {
+    if (e.key === "Enter") {
+      e.preventDefault();
+      submit();
+    }
+  });
+  input.focus();
+
+  return instance;
+}
diff --git a/Client/tauri-client/src/lib/notifications.ts b/Client/tauri-client/src/lib/notifications.ts
index 9c93446b..277b5467 100644
--- a/Client/tauri-client/src/lib/notifications.ts
+++ b/Client/tauri-client/src/lib/notifications.ts
@@ -4,10 +4,12 @@
  */
 
 import { loadPref } from "./preferences";
+import { notificationAllowed } from "./channel-mutes";
 import { loadUserStatus } from "./userStatus";
 import { authStore } from "@stores/auth.store";
 import { channelsStore } from "@stores/channels.store";
 import type { ChatMessagePayload } from "./types";
+import { mentionsCurrentUser } from "./mentions";
 import { createLogger } from "./logger";
 
 const log = createLogger("notifications");
@@ -17,11 +19,6 @@ function isWindowFocused(): boolean {
   return document.hasFocus();
 }
 
-/** Check if message content contains @everyone or @here. */
-function containsEveryone(content: string): boolean {
-  return content.includes("@everyone") || content.includes("@here");
-}
-
 /** Get the channel name for a given channel ID. */
 function getChannelName(channelId: number): string {
   const channels = channelsStore.getState().channels;
@@ -47,11 +44,30 @@ export function notifyIncomingMessage(payload: ChatMessagePayload): void {
   const activeChannelId = channelsStore.getState().activeChannelId;
   if (isWindowFocused() && payload.channel_id === activeChannelId) return;
 
-  // Check @everyone suppression
-  if (loadPref<boolean>("suppressEveryone", false) && containsEveryone(payload.content)) {
+  const mentionInfo = {
+    mentions: payload.mentions,
+    mentionsEveryone: payload.mentions_everyone,
+  };
+  const directMention = mentionsCurrentUser(payload.content, mentionInfo);
+  const everyoneMention = payload.mentions_everyone === true;
+
+  // "Suppress @everyone" now means exactly that: only a notification the
+  // @everyone/@here caused is dropped. A message that also names the user is
+  // theirs to see, and an @everyone the sender lacked the permission for never
+  // reached mention status in the first place, so it is not suppressed either.
+  if (loadPref<boolean>("suppressEveryone", false) && everyoneMention && !directMention) {
     return;
   }
 
+  const mentioned = directMention || everyoneMention;
+
+  // A muted channel stops making noise entirely — popup, chime AND taskbar
+  // flash, because a flashing taskbar is exactly the interruption the mute was
+  // asked for. The unread badge is untouched (it is drawn from the store, not
+  // from here) and just renders dimmed. A message that names the reader is
+  // never silenced: see @lib/channel-mutes.
+  if (!notificationAllowed(payload.channel_id, mentioned)) return;
+
   // Do Not Disturb — the settings panel promises "You will not receive desktop
   // notifications", so honour it for the popup and the chime. The taskbar
   // flash stays: it's a passive hint, not a notification.
@@ -66,7 +82,12 @@ export function notifyIncomingMessage(payload: ChatMessagePayload): void {
     return cleaned.length > maxLen ? cleaned.slice(0, maxLen) + "..." : cleaned;
   }
 
-  const title = sanitizeNotif(`${payload.user.username} in #${channelName}`, 80);
+  const title = sanitizeNotif(
+    mentioned
+      ? `${payload.user.username} mentioned you in #${channelName}`
+      : `${payload.user.username} in #${channelName}`,
+    80,
+  );
   const body = sanitizeNotif(payload.content, 100);
 
   // Desktop notification
@@ -137,6 +158,7 @@ let notifAudioCtx: AudioContext | null = null;
 
 /** Close and release the notification AudioContext. Call on logout/cleanup. */
 export function cleanupNotificationAudio(): void {
+  stopRingChime();
   if (notifAudioCtx !== null) {
     notifAudioCtx.close().catch((err) => {
       log.warn("Failed to close notification AudioContext", err);
@@ -145,6 +167,30 @@ export function cleanupNotificationAudio(): void {
   }
 }
 
+// The ring chime repeats until the call is answered, declined or times out —
+// unlike a message chime, which fires once. It reuses playNotificationSound so
+// a call sounds like the app rather than like a second app.
+let ringInterval: ReturnType<typeof setInterval> | null = null;
+
+/** Start the repeating incoming-call chime. Idempotent. */
+export function startRingChime(): void {
+  if (ringInterval !== null) return;
+  // DND silences a call chime for the same reason it silences a message one:
+  // the settings panel promises no notification sounds, and a ringing phone is
+  // the loudest possible violation of that. The banner still appears.
+  if (loadUserStatus() === "dnd") return;
+  if (!loadPref<boolean>("notificationSounds", true)) return;
+  playNotificationSound();
+  ringInterval = setInterval(() => playNotificationSound(), 2000);
+}
+
+/** Stop the repeating incoming-call chime. Idempotent. */
+export function stopRingChime(): void {
+  if (ringInterval === null) return;
+  clearInterval(ringInterval);
+  ringInterval = null;
+}
+
 /** Play a brief notification chime. */
 function playNotificationSound(): void {
   try {
diff --git a/Client/tauri-client/src/lib/nsfw-gate.ts b/Client/tauri-client/src/lib/nsfw-gate.ts
new file mode 100644
index 00000000..7b53404f
--- /dev/null
+++ b/Client/tauri-client/src/lib/nsfw-gate.ts
@@ -0,0 +1,70 @@
+/**
+ * Per-session acknowledgement of a channel's NSFW flag.
+ *
+ * The server treats `nsfw` as a label and nothing more — it stores it,
+ * broadcasts it and audits an operator flipping it, but applies no content
+ * behaviour of its own: no filtering, no age check, no restriction on who may
+ * read or post. Everything a user experiences from the flag is decided here.
+ *
+ * What this client decides: the first time a session opens a flagged channel,
+ * show a warning the reader must accept before its messages are rendered.
+ *
+ * Remembered in **sessionStorage**, deliberately, not localStorage: the promise
+ * this makes is "once per session", so closing the app and coming back asks
+ * again. It is a courtesy prompt, not a security control — a determined reader
+ * clears the key, and the messages were never withheld by the server anyway.
+ */
+
+const STORAGE_PREFIX = "owncord:nsfw-ack:";
+
+function storageKey(channelId: number): string {
+  return `${STORAGE_PREFIX}${channelId}`;
+}
+
+/**
+ * Whether this session has already accepted the warning for `channelId`.
+ *
+ * A sessionStorage that throws (private modes, a sandboxed webview, a disabled
+ * storage partition) is read as "not acknowledged": erring toward showing the
+ * prompt again is the harmless direction, where erring the other way would
+ * silently drop the gate the flag exists to produce.
+ */
+export function isNsfwAcknowledged(channelId: number): boolean {
+  try {
+    return sessionStorage.getItem(storageKey(channelId)) === "1";
+  } catch {
+    return false;
+  }
+}
+
+/** Record that this session accepted the warning for `channelId`. */
+export function acknowledgeNsfw(channelId: number): void {
+  try {
+    sessionStorage.setItem(storageKey(channelId), "1");
+  } catch {
+    // Storage unavailable — the gate simply asks again next time. Nothing to
+    // recover from, and failing the channel open over it would be absurd.
+  }
+}
+
+/** Drop every stored acknowledgement (used by tests and by logout). */
+export function clearNsfwAcknowledgements(): void {
+  try {
+    const keys: string[] = [];
+    for (let i = 0; i < sessionStorage.length; i++) {
+      const key = sessionStorage.key(i);
+      if (key !== null && key.startsWith(STORAGE_PREFIX)) keys.push(key);
+    }
+    for (const key of keys) sessionStorage.removeItem(key);
+  } catch {
+    // Nothing stored means nothing to clear.
+  }
+}
+
+/**
+ * Whether opening `channel` should show the age gate: flagged, and not yet
+ * acknowledged in this session.
+ */
+export function nsfwGateRequired(channel: { id: number; nsfw: boolean }): boolean {
+  return channel.nsfw && !isNsfwAcknowledged(channel.id);
+}
diff --git a/Client/tauri-client/src/lib/permissions.ts b/Client/tauri-client/src/lib/permissions.ts
index c82a6cc2..4816116e 100644
--- a/Client/tauri-client/src/lib/permissions.ts
+++ b/Client/tauri-client/src/lib/permissions.ts
@@ -58,6 +58,45 @@ export function isAdministrator(userPerms: number): boolean {
   return (userPerms & Permission.ADMINISTRATOR) === Permission.ADMINISTRATOR;
 }
 
+/**
+ * Permission mask for a role name, from the role list the server sends in
+ * `ready`. Returns null when that list has no matching entry (pre-`ready`, or
+ * an older server that sent none) so callers can distinguish "unknown role"
+ * from "role with no bits" and fall back instead of hiding everything.
+ */
+export function permissionsForRole(roleName: string): number | null {
+  const name = roleName.toLowerCase();
+  const role = channelsStore.getState().roles.find((r) => r.name.toLowerCase() === name);
+  return role?.permissions ?? null;
+}
+
+/**
+ * Legacy owner/admin name check. Only meaningful as a fallback for servers
+ * that send no role list; the permission mask is authoritative whenever one
+ * is available.
+ */
+export function isLegacyAdminRole(roleName: string): boolean {
+  const name = roleName.toLowerCase();
+  return name === "owner" || name === "admin";
+}
+
+/**
+ * Whether `roleName` grants `perm`, from the role list the server sends in
+ * `ready`. When that list has no matching entry (pre-`ready`, or an older
+ * server that sent none) the legacy owner/admin name check stands in — a mask
+ * of 0 would otherwise hide moderation from every actual admin.
+ *
+ * This is the single derivation every moderation affordance uses, so the
+ * member-list gates and the voice moderation menu cannot drift apart. Drives
+ * affordances only — the server is still the authority on every action, and
+ * enforces the rank rule the client cannot evaluate.
+ */
+export function roleHasPermission(roleName: string, perm: Permission): boolean {
+  const perms = permissionsForRole(roleName);
+  if (perms === null) return isLegacyAdminRole(roleName);
+  return hasPermission(perms, perm);
+}
+
 /**
  * Effective permission bits for the signed-in user, from the role list the
  * server sends in `ready`. Returns 0 when the role is unknown (pre-`ready`,
@@ -66,10 +105,7 @@ export function isAdministrator(userPerms: number): boolean {
 export function currentUserPermissions(): number {
   const roleName = authStore.getState().user?.role;
   if (roleName === undefined || roleName === null) return 0;
-  const role = channelsStore
-    .getState()
-    .roles.find((r) => r.name.toLowerCase() === roleName.toLowerCase());
-  return role?.permissions ?? 0;
+  return permissionsForRole(roleName) ?? 0;
 }
 
 /**
@@ -84,3 +120,29 @@ export function currentUserHasPermission(perm: Permission): boolean {
 export function canManageMessages(): boolean {
   return currentUserHasPermission(Permission.MANAGE_MESSAGES);
 }
+
+/**
+ * Whether the signed-in user's role holds MANAGE_CHANNELS — create, edit,
+ * delete and reorder channels, all of which the server gates on the same bit
+ * behind `/admin/api/channels*`.
+ *
+ * Routed through `roleHasPermission` rather than `currentUserHasPermission` so
+ * a server that sent no role list still shows the affordances to owner/admin
+ * instead of hiding channel management from everyone. The one derivation for
+ * every channel-management affordance, so the category "+", the context menu
+ * and the audit-log entry cannot disagree about who may manage channels.
+ */
+export function canManageChannels(): boolean {
+  const roleName = authStore.getState().user?.role ?? "";
+  return roleHasPermission(roleName, Permission.MANAGE_CHANNELS);
+}
+
+/**
+ * Whether the signed-in user's role holds VIEW_AUDIT_LOG. Gates the desktop
+ * entry point into the admin panel's audit log; the panel re-checks the bit
+ * on every request.
+ */
+export function canViewAuditLog(): boolean {
+  const roleName = authStore.getState().user?.role ?? "";
+  return roleHasPermission(roleName, Permission.VIEW_AUDIT_LOG);
+}
diff --git a/Client/tauri-client/src/lib/protocolTypes.ts b/Client/tauri-client/src/lib/protocolTypes.ts
index 218e4ea9..e907f1a1 100644
--- a/Client/tauri-client/src/lib/protocolTypes.ts
+++ b/Client/tauri-client/src/lib/protocolTypes.ts
@@ -19,6 +19,7 @@ export const ServerMessageType = {
   CHAT_SEND_OK: "chat_send_ok",
   CHAT_EDITED: "chat_edited",
   CHAT_DELETED: "chat_deleted",
+  CHAT_BULK_DELETED: "chat_bulk_deleted",
   REACTION_UPDATE: "reaction_update",
   TYPING: "typing",
   PRESENCE: "presence",
@@ -30,16 +31,22 @@ export const ServerMessageType = {
   VOICE_TOKEN: "voice_token",
   VOICE_SPEAKERS: "voice_speakers",
   VOICE_LEAVE: "voice_leave", // broadcast (same string as client msg)
+  VOICE_MOVED: "voice_moved",
+  VOICE_DISCONNECTED: "voice_disconnected",
   MEMBER_JOIN: "member_join",
   MEMBER_LEAVE: "member_leave",
   MEMBER_UPDATE: "member_update",
   USER_UPDATE: "user_update",
   MEMBER_BAN: "member_ban",
+  ROLES_UPDATE: "roles_update",
+  EMOJI_UPDATE: "emoji_update",
   SERVER_RESTART: "server_restart",
   ERROR: "error",
   PONG: "pong",
   DM_CHANNEL_OPEN: "dm_channel_open",
   DM_CHANNEL_CLOSE: "dm_channel_close",
+  CALL_INCOMING: "call_incoming",
+  CALL_DECLINED: "call_declined",
   VOICE_E2EE_ANNOUNCE: "voice_e2ee_announce", // broadcast (same string as client msg)
   VOICE_E2EE_OFFER: "voice_e2ee_offer", // relay (same string as client msg)
 } as const;
@@ -59,6 +66,7 @@ export const ClientMessageType = {
   REACTION_REMOVE: "reaction_remove",
   TYPING_START: "typing_start",
   CHANNEL_FOCUS: "channel_focus",
+  MARK_READ: "mark_read",
   PRESENCE_UPDATE: "presence_update",
   VOICE_JOIN: "voice_join",
   VOICE_LEAVE: "voice_leave",
@@ -66,10 +74,16 @@ export const ClientMessageType = {
   VOICE_DEAFEN: "voice_deafen",
   VOICE_CAMERA: "voice_camera",
   VOICE_SCREENSHARE: "voice_screenshare",
+  VOICE_MOD_MUTE: "voice_mod_mute",
+  VOICE_MOD_DEAFEN: "voice_mod_deafen",
+  VOICE_MOD_MOVE: "voice_mod_move",
+  VOICE_MOD_KICK: "voice_mod_kick",
   PING: "ping",
   VOICE_TOKEN_REFRESH: "voice_token_refresh",
   VOICE_E2EE_ANNOUNCE: "voice_e2ee_announce",
   VOICE_E2EE_OFFER: "voice_e2ee_offer",
+  CALL_RING: "call_ring",
+  CALL_DECLINE: "call_decline",
 } as const;
 
 export type ClientMessageTypeValue = (typeof ClientMessageType)[keyof typeof ClientMessageType];
diff --git a/Client/tauri-client/src/lib/read-state.ts b/Client/tauri-client/src/lib/read-state.ts
new file mode 100644
index 00000000..d8d2bc8c
--- /dev/null
+++ b/Client/tauri-client/src/lib/read-state.ts
@@ -0,0 +1,77 @@
+/**
+ * Explicit mark-as-read, for affordances that clear a badge without opening
+ * the channel (the channel context menu, "Mark All as Read").
+ *
+ * Opening a channel already marks it read via `channel_focus`. That message
+ * also rebinds the connection's focused channel, so it is the wrong tool here:
+ * marking a channel the user is *not* looking at must not move focus off the
+ * one on screen. The server has a dedicated `mark_read` for exactly this.
+ */
+
+import { channelsStore, clearUnread } from "@stores/channels.store";
+import { dmStore, clearDmUnread } from "@stores/dm.store";
+
+/** Sends one `mark_read` over the socket. */
+export type MarkReadSender = (channelId: number) => void;
+
+let sender: MarkReadSender | null = null;
+
+/**
+ * Register the socket sender. Called once from MainPage with the live WsClient,
+ * mirroring how the attachment renderer is given the server host. Until it is
+ * set, marking read still clears the local badges — the next `ready` re-asserts
+ * the server's view, so a dropped send self-corrects rather than lying forever.
+ */
+export function setMarkReadSender(next: MarkReadSender | null): void {
+  sender = next;
+}
+
+/**
+ * Mark one channel read: advance the server read state and drop the local
+ * unread/mention badges. Works for DMs too — the badge lives in dm.store for
+ * those, and clearing the other store is a no-op.
+ *
+ * No-op for a channel this client does not know, so a stale menu cannot ask the
+ * server to advance a read state for something that is not in the user's list.
+ */
+export function markChannelRead(channelId: number): void {
+  const known =
+    channelsStore.getState().channels.has(channelId) ||
+    dmStore.getState().channels.some((c) => c.channelId === channelId);
+  if (!known) return;
+
+  sender?.(channelId);
+  clearUnread(channelId);
+  clearDmUnread(channelId);
+}
+
+/** Whether a channel currently shows an unread or mention badge — what decides
+ *  if "Mark as Read" is offered as an enabled action. */
+export function hasUnread(channelId: number): boolean {
+  const ch = channelsStore.getState().channels.get(channelId);
+  if (ch !== undefined && (ch.unreadCount > 0 || ch.mentionCount > 0)) return true;
+  const dm = dmStore.getState().channels.find((c) => c.channelId === channelId);
+  return dm !== undefined && (dm.unreadCount > 0 || dm.mentionCount > 0);
+}
+
+/** Ids of every channel and DM that currently shows a badge. */
+export function unreadChannelIds(): readonly number[] {
+  const ids = new Set<number>();
+  for (const ch of channelsStore.getState().channels.values()) {
+    if (ch.unreadCount > 0 || ch.mentionCount > 0) ids.add(ch.id);
+  }
+  for (const dm of dmStore.getState().channels) {
+    if (dm.unreadCount > 0 || dm.mentionCount > 0) ids.add(dm.channelId);
+  }
+  return [...ids];
+}
+
+/**
+ * Mark every unread channel and DM read. Returns how many were marked, so the
+ * caller can stay silent when there was nothing to do.
+ */
+export function markAllRead(): number {
+  const ids = unreadChannelIds();
+  for (const id of ids) markChannelRead(id);
+  return ids.length;
+}
diff --git a/Client/tauri-client/src/lib/types.ts b/Client/tauri-client/src/lib/types.ts
index 19f93bbb..3f4efd7a 100644
--- a/Client/tauri-client/src/lib/types.ts
+++ b/Client/tauri-client/src/lib/types.ts
@@ -8,8 +8,15 @@
 // Common / Shared Types
 // -----------------------------------------------------------------------------
 
-/** Status values allowed by the protocol. */
-export type UserStatus = "online" | "idle" | "dnd" | "offline";
+/**
+ * Status values allowed by the protocol.
+ *
+ * "invisible" is a real, settable status since phase 6: the server stores it
+ * as chosen and maps it to "offline" for every OTHER user, so the owner keeps
+ * seeing their own true state. "offline" is what the server broadcasts for a
+ * user with no live session — it is no longer something a user picks.
+ */
+export type UserStatus = "online" | "idle" | "dnd" | "invisible" | "offline";
 
 /** Channel types supported by the server. */
 export type ChannelType = "text" | "voice" | "announcement" | "dm";
@@ -71,12 +78,21 @@ export interface MessageUser {
   readonly id: number;
   readonly username: string;
   readonly avatar: string | null;
+  /** Nickname to render instead of `username`. Absent/null = use `username`.
+   *  Mentions still resolve against `username`, which is the unique handle. */
+  readonly display_name?: string | null;
 }
 
 /** User object with role, used in auth_ok and member_join. */
 export interface UserWithRole extends MessageUser {
   readonly role: string;
   readonly totp_enabled?: boolean;
+  /** The signed-in user's own profile text. Null = unset. */
+  readonly about?: string | null;
+  readonly custom_status?: string | null;
+  /** The signed-in user's OWN true status, "invisible" included. Only ever
+   *  present on their own auth_ok / REST me payload. */
+  readonly status?: UserStatus;
   /** Long-term E2EE identity public key (base64), pinned by peers on first
    *  sight (F3 TOFU). Omitted/null when the user has not published one. */
   readonly identity_public_key?: string | null;
@@ -110,6 +126,8 @@ export interface ReadyChannel {
   readonly name: string;
   readonly type: ChannelType;
   readonly category: string | null;
+  /** Channel topic ("" = none). Absent from older servers. */
+  readonly topic?: string;
   readonly position: number;
   readonly unread_count?: number;
   readonly last_message_id?: number;
@@ -125,6 +143,26 @@ export interface ReadyChannel {
    * slow-mode countdown; the server still enforces. Absent from older servers.
    */
   readonly slow_mode?: number;
+  /**
+   * Unread messages in this channel that mention the current user (directly or
+   * via @everyone/@here). Always ≤ unread_count. Absent from older servers.
+   */
+  readonly mention_count?: number;
+  /**
+   * Whether the channel is flagged as possibly carrying sensitive content.
+   * A pure label: the server stores and ships it but applies no content
+   * behaviour of its own, so what it means is entirely this client's choice
+   * (a one-time-per-session age gate and a sidebar marker). Absent from older
+   * servers, which is read as "not flagged".
+   */
+  readonly nsfw?: boolean;
+  /**
+   * Voice capacity limits (0 = unlimited), the same values the server enforces
+   * on join with CHANNEL_FULL / VIDEO_LIMIT. Shipped so the sidebar can show
+   * "3/5"; the client enforces nothing. Absent from older servers.
+   */
+  readonly voice_max_users?: number;
+  readonly voice_max_video?: number;
 }
 
 /** Member object in the ready payload. */
@@ -134,6 +172,10 @@ export interface ReadyMember {
   readonly avatar: string | null;
   readonly role: string;
   readonly status: UserStatus;
+  /** Nickname to render instead of `username`. Null = unset. */
+  readonly display_name?: string | null;
+  /** Free-text status line shown under the name. Null = unset. */
+  readonly custom_status?: string | null;
   /** Long-term E2EE identity public key (base64) for voice TOFU (F3). */
   readonly identity_public_key?: string | null;
 }
@@ -144,14 +186,26 @@ export interface ReadyVoiceState {
   readonly user_id: number;
   readonly muted: boolean;
   readonly deafened: boolean;
+  /** Moderator-imposed; optional so an older server's payload still parses. */
+  readonly server_muted?: boolean;
+  readonly server_deafened?: boolean;
 }
 
-/** Role object in the ready payload. */
+/** Role object in the ready payload and in roles_update. */
 export interface ReadyRole {
   readonly id: number;
   readonly name: string;
   readonly color: string | null;
   readonly permissions: number;
+  /**
+   * Hierarchy rank — higher outranks lower. Optional because servers predating
+   * role management shipped the list without it; nothing in the client sorts
+   * on it yet, but role management makes positions mutable, so a stale copy
+   * must be replaceable rather than inferred from list order.
+   */
+  readonly position?: number;
+  /** True for the fallback role members land on when their role is deleted. */
+  readonly is_default?: boolean;
 }
 
 // -----------------------------------------------------------------------------
@@ -172,6 +226,7 @@ export enum Permission {
   KICK_MEMBERS = 0x40000,
   BAN_MEMBERS = 0x80000,
   MUTE_MEMBERS = 0x100000,
+  MENTION_EVERYONE = 0x200000,
   MANAGE_ROLES = 0x1000000,
   MANAGE_SERVER = 0x2000000,
   MANAGE_INVITES = 0x4000000,
@@ -220,6 +275,18 @@ export interface ChatMessagePayload {
   readonly reply_to: number | null;
   readonly attachments: readonly Attachment[];
   readonly timestamp: string;
+  /**
+   * Server-resolved user IDs this message mentions, ordered by first
+   * appearance. Absent from older servers — callers fall back to resolving
+   * @tokens against the member list. Never contains @everyone/@here.
+   */
+  readonly mentions?: readonly number[];
+  /**
+   * Whether an @everyone/@here in the content cleared the sender's
+   * MENTION_EVERYONE gate. A token without the bit carries no mention
+   * semantics at all. Absent from older servers.
+   */
+  readonly mentions_everyone?: boolean;
 }
 
 export interface ChatSendOkPayload {
@@ -232,6 +299,9 @@ export interface ChatEditedPayload {
   readonly channel_id: number;
   readonly content: string;
   readonly edited_at: string;
+  /** Re-resolved mentions for the new content. An edit never re-notifies. */
+  readonly mentions?: readonly number[];
+  readonly mentions_everyone?: boolean;
 }
 
 export interface ChatDeletedPayload {
@@ -239,6 +309,12 @@ export interface ChatDeletedPayload {
   readonly channel_id: number;
 }
 
+/** Bulk moderator delete (channel purge). `ids` is newest-first and never null. */
+export interface ChatBulkDeletedPayload {
+  readonly channel_id: number;
+  readonly ids: readonly number[];
+}
+
 export interface ReactionUpdatePayload {
   readonly message_id: number;
   readonly channel_id: number;
@@ -256,6 +332,10 @@ export interface TypingPayload {
 export interface PresencePayload {
   readonly user_id: number;
   readonly status: UserStatus;
+  /** The user's current custom status line. Always present on the wire
+   *  (null = none), so a cleared text is distinguishable from an event that
+   *  simply does not mention it. */
+  readonly custom_status?: string | null;
 }
 
 export interface ChannelCreatePayload {
@@ -263,15 +343,33 @@ export interface ChannelCreatePayload {
   readonly name: string;
   readonly type: ChannelType;
   readonly category: string | null;
+  readonly topic?: string;
   readonly position: number;
   readonly slow_mode?: number;
+  /** See ReadyChannel.nsfw — a label the server never acts on. */
+  readonly nsfw?: boolean;
+  /** Voice capacity limits (0 = unlimited). See ReadyChannel. */
+  readonly voice_max_users?: number;
+  readonly voice_max_video?: number;
 }
 
 export interface ChannelUpdatePayload {
   readonly id: number;
   readonly name?: string;
+  readonly topic?: string;
+  /**
+   * The category the channel now sits under ("" = uncategorized). Moving a
+   * channel between categories is an edit, so the broadcast carries it and
+   * the sidebar regroups without a reconnect.
+   */
+  readonly category?: string | null;
   readonly position?: number;
   readonly slow_mode?: number;
+  /** See ReadyChannel.nsfw — a label the server never acts on. */
+  readonly nsfw?: boolean;
+  /** Voice capacity limits (0 = unlimited). See ReadyChannel. */
+  readonly voice_max_users?: number;
+  readonly voice_max_video?: number;
 }
 
 export interface ChannelDeletePayload {
@@ -287,6 +385,21 @@ export interface VoiceStatePayload {
   readonly speaking: boolean;
   readonly camera: boolean;
   readonly screenshare: boolean;
+  /** Moderator-imposed; the user cannot lift these themselves. Optional so an
+   *  older server's payload still parses. */
+  readonly server_muted?: boolean;
+  readonly server_deafened?: boolean;
+}
+
+/** Server -> Client: a moderator moved this client to another voice channel. */
+export interface VoiceMovedPayload {
+  readonly to_channel_id: number;
+}
+
+/** Server -> Client: a moderator removed this client from voice. */
+export interface VoiceDisconnectedPayload {
+  readonly channel_id: number;
+  readonly reason: string;
 }
 
 export interface VoiceLeavePayload {
@@ -340,12 +453,38 @@ export interface VoiceE2EEOfferPayload {
 
 export interface MemberJoinPayload {
   readonly user: UserWithRole;
+  /** Viewer-safe presence the connecting user comes online as (broadcast
+   *  collapse of their real status — an invisible connector reports
+   *  "offline" here, never their true chosen status). Optional only for
+   *  compatibility with an older server that omits it; a caller MUST treat a
+   *  missing value as "offline", not assume "online", so a hidden user does
+   *  not render visible just because the field wasn't sent yet. */
+  readonly status?: UserStatus;
 }
 
 export interface MemberLeavePayload {
   readonly user_id: number;
 }
 
+/**
+ * Full role list after any role mutation. The server sends the whole list
+ * rather than a delta, so the store is replaced wholesale — a dropped
+ * intermediate event can never leave a deleted role on screen.
+ */
+export interface RolesUpdatePayload {
+  readonly roles: readonly ReadyRole[];
+}
+
+/**
+ * `emoji_update` — the server's whole custom-emoji set after an upload or a
+ * delete. Whole-set for the same reason roles_update is: the client replaces
+ * its map rather than patching it, so a dropped event cannot leave a deleted
+ * emoji rendering.
+ */
+export interface EmojiUpdatePayload {
+  readonly emoji: readonly EmojiResponse[];
+}
+
 export interface MemberUpdatePayload {
   readonly user_id: number;
   readonly role: string;
@@ -355,6 +494,10 @@ export interface UserUpdatePayload {
   readonly user_id: number;
   readonly username: string;
   readonly avatar: string | null;
+  /** Always present (null = cleared): user_update replaces the client's copy
+   *  of the profile wholesale. */
+  readonly display_name?: string | null;
+  readonly about?: string | null;
   /** Updated E2EE identity public key (base64) — lets peers detect an
    *  identity-key change (TOFU mismatch) as it happens (F3). */
   readonly identity_public_key?: string | null;
@@ -374,25 +517,53 @@ export interface DmRecipient {
   readonly username: string;
   readonly avatar: string;
   readonly status: string;
+  /** Chosen nickname, "" when unset. Absent from pre-phase-6 servers. */
+  readonly display_name?: string;
 }
 
 /** DM channel object in ready payload and dm_channel_open event. */
 export interface DmChannelPayload {
   readonly channel_id: number;
+  /**
+   * The other participant of a 1:1 DM. Retained for backward compatibility;
+   * for a group it carries the first of `recipients` so an older payload
+   * shape still renders something. Prefer `recipients`.
+   */
   readonly recipient: DmRecipient;
+  /**
+   * Every participant except the current user. Absent from pre-group servers,
+   * where `recipient` is the whole membership.
+   */
+  readonly recipients?: readonly DmRecipient[];
+  /** Optional group name. "" (or absent) for a 1:1 DM. */
+  readonly name?: string;
+  /** True for a group DM. Absent from pre-group servers, which had none. */
+  readonly is_group?: boolean;
   readonly last_message_id: number | null;
   readonly last_message: string;
   readonly last_message_at: string;
   readonly unread_count: number;
+  /**
+   * Unread messages in this DM that mention the current user. Absent from
+   * older servers, which shipped no DM mention state at all — treat as 0.
+   */
+  readonly mention_count?: number;
 }
 
-export interface DmChannelOpenPayload {
+/** dm_channel_open carries the same shape as a ready-payload DM entry. */
+export type DmChannelOpenPayload = DmChannelPayload;
+
+/** call_incoming / call_declined. Ephemeral: there is no call id because a
+ *  call is presence in the DM's voice channel, not a server-side record. */
+export interface CallSignalPayload {
+  readonly channel_id: number;
+  readonly from_user: number;
+  readonly username: string;
+}
+
+/** call_ring / call_decline (client → server). */
+export interface CallSignalRequestPayload {
   readonly channel_id: number;
-  readonly recipient: DmRecipient;
-  readonly last_message_id: number | null;
-  readonly last_message: string;
-  readonly last_message_at: string;
-  readonly unread_count: number;
 }
 
 export interface DmChannelClosePayload {
@@ -452,8 +623,20 @@ export interface ChannelFocusPayload {
   readonly channel_id: number;
 }
 
+/**
+ * mark_read — advance the read state for a channel the user is *not* viewing.
+ * Same shape as channel_focus, deliberately a different message: focus also
+ * rebinds the connection's focused channel, which would be wrong here.
+ */
+export interface MarkReadPayload {
+  readonly channel_id: number;
+}
+
 export interface PresenceUpdatePayload {
   readonly status: UserStatus;
+  /** Omitted = leave the stored text alone (what the auto-idle timer sends);
+   *  "" = clear it. */
+  readonly custom_status?: string;
 }
 
 export interface VoiceJoinPayload {
@@ -479,6 +662,29 @@ export interface VoiceScreensharePayload {
   readonly enabled: boolean;
 }
 
+/** Client -> Server: moderator sets another user's server mute. channel_id is
+ *  the channel the moderator sees them in; the server refuses a mismatch. */
+export interface VoiceModMutePayload {
+  readonly channel_id: number;
+  readonly user_id: number;
+  readonly muted: boolean;
+}
+
+export interface VoiceModDeafenPayload {
+  readonly channel_id: number;
+  readonly user_id: number;
+  readonly deafened: boolean;
+}
+
+export interface VoiceModMovePayload {
+  readonly user_id: number;
+  readonly to_channel_id: number;
+}
+
+export interface VoiceModKickPayload {
+  readonly user_id: number;
+}
+
 // -----------------------------------------------------------------------------
 // Discriminated Union: Server → Client Messages
 // -----------------------------------------------------------------------------
@@ -491,6 +697,7 @@ export type ServerMessage =
   | (WsEnvelope<ChatSendOkPayload> & { readonly type: "chat_send_ok" })
   | (WsEnvelope<ChatEditedPayload> & { readonly type: "chat_edited" })
   | (WsEnvelope<ChatDeletedPayload> & { readonly type: "chat_deleted" })
+  | (WsEnvelope<ChatBulkDeletedPayload> & { readonly type: "chat_bulk_deleted" })
   | (WsEnvelope<ReactionUpdatePayload> & { readonly type: "reaction_update" })
   | (WsEnvelope<TypingPayload> & { readonly type: "typing" })
   | (WsEnvelope<PresencePayload> & { readonly type: "presence" })
@@ -502,6 +709,8 @@ export type ServerMessage =
   | (WsEnvelope<VoiceConfigPayload> & { readonly type: "voice_config" })
   | (WsEnvelope<VoiceSpeakersPayload> & { readonly type: "voice_speakers" })
   | (WsEnvelope<VoiceTokenPayload> & { readonly type: "voice_token" })
+  | (WsEnvelope<VoiceMovedPayload> & { readonly type: "voice_moved" })
+  | (WsEnvelope<VoiceDisconnectedPayload> & { readonly type: "voice_disconnected" })
   | (WsEnvelope<VoiceE2EEAnnouncePayload> & { readonly type: "voice_e2ee_announce" })
   | (WsEnvelope<VoiceE2EEOfferPayload> & { readonly type: "voice_e2ee_offer" })
   | (WsEnvelope<MemberJoinPayload> & { readonly type: "member_join" })
@@ -509,8 +718,12 @@ export type ServerMessage =
   | (WsEnvelope<MemberUpdatePayload> & { readonly type: "member_update" })
   | (WsEnvelope<UserUpdatePayload> & { readonly type: "user_update" })
   | (WsEnvelope<MemberBanPayload> & { readonly type: "member_ban" })
+  | (WsEnvelope<RolesUpdatePayload> & { readonly type: "roles_update" })
+  | (WsEnvelope<EmojiUpdatePayload> & { readonly type: "emoji_update" })
   | (WsEnvelope<DmChannelOpenPayload> & { readonly type: "dm_channel_open" })
   | (WsEnvelope<DmChannelClosePayload> & { readonly type: "dm_channel_close" })
+  | (WsEnvelope<CallSignalPayload> & { readonly type: "call_incoming" })
+  | (WsEnvelope<CallSignalPayload> & { readonly type: "call_declined" })
   | (WsEnvelope<ServerRestartPayload> & { readonly type: "server_restart" })
   | (WsEnvelope<ErrorPayload> & { readonly type: "error" });
 
@@ -527,6 +740,7 @@ export type ClientMessage =
   | (WsEnvelope<ReactionRemovePayload> & { readonly type: "reaction_remove" })
   | (WsEnvelope<TypingStartPayload> & { readonly type: "typing_start" })
   | (WsEnvelope<ChannelFocusPayload> & { readonly type: "channel_focus" })
+  | (WsEnvelope<MarkReadPayload> & { readonly type: "mark_read" })
   | (WsEnvelope<PresenceUpdatePayload> & { readonly type: "presence_update" })
   | (WsEnvelope<VoiceJoinPayload> & { readonly type: "voice_join" })
   | (WsEnvelope<VoiceLeaveClientPayload> & { readonly type: "voice_leave" })
@@ -534,13 +748,19 @@ export type ClientMessage =
   | (WsEnvelope<VoiceDeafenPayload> & { readonly type: "voice_deafen" })
   | (WsEnvelope<VoiceCameraPayload> & { readonly type: "voice_camera" })
   | (WsEnvelope<VoiceScreensharePayload> & { readonly type: "voice_screenshare" })
+  | (WsEnvelope<VoiceModMutePayload> & { readonly type: "voice_mod_mute" })
+  | (WsEnvelope<VoiceModDeafenPayload> & { readonly type: "voice_mod_deafen" })
+  | (WsEnvelope<VoiceModMovePayload> & { readonly type: "voice_mod_move" })
+  | (WsEnvelope<VoiceModKickPayload> & { readonly type: "voice_mod_kick" })
   | (WsEnvelope<Record<string, never>> & { readonly type: "voice_token_refresh" })
   | (WsEnvelope<{ public_key: string; signature?: string }> & {
       readonly type: "voice_e2ee_announce";
     })
   | (WsEnvelope<{ target_user_id: number; encrypted_key: string; iv: string }> & {
       readonly type: "voice_e2ee_offer";
-    });
+    })
+  | (WsEnvelope<CallSignalRequestPayload> & { readonly type: "call_ring" })
+  | (WsEnvelope<CallSignalRequestPayload> & { readonly type: "call_decline" });
 
 // -----------------------------------------------------------------------------
 // REST API Response Types
@@ -590,6 +810,9 @@ export interface MessageResponse {
   readonly edited_at: string | null;
   readonly deleted: boolean;
   readonly timestamp: string;
+  /** Server-resolved mentioned user IDs. Absent from older servers. */
+  readonly mentions?: readonly number[];
+  readonly mentions_everyone?: boolean;
 }
 
 /** Paginated messages response. */
@@ -598,6 +821,43 @@ export interface MessagesResponse {
   readonly has_more: boolean;
 }
 
+/**
+ * A window of history centred on one message, from
+ * `GET /channels/{id}/messages/around/{messageId}`.
+ *
+ * Unlike {@link MessagesResponse}, `messages` is **oldest-first** — it is
+ * already in render order and must not be reversed. `has_more_after` true
+ * means the window is detached from the live tail.
+ */
+export interface MessagesAroundResponse {
+  readonly messages: readonly MessageResponse[];
+  readonly has_more_before: boolean;
+  readonly has_more_after: boolean;
+}
+
+/** One reactor in the who-reacted list. `avatar` is `""` when unset. */
+export interface ReactionUser {
+  readonly id: number;
+  readonly username: string;
+  readonly avatar: string;
+}
+
+/**
+ * Who reacted to a message with one emoji, from
+ * `GET /channels/{id}/messages/{messageId}/reactions/{emoji}/users`.
+ * Ordered oldest reaction first and capped at 100 by the server.
+ */
+export interface ReactionUsersResponse {
+  readonly users: readonly ReactionUser[];
+}
+
+/** Result of a channel purge — the ids actually soft-deleted, newest-first. */
+export interface PurgeResponse {
+  readonly channel_id: number;
+  readonly ids: readonly number[];
+  readonly count: number;
+}
+
 /** Member object from REST API. */
 export interface MemberResponse {
   readonly id: number;
@@ -605,6 +865,9 @@ export interface MemberResponse {
   readonly avatar: string | null;
   readonly role: string;
   readonly status: UserStatus;
+  readonly display_name?: string | null;
+  readonly about?: string | null;
+  readonly custom_status?: string | null;
 }
 
 /** Search result item. */
@@ -628,13 +891,17 @@ export interface ApiError {
   readonly message: string;
 }
 
-/** Single emoji object from GET /api/emoji. */
+/**
+ * Single custom emoji from GET/POST /api/v1/emoji.
+ *
+ * `url` is server-relative and behind the session token — it is fetched the
+ * same authenticated, cert-pinned way attachments are, never assigned straight
+ * to an <img src>.
+ */
 export interface EmojiResponse {
   readonly id: number;
   readonly shortcode: string;
-  readonly filename: string;
-  readonly uploaded_by: number;
-  readonly created_at: string;
+  readonly url: string;
 }
 
 /** Single sound object from GET /api/sounds. */
@@ -709,6 +976,10 @@ export interface CreateDmResponse {
   readonly created: boolean;
 }
 
+/** POST /api/v1/dms/group and PATCH /api/v1/dms/{id} both answer with the
+ *  same DM summary shape the list and the ready payload use. */
+export type GroupDmResponse = DmChannelPayload;
+
 /** GET /api/v1/blocks response. */
 export interface BlockedUsersResponse {
   readonly blocked_user_ids: readonly number[];
diff --git a/Client/tauri-client/src/lib/userStatus.ts b/Client/tauri-client/src/lib/userStatus.ts
index 8e5b17ce..064ac407 100644
--- a/Client/tauri-client/src/lib/userStatus.ts
+++ b/Client/tauri-client/src/lib/userStatus.ts
@@ -5,14 +5,37 @@
  * and write through here, so they can't drift apart, and consumers such as the
  * notification service can ask "is the user in Do Not Disturb?" without
  * reaching into a store that only tracks *other* members' presence.
+ *
+ * Since phase 6 this also records *who* chose the status. The auto-idle timer
+ * needs to flip a user to idle after ten quiet minutes and back to online when
+ * they return — but it must never undo a status the user picked by hand. A
+ * manually chosen Idle stays idle when they start typing again, and a manually
+ * chosen Do Not Disturb or Invisible is never touched at all. Storing the
+ * origin alongside the value is what makes those two cases distinguishable;
+ * the timer alone cannot tell them apart.
  */
 
 import type { UserStatus } from "./types";
 import { loadPref, savePref } from "./preferences";
 
 export const USER_STATUS_PREF_KEY = "userStatus";
+/** Where the current status came from. Separate key so an older client's
+ *  saved status keeps working (absent = treated as a manual choice). */
+export const USER_STATUS_ORIGIN_PREF_KEY = "userStatusOrigin";
 
-const VALID_STATUSES: readonly UserStatus[] = ["online", "idle", "dnd", "offline"];
+/** Who chose the current status. */
+export type StatusOrigin = "manual" | "auto";
+
+/**
+ * Statuses a user can pick.
+ *
+ * "offline" is deliberately absent: it used to be the "appear offline" option,
+ * and "invisible" replaced it in phase 6 precisely because the server cannot
+ * tell a chosen "offline" from a dropped connection. A stored "offline" from
+ * an older client is migrated to "invisible" on read, which is what the user
+ * meant when they picked it.
+ */
+const VALID_STATUSES: readonly UserStatus[] = ["online", "idle", "dnd", "invisible"];
 
 function isUserStatus(value: string): value is UserStatus {
   return (VALID_STATUSES as readonly string[]).includes(value);
@@ -21,11 +44,24 @@ function isUserStatus(value: string): value is UserStatus {
 /** The status the user last selected, defaulting to "online". */
 export function loadUserStatus(): UserStatus {
   const raw = loadPref<string>(USER_STATUS_PREF_KEY, "online");
+  // Migration: "offline" was this client's old spelling of "appear offline".
+  if (raw === "offline") return "invisible";
   return isUserStatus(raw) ? raw : "online";
 }
 
-/** Persist the selected status and notify same-window listeners. */
-export function saveUserStatus(status: UserStatus): void {
+/** Whether the current status was set by the user or by the idle timer. */
+export function loadUserStatusOrigin(): StatusOrigin {
+  return loadPref<string>(USER_STATUS_ORIGIN_PREF_KEY, "manual") === "auto" ? "auto" : "manual";
+}
+
+/**
+ * Persist the selected status and notify same-window listeners.
+ * `origin` defaults to "manual" — everything that is not the idle timer is a
+ * deliberate choice, and defaulting the other way would let a UI surface
+ * silently mark a real choice as revocable.
+ */
+export function saveUserStatus(status: UserStatus, origin: StatusOrigin = "manual"): void {
+  savePref(USER_STATUS_ORIGIN_PREF_KEY, origin);
   savePref(USER_STATUS_PREF_KEY, status);
 }
 
@@ -47,3 +83,25 @@ export function onUserStatusChange(
     window.removeEventListener("owncord:pref-change", handler);
   };
 }
+
+// ---------------------------------------------------------------------------
+// Custom status text
+// ---------------------------------------------------------------------------
+
+export const CUSTOM_STATUS_PREF_KEY = "customStatus";
+
+/** Server-side cap on users.custom_status. Mirrored here so the input can
+ *  bound itself instead of learning about it from a rejected send. */
+export const MAX_CUSTOM_STATUS_LEN = 128;
+
+/** The custom status line the user last set, "" when none. */
+export function loadCustomStatus(): string {
+  const raw = loadPref<string>(CUSTOM_STATUS_PREF_KEY, "");
+  return typeof raw === "string" ? raw.slice(0, MAX_CUSTOM_STATUS_LEN) : "";
+}
+
+/** Persist the custom status line locally. The server is the authority; this
+ *  is only so the input renders the right text before `ready` arrives. */
+export function saveCustomStatus(text: string): void {
+  savePref(CUSTOM_STATUS_PREF_KEY, text.slice(0, MAX_CUSTOM_STATUS_LEN));
+}
diff --git a/Client/tauri-client/src/main.ts b/Client/tauri-client/src/main.ts
index 64ec7b89..1ba35558 100644
--- a/Client/tauri-client/src/main.ts
+++ b/Client/tauri-client/src/main.ts
@@ -26,6 +26,7 @@ import { initLogPersistence, flushLogs } from "@lib/logPersistence";
 import { saveCredential, loadCredential, deleteCredential } from "@lib/credentials";
 import { initWindowState } from "@lib/window-state";
 import { initDeepLinks } from "@lib/deep-link";
+import { jumpToMessage } from "@lib/message-navigation";
 import { createCertMismatchModal, createCertFirstUseModal } from "@components/CertMismatchModal";
 import { createProfileManager, createTauriBackend } from "@lib/profiles";
 import type { CertTofuEvent } from "@lib/ws";
@@ -621,9 +622,11 @@ authStore.subscribeSelector(
       ws.disconnect();
       lastConnectToken = "";
       lastConnectHost = "";
-      // Clear stored credential on logout
+      // Clear stored credential on logout — but keep it when the server
+      // kicked us by shutting down: the token is still valid, and deleting
+      // the credential would break auto-login every time the server restarts.
       const host = api.getConfig().host;
-      if (host) {
+      if (host && authStore.getState().logoutReason !== "server_shutdown") {
         void deleteCredential(host);
       }
       router.navigate("connect");
@@ -662,7 +665,14 @@ function handleInviteDeepLink(code: string, host?: string): void {
     pendingInviteLink = null;
   }
 }
-void initDeepLinks(handleInviteDeepLink);
+// Route owncord://message/<channelId>/<messageId> permalinks to the main
+// page's jumper. Before the main page mounts (or when the channel isn't
+// visible to this user) the jump is a logged no-op — a link into a server the
+// user is not signed into has nothing to open.
+function handleMessageDeepLink(channelId: number, messageId: number): void {
+  jumpToMessage(channelId, messageId);
+}
+void initDeepLinks(handleInviteDeepLink, handleMessageDeepLink);
 
 // Initialize log persistence to disk (fire-and-forget)
 void initLogPersistence();
diff --git a/Client/tauri-client/src/pages/ConnectPage.ts b/Client/tauri-client/src/pages/ConnectPage.ts
index 379821b8..26782830 100644
--- a/Client/tauri-client/src/pages/ConnectPage.ts
+++ b/Client/tauri-client/src/pages/ConnectPage.ts
@@ -228,6 +228,7 @@ export function createConnectPage(
         onClose: () => closeSettings(),
         onChangePassword: () => Promise.resolve(),
         onUpdateProfile: () => Promise.resolve(),
+        onUploadAvatar: () => Promise.reject(new Error("Not authenticated")),
         onLogout: () => {},
         onDeleteAccount: () => Promise.resolve(),
         onStatusChange: () => {},
diff --git a/Client/tauri-client/src/pages/MainPage.ts b/Client/tauri-client/src/pages/MainPage.ts
index fd9a8c8c..9c12a6ca 100644
--- a/Client/tauri-client/src/pages/MainPage.ts
+++ b/Client/tauri-client/src/pages/MainPage.ts
@@ -5,6 +5,7 @@
 import { createElement, appendChildren } from "@lib/dom";
 import type { MountableComponent } from "@lib/safe-render";
 import type { WsClient } from "@lib/ws";
+import type { UserStatus } from "@lib/types";
 import type { ApiClient } from "@lib/api";
 import { createLogger } from "@lib/logger";
 import { createRateLimiterSet } from "@lib/rate-limiter";
@@ -20,9 +21,11 @@ import { authStore, clearAuth, updateUser } from "@stores/auth.store";
 import { closeSettings, uiStore } from "@stores/ui.store";
 import { updatePresence } from "@stores/members.store";
 import { loadUserStatus } from "@lib/userStatus";
+import { startAutoIdle, type AutoIdleController } from "@lib/autoIdle";
 import { channelsStore, getActiveChannel } from "@stores/channels.store";
-import { dmStore } from "@stores/dm.store";
+import { dmStore, dmDisplayName } from "@stores/dm.store";
 import { voiceStore } from "@stores/voice.store";
+import { clearCustomEmoji } from "@stores/emoji.store";
 import {
   cleanupAll as voiceCleanupAll,
   setOnRemoteVideo,
@@ -33,6 +36,12 @@ import {
   setOnError as setVoiceOnError,
 } from "@lib/livekitSession";
 import { setServerHost } from "@components/message-list/renderers";
+import { clearAttachmentCaches } from "@components/message-list/attachments";
+import {
+  setReactionUsersFetcher,
+  clearReactionUsersCache,
+} from "@components/message-list/reaction-tooltip";
+import { setMarkReadSender } from "@lib/read-state";
 import { createQuickSwitcherManager } from "./main-page/OverlayManagers";
 import { attachGlobalKeybinds } from "./main-page/GlobalKeybinds";
 import { createVoiceWidgetCallbacks } from "./main-page/VoiceCallbacks";
@@ -47,6 +56,12 @@ import type { ChannelController } from "./main-page/ChannelController";
 import { createUpdateNotifier } from "@components/UpdateNotifier";
 import { createDmProfileSidebar } from "@components/DmProfileSidebar";
 import type { DmProfileSidebarComponent } from "@components/DmProfileSidebar";
+import { createIncomingCallBanner } from "@components/IncomingCallBanner";
+import type { IncomingCallBannerComponent } from "@components/IncomingCallBanner";
+import { createRingController } from "@lib/call-ring";
+import type { RingController } from "@lib/call-ring";
+import { startRingChime, stopRingChime } from "@lib/notifications";
+import { createSidebarVoiceCallbacks } from "./main-page/VoiceCallbacks";
 import { createSidebarArea } from "./main-page/SidebarArea";
 import { createChatArea } from "./main-page/ChatArea";
 import { SCREENSHARE_TILE_ID_OFFSET } from "@lib/constants";
@@ -79,6 +94,20 @@ export function createMainPage(options: MainPageOptions): MountableComponent {
     setLiveKitServerHost(apiConfig.host);
   }
 
+  // "Mark as Read" affordances need the socket but are reached from deep inside
+  // the sidebar; register the sender once instead of threading ws through.
+  setMarkReadSender((channelId) => {
+    ws.send({ type: "mark_read", payload: { channel_id: channelId } });
+  });
+
+  // The who-reacted tooltip fetches on hover; give it the live REST client the
+  // same way the attachment renderer is given the server host.
+  clearReactionUsersCache();
+  setReactionUsersFetcher(async (channelId, messageId, emoji) => {
+    const res = await api.getReactionUsers(channelId, messageId, emoji);
+    return res.users;
+  });
+
   const limiters = createRateLimiterSet();
 
   let container: Element | null = null;
@@ -102,6 +131,9 @@ export function createMainPage(options: MainPageOptions): MountableComponent {
   let reactionCtrl: ReactionController | null = null;
   let videoModeCtrl: VideoModeController | null = null;
   let channelCtrl: ChannelController | null = null;
+  /** Inactivity watcher that flips the status to idle after ten quiet
+   *  minutes. Started once the socket is up, torn down with the page. */
+  let autoIdle: AutoIdleController | null = null;
 
   // Toast container for user-facing error feedback
   let toast: ToastContainer | null = null;
@@ -110,6 +142,10 @@ export function createMainPage(options: MainPageOptions): MountableComponent {
   let dmProfileSidebar: DmProfileSidebarComponent | null = null;
   let dmProfileSlot: HTMLDivElement | null = null;
 
+  // DM calls: the banner draws a ring, the controller owns its lifetime.
+  let callBanner: IncomingCallBannerComponent | null = null;
+  let ringCtrl: RingController | null = null;
+
   // ---------------------------------------------------------------------------
   // Helpers
   // ---------------------------------------------------------------------------
@@ -119,13 +155,20 @@ export function createMainPage(options: MainPageOptions): MountableComponent {
   }
 
   /**
-   * Re-assert the status the user picked in settings. The server starts every
-   * session as "online", so without this a saved "Do Not Disturb" would show
-   * as selected in the panel while everyone else saw the user as online.
+   * Re-assert the status the user picked, if the server disagrees.
+   *
+   * This used to fire on every connect, because the server stamped everyone
+   * online at handshake and the client had to race to correct it — which is
+   * what made a chosen Do Not Disturb (and "appear offline") flash online on
+   * every reconnect. The server now reads the saved status and announces
+   * *that*, so this is a no-op in the normal case and only speaks up when the
+   * two genuinely differ (an older server, or a status changed while the
+   * socket was down).
    */
   function restoreSavedPresence(): void {
     const status = loadUserStatus();
-    if (status === "online") return;
+    const serverStatus = authStore.getState().user?.status;
+    if (serverStatus === status) return;
     const userId = getCurrentUserId();
     if (userId !== 0) {
       updatePresence(userId, status);
@@ -135,15 +178,31 @@ export function createMainPage(options: MainPageOptions): MountableComponent {
     }
   }
 
-  /** Resolve display name for a channel — for DMs, use recipient username from DM store. */
+  /** Send a presence change and reflect it locally. Shared by the settings
+   *  tab, the user bar and the auto-idle timer so all three agree. */
+  function applyPresence(status: UserStatus): void {
+    const userId = getCurrentUserId();
+    if (userId !== 0) {
+      updatePresence(userId, status);
+    }
+    if (limiters.presence.tryConsume()) {
+      ws.send({ type: "presence_update", payload: { status } });
+    }
+  }
+
+  /**
+   * Resolve a channel's display name. A DM is named by who is in it (or, for a
+   * group, by its name), and the store is the authority on that — the channels
+   * store carries a synthesised copy that can lag a rename or a departure.
+   */
   function resolveChannelName(
     channelId: number,
     channelName: string,
     channelType?: string,
   ): string {
-    if (channelType === "dm" && (!channelName || channelName === "")) {
+    if (channelType === "dm") {
       const dm = dmStore.getState().channels.find((c) => c.channelId === channelId);
-      if (dm !== undefined) return dm.recipient.username;
+      if (dm !== undefined) return dmDisplayName(dm);
     }
     return channelName;
   }
@@ -192,6 +251,22 @@ export function createMainPage(options: MainPageOptions): MountableComponent {
     dmProfileSidebar.mount(dmProfileSlot);
   }
 
+  /**
+   * Start a call in the currently open DM: join its voice channel and ring the
+   * other participants.
+   *
+   * Joining first is deliberate. A "call" is presence in the DM's voice
+   * channel, so the ring is only truthful once the caller is actually there —
+   * ringing first would offer an empty room to whoever accepts.
+   */
+  function startCall(): void {
+    const active = getActiveChannel();
+    if (active === null || active.type !== "dm") return;
+    createSidebarVoiceCallbacks(ws).onVoiceJoin(active.id);
+    ws.send({ type: "call_ring", payload: { channel_id: active.id } });
+    showToast("Calling…", "info");
+  }
+
   /** Close the DM profile sidebar if open. */
   function closeDmProfile(): void {
     if (dmProfileSidebar !== null) {
@@ -241,10 +316,19 @@ export function createMainPage(options: MainPageOptions): MountableComponent {
     applyConnectionStatus(banner, uiStore.getState().connectionStatus);
     if (uiStore.getState().connectionStatus === "connected") restoreSavedPresence();
 
+    // Auto-idle. It only ever moves a status it is itself responsible for
+    // (see @lib/autoIdle) — a manually chosen Idle, Do Not Disturb or
+    // Invisible is never touched — so it is safe to leave running for the
+    // whole session.
+    autoIdle = startAutoIdle({ onStatusChange: (status) => applyPresence(status) });
+
     unsubscribers.push(
       ws.on("server_restart", (payload) => {
         try {
-          if (banner !== null) {
+          // A "shutdown" broadcast kicks back to the login screen (handled in
+          // the dispatcher) — no point starting a countdown on a page that is
+          // about to unmount.
+          if (banner !== null && payload.reason !== "shutdown") {
             banner.showRestart(payload.delay_seconds);
           }
         } catch (err) {
@@ -281,6 +365,9 @@ export function createMainPage(options: MainPageOptions): MountableComponent {
       onToggleDmProfile: () => {
         toggleDmProfile();
       },
+      onStartCall: () => {
+        startCall();
+      },
     });
     dmProfileSlot = chatAreaResult.dmProfileSlot;
     children.push(...chatAreaResult.children);
@@ -315,10 +402,18 @@ export function createMainPage(options: MainPageOptions): MountableComponent {
           throw err;
         }
       },
-      onUpdateProfile: async (username) => {
+      onUpdateProfile: async (patch) => {
         try {
-          const updated = await api.updateProfile({ username });
-          updateUser({ username: updated.username });
+          // The username is required by the API but optional in the patch (the
+          // profile form only edits the display name and about), so fill it in
+          // from the current user rather than making every caller repeat it.
+          const username = patch.username ?? authStore.getState().user?.username ?? "";
+          const updated = await api.updateProfile({ ...patch, username });
+          updateUser({
+            username: updated.username,
+            display_name: updated.display_name ?? null,
+            about: updated.about ?? null,
+          });
           showToast("Profile updated", "success");
         } catch (err) {
           const msg = err instanceof Error ? err.message : "Failed to update profile";
@@ -326,6 +421,21 @@ export function createMainPage(options: MainPageOptions): MountableComponent {
           throw err;
         }
       },
+      onUploadAvatar: async (file) => {
+        try {
+          const uploaded = await api.uploadAvatar(file);
+          // The server has already pointed the column at the served file and
+          // broadcast a user_update; this keeps the local copy from lagging a
+          // round-trip behind.
+          updateUser({ avatar: uploaded.url });
+          showToast("Avatar updated", "success");
+          return uploaded.url;
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : "Failed to upload avatar";
+          showToast(msg, "error");
+          throw err;
+        }
+      },
       onLogout: () => logout(api),
       onDeleteAccount: async (password) => {
         await api.deleteAccount(password);
@@ -363,15 +473,7 @@ export function createMainPage(options: MainPageOptions): MountableComponent {
           throw err;
         }
       },
-      onStatusChange: (status) => {
-        const userId = getCurrentUserId();
-        if (userId !== 0) {
-          updatePresence(userId, status);
-        }
-        if (limiters.presence.tryConsume()) {
-          ws.send({ type: "presence_update", payload: { status } });
-        }
-      },
+      onStatusChange: (status) => applyPresence(status),
     });
     settingsOverlay.mount(root);
     children.push(settingsOverlay);
@@ -400,6 +502,67 @@ export function createMainPage(options: MainPageOptions): MountableComponent {
     children.push(toast);
     initToast(toast);
 
+    // --- DM calls ---
+    // The banner is mounted on the page root rather than inside the chat area
+    // so a ring stays visible while the user is looking at another channel —
+    // which is exactly when a call most needs to be answerable.
+    ringCtrl = createRingController({
+      onRingStateChange: (state) => callBanner?.setRing(state),
+      onChime: (playing) => (playing ? startRingChime() : stopRingChime()),
+      onAccept: (channelId) => {
+        createSidebarVoiceCallbacks(ws).onVoiceJoin(channelId);
+      },
+      onDecline: (channelId) => {
+        ws.send({ type: "call_decline", payload: { channel_id: channelId } });
+      },
+    });
+    callBanner = createIncomingCallBanner({
+      onAccept: () => ringCtrl?.accept(),
+      onDecline: () => ringCtrl?.decline(),
+    });
+    callBanner.mount(root);
+    children.push(callBanner);
+
+    unsubscribers.push(
+      ws.on("call_incoming", (payload) => {
+        try {
+          // A call in the DM you are already sitting in still rings: the
+          // channel being open does not mean the app has focus, and Discord
+          // rings there too.
+          ringCtrl?.incoming({
+            channelId: payload.channel_id,
+            fromUserId: payload.from_user,
+            fromUsername: payload.username,
+          });
+        } catch (err) {
+          log.error("call_incoming handler error", err);
+        }
+      }),
+    );
+    unsubscribers.push(
+      ws.on("call_declined", (payload) => {
+        ringCtrl?.cancel(payload.channel_id);
+      }),
+    );
+    // The ringer hanging up before anyone answered: their voice_leave is the
+    // only signal there is that the call is over, because there is no call
+    // record to close. Ringing for a room with nobody in it is worse than a
+    // missed call, so a leave stops the ring for that channel.
+    unsubscribers.push(
+      ws.on("voice_leave", (payload) => {
+        const ringing = ringCtrl?.current();
+        if (ringing === null || ringing === undefined) return;
+        if (payload.user_id === ringing.fromUserId) {
+          ringCtrl?.cancel(ringing.channelId);
+        }
+      }),
+    );
+    unsubscribers.push(() => {
+      ringCtrl?.destroy();
+      ringCtrl = null;
+      callBanner = null;
+    });
+
     // Message loading controller
     msgCtrl = createMessageController({
       api,
@@ -548,6 +711,16 @@ export function createMainPage(options: MainPageOptions): MountableComponent {
       // Full voice cleanup — tears down room, callbacks, ws ref, serverHost.
       // Prevents stale module-level state persisting across logout/reconnect cycles.
       voiceCleanupAll();
+      // Custom emoji belong to the server this page was connected to. The set
+      // is module-global, so without this a switch to another server would keep
+      // rendering the previous one's shortcodes until its own list arrived.
+      clearCustomEmoji();
+      // Image/video/audio caches are module-global too — without this every
+      // clip viewed this session stays pinned (as a blob: URL or a cached
+      // data: URI) past logout.
+      clearAttachmentCaches();
+      autoIdle?.destroy();
+      autoIdle = null;
       channelCtrl?.destroyChannel();
       channelCtrl = null;
 
diff --git a/Client/tauri-client/src/pages/main-page/ChannelController.ts b/Client/tauri-client/src/pages/main-page/ChannelController.ts
index 1bc71907..079df401 100644
--- a/Client/tauri-client/src/pages/main-page/ChannelController.ts
+++ b/Client/tauri-client/src/pages/main-page/ChannelController.ts
@@ -15,13 +15,17 @@ import type { MessageListComponent } from "@components/MessageList";
 import { createMessageInput } from "@components/MessageInput";
 import type { MessageInputComponent } from "@components/MessageInput";
 import { createTypingIndicator } from "@components/TypingIndicator";
+import { createNsfwGate } from "@components/NsfwGate";
+import { nsfwGateRequired } from "@lib/nsfw-gate";
 import {
   getChannelMessages,
   setMessagePinned,
   addOptimisticMessage,
   markSendFailed,
   removeOptimistic,
+  reattachToPresent,
 } from "@stores/messages.store";
+import { jumpToMessage } from "@lib/message-navigation";
 import { authStore } from "@stores/auth.store";
 import type { MessageUser } from "@lib/types";
 import type { MessageController } from "./MessageController";
@@ -29,11 +33,11 @@ import type { PendingDeleteManager } from "./MessageController";
 import type { ReactionController } from "./ReactionController";
 import { updateChatHeaderForDm } from "./ChatHeader";
 import type { ChatHeaderRefs } from "./ChatHeader";
-import { dmStore } from "@stores/dm.store";
+import { dmStore, dmDisplayName } from "@stores/dm.store";
 import { canManageMessages } from "@lib/permissions";
 import { blocksStore, dmComposerBlockReason } from "@stores/blocks.store";
 import { membersStore } from "@stores/members.store";
-import { channelsStore } from "@stores/channels.store";
+import { channelsStore, setActiveChannel } from "@stores/channels.store";
 import { uiStore } from "@stores/ui.store";
 
 const log = createLogger("channel-ctrl");
@@ -97,6 +101,8 @@ export function createChannelController(opts: ChannelControllerOptions): Channel
   let messageList: MessageListComponent | null = null;
   let messageInput: MessageInputComponent | null = null;
   let typingIndicator: MountableComponent | null = null;
+  // The age gate covering the message area of an NSFW channel, while it is up.
+  let nsfwGate: MountableComponent | null = null;
   // Store/ws subscriptions that keep the composer's disabled state in sync.
   let composerGatingUnsubs: (() => void)[] = [];
 
@@ -111,6 +117,10 @@ export function createChannelController(opts: ChannelControllerOptions): Channel
       channelAbort = null;
     }
 
+    if (nsfwGate !== null) {
+      nsfwGate.destroy?.();
+      nsfwGate = null;
+    }
     if (messageList !== null) {
       messageList.destroy?.();
       messageList = null;
@@ -218,6 +228,20 @@ export function createChannelController(opts: ChannelControllerOptions): Channel
           void msgCtrl.loadMessages(channelId, channelAbort.signal);
         }
       },
+      // A reply bar (and any other in-row jump) goes through the same jumper
+      // as search hits and permalinks, so an out-of-window target fetches its
+      // around-window instead of silently doing nothing.
+      onJumpToMessage: (msgId: number) => {
+        jumpToMessage(channelId, msgId);
+      },
+      onJumpToPresent: () => {
+        // Dropping the detached flag also clears "loaded", so loadMessages
+        // refetches the live tail instead of short-circuiting.
+        reattachToPresent(channelId);
+        if (channelAbort !== null) {
+          void msgCtrl.loadMessages(channelId, channelAbort.signal);
+        }
+      },
       onReplyClick: (msgId: number) => {
         const msgs = getChannelMessages(channelId);
         const msg = msgs.find((m) => m.id === msgId);
@@ -321,10 +345,15 @@ export function createChannelController(opts: ChannelControllerOptions): Channel
     // composer disables (with a reason) when the socket is down or the user
     // may not post here, instead of accepting a click and failing. For DM
     // channels the reason also covers block state (channels-members-dms.md §3.2).
-    const dmRecipientId =
+    // Block gating is a 1:1 rule (Discord semantics, mirrored by the server's
+    // requireDMNotBlocked): a group DM is a shared room, and gating one
+    // member's composer over a block with one other member would leave the
+    // group reading a conversation that person cannot join.
+    const gatedDm =
       channelType === "dm"
-        ? (dmStore.getState().channels.find((c) => c.channelId === channelId)?.recipient.id ?? null)
-        : null;
+        ? dmStore.getState().channels.find((c) => c.channelId === channelId)
+        : undefined;
+    const dmRecipientId = gatedDm !== undefined && !gatedDm.isGroup ? gatedDm.recipient.id : null;
     // Slow mode as affordance: after an accepted send the composer disables
     // itself for the channel's cooldown with a live countdown, instead of
     // taking a message the server will bounce with SLOW_MODE (UX spec §5,
@@ -444,22 +473,62 @@ export function createChannelController(opts: ChannelControllerOptions): Channel
       { signal },
     );
 
+    // Age gate. Mounted over the message area — the channel is live underneath,
+    // so accepting reveals it without a refetch, and declining leaves the
+    // channel rather than pretending it is empty. Only the first open of a
+    // flagged channel in a session shows it (see @lib/nsfw-gate).
+    const storedChannel = channelsStore.getState().channels.get(channelId);
+    if (storedChannel !== undefined && nsfwGateRequired(storedChannel)) {
+      const gate = createNsfwGate({
+        channelId,
+        channelName,
+        onContinue: () => {
+          gate.destroy?.();
+          if (nsfwGate === gate) nsfwGate = null;
+        },
+        onCancel: () => {
+          // Leave the channel entirely: keeping the gate up over a channel the
+          // reader declined would strand them on a screen with no way out that
+          // is not also "continue".
+          destroyChannel();
+          setActiveChannel(null);
+        },
+      });
+      gate.mount(slots.messagesSlot);
+      nsfwGate = gate;
+    }
+
     // Update header
     if (chatHeaderRefs !== null && channelType === "dm") {
-      // Look up the recipient's actual status from DM store or members store
       const dmChannel = dmStore.getState().channels.find((c) => c.channelId === channelId);
-      let recipientStatus = "Offline";
-      if (dmChannel !== undefined) {
+      // A group has no single presence to show, so the subtitle lists who is
+      // in it instead — that is the fact a group header is asked for, and a
+      // first member's status presented as the group's would be a lie.
+      let subtitle = "Offline";
+      if (dmChannel !== undefined && dmChannel.isGroup) {
+        const names = dmChannel.participants.map((p) => (p.displayName ?? "") || p.username);
+        subtitle = `${names.length + 1} members: You, ${names.join(", ")}`;
+      } else if (dmChannel !== undefined) {
         const member = membersStore.getState().members.get(dmChannel.recipient.id);
-        recipientStatus = member?.status ?? dmChannel.recipient.status ?? "Offline";
+        const status = member?.status ?? dmChannel.recipient.status ?? "Offline";
+        subtitle = status.charAt(0).toUpperCase() + status.slice(1);
       }
-      const displayStatus = recipientStatus.charAt(0).toUpperCase() + recipientStatus.slice(1);
-      updateChatHeaderForDm(chatHeaderRefs, { username: channelName, status: displayStatus });
+      const headerName = dmChannel !== undefined ? dmDisplayName(dmChannel) : channelName;
+      updateChatHeaderForDm(chatHeaderRefs, { username: headerName, status: subtitle });
     } else if (chatHeaderRefs !== null) {
       updateChatHeaderForDm(chatHeaderRefs, null);
       if (chatHeaderName !== null) {
         setText(chatHeaderName, channelName);
       }
+      // Show the channel topic and keep it live across channel_update events.
+      const topicEl = chatHeaderRefs.topicEl;
+      setText(topicEl, channelsStore.getState().channels.get(channelId)?.topic ?? "");
+      composerGatingUnsubs.push(
+        channelsStore.subscribeSelector(
+          (s) => s.channels.get(channelId)?.topic ?? "",
+          (topic) => setText(topicEl, topic),
+        ),
+      );
     } else if (chatHeaderName !== null) {
       setText(chatHeaderName, channelName);
     }
diff --git a/Client/tauri-client/src/pages/main-page/ChatArea.ts b/Client/tauri-client/src/pages/main-page/ChatArea.ts
index 5c976087..72b98df1 100644
--- a/Client/tauri-client/src/pages/main-page/ChatArea.ts
+++ b/Client/tauri-client/src/pages/main-page/ChatArea.ts
@@ -15,6 +15,8 @@ import type { ChatHeaderRefs } from "./ChatHeader";
 import { createPinnedPanelController, createSearchOverlayController } from "./OverlayManagers";
 import type { SearchOverlayController } from "./OverlayManagers";
 import type { ChannelController } from "./ChannelController";
+import { createMessageJumper } from "./MessageJump";
+import { setMessageJumpHandler } from "@lib/message-navigation";
 
 // ---------------------------------------------------------------------------
 // Types
@@ -26,6 +28,8 @@ export interface ChatAreaOptions {
   readonly getToast: () => ToastContainer | null;
   readonly getChannelCtrl: () => ChannelController | null;
   readonly onToggleDmProfile?: () => void;
+  /** Start a call in the current DM (join its voice channel + ring). */
+  readonly onStartCall?: () => void;
 }
 
 export interface ChatAreaResult {
@@ -64,15 +68,26 @@ export function createChatArea(opts: ChatAreaOptions): ChatAreaResult {
   const children: MountableComponent[] = [];
   const unsubscribers: Array<() => void> = [];
 
+  // --- Message jumping ---
+  // One implementation for every jump affordance. Registering it globally lets
+  // parts that have no handle on this page — permalink chips inside a rendered
+  // message, owncord://message links from the OS — reach the same path.
+  const jumper = createMessageJumper({ api, getChannelCtrl });
+  unsubscribers.push(
+    setMessageJumpHandler((channelId, messageId) => {
+      void jumper.jumpTo(channelId, messageId);
+    }),
+  );
+
   // --- Overlay controllers ---
   const pinnedCtrl = createPinnedPanelController({
     api,
     getRoot,
     getCurrentChannelId: () => getChannelCtrl()?.currentChannelId ?? null,
     onJumpToMessage: (msgId: number) => {
-      const ctrl = getChannelCtrl();
-      if (ctrl == null || ctrl.messageList == null) return false;
-      return ctrl.messageList.scrollToMessage(msgId);
+      const channelId = getChannelCtrl()?.currentChannelId;
+      if (channelId == null) return;
+      void jumper.jumpTo(channelId, msgId);
     },
   });
   unsubscribers.push(() => {
@@ -83,10 +98,8 @@ export function createChatArea(opts: ChatAreaOptions): ChatAreaResult {
     api,
     getRoot,
     getCurrentChannelId: () => getChannelCtrl()?.currentChannelId ?? null,
-    onJumpToMessage: (_channelId: number, msgId: number) => {
-      const ctrl = getChannelCtrl();
-      if (ctrl == null || ctrl.messageList == null) return false;
-      return ctrl.messageList.scrollToMessage(msgId);
+    onJumpToMessage: (channelId: number, msgId: number) => {
+      void jumper.jumpTo(channelId, msgId);
     },
   });
   unsubscribers.push(() => {
@@ -102,6 +115,7 @@ export function createChatArea(opts: ChatAreaOptions): ChatAreaResult {
       searchCtrl.open();
     },
     onToggleDmProfile: opts.onToggleDmProfile,
+    onStartCall: opts.onStartCall,
   });
   const chatHeaderName = chatHeader.refs.nameEl;
 
diff --git a/Client/tauri-client/src/pages/main-page/ChatHeader.ts b/Client/tauri-client/src/pages/main-page/ChatHeader.ts
index 31fd7ac1..c6dd299c 100644
--- a/Client/tauri-client/src/pages/main-page/ChatHeader.ts
+++ b/Client/tauri-client/src/pages/main-page/ChatHeader.ts
@@ -13,12 +13,17 @@ export interface ChatHeaderRefs {
   readonly hashEl: HTMLSpanElement;
   readonly nameEl: HTMLSpanElement;
   readonly topicEl: HTMLSpanElement;
+  /** The DM call button. Hidden outside DMs — a guild voice channel is joined
+   *  from the sidebar, and a text channel has nobody in particular to call. */
+  readonly callBtn: HTMLButtonElement;
 }
 
 export interface ChatHeaderOptions {
   readonly onTogglePins: () => void;
   readonly onSearchFocus?: () => void;
   readonly onToggleDmProfile?: () => void;
+  /** Start a call in the current DM: join its voice channel and ring. */
+  readonly onStartCall?: () => void;
 }
 
 // ---------------------------------------------------------------------------
@@ -58,6 +63,19 @@ export function buildChatHeader(opts: ChatHeaderOptions): {
   const topicEl = createElement("span", { class: "ch-topic" }, "");
 
   const tools = createElement("div", { class: "ch-tools" });
+  const callBtn = createElement("button", {
+    type: "button",
+    class: "call-btn",
+    title: "Start a call",
+    "aria-label": "Start a call",
+    "data-testid": "call-btn",
+  });
+  callBtn.appendChild(createIcon("phone", 18));
+  callBtn.style.display = "none";
+  if (opts.onStartCall !== undefined) {
+    const start = opts.onStartCall;
+    callBtn.addEventListener("click", () => start());
+  }
   const pinBtn = createElement("button", {
     type: "button",
     class: "pin-btn",
@@ -82,16 +100,23 @@ export function buildChatHeader(opts: ChatHeaderOptions): {
       searchInput.blur();
     });
   }
-  appendChildren(tools, searchInput, pinBtn);
+  appendChildren(tools, searchInput, callBtn, pinBtn);
 
   appendChildren(header, nameGroup, divider, topicEl, tools);
-  return { element: header, refs: { hashEl: hash, nameEl, topicEl } };
+  return { element: header, refs: { hashEl: hash, nameEl, topicEl, callBtn } };
 }
 
 // ---------------------------------------------------------------------------
 // DM mode helper
 // ---------------------------------------------------------------------------
 
+/**
+ * Put the header into DM mode (or, with null, back into channel mode).
+ *
+ * `subtitle` is what sits where a channel topic would: the other party's
+ * presence for a 1:1 DM, and the member list for a group — a group has no
+ * single status to show, and "who is in here" is the fact that matters.
+ */
 export function updateChatHeaderForDm(
   refs: ChatHeaderRefs,
   recipient: { username: string; status: string } | null,
@@ -100,7 +125,9 @@ export function updateChatHeaderForDm(
     setText(refs.hashEl, "@");
     setText(refs.nameEl, recipient.username);
     setText(refs.topicEl, recipient.status);
+    refs.callBtn.style.display = "";
   } else {
     setText(refs.hashEl, "#");
+    refs.callBtn.style.display = "none";
   }
 }
diff --git a/Client/tauri-client/src/pages/main-page/MemberPickerModal.ts b/Client/tauri-client/src/pages/main-page/MemberPickerModal.ts
index 8e93f380..c3669252 100644
--- a/Client/tauri-client/src/pages/main-page/MemberPickerModal.ts
+++ b/Client/tauri-client/src/pages/main-page/MemberPickerModal.ts
@@ -1,6 +1,13 @@
 /**
- * MemberPickerModal — a simple modal that lists server members for starting
- * a new DM conversation. Uses the shared modal factory for overlay behavior.
+ * MemberPickerModal — lists server members for starting a DM.
+ *
+ * One picker covers both cases rather than two: selecting a single member
+ * opens a 1:1 DM, selecting two or more creates a group. That is Discord's
+ * model, and it is also the honest one — "new conversation" is one intent, and
+ * making the user choose "DM" or "group DM" up front asks them to commit
+ * before they have picked who is in it.
+ *
+ * Uses the shared modal factory for overlay behavior.
  */
 
 import { createElement, setText, appendChildren } from "@lib/dom";
@@ -9,14 +16,20 @@ import type { ModalInstance } from "@lib/modalFactory";
 import type { MountableComponent } from "@lib/safe-render";
 import { membersStore } from "@stores/members.store";
 import { authStore } from "@stores/auth.store";
+import { MAX_GROUP_DM_PARTICIPANTS } from "@lib/constants";
 
 // ---------------------------------------------------------------------------
 // Types
 // ---------------------------------------------------------------------------
 
 export interface MemberPickerOptions {
-  /** Called when the user selects a member. Receives the member's user ID. */
+  /** One member picked — open a 1:1 DM. */
   readonly onSelect: (userId: number) => void;
+  /**
+   * Two or more picked — create a group DM. Optional: without it the picker
+   * stays single-select and behaves exactly as it did before groups.
+   */
+  readonly onSelectGroup?: (userIds: readonly number[], name: string) => void;
   /** Called when the modal is dismissed (cancel or overlay click). */
   readonly onClose: () => void;
 }
@@ -31,28 +44,70 @@ export interface MemberPickerOptions {
  */
 export function createMemberPickerModal(opts: MemberPickerOptions): MountableComponent {
   let modalInstance: ModalInstance | null = null;
+  const selected = new Set<number>();
+  const multi = opts.onSelectGroup !== undefined;
 
   function mount(container: Element): void {
     const members = membersStore.getState().members;
     const currentUserId = authStore.getState().user?.id ?? 0;
 
-    // Build the content that goes inside the modal
     const content = createElement("div", { style: "padding:20px;" });
     const title = createElement("h3", {}, "New Direct Message");
     const subtitle = createElement(
       "p",
       { style: "color:var(--text-secondary);font-size:0.85rem;margin:0 0 8px;" },
-      "Select a member to start a conversation",
+      multi
+        ? `Select one member for a DM, or up to ${MAX_GROUP_DM_PARTICIPANTS - 1} for a group`
+        : "Select a member to start a conversation",
     );
     const listContainer = createElement("div", {
       class: "dm-member-picker-list",
       style: "max-height:300px;overflow-y:auto;",
     });
 
+    // Group name field, revealed only once the selection is actually a group:
+    // asking a 1:1 DM to be named would be asking for something that has no
+    // effect (the server refuses to name a two-person DM).
+    const nameInput = createElement("input", {
+      class: "dm-group-name-input",
+      type: "text",
+      maxlength: "100",
+      placeholder: "Group name (optional)",
+      "data-testid": "dm-group-name",
+      style: "width:100%;margin-top:10px;",
+    });
+    nameInput.style.display = "none";
+
+    const confirmBtn = createElement(
+      "button",
+      {
+        class: "btn btn-primary",
+        style: "margin-top:10px;width:100%;",
+        "data-testid": "dm-picker-create",
+      },
+      "Create DM",
+    );
+    confirmBtn.style.display = "none";
+
+    const close = (): void => {
+      modalInstance?.close();
+    };
+
+    const refreshControls = (): void => {
+      const isGroup = selected.size >= 2;
+      // The name field appears only once the selection is actually a group:
+      // the server refuses to name a two-person DM, so offering the field
+      // there would be offering something that cannot take effect.
+      nameInput.style.display = isGroup ? "" : "none";
+      confirmBtn.style.display = selected.size >= 1 ? "" : "none";
+      setText(confirmBtn, isGroup ? `Create Group DM (${selected.size + 1})` : "Create DM");
+    };
+
     for (const member of members.values()) {
       if (member.id === currentUserId) continue;
       const item = createElement("div", {
         class: "dm-member-picker-item channel-item",
+        "data-testid": `dm-picker-member-${member.id}`,
         style: "cursor:pointer;padding:6px 8px;display:flex;align-items:center;gap:8px;",
       });
       const avatar = createElement("div", {
@@ -60,8 +115,9 @@ export function createMemberPickerModal(opts: MemberPickerOptions): MountableCom
         style:
           "width:28px;height:28px;border-radius:50%;background:#5865F2;display:flex;align-items:center;justify-content:center;font-size:0.75rem;color:white;flex-shrink:0;",
       });
-      setText(avatar, member.username.charAt(0).toUpperCase());
-      const nameEl = createElement("span", {}, member.username);
+      const label = (member.displayName ?? "") || member.username;
+      setText(avatar, label.charAt(0).toUpperCase());
+      const nameEl = createElement("span", {}, label);
       const statusEl = createElement(
         "span",
         {
@@ -72,29 +128,55 @@ export function createMemberPickerModal(opts: MemberPickerOptions): MountableCom
       appendChildren(item, avatar, nameEl, statusEl);
 
       item.addEventListener("click", () => {
-        if (modalInstance !== null) {
-          modalInstance.close();
+        // Single-select mode keeps the pre-group behaviour: one click, one DM.
+        if (!multi) {
+          close();
+          opts.onSelect(member.id);
+          return;
         }
-        opts.onSelect(member.id);
+        if (selected.has(member.id)) {
+          selected.delete(member.id);
+          item.classList.remove("selected");
+          refreshControls();
+          return;
+        }
+        // The cap counts the creator too, so the picker allows one fewer.
+        if (selected.size >= MAX_GROUP_DM_PARTICIPANTS - 1) return;
+        selected.add(member.id);
+        item.classList.add("selected");
+        refreshControls();
       });
+
       listContainer.appendChild(item);
     }
 
+    // One button for both outcomes, relabelled by the selection size. A
+    // separate "make it a group" control would ask the user to declare their
+    // intent before picking who is in it, when the picking is the declaration.
+    confirmBtn.addEventListener("click", () => {
+      const ids = [...selected];
+      if (ids.length === 0) return;
+      if (ids.length === 1) {
+        close();
+        opts.onSelect(ids[0]!);
+        return;
+      }
+      const name = nameInput.value.trim();
+      close();
+      opts.onSelectGroup?.(ids, name);
+    });
+
     const cancelBtn = createElement(
       "button",
       {
         class: "btn btn-secondary",
-        style: "margin-top:12px;width:100%;",
+        style: "margin-top:8px;width:100%;",
       },
       "Cancel",
     );
-    cancelBtn.addEventListener("click", () => {
-      if (modalInstance !== null) {
-        modalInstance.close();
-      }
-    });
+    cancelBtn.addEventListener("click", () => close());
 
-    appendChildren(content, title, subtitle, listContainer, cancelBtn);
+    appendChildren(content, title, subtitle, listContainer, nameInput, confirmBtn, cancelBtn);
 
     modalInstance = createModal(
       {
@@ -107,6 +189,7 @@ export function createMemberPickerModal(opts: MemberPickerOptions): MountableCom
   }
 
   function destroy(): void {
+    selected.clear();
     if (modalInstance !== null) {
       modalInstance.destroy();
       modalInstance = null;
diff --git a/Client/tauri-client/src/pages/main-page/MessageJump.ts b/Client/tauri-client/src/pages/main-page/MessageJump.ts
new file mode 100644
index 00000000..7d3491ac
--- /dev/null
+++ b/Client/tauri-client/src/pages/main-page/MessageJump.ts
@@ -0,0 +1,116 @@
+/**
+ * MessageJump — the one implementation behind every "jump to this message"
+ * affordance: search results, the pinned panel, reply bars, permalink chips in
+ * chat, and `owncord://message/…` links opened from the OS.
+ *
+ * The interesting case is a target outside the loaded window. Rather than
+ * telling the user "not in loaded history" and stopping there (which is what
+ * the search and pinned panels used to do), the jumper fetches the server's
+ * around-window, swaps it into the store, and scrolls to the target. That
+ * leaves the channel *detached* from the live tail, which the MessageList
+ * signals with its "Jump to Present" pill.
+ */
+
+import type { ApiClient } from "@lib/api";
+import { createLogger } from "@lib/logger";
+import { ApiClientError } from "@lib/api";
+import { showToast } from "@lib/toast";
+import { findChannelById, navigateToChannel } from "@lib/channel-navigation";
+import { setAroundMessages, hasMessageLoaded } from "@stores/messages.store";
+import type { ChannelController } from "./ChannelController";
+
+const log = createLogger("message-jump");
+
+/** Window size requested when a jump target is not in the loaded page. */
+const AROUND_WINDOW = 50;
+
+export interface MessageJumpOptions {
+  readonly api: ApiClient;
+  readonly getChannelCtrl: () => ChannelController | null;
+  /**
+   * Wait for the channel switch / re-render to hit the DOM. Defaults to a
+   * requestAnimationFrame; tests inject a resolved promise instead.
+   */
+  readonly nextFrame?: () => Promise<void>;
+}
+
+export interface MessageJumper {
+  /**
+   * Open `channelId` if needed and scroll to `messageId`, fetching the
+   * around-window when the message is not loaded. Resolves true when the row
+   * was actually reached.
+   */
+  jumpTo(channelId: number, messageId: number): Promise<boolean>;
+}
+
+function defaultNextFrame(): Promise<void> {
+  return new Promise((resolve) => {
+    requestAnimationFrame(() => resolve());
+  });
+}
+
+export function createMessageJumper(opts: MessageJumpOptions): MessageJumper {
+  const nextFrame = opts.nextFrame ?? defaultNextFrame;
+
+  /** Scroll the mounted list to a message, if that list is showing `channelId`. */
+  function scrollIfMounted(channelId: number, messageId: number): boolean {
+    const ctrl = opts.getChannelCtrl();
+    if (ctrl === null || ctrl.messageList === null) return false;
+    if (ctrl.currentChannelId !== channelId) return false;
+    return ctrl.messageList.scrollToMessage(messageId);
+  }
+
+  async function jumpTo(channelId: number, messageId: number): Promise<boolean> {
+    // A permalink to a channel this user cannot see must degrade quietly
+    // rather than blank the chat area on an unknown id.
+    if (findChannelById(channelId) === null) {
+      showToast("That channel isn't available", "info");
+      return false;
+    }
+
+    const ctrl = opts.getChannelCtrl();
+    if (ctrl === null) return false;
+
+    if (ctrl.currentChannelId !== channelId) {
+      navigateToChannel(channelId);
+      // The channel switch mounts a fresh MessageList and kicks off its
+      // history fetch; give it a frame before asking it to scroll.
+      await nextFrame();
+    }
+
+    if (scrollIfMounted(channelId, messageId)) return true;
+
+    // Not in the loaded window (or the fresh channel is still fetching) —
+    // replace the window with one centred on the target.
+    try {
+      const resp = await opts.api.getMessagesAround(channelId, messageId, {
+        limit: AROUND_WINDOW,
+      });
+      setAroundMessages(channelId, resp.messages, resp.has_more_before, resp.has_more_after);
+    } catch (err) {
+      if (err instanceof ApiClientError && err.status === 404) {
+        showToast("That message no longer exists", "info");
+        return false;
+      }
+      log.error("Failed to fetch the message window", { channelId, messageId, error: String(err) });
+      showToast("Couldn't jump to that message", "error");
+      return false;
+    }
+
+    if (!hasMessageLoaded(channelId, messageId)) {
+      // The server answered but the centre is not in the window — nothing to
+      // scroll to, and silently landing elsewhere would be worse.
+      showToast("Couldn't jump to that message", "error");
+      return false;
+    }
+
+    // The store update re-renders the list; scroll on the next frame.
+    await nextFrame();
+    if (scrollIfMounted(channelId, messageId)) return true;
+
+    log.warn("Around-window loaded but the row did not render", { channelId, messageId });
+    return false;
+  }
+
+  return { jumpTo };
+}
diff --git a/Client/tauri-client/src/pages/main-page/OverlayManagers.ts b/Client/tauri-client/src/pages/main-page/OverlayManagers.ts
index b79a6216..03f83868 100644
--- a/Client/tauri-client/src/pages/main-page/OverlayManagers.ts
+++ b/Client/tauri-client/src/pages/main-page/OverlayManagers.ts
@@ -204,7 +204,12 @@ export function createPinnedPanelController(opts: {
   readonly getRoot: () => HTMLDivElement | null;
 
   readonly getCurrentChannelId: () => number | null;
-  readonly onJumpToMessage?: (messageId: number) => boolean;
+  /**
+   * Jump to a pinned message. Fire-and-forget: the jumper fetches the
+   * around-window when the message is not loaded and reports its own failures,
+   * so the panel simply closes and gets out of the way.
+   */
+  readonly onJumpToMessage?: (messageId: number) => void;
 }): PinnedPanelController {
   let instance: MountableComponent | null = null;
 
@@ -230,16 +235,8 @@ export function createPinnedPanelController(opts: {
         channelId,
         pinnedMessages: pins,
         onJumpToMessage: (msgId: number) => {
-          if (opts.onJumpToMessage !== undefined) {
-            const found = opts.onJumpToMessage(msgId);
-            if (found) {
-              close();
-            } else {
-              showToast("Message not in loaded window", "info");
-            }
-          } else {
-            close();
-          }
+          opts.onJumpToMessage?.(msgId);
+          close();
         },
         onUnpin: (msgId: number) => {
           void opts.api
@@ -280,7 +277,12 @@ export function createSearchOverlayController(opts: {
   readonly getRoot: () => HTMLDivElement | null;
 
   readonly getCurrentChannelId: () => number | null;
-  readonly onJumpToMessage?: (channelId: number, messageId: number) => boolean;
+  /**
+   * Jump to a search hit, in whichever channel it lives. Fire-and-forget — the
+   * jumper opens the channel, fetches the around-window when needed, and
+   * surfaces its own failures.
+   */
+  readonly onJumpToMessage?: (channelId: number, messageId: number) => void;
 }): SearchOverlayController {
   let instance: MountableComponent | null = null;
 
@@ -311,16 +313,13 @@ export function createSearchOverlayController(opts: {
         }
       },
       onSelectResult: (result) => {
-        setActiveChannel(result.channel_id);
-        if (opts.onJumpToMessage !== undefined) {
-          // Give the channel a frame to mount before scrolling
-          requestAnimationFrame(() => {
-            const found = opts.onJumpToMessage!(result.channel_id, result.message_id);
-            if (!found) {
-              showToast("Message not in loaded history", "info");
-            }
-          });
+        if (opts.onJumpToMessage === undefined) {
+          setActiveChannel(result.channel_id);
+          return;
         }
+        // The jumper owns the channel switch too, so the fetch it may need to
+        // do is sequenced after the switch rather than racing it.
+        opts.onJumpToMessage(result.channel_id, result.message_id);
       },
       onClose: close,
     });
diff --git a/Client/tauri-client/src/pages/main-page/SidebarArea.ts b/Client/tauri-client/src/pages/main-page/SidebarArea.ts
index 9c23c5c6..b7840441 100644
--- a/Client/tauri-client/src/pages/main-page/SidebarArea.ts
+++ b/Client/tauri-client/src/pages/main-page/SidebarArea.ts
@@ -5,7 +5,7 @@
  * unified sidebar layout with a quick-switch overlay for server switching.
  */
 
-import { createElement, setText, clearChildren, appendChildren } from "@lib/dom";
+import { createElement, setText, clearChildren } from "@lib/dom";
 import type { MountableComponent } from "@lib/safe-render";
 import type { WsClient } from "@lib/ws";
 import type { ApiClient } from "@lib/api";
@@ -20,15 +20,23 @@ import { createUserBar } from "@components/UserBar";
 import { createVoiceWidget } from "@components/VoiceWidget";
 import { createQuickSwitchOverlay } from "@components/QuickSwitchOverlay";
 import type { QuickSwitchProfile } from "@components/QuickSwitchOverlay";
-import { createVoiceWidgetCallbacks, createSidebarVoiceCallbacks } from "./VoiceCallbacks";
+import {
+  createVoiceWidgetCallbacks,
+  createSidebarVoiceCallbacks,
+  createVoiceModerationCallbacks,
+} from "./VoiceCallbacks";
 import { createSidebarMemberSection } from "./SidebarMemberSection";
 import { createInviteManagerController } from "./OverlayManagers";
 import {
   selectDmConversation,
   handleCreateDm,
+  handleCreateGroupDm,
   buildDmConversations,
   type DmHelperDeps,
 } from "./SidebarDmHelpers";
+import { createMemberPickerModal } from "./MemberPickerModal";
+import { createPromptModal } from "@lib/modalFactory";
+import { toggleChannelMute } from "@lib/channel-mutes";
 import { createSidebarDmSection } from "./SidebarDmSection";
 import { uiStore, setSidebarMode, loadCollapsedCategories } from "@stores/ui.store";
 import { authStore, clearAuth } from "@stores/auth.store";
@@ -36,6 +44,8 @@ import { membersStore, getOnlineMembers } from "@stores/members.store";
 import { channelsStore, setActiveChannel } from "@stores/channels.store";
 import { dmStore, removeDmChannel } from "@stores/dm.store";
 import { createProfileManager, createTauriBackend } from "@lib/profiles";
+import { openAdminPanel } from "@lib/admin-panel";
+import { canViewAuditLog } from "@lib/permissions";
 import type { ProfileManager } from "@lib/profiles";
 
 // ---------------------------------------------------------------------------
@@ -94,6 +104,11 @@ export function createSidebarArea(opts: SidebarAreaOptions): SidebarAreaResult {
   // Quick-switch overlay instance
   let quickSwitchInstance: MountableComponent | null = null;
 
+  // Re-render hook for the DM sidebar, set while DM mode is mounted. Mute state
+  // lives in localStorage rather than a store, so toggling it has no subscriber
+  // to wake — this is how the row redraws dimmed.
+  let refreshDmSidebarRef: (() => void) | null = null;
+
   // ---------------------------------------------------------------------------
   // Sidebar wrapper (replaces old channel-sidebar root)
   // ---------------------------------------------------------------------------
@@ -143,6 +158,59 @@ export function createSidebarArea(opts: SidebarAreaOptions): SidebarAreaResult {
     headerInviteCtrl.cleanup();
   });
 
+  // ---------------------------------------------------------------------------
+  // Audit log entry point
+  // ---------------------------------------------------------------------------
+  //
+  // The audit log itself stays in the admin panel — it is a paginated,
+  // filterable table over an endpoint this client otherwise never calls, and a
+  // second implementation would be a second thing to keep correct. What belongs
+  // here is the way in, for the moderators who hold VIEW_AUDIT_LOG and would
+  // otherwise have to know the panel's URL by heart.
+  //
+  // Rendered once per mount and kept in sync with the role list: `ready` may
+  // land after this header is built, and a moderator whose role only becomes
+  // known then would never see the entry otherwise.
+  const auditBtn = createElement(
+    "button",
+    {
+      class: "sidebar-audit-btn",
+      title: "Open the audit log in the admin panel (opens in your browser)",
+      "data-testid": "audit-log-btn",
+    },
+    "Audit Log",
+  );
+  auditBtn.addEventListener("click", () => {
+    const host = api.getConfig().host ?? "";
+    if (host === "") {
+      getToast()?.show("Not connected to a server", "error");
+      return;
+    }
+    void openAdminPanel(host, "audit").catch(() => {
+      getToast()?.show("Could not open the admin panel", "error");
+    });
+  });
+
+  const syncAuditBtn = (): void => {
+    auditBtn.style.display = canViewAuditLog() ? "" : "none";
+  };
+  syncAuditBtn();
+  serverHeader.appendChild(auditBtn);
+  // The permission is derived from the signed-in user's role plus the role
+  // list, so both have to be watched.
+  unsubscribers.push(
+    authStore.subscribeSelector(
+      (s) => s.user?.role ?? null,
+      () => syncAuditBtn(),
+    ),
+  );
+  unsubscribers.push(
+    channelsStore.subscribeSelector(
+      (s) => s.roles,
+      () => syncAuditBtn(),
+    ),
+  );
+
   sidebarWrapper.appendChild(serverHeader);
 
   // Load per-server collapsed category state from localStorage
@@ -186,6 +254,7 @@ export function createSidebarArea(opts: SidebarAreaOptions): SidebarAreaResult {
     return createChannelSidebar({
       onVoiceJoin: sidebarVoice.onVoiceJoin,
       onVoiceLeave: sidebarVoice.onVoiceLeave,
+      onVoiceModerate: createVoiceModerationCallbacks(ws),
       onWatchStream: opts.onWatchStream,
       onCreateChannel: (category) => {
         if (activeModal !== null) return;
@@ -211,10 +280,20 @@ export function createSidebarArea(opts: SidebarAreaOptions): SidebarAreaResult {
       },
       onEditChannel: (channel) => {
         if (activeModal !== null) return;
+        // Pre-fill from the store rather than from the sidebar's row: the store
+        // is what channel_update writes into, so the modal opens on the current
+        // values even if the row was rendered before the last edit landed.
+        const stored = channelsStore.getState().channels.get(channel.id);
         const modal = createEditChannelModal({
           channelId: channel.id,
           channelName: channel.name,
           channelType: channel.type,
+          channelTopic: stored?.topic ?? "",
+          channelCategory: stored?.category ?? "",
+          channelSlowMode: stored?.slowMode ?? 0,
+          channelNsfw: stored?.nsfw ?? false,
+          channelVoiceMaxUsers: stored?.voiceMaxUsers ?? 0,
+          channelVoiceMaxVideo: stored?.voiceMaxVideo ?? 0,
           onSave: async (data) => {
             try {
               await api.adminUpdateChannel(channel.id, data);
@@ -261,6 +340,22 @@ export function createSidebarArea(opts: SidebarAreaOptions): SidebarAreaResult {
           void api.adminUpdateChannel(r.channelId, { position: r.newPosition });
         }
       },
+      onPurgeChannel: async (channel, count) => {
+        try {
+          // The store is updated by the chat_bulk_deleted broadcast, so the
+          // response is only used for the toast's honest count.
+          const result = await api.purgeMessages(channel.id, count);
+          getToast()?.show(
+            result.count === 0
+              ? `No messages to purge in #${channel.name}`
+              : `Purged ${result.count} message${result.count === 1 ? "" : "s"} from #${channel.name}`,
+            result.count === 0 ? "info" : "success",
+          );
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : "Failed to purge messages";
+          getToast()?.show(msg, "error");
+        }
+      },
     });
   }
 
@@ -277,85 +372,29 @@ export function createSidebarArea(opts: SidebarAreaOptions): SidebarAreaResult {
     },
   };
 
-  /** Show a simple member picker modal and call createDm on selection. */
+  /**
+   * Show the member picker. One selection opens a 1:1 DM; two or more create a
+   * group — the picker itself decides which, so the sidebar does not need two
+   * entry points for what the user experiences as one action.
+   */
   function showMemberPicker(): void {
     if (activeModal !== null) return;
 
-    const members = membersStore.getState().members;
-    const currentUserId = authStore.getState().user?.id ?? 0;
-
-    const overlay = createElement("div", { class: "modal-overlay visible" });
-    const modal = createElement("div", {
-      class: "modal dm-member-picker-modal",
-      style: "padding:20px;",
-    });
-    const title = createElement("h3", {}, "New Direct Message");
-    const subtitle = createElement(
-      "p",
-      { style: "color:var(--text-secondary);font-size:0.85rem;margin:0 0 8px;" },
-      "Select a member to start a conversation",
-    );
-    const listContainer = createElement("div", {
-      class: "dm-member-picker-list",
-      style: "max-height:300px;overflow-y:auto;",
-    });
-
-    for (const member of members.values()) {
-      if (member.id === currentUserId) continue;
-      const item = createElement("div", {
-        class: "dm-member-picker-item channel-item",
-        style: "cursor:pointer;padding:6px 8px;display:flex;align-items:center;gap:8px;",
-      });
-      const avatar = createElement("div", {
-        class: "dm-avatar",
-        style:
-          "width:28px;height:28px;border-radius:50%;background:#5865F2;display:flex;align-items:center;justify-content:center;font-size:0.75rem;color:white;flex-shrink:0;",
-      });
-      setText(avatar, member.username.charAt(0).toUpperCase());
-      const nameEl = createElement("span", {}, member.username);
-      const statusEl = createElement(
-        "span",
-        {
-          style: `font-size:0.75rem;margin-left:auto;color:${member.status === "online" ? "var(--green)" : "var(--text-micro)"};`,
-        },
-        member.status,
-      );
-      appendChildren(item, avatar, nameEl, statusEl);
-
-      item.addEventListener("click", () => {
+    const picker = createMemberPickerModal({
+      onSelect: (userId) => {
         closePickerModal();
-        void handleCreateDm(member.id, dmDeps);
-      });
-      listContainer.appendChild(item);
-    }
-
-    const cancelBtn = createElement(
-      "button",
-      {
-        class: "btn btn-secondary",
-        style: "margin-top:12px;width:100%;",
+        void handleCreateDm(userId, dmDeps);
+      },
+      onSelectGroup: (userIds, name) => {
+        closePickerModal();
+        void handleCreateGroupDm(userIds, name, dmDeps);
+      },
+      onClose: () => {
+        activeModal = null;
       },
-      "Cancel",
-    );
-    cancelBtn.addEventListener("click", () => closePickerModal());
-
-    appendChildren(modal, title, subtitle, listContainer, cancelBtn);
-    overlay.appendChild(modal);
-    overlay.addEventListener("click", (e) => {
-      if (e.target === overlay) closePickerModal();
     });
-
-    const pickerComponent: MountableComponent = {
-      mount: (container: Element) => {
-        container.appendChild(overlay);
-      },
-      destroy: () => {
-        overlay.remove();
-      },
-    };
-
-    activeModal = pickerComponent;
-    pickerComponent.mount(document.body);
+    activeModal = picker;
+    picker.mount(document.body);
   }
 
   function closePickerModal(): void {
@@ -369,48 +408,91 @@ export function createSidebarArea(opts: SidebarAreaOptions): SidebarAreaResult {
   // DM sidebar builder (dms mode)
   // ---------------------------------------------------------------------------
 
+  /**
+   * Leave the DM list gracefully after a conversation goes away: fall back to
+   * another DM if there is one, otherwise to the channel the user came from.
+   */
+  function fallBackFromDm(): void {
+    const remaining = dmStore.getState().channels;
+    if (remaining.length > 0) {
+      selectDmConversation(remaining[0]!, dmDeps);
+      return;
+    }
+    setSidebarMode("channels");
+    if (channelBeforeDm !== null) {
+      setActiveChannel(channelBeforeDm);
+      return;
+    }
+    for (const ch of channelsStore.getState().channels.values()) {
+      if (ch.type === "text") {
+        setActiveChannel(ch.id);
+        break;
+      }
+    }
+  }
+
+  /**
+   * Close a 1:1 DM or leave a group.
+   *
+   * The client does not decide which: the server's DELETE /dms/{id} is a hide
+   * for a 1:1 and a leave for a group, and duplicating that branch here would
+   * be a second place to get it wrong. Locally, both mean "drop it from the
+   * list" — the row is removed optimistically because the request is a
+   * fire-and-forget one whose failure the sidebar cannot usefully recover from
+   * (the next `ready` restores the truth either way).
+   */
+  function closeOrLeaveDm(channelId: number): void {
+    const wasActive = channelsStore.getState().activeChannelId === channelId;
+    removeDmChannel(channelId);
+    void api.closeDm(channelId).catch(() => {
+      getToast()?.show("Could not leave that conversation", "error");
+    });
+    if (wasActive) fallBackFromDm();
+  }
+
+  /** Rename a group DM (participants only; the server refuses a 1:1). */
+  function renameGroup(channelId: number): void {
+    const dm = dmStore.getState().channels.find((c) => c.channelId === channelId);
+    if (dm === undefined || !dm.isGroup) return;
+    createPromptModal({
+      title: "Rename Group",
+      label: "Leave it empty to go back to listing the members.",
+      initialValue: dm.name,
+      placeholder: "Group name",
+      maxLength: 100,
+      testId: "dm-rename-input",
+      onSubmit: (name) => {
+        // The store is updated by the dm_channel_open the server fans out to
+        // every participant, so the response is only used for the error path.
+        void api.renameGroupDm(channelId, name).catch((err: unknown) => {
+          const msg = err instanceof Error ? err.message : "Failed to rename group";
+          getToast()?.show(msg, "error");
+        });
+      },
+    });
+  }
+
   function buildDmSidebar(): MountableComponent {
     const serverName = authStore.getState().serverName ?? "Server";
-    const activeDmUserId = uiStore.getState().activeDmUserId;
+    const activeChannelId = channelsStore.getState().activeChannelId;
     const dmChannels = dmStore.getState().channels;
-    const conversations = buildDmConversations(activeDmUserId);
+    const conversations = buildDmConversations(activeChannelId);
 
     return createDmSidebar({
       conversations,
-      onSelectConversation: (userId) => {
-        const dmChannel = dmChannels.find((c) => c.recipient.id === userId);
+      onSelectConversation: (channelId) => {
+        const dmChannel = dmChannels.find((c) => c.channelId === channelId);
         if (dmChannel !== undefined) {
           selectDmConversation(dmChannel, dmDeps);
         }
       },
-      onCloseDm: (userId) => {
-        const dmChannel = dmChannels.find((c) => c.recipient.id === userId);
-        if (dmChannel !== undefined) {
-          const wasActive = channelsStore.getState().activeChannelId === dmChannel.channelId;
-          removeDmChannel(dmChannel.channelId);
-          void api.closeDm(dmChannel.channelId);
-
-          if (wasActive) {
-            const remaining = dmStore.getState().channels;
-            if (remaining.length > 0) {
-              selectDmConversation(remaining[0]!, dmDeps);
-            } else {
-              setSidebarMode("channels");
-              if (channelBeforeDm !== null) {
-                setActiveChannel(channelBeforeDm);
-              } else {
-                const channels = channelsStore.getState().channels;
-                for (const ch of channels.values()) {
-                  if (ch.type === "text") {
-                    setActiveChannel(ch.id);
-                    break;
-                  }
-                }
-              }
-            }
-          }
-        }
+      onCloseDm: (channelId) => closeOrLeaveDm(channelId),
+      onToggleMute: (channelId) => {
+        toggleChannelMute(channelId);
+        // Mute state is not in a store, so nothing re-renders on its own.
+        refreshDmSidebarRef?.();
       },
+      onRenameGroup: (channelId) => renameGroup(channelId),
       onNewDm: () => {
         showMemberPicker();
       },
@@ -420,8 +502,7 @@ export function createSidebarArea(opts: SidebarAreaOptions): SidebarAreaResult {
           setActiveChannel(channelBeforeDm);
           channelBeforeDm = null;
         } else {
-          const channels = channelsStore.getState().channels;
-          for (const ch of channels.values()) {
+          for (const ch of channelsStore.getState().channels.values()) {
             if (ch.type === "text") {
               setActiveChannel(ch.id);
               break;
@@ -497,7 +578,13 @@ export function createSidebarArea(opts: SidebarAreaOptions): SidebarAreaResult {
       // --- Member list (below DM section) ---
       // Same wiring lives in SidebarMemberSection; this used to be a private
       // copy of it, and a fix to one silently missed the other.
-      const memberSection = createSidebarMemberSection({ api, getToast });
+      const memberSection = createSidebarMemberSection({
+        api,
+        getToast,
+        onMessageUser: (userId) => {
+          void handleCreateDm(userId, dmDeps);
+        },
+      });
       contentSlot.appendChild(memberSection.element);
       channelModeExtras.push(memberSection.memberListComponent);
       channelModeUnsubs.push(memberSection.destroy);
@@ -529,6 +616,11 @@ export function createSidebarArea(opts: SidebarAreaOptions): SidebarAreaResult {
         contentSlot.appendChild(freshSlot);
       }
 
+      refreshDmSidebarRef = refreshDmSidebar;
+      channelModeUnsubs.push(() => {
+        refreshDmSidebarRef = null;
+      });
+
       // Re-render DM sidebar when DM store changes (new DMs, message updates)
       const unsubDmStore = dmStore.subscribeSelector(
         (s) => s.channels,
@@ -538,9 +630,10 @@ export function createSidebarArea(opts: SidebarAreaOptions): SidebarAreaResult {
       );
       channelModeUnsubs.push(unsubDmStore);
 
-      // Re-render DM sidebar when active DM user changes
-      const unsubDmActive = uiStore.subscribeSelector(
-        (s) => s.activeDmUserId,
+      // Re-render DM sidebar when the active conversation changes. Keyed on the
+      // active channel rather than activeDmUserId, which a group DM leaves null.
+      const unsubDmActive = channelsStore.subscribeSelector(
+        (s) => s.activeChannelId,
         () => {
           refreshDmSidebar();
         },
diff --git a/Client/tauri-client/src/pages/main-page/SidebarDmHelpers.ts b/Client/tauri-client/src/pages/main-page/SidebarDmHelpers.ts
index d5328fcb..d9801c2d 100644
--- a/Client/tauri-client/src/pages/main-page/SidebarDmHelpers.ts
+++ b/Client/tauri-client/src/pages/main-page/SidebarDmHelpers.ts
@@ -9,9 +9,11 @@ import type { DmConversation } from "@components/DmSidebar";
 import { setSidebarMode, setActiveDmUser } from "@stores/ui.store";
 import { channelsStore, setActiveChannel } from "@stores/channels.store";
 import type { Channel } from "@stores/channels.store";
-import { dmStore, clearDmUnread, addDmChannel } from "@stores/dm.store";
-import type { DmChannel } from "@stores/dm.store";
+import { dmStore, clearDmUnread, addDmChannel, dmDisplayName } from "@stores/dm.store";
+import type { DmChannel, DmUser } from "@stores/dm.store";
 import { membersStore } from "@stores/members.store";
+import { isChannelMuted } from "@lib/channel-mutes";
+import type { DmChannelPayload } from "@lib/types";
 
 // ---------------------------------------------------------------------------
 // Types
@@ -43,7 +45,10 @@ export function selectDmConversation(dmChannel: DmChannel, deps: DmHelperDeps):
     }
   }
 
-  setActiveDmUser(dmChannel.recipient.id);
+  // A group has no single "DM user"; the sidebar's active marker keys on the
+  // active channel instead. This is kept for the 1:1 case, where other parts
+  // (the profile sidebar) still ask "who am I talking to".
+  setActiveDmUser(dmChannel.isGroup ? null : dmChannel.recipient.id);
   setSidebarMode("dms");
   clearDmUnread(dmChannel.channelId);
 
@@ -60,22 +65,33 @@ export function selectDmConversation(dmChannel: DmChannel, deps: DmHelperDeps):
 export function addDmToChannelsStore(dmChannel: DmChannel): void {
   const existing = channelsStore.getState().channels.get(dmChannel.channelId);
 
-  // If the channel exists but has an empty name (server sends DMs with name=''),
-  // update it with the recipient's username
-  if (existing !== undefined && existing.name !== "") return;
+  // Re-synthesise when the stored name has gone stale as well as when it is
+  // empty: a group rename or a member leaving changes what the DM is called,
+  // and the channels-store copy is what the chat header reads.
+  if (existing !== undefined && existing.name === dmDisplayName(dmChannel)) return;
 
   const newChannel: Channel = {
     id: dmChannel.channelId,
-    name: dmChannel.recipient.username,
+    name: dmDisplayName(dmChannel),
     type: "dm",
     category: null,
     position: 0,
     unreadCount: dmChannel.unreadCount,
+    // The DM's own mention count, not a hardcoded 0: the ready payload now
+    // carries it, so a DM mention badge survives a reconnect.
+    mentionCount: dmChannel.mentionCount,
     lastMessageId: dmChannel.lastMessageId,
     // Channel-level permission is always true for DMs; block state is layered on
     // top by the composer via blocks.store (see ChannelController), not canSend.
     canSend: true,
     slowMode: 0,
+    topic: "",
+    // A DM is never age-gated and has no voice capacity: the flags exist on
+    // guild channels, and a DM row is synthesised here rather than coming from
+    // the server's channel list.
+    nsfw: false,
+    voiceMaxUsers: 0,
+    voiceMaxVideo: 0,
   };
   channelsStore.setState((prev) => {
     const next = new Map(prev.channels);
@@ -94,18 +110,24 @@ export async function handleCreateDm(recipientId: number, deps: DmHelperDeps): P
     const result = await deps.api.createDm(recipientId);
     const member = membersStore.getState().members.get(recipientId);
 
+    const recipient: DmUser = {
+      id: result.recipient.id,
+      username: result.recipient.username,
+      avatar: result.recipient.avatar,
+      status: result.recipient.status ?? member?.status ?? "offline",
+      displayName: result.recipient.display_name ?? member?.displayName ?? "",
+    };
     const dmChannel: DmChannel = {
       channelId: result.channel_id,
-      recipient: {
-        id: result.recipient.id,
-        username: result.recipient.username,
-        avatar: result.recipient.avatar,
-        status: result.recipient.status ?? member?.status ?? "offline",
-      },
+      recipient,
+      participants: [recipient],
+      name: "",
+      isGroup: false,
       lastMessageId: null,
       lastMessage: "",
       lastMessageAt: "",
       unreadCount: 0,
+      mentionCount: 0,
     };
 
     addDmChannel(dmChannel);
@@ -116,21 +138,98 @@ export async function handleCreateDm(recipientId: number, deps: DmHelperDeps): P
   }
 }
 
+// ---------------------------------------------------------------------------
+// dmChannelFromPayload
+// ---------------------------------------------------------------------------
+
+/**
+ * Map a server DM summary (the shape `POST /dms/group`, `PATCH /dms/{id}`,
+ * `GET /dms` and `dm_channel_open` all share) into the store's DmChannel.
+ *
+ * The dispatcher has its own copy of this for the WS path; this one exists so
+ * the REST responses land in exactly the same shape without importing the
+ * dispatcher's internals into the sidebar.
+ */
+export function dmChannelFromPayload(p: DmChannelPayload): DmChannel {
+  const participants: DmUser[] = (p.recipients ?? [p.recipient]).map((u) => ({
+    id: u.id,
+    username: u.username,
+    avatar: u.avatar,
+    status: u.status,
+    displayName: u.display_name ?? "",
+  }));
+  return {
+    channelId: p.channel_id,
+    recipient: participants[0] ?? {
+      id: p.recipient.id,
+      username: p.recipient.username,
+      avatar: p.recipient.avatar,
+      status: p.recipient.status,
+      displayName: p.recipient.display_name ?? "",
+    },
+    participants,
+    name: p.name ?? "",
+    isGroup: p.is_group ?? false,
+    lastMessageId: p.last_message_id,
+    lastMessage: p.last_message,
+    lastMessageAt: p.last_message_at,
+    unreadCount: p.unread_count,
+    mentionCount: p.mention_count ?? 0,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// handleCreateGroupDm
+// ---------------------------------------------------------------------------
+
+/** Create a group DM with the given members and switch to it. */
+export async function handleCreateGroupDm(
+  recipientIds: readonly number[],
+  name: string,
+  deps: DmHelperDeps,
+): Promise<void> {
+  try {
+    const result = await deps.api.createGroupDm(recipientIds, name);
+    const dmChannel = dmChannelFromPayload(result);
+    addDmChannel(dmChannel);
+    selectDmConversation(dmChannel, deps);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : "Failed to create group DM";
+    deps.getToast()?.show(msg, "error");
+  }
+}
+
 // ---------------------------------------------------------------------------
 // buildDmConversations — helper for DM sidebar mode
 // ---------------------------------------------------------------------------
 
-/** Build a readonly DmConversation array from DM store state. */
-export function buildDmConversations(activeDmUserId: number | null): readonly DmConversation[] {
+/**
+ * Build a readonly DmConversation array from DM store state.
+ *
+ * Keyed on the channel, not on the recipient user: a group DM has no single
+ * recipient, and a user can be in both a 1:1 and a group with the same person,
+ * so a user id no longer identifies a row.
+ */
+export function buildDmConversations(activeChannelId: number | null): readonly DmConversation[] {
   const dmChannels = dmStore.getState().channels;
   return dmChannels.map((dm) => ({
+    channelId: dm.channelId,
     userId: dm.recipient.id,
-    username: dm.recipient.username,
+    username: dmDisplayName(dm),
     avatar: dm.recipient.avatar || null,
     status: (dm.recipient.status as DmConversation["status"]) ?? "offline",
+    isGroup: dm.isGroup,
+    participants: dm.participants.map((p) => ({
+      id: p.id,
+      username: (p.displayName ?? "") || p.username,
+      avatar: p.avatar || null,
+    })),
     lastMessage: dm.lastMessage || "No messages yet",
     timestamp: dm.lastMessageAt,
-    unread: dm.unreadCount > 0,
-    active: dm.recipient.id === activeDmUserId,
+    unread: dm.unreadCount > 0 || dm.mentionCount > 0,
+    unreadCount: dm.unreadCount,
+    mentionCount: dm.mentionCount,
+    muted: isChannelMuted(dm.channelId),
+    active: dm.channelId === activeChannelId,
   }));
 }
diff --git a/Client/tauri-client/src/pages/main-page/SidebarDmSection.ts b/Client/tauri-client/src/pages/main-page/SidebarDmSection.ts
index 516d3647..b0db4c3f 100644
--- a/Client/tauri-client/src/pages/main-page/SidebarDmSection.ts
+++ b/Client/tauri-client/src/pages/main-page/SidebarDmSection.ts
@@ -5,9 +5,10 @@
  */
 
 import { createElement, setText, clearChildren, appendChildren } from "@lib/dom";
-import { dmStore } from "@stores/dm.store";
+import { dmStore, dmDisplayName } from "@stores/dm.store";
 import type { DmChannel } from "@stores/dm.store";
 import { setSidebarMode } from "@stores/ui.store";
+import { isChannelMuted } from "@lib/channel-mutes";
 
 // ---------------------------------------------------------------------------
 // Types
@@ -72,12 +73,16 @@ export function createSidebarDmSection(opts: SidebarDmSectionOptions): SidebarDm
     const dmChannels = dmStore.getState().channels;
     const displayChannels = dmChannels.slice(0, 3);
     for (const dm of displayChannels) {
+      const muted = isChannelMuted(dm.channelId);
       const dmItem = createElement("div", {
-        class: "channel-item",
+        class: muted ? "channel-item muted" : "channel-item",
         "data-testid": "dm-entry",
       });
-      const statusColor =
-        dm.recipient.status === "online"
+      // A group has no presence of its own, so it gets a neutral marker rather
+      // than the first member's dot dressed up as the conversation's state.
+      const statusColor = dm.isGroup
+        ? "var(--text-micro)"
+        : dm.recipient.status === "online"
           ? "var(--green)"
           : dm.recipient.status === "idle"
             ? "var(--yellow)"
@@ -85,17 +90,18 @@ export function createSidebarDmSection(opts: SidebarDmSectionOptions): SidebarDm
               ? "var(--red)"
               : "var(--text-micro)";
       const statusDot = createElement("span", {
-        style: `display:inline-block;width:8px;height:8px;border-radius:50%;background:${statusColor};flex-shrink:0;`,
+        style: `display:inline-block;width:8px;height:8px;border-radius:${dm.isGroup ? "2px" : "50%"};background:${statusColor};flex-shrink:0;`,
       });
-      const name = createElement("span", { class: "ch-name" }, dm.recipient.username);
+      const name = createElement("span", { class: "ch-name" }, dmDisplayName(dm));
       const parts: Element[] = [statusDot, name];
       if (dm.unreadCount > 0) {
+        // Muted: the count still increments (it is a fact about the channel),
+        // it just stops shouting. Only the colour changes.
         const badge = createElement(
           "span",
           {
-            class: "dm-unread-badge",
-            style:
-              "margin-left:auto;background:var(--red);color:white;border-radius:10px;padding:1px 6px;font-size:0.7rem;",
+            class: muted ? "dm-unread-badge muted" : "dm-unread-badge",
+            style: `margin-left:auto;background:${muted ? "var(--text-micro)" : "var(--red)"};color:white;border-radius:10px;padding:1px 6px;font-size:0.7rem;`,
           },
           String(dm.unreadCount),
         );
@@ -116,8 +122,13 @@ export function createSidebarDmSection(opts: SidebarDmSectionOptions): SidebarDm
       viewAllBtn.style.display = "none";
     }
 
-    // Update total unread badge on the DM header
-    const totalUnread = dmChannels.reduce((sum, c) => sum + c.unreadCount, 0);
+    // Update total unread badge on the DM header. Muted conversations are
+    // excluded: the header badge is an interrupt, and a muted DM asked not to
+    // be one. Its own row still shows its dimmed count.
+    const totalUnread = dmChannels.reduce(
+      (sum, c) => sum + (isChannelMuted(c.channelId) ? 0 : c.unreadCount),
+      0,
+    );
     if (totalUnread > 0) {
       setText(dmUnreadBadge, String(totalUnread));
       dmUnreadBadge.style.display = "";
diff --git a/Client/tauri-client/src/pages/main-page/SidebarMemberSection.ts b/Client/tauri-client/src/pages/main-page/SidebarMemberSection.ts
index 09ee5617..31fa4b26 100644
--- a/Client/tauri-client/src/pages/main-page/SidebarMemberSection.ts
+++ b/Client/tauri-client/src/pages/main-page/SidebarMemberSection.ts
@@ -8,6 +8,7 @@ import { createElement, appendChildren } from "@lib/dom";
 import type { MountableComponent } from "@lib/safe-render";
 import { createMemberList } from "@components/MemberList";
 import { authStore } from "@stores/auth.store";
+import { setUserBlockedByMe } from "@stores/blocks.store";
 import { getRoleIdByName } from "@stores/channels.store";
 import type { ApiClient } from "@lib/api";
 import type { ToastContainer } from "@components/Toast";
@@ -26,6 +27,8 @@ const LS_KEY_COLLAPSED = "owncord:member-list-collapsed";
 export interface SidebarMemberSectionOptions {
   readonly api: ApiClient;
   readonly getToast: () => ToastContainer | null;
+  /** Start a DM with a user (profile popup's Message button). */
+  readonly onMessageUser?: (userId: number) => void;
 }
 
 export interface SidebarMemberSectionResult {
@@ -44,7 +47,7 @@ export interface SidebarMemberSectionResult {
 export function createSidebarMemberSection(
   opts: SidebarMemberSectionOptions,
 ): SidebarMemberSectionResult {
-  const { api, getToast } = opts;
+  const { api, getToast, onMessageUser } = opts;
   const unsubs: Array<() => void> = [];
 
   // --- Container ---
@@ -147,24 +150,45 @@ export function createSidebarMemberSection(
   // --- Member list component ---
   const memberList = createMemberList({
     currentUserRole: authStore.getState().user?.role ?? "member",
+    ...(onMessageUser !== undefined ? { onMessageUser } : {}),
+    // "Force Logout", not "Kick": the endpoint revokes the target's sessions
+    // and nothing stops them signing back in — there is no membership to remove.
     onKick: async (userId, username) => {
       try {
         await api.adminKickMember(userId);
-        getToast()?.show(`Kicked ${username}`, "success");
+        getToast()?.show(`Forced ${username} to log out`, "success");
       } catch (err) {
-        const msg = err instanceof Error ? err.message : "Failed to kick member";
+        const msg = err instanceof Error ? err.message : "Failed to force logout";
         getToast()?.show(msg, "error");
       }
     },
-    onBan: async (userId, username, reason) => {
+    onBan: async (userId, username, reason, durationHours) => {
       try {
-        await api.adminBanMember(userId, reason);
-        getToast()?.show(`Banned ${username}`, "success");
+        await api.adminBanMember(userId, reason, durationHours);
+        getToast()?.show(
+          durationHours > 0 ? `Banned ${username} for ${durationHours}h` : `Banned ${username}`,
+          "success",
+        );
       } catch (err) {
         const msg = err instanceof Error ? err.message : "Failed to ban member";
         getToast()?.show(msg, "error");
       }
     },
+    onToggleBlock: async (userId, username, block) => {
+      try {
+        if (block) {
+          await api.blockUser(userId);
+        } else {
+          await api.unblockUser(userId);
+        }
+        setUserBlockedByMe(userId, block);
+        getToast()?.show(block ? `Blocked ${username}` : `Unblocked ${username}`, "success");
+      } catch (err) {
+        const fallback = block ? "Failed to block user" : "Failed to unblock user";
+        const msg = err instanceof Error ? err.message : fallback;
+        getToast()?.show(msg, "error");
+      }
+    },
     onChangeRole: async (userId, username, newRole) => {
       const roleId = getRoleIdByName(newRole);
       if (roleId === undefined) {
diff --git a/Client/tauri-client/src/pages/main-page/VoiceCallbacks.ts b/Client/tauri-client/src/pages/main-page/VoiceCallbacks.ts
index 4f80887b..746c669e 100644
--- a/Client/tauri-client/src/pages/main-page/VoiceCallbacks.ts
+++ b/Client/tauri-client/src/pages/main-page/VoiceCallbacks.ts
@@ -7,6 +7,7 @@ import { createLogger } from "@lib/logger";
 import type { WsClient } from "@lib/ws";
 import { voiceStore, joinVoiceChannel, leaveVoiceChannel } from "@stores/voice.store";
 import { uiStore } from "@stores/ui.store";
+import type { VoiceModerationCallbacks } from "@components/ChannelSidebar";
 import {
   leaveVoice as voiceSessionLeave,
   setMuted as voiceSessionSetMuted,
@@ -69,6 +70,10 @@ export function createVoiceWidgetCallbacks(
     onMuteToggle: () => {
       if (!limiters.voice.tryConsume()) return;
       const state = voiceStore.getState();
+      // A moderator-imposed mute is not ours to lift; the server refuses the
+      // unmute, so don't spend the round-trip (keybinds reach here too, not
+      // just the disabled button).
+      if (state.localServerMuted === true) return;
       if (state.localMuted) {
         voiceSessionSetMuted(false);
         ws.send({ type: "voice_mute", payload: { muted: false } });
@@ -84,6 +89,7 @@ export function createVoiceWidgetCallbacks(
     onDeafenToggle: () => {
       if (!limiters.voice.tryConsume()) return;
       const state = voiceStore.getState();
+      if (state.localServerDeafened === true) return;
       if (state.localDeafened) {
         voiceSessionSetDeafened(false);
         ws.send({ type: "voice_deafen", payload: { deafened: false } });
@@ -129,6 +135,40 @@ export function createVoiceWidgetCallbacks(
 // Sidebar Voice Callbacks
 // ---------------------------------------------------------------------------
 
+/** Moderator voice actions. Fire-and-forget sends: the server answers with a
+ *  voice_state / voice_leave broadcast on success and an error frame on
+ *  refusal, so there is no optimistic local state to roll back. */
+export function createVoiceModerationCallbacks(ws: WsClient): VoiceModerationCallbacks {
+  return {
+    onServerMute: (channelId, userId, muted) => {
+      if (!socketLive()) return;
+      log.info("Server mute", { channelId, userId, muted });
+      ws.send({
+        type: "voice_mod_mute",
+        payload: { channel_id: channelId, user_id: userId, muted },
+      });
+    },
+    onServerDeafen: (channelId, userId, deafened) => {
+      if (!socketLive()) return;
+      log.info("Server deafen", { channelId, userId, deafened });
+      ws.send({
+        type: "voice_mod_deafen",
+        payload: { channel_id: channelId, user_id: userId, deafened },
+      });
+    },
+    onMove: (userId, toChannelId) => {
+      if (!socketLive()) return;
+      log.info("Move voice user", { userId, toChannelId });
+      ws.send({ type: "voice_mod_move", payload: { user_id: userId, to_channel_id: toChannelId } });
+    },
+    onDisconnect: (userId) => {
+      if (!socketLive()) return;
+      log.info("Disconnect voice user", { userId });
+      ws.send({ type: "voice_mod_kick", payload: { user_id: userId } });
+    },
+  };
+}
+
 export function createSidebarVoiceCallbacks(ws: WsClient): SidebarVoiceCallbacks {
   return {
     onVoiceJoin: (channelId: number) => {
diff --git a/Client/tauri-client/src/stores/auth.store.ts b/Client/tauri-client/src/stores/auth.store.ts
index fb069b04..441d06b8 100644
--- a/Client/tauri-client/src/stores/auth.store.ts
+++ b/Client/tauri-client/src/stores/auth.store.ts
@@ -11,12 +11,22 @@ import { createLogger } from "@lib/logger";
 
 const log = createLogger("auth.store");
 
+/** Why the session ended. "user" covers every locally-initiated or
+ *  invalid-token path (logout, 401, auth_error, ban); "server_shutdown" is a
+ *  server-initiated kick whose token is still valid — the logout wiring keeps
+ *  the saved credential in that case so auto-login works when the server
+ *  comes back. */
+export type LogoutReason = "user" | "server_shutdown";
+
 export interface AuthState {
   readonly token: string | null;
   readonly user: UserWithRole | null;
   readonly serverName: string | null;
   readonly motd: string | null;
   readonly isAuthenticated: boolean;
+  /** Set by clearAuth; cleared again on the next setAuth. Optional so the
+   *  many inline AuthState test fixtures need not restate it. */
+  readonly logoutReason?: LogoutReason | null;
 }
 
 const INITIAL_STATE: AuthState = {
@@ -41,9 +51,11 @@ export function setAuth(token: string, user: UserWithRole, serverName: string, m
 }
 
 /** Reset auth state (logout / disconnect). Also cleans up the voice
- *  session (WebRTC, AudioContext, streams) and clears voice store state.
- *  Safe to call even if no voice session is active — leaveVoice is idempotent. */
-export function clearAuth(): void {
+ *  session (WebRTC, AudioContext, streams) and clears voice store state —
+ *  including camera/screenshare, whose tracks leaveVoice stops and whose
+ *  toggles it resets. Safe to call even if no voice session is active —
+ *  leaveVoice is idempotent. */
+export function clearAuth(reason: LogoutReason = "user"): void {
   // livekitSession (and the ~1.3 MB livekit-client SDK behind it) is loaded
   // lazily so it stays out of the startup path. Only import it when there is
   // actually a voice session to leave — otherwise a text-only user who never
@@ -58,7 +70,7 @@ export function clearAuth(): void {
   }
   resetVoiceStore();
   cleanupNotificationAudio();
-  authStore.setState(() => ({ ...INITIAL_STATE }));
+  authStore.setState(() => ({ ...INITIAL_STATE, logoutReason: reason }));
 }
 
 /** Shorthand selector for the current token. */
diff --git a/Client/tauri-client/src/stores/blocks.store.ts b/Client/tauri-client/src/stores/blocks.store.ts
index a2f82062..d800e5bb 100644
--- a/Client/tauri-client/src/stores/blocks.store.ts
+++ b/Client/tauri-client/src/stores/blocks.store.ts
@@ -35,6 +35,17 @@ export function setBlockedByMe(userIds: readonly number[]): void {
   blocksStore.setState((prev) => ({ ...prev, blockedByMe: new Set(userIds) }));
 }
 
+/** Mark (or unmark) a user as blocked by the local user (after PUT/DELETE /blocks). */
+export function setUserBlockedByMe(userId: number, blocked: boolean): void {
+  blocksStore.setState((prev) => {
+    if (prev.blockedByMe.has(userId) === blocked) return prev;
+    const next = new Set(prev.blockedByMe);
+    if (blocked) next.add(userId);
+    else next.delete(userId);
+    return { ...prev, blockedByMe: next };
+  });
+}
+
 /** Mark (or unmark) a recipient as having refused our DM. */
 export function setUserBlockedByThem(userId: number, blocked: boolean): void {
   blocksStore.setState((prev) => {
diff --git a/Client/tauri-client/src/stores/channels.store.ts b/Client/tauri-client/src/stores/channels.store.ts
index 68e3d2c6..6878d1f0 100644
--- a/Client/tauri-client/src/stores/channels.store.ts
+++ b/Client/tauri-client/src/stores/channels.store.ts
@@ -17,13 +17,37 @@ export interface Channel {
   readonly name: string;
   readonly type: ChannelType;
   readonly category: string | null;
+  /** Channel topic ("" = none). */
+  readonly topic: string;
   readonly position: number;
   readonly unreadCount: number;
+  /**
+   * Unread messages here that mention the current user (directly or via
+   * @everyone/@here). Always a subset of unreadCount; drives the red mention
+   * badge, which outranks the plain unread badge.
+   */
+  readonly mentionCount: number;
   readonly lastMessageId: number | null;
   /** Whether the current user may post here (drives the composer affordance). */
   readonly canSend: boolean;
   /** Per-channel cooldown in seconds (0 = off). Drives the composer countdown. */
   readonly slowMode: number;
+  /**
+   * Flagged as possibly carrying sensitive content.
+   *
+   * The server stores and broadcasts this and does nothing else with it — no
+   * filtering, no restriction on who may read or post — so every consequence
+   * is this client's: a one-time-per-session age gate before the channel's
+   * messages are shown, and a marker on the sidebar row.
+   */
+  readonly nsfw: boolean;
+  /**
+   * Voice capacity limits (0 = unlimited). The server enforces both on join
+   * (CHANNEL_FULL / VIDEO_LIMIT); these copies exist so the sidebar can show
+   * "3/5" and the client never has to guess why a join was refused.
+   */
+  readonly voiceMaxUsers: number;
+  readonly voiceMaxVideo: number;
 }
 
 export interface ChannelsState {
@@ -40,8 +64,28 @@ const INITIAL_STATE: ChannelsState = {
 
 export const channelsStore = createStore<ChannelsState>(INITIAL_STATE);
 
+/**
+ * How many unread messages each channel had at the moment it was last opened.
+ *
+ * Opening a channel clears its badge immediately, which destroys the only
+ * record of where the reader had got to — so the value is snapshotted here
+ * first. MessageList reads it to place the "NEW" divider above the first
+ * message the reader has not seen. Kept outside the store state because it is
+ * not reactive: it is read once when the list mounts, and a subscriber firing
+ * on it would just re-render the list for no visible change.
+ */
+const unreadOnOpen = new Map<number, number>();
+
+/** Unread count this channel had when it was last opened (0 = nothing new). */
+export function getUnreadOnOpen(channelId: number): number {
+  return unreadOnOpen.get(channelId) ?? 0;
+}
+
 /** Bulk set channels from the ready payload. Converts ReadyChannel[] to Map. */
 export function setChannels(channels: readonly ReadyChannel[]): void {
+  // A fresh ready payload restates unread from the server; any snapshot from
+  // the previous connection describes a read position that no longer applies.
+  unreadOnOpen.clear();
   const map = new Map<number, Channel>();
   for (const ch of channels) {
     map.set(ch.id, {
@@ -49,13 +93,20 @@ export function setChannels(channels: readonly ReadyChannel[]): void {
       name: ch.name,
       type: ch.type,
       category: ch.category,
+      topic: ch.topic ?? "",
       position: ch.position,
       unreadCount: ch.unread_count ?? 0,
+      mentionCount: ch.mention_count ?? 0,
       lastMessageId: ch.last_message_id ?? null,
       // The current server always sends can_send; older servers omit it, in
       // which case we default permissive (no gating) rather than guessing.
       canSend: ch.can_send ?? true,
       slowMode: ch.slow_mode ?? 0,
+      // Older servers omit these; "absent" reads as unflagged / unlimited,
+      // which is also what an unconfigured channel sends.
+      nsfw: ch.nsfw ?? false,
+      voiceMaxUsers: ch.voice_max_users ?? 0,
+      voiceMaxVideo: ch.voice_max_video ?? 0,
     });
   }
   channelsStore.setState((prev) => ({
@@ -85,19 +136,31 @@ export function addChannel(channel: ChannelCreatePayload): void {
       name: channel.name,
       type: channel.type,
       category: channel.category,
+      topic: channel.topic ?? "",
       position: channel.position,
       unreadCount: 0,
+      mentionCount: 0,
       lastMessageId: null,
       // Broadcasts carry no per-user data; default permissive. The next ready
       // payload delivers the authoritative can_send. Server enforces regardless.
       canSend: true,
       slowMode: channel.slow_mode ?? 0,
+      nsfw: channel.nsfw ?? false,
+      voiceMaxUsers: channel.voice_max_users ?? 0,
+      voiceMaxVideo: channel.voice_max_video ?? 0,
     });
     return { ...prev, channels: next };
   });
 }
 
-/** Update a channel's name and/or position immutably. */
+/**
+ * Apply a channel_update broadcast immutably.
+ *
+ * Every field is optional and an absent one is left alone rather than reset:
+ * the payload from an older server carries fewer keys than this one knows
+ * about, and treating "absent" as "cleared" would blank a channel's topic or
+ * drop its NSFW flag on the first update after connecting.
+ */
 export function updateChannel(update: ChannelUpdatePayload): void {
   channelsStore.setState((prev) => {
     const existing = prev.channels.get(update.id);
@@ -107,8 +170,15 @@ export function updateChannel(update: ChannelUpdatePayload): void {
     const updated: Channel = {
       ...existing,
       ...(update.name !== undefined ? { name: update.name } : {}),
+      ...(update.topic !== undefined ? { topic: update.topic } : {}),
+      // "" is a real value here — it means "no category" — so only undefined
+      // is treated as "not sent".
+      ...(update.category !== undefined ? { category: update.category } : {}),
       ...(update.position !== undefined ? { position: update.position } : {}),
       ...(update.slow_mode !== undefined ? { slowMode: update.slow_mode } : {}),
+      ...(update.nsfw !== undefined ? { nsfw: update.nsfw } : {}),
+      ...(update.voice_max_users !== undefined ? { voiceMaxUsers: update.voice_max_users } : {}),
+      ...(update.voice_max_video !== undefined ? { voiceMaxVideo: update.voice_max_video } : {}),
     };
     const next = new Map(prev.channels);
     next.set(update.id, updated);
@@ -143,17 +213,27 @@ export function removeChannel(id: number): void {
   });
 }
 
-/** Set the active channel by id (or null to deselect). Clears unread count for the activated channel. */
+/**
+ * Set the active channel by id (or null to deselect). Clears the unread and
+ * mention counts for the activated channel — the server's channel_focus does
+ * the same server-side, so the badges must not survive the visit locally.
+ */
 export function setActiveChannel(id: number | null): void {
+  // Snapshot before clearing — this is the last moment the reader's position is
+  // knowable (see unreadOnOpen). Done outside setState so the updater stays a
+  // pure function of previous state.
+  if (id !== null) {
+    unreadOnOpen.set(id, channelsStore.getState().channels.get(id)?.unreadCount ?? 0);
+  }
   channelsStore.setState((prev) => {
     if (id === null) {
       return { ...prev, activeChannelId: null };
     }
     const existing = prev.channels.get(id);
-    if (existing === undefined || existing.unreadCount === 0) {
+    if (existing === undefined || (existing.unreadCount === 0 && existing.mentionCount === 0)) {
       return { ...prev, activeChannelId: id };
     }
-    const updated: Channel = { ...existing, unreadCount: 0 };
+    const updated: Channel = { ...existing, unreadCount: 0, mentionCount: 0 };
     const next = new Map(prev.channels);
     next.set(id, updated);
     return { ...prev, activeChannelId: id, channels: next };
@@ -170,6 +250,39 @@ export function getActiveChannel(): Channel | null {
   });
 }
 
+/**
+ * The group header an uncategorized VOICE channel falls back to.
+ *
+ * Categories are free text and a channel of any type may carry any of them, so
+ * a voice channel groups under whatever category it has — there is no magic
+ * name that makes a category "the voice one". Only a voice channel with no
+ * category at all needs somewhere to go, and mixing it into the unnamed group
+ * next to uncategorized text channels reads as a bug, so it gets this group.
+ */
+export const UNCATEGORIZED_VOICE_CATEGORY = "Voice";
+
+/** The category header a channel is displayed under. */
+export function displayCategoryOf(channel: Channel): string | null {
+  if (channel.category !== null && channel.category !== "") {
+    return channel.category;
+  }
+  return channel.type === "voice" ? UNCATEGORIZED_VOICE_CATEGORY : null;
+}
+
+/** Every distinct category name currently in use, sorted, for suggestion lists. */
+export function getKnownCategories(): string[] {
+  return channelsStore.select((s) => {
+    const names = new Set<string>();
+    for (const channel of s.channels.values()) {
+      if (channel.type === "dm") continue;
+      if (channel.category !== null && channel.category !== "") {
+        names.add(channel.category);
+      }
+    }
+    return [...names].toSorted((a, b) => a.localeCompare(b));
+  });
+}
+
 /** Group channels by category, sorted by position within each group. */
 export function getChannelsByCategory(): Map<string | null, Channel[]> {
   return channelsStore.select((s) => {
@@ -177,11 +290,12 @@ export function getChannelsByCategory(): Map<string | null, Channel[]> {
     for (const channel of s.channels.values()) {
       // DM channels are shown in the DM sidebar, not the channel list
       if (channel.type === "dm") continue;
-      const existing = grouped.get(channel.category);
+      const category = displayCategoryOf(channel);
+      const existing = grouped.get(category);
       if (existing !== undefined) {
         existing.push(channel);
       } else {
-        grouped.set(channel.category, [channel]);
+        grouped.set(category, [channel]);
       }
     }
     for (const channels of grouped.values()) {
@@ -211,7 +325,31 @@ export function incrementUnread(channelId: number): void {
   });
 }
 
-/** Clear unread count for a channel. */
+/**
+ * Increment the mention count for a channel, unless it is the active channel.
+ * Callers also call incrementUnread — a mention is always an unread too, and
+ * the two counters are kept independent so the badge can outrank.
+ */
+export function incrementMention(channelId: number): void {
+  channelsStore.setState((prev) => {
+    if (prev.activeChannelId === channelId) {
+      return prev;
+    }
+    const existing = prev.channels.get(channelId);
+    if (existing === undefined) {
+      return prev;
+    }
+    const updated: Channel = {
+      ...existing,
+      mentionCount: existing.mentionCount + 1,
+    };
+    const next = new Map(prev.channels);
+    next.set(channelId, updated);
+    return { ...prev, channels: next };
+  });
+}
+
+/** Clear the unread and mention counts for a channel — they clear together. */
 export function clearUnread(channelId: number): void {
   channelsStore.setState((prev) => {
     const existing = prev.channels.get(channelId);
@@ -221,6 +359,7 @@ export function clearUnread(channelId: number): void {
     const updated: Channel = {
       ...existing,
       unreadCount: 0,
+      mentionCount: 0,
     };
     const next = new Map(prev.channels);
     next.set(channelId, updated);
diff --git a/Client/tauri-client/src/stores/dm.store.ts b/Client/tauri-client/src/stores/dm.store.ts
index 7fe874f5..772dbd08 100644
--- a/Client/tauri-client/src/stores/dm.store.ts
+++ b/Client/tauri-client/src/stores/dm.store.ts
@@ -10,15 +10,35 @@ export interface DmUser {
   readonly username: string;
   readonly avatar: string;
   readonly status: string;
+  /** Nickname to render instead of `username`. "" = unset. */
+  readonly displayName?: string;
 }
 
 export interface DmChannel {
   readonly channelId: number;
+  /**
+   * The other participant of a 1:1 DM. For a group it is the first of
+   * `participants`; anything that must be correct for groups reads
+   * `participants` instead. Kept because most 1:1 call sites want exactly one
+   * user and would otherwise all index into an array.
+   */
   readonly recipient: DmUser;
+  /** Everyone in the DM except the current user. Never empty for a live DM. */
+  readonly participants: readonly DmUser[];
+  /** Optional group name. "" for a 1:1 DM and for an unnamed group. */
+  readonly name: string;
+  /** True for a group DM (3+ participants at creation). */
+  readonly isGroup: boolean;
   readonly lastMessageId: number | null;
   readonly lastMessage: string;
   readonly lastMessageAt: string;
   readonly unreadCount: number;
+  /**
+   * Unread messages in this DM that mention the current user. Kept independent
+   * of unreadCount so the red mention badge can outrank the plain one, exactly
+   * as it does for channels.
+   */
+  readonly mentionCount: number;
 }
 
 export interface DmState {
@@ -34,11 +54,38 @@ export function setDmChannels(channels: readonly DmChannel[]): void {
   dmStore.setState(() => ({ channels }));
 }
 
-/** Add or update a single DM channel (from dm_channel_open event). */
+/**
+ * Add or update a single DM channel (from a `dm_channel_open` event).
+ *
+ * Local unread and mention counts survive the replace when the incoming
+ * payload carries none. `dm_channel_open` is now also how a *membership*
+ * change arrives — a group created, renamed, or left — and those payloads have
+ * no unread state to report, so taking their zeroes literally would clear
+ * everyone's badge every time somebody renamed a group. Between two `ready`s
+ * the client's own count is the authoritative one (it is what the incoming
+ * messages incremented), and a genuine reopen has nothing to lose: its local
+ * count is zero too.
+ */
 export function addDmChannel(channel: DmChannel): void {
   dmStore.setState((prev) => {
+    const existing = prev.channels.find((c) => c.channelId === channel.channelId);
     const filtered = prev.channels.filter((c) => c.channelId !== channel.channelId);
-    return { channels: [channel, ...filtered] };
+    const merged: DmChannel =
+      existing === undefined
+        ? channel
+        : {
+            ...channel,
+            unreadCount: channel.unreadCount > 0 ? channel.unreadCount : existing.unreadCount,
+            mentionCount: channel.mentionCount > 0 ? channel.mentionCount : existing.mentionCount,
+            // Same reasoning for the preview: a rename does not know what the
+            // last message was, and blanking it would leave the row emptier
+            // than before the rename.
+            lastMessageId: channel.lastMessageId ?? existing.lastMessageId,
+            lastMessage: channel.lastMessage !== "" ? channel.lastMessage : existing.lastMessage,
+            lastMessageAt:
+              channel.lastMessageAt !== "" ? channel.lastMessageAt : existing.lastMessageAt,
+          };
+    return { channels: [merged, ...filtered] };
   });
 }
 
@@ -98,9 +145,43 @@ export function updateDmLastMessagePreview(
   });
 }
 
-/** Clear unread count for a DM channel. */
+/** Clear the unread and mention counts for a DM channel — they clear together,
+ *  matching channels.store.clearUnread and the server's read-state advance. */
 export function clearDmUnread(channelId: number): void {
   dmStore.setState((prev) => ({
-    channels: prev.channels.map((c) => (c.channelId === channelId ? { ...c, unreadCount: 0 } : c)),
+    channels: prev.channels.map((c) =>
+      c.channelId === channelId ? { ...c, unreadCount: 0, mentionCount: 0 } : c,
+    ),
+  }));
+}
+
+/**
+ * The label a DM renders under.
+ *
+ * One function so the sidebar row, the chat header, the quick switcher and the
+ * notification title cannot disagree about what a conversation is called —
+ * which for a group with no name they would, since each would pick its own
+ * order and cut-off for the joined member list.
+ *
+ * A named group uses its name. An unnamed group joins its members' names, and
+ * past three says "and N more" rather than growing without bound. A 1:1 DM is
+ * named by the person on the other end.
+ */
+export function dmDisplayName(dm: DmChannel): string {
+  if (dm.name !== "") return dm.name;
+  const names = dm.participants.map((p) => (p.displayName ?? "") || p.username);
+  if (names.length === 0) return dm.recipient.username;
+  if (!dm.isGroup) return names[0]!;
+  if (names.length <= 3) return names.join(", ");
+  return `${names.slice(0, 3).join(", ")} and ${names.length - 3} more`;
+}
+
+/** Increment a DM's mention count. Callers also call updateDmLastMessage — a
+ *  mention is always an unread too. */
+export function incrementDmMention(channelId: number): void {
+  dmStore.setState((prev) => ({
+    channels: prev.channels.map((c) =>
+      c.channelId === channelId ? { ...c, mentionCount: c.mentionCount + 1 } : c,
+    ),
   }));
 }
diff --git a/Client/tauri-client/src/stores/emoji.store.ts b/Client/tauri-client/src/stores/emoji.store.ts
new file mode 100644
index 00000000..eee73f55
--- /dev/null
+++ b/Client/tauri-client/src/stores/emoji.store.ts
@@ -0,0 +1,89 @@
+/**
+ * Emoji store — the server's custom-emoji set.
+ *
+ * Loaded once from GET /api/v1/emoji when the session goes ready, then
+ * replaced wholesale on every `emoji_update` broadcast. The server sends the
+ * full set rather than a delta for the same reason it does for roles: a
+ * dropped intermediate event can never leave a deleted emoji rendering in
+ * messages that name it.
+ *
+ * Everything downstream reads through `resolveEmoji`, which is the single
+ * answer to "is `:name:` a real emoji here" — message rendering, the picker,
+ * the composer autocomplete and reaction pills must all agree, and an
+ * unresolved shortcode is plain text everywhere.
+ */
+
+import { createStore } from "@lib/store";
+
+/** One custom emoji as the server describes it. */
+export interface CustomEmoji {
+  readonly id: number;
+  /** Lowercase, colon-free, e.g. "wave". */
+  readonly shortcode: string;
+  /** Server-relative image path, e.g. "/api/v1/emoji/3/image". */
+  readonly url: string;
+}
+
+export interface EmojiState {
+  /** The set in server order (shortcode ascending). */
+  readonly emoji: readonly CustomEmoji[];
+  /** Lookup by lowercase shortcode. Rebuilt with the list, never mutated. */
+  readonly byShortcode: ReadonlyMap<string, CustomEmoji>;
+}
+
+const INITIAL: EmojiState = {
+  emoji: [],
+  byShortcode: new Map(),
+};
+
+export const emojiStore = createStore<EmojiState>(INITIAL);
+
+/**
+ * The shortcode spelling the server accepts, mirrored here so the client never
+ * treats `:not a code:` or `:x:` as a candidate. Deliberately identical to the
+ * server's regexp: a token this rejects can never resolve, and a token this
+ * accepts is one the server could have stored.
+ */
+export const SHORTCODE_PATTERN = /^[a-z0-9_]{2,32}$/;
+
+/** Replace the whole set (from the REST list or an `emoji_update`). */
+export function setCustomEmoji(list: readonly CustomEmoji[]): void {
+  const next: CustomEmoji[] = [];
+  const byShortcode = new Map<string, CustomEmoji>();
+  for (const e of list) {
+    // Defensive: a malformed entry must not poison the lookup map that
+    // message rendering consults for every `:token:` in every message.
+    if (typeof e?.shortcode !== "string" || typeof e.url !== "string") continue;
+    const shortcode = e.shortcode.toLowerCase();
+    if (!SHORTCODE_PATTERN.test(shortcode)) continue;
+    const entry: CustomEmoji = { id: e.id, shortcode, url: e.url };
+    next.push(entry);
+    // First spelling wins, so a duplicate cannot silently shadow the earlier
+    // one after the list has already been rendered.
+    if (!byShortcode.has(shortcode)) byShortcode.set(shortcode, entry);
+  }
+  emojiStore.setState(() => ({ emoji: next, byShortcode }));
+}
+
+/** Drop every custom emoji (logout, or a switch to another server). */
+export function clearCustomEmoji(): void {
+  emojiStore.setState((prev) => (prev.emoji.length === 0 ? prev : INITIAL));
+}
+
+/**
+ * The emoji owning `shortcode`, or null. Accepts the bare name or the `:name:`
+ * spelling, so callers holding either form need no preprocessing.
+ */
+export function resolveEmoji(shortcode: string): CustomEmoji | null {
+  if (typeof shortcode !== "string") return null;
+  let name = shortcode.toLowerCase();
+  if (name.startsWith(":") && name.endsWith(":") && name.length > 2) {
+    name = name.slice(1, -1);
+  }
+  return emojiStore.getState().byShortcode.get(name) ?? null;
+}
+
+/** The whole set, for the picker and the composer autocomplete. */
+export function listCustomEmoji(): readonly CustomEmoji[] {
+  return emojiStore.getState().emoji;
+}
diff --git a/Client/tauri-client/src/stores/members.store.ts b/Client/tauri-client/src/stores/members.store.ts
index 6a8fbf86..d8ea10a1 100644
--- a/Client/tauri-client/src/stores/members.store.ts
+++ b/Client/tauri-client/src/stores/members.store.ts
@@ -12,6 +12,12 @@ export interface Member {
   readonly avatar: string | null;
   readonly role: string;
   readonly status: UserStatus;
+  /** Nickname to render instead of `username`. Null = unset. Optional only so
+   *  the many inline Member test fixtures need not restate it. Mentions still
+   *  resolve against `username` — it is the unique handle. */
+  readonly displayName?: string | null;
+  /** Free-text status line shown under the name. Null = unset. */
+  readonly customStatus?: string | null;
   /** Long-term E2EE identity public key (base64) for voice TOFU (F3). The store
    *  always sets it (null when the user has not published one); optional only so
    *  the many inline Member test fixtures need not restate it. */
@@ -56,6 +62,8 @@ export function setMembers(members: readonly ReadyMember[]): void {
       avatar: m.avatar,
       role: m.role,
       status: m.status,
+      displayName: m.display_name ?? null,
+      customStatus: m.custom_status ?? null,
       identityPublicKey: m.identity_public_key ?? null,
     });
   }
@@ -71,7 +79,11 @@ export function setMembers(members: readonly ReadyMember[]): void {
   }));
 }
 
-/** Add a member from a member_join event. */
+/** Add a member from a member_join event.
+ *  status comes from the payload's viewer-safe field, never assumed —
+ *  an invisible user's join broadcasts "offline", and a server old enough to
+ *  omit the field entirely must fail safe the same way rather than flash the
+ *  member online. */
 export function addMember(payload: MemberJoinPayload): void {
   membersStore.setState((prev) => {
     const next = new Map(prev.members);
@@ -80,7 +92,11 @@ export function addMember(payload: MemberJoinPayload): void {
       username: payload.user.username,
       avatar: payload.user.avatar,
       role: payload.user.role,
-      status: "online",
+      status: payload.status ?? "offline",
+      displayName: payload.user.display_name ?? null,
+      // member_join carries no custom status; a presence event follows it and
+      // is what fills this in.
+      customStatus: prev.members.get(payload.user.id)?.customStatus ?? null,
       identityPublicKey: payload.user.identity_public_key ?? null,
     });
     return { ...prev, members: next, roleRevision: (prev.roleRevision ?? 0) + 1 };
@@ -107,14 +123,43 @@ export function updateMemberRole(userId: number, role: string): void {
   });
 }
 
-/** Update a member's profile (username, avatar, identity key) from a
- *  user_update event. `identityPublicKey` is only applied when provided, so a
- *  profile update that omits it doesn't clobber a pinned key. */
-export function updateMemberProfile(
+/** The profile fields a user_update event replaces. `identityPublicKey` and
+ *  `displayName` are only applied when provided, so an older server's payload
+ *  (or a partial one) doesn't clobber a pinned key or a nickname. */
+export interface MemberProfilePatch {
+  readonly username: string;
+  readonly avatar: string | null;
+  readonly displayName?: string | null;
+  readonly identityPublicKey?: string | null;
+}
+
+/** Update a member's profile from a user_update event. */
+export function updateMemberProfile(userId: number, patch: MemberProfilePatch): void {
+  membersStore.setState((prev) => {
+    const existing = prev.members.get(userId);
+    if (!existing) return prev;
+    const next = new Map(prev.members);
+    next.set(userId, {
+      ...existing,
+      username: patch.username,
+      avatar: patch.avatar,
+      displayName: patch.displayName === undefined ? existing.displayName : patch.displayName,
+      identityPublicKey:
+        patch.identityPublicKey === undefined
+          ? existing.identityPublicKey
+          : patch.identityPublicKey,
+    });
+    return { ...prev, members: next };
+  });
+}
+
+/** Update a member's presence status, and the custom status line that rides
+ *  along with it. `customStatus` is only applied when the event carried the
+ *  field — a bare status flip must not blank the text. */
+export function updatePresence(
   userId: number,
-  username: string,
-  avatar: string | null,
-  identityPublicKey?: string | null,
+  status: UserStatus,
+  customStatus?: string | null,
 ): void {
   membersStore.setState((prev) => {
     const existing = prev.members.get(userId);
@@ -122,24 +167,20 @@ export function updateMemberProfile(
     const next = new Map(prev.members);
     next.set(userId, {
       ...existing,
-      username,
-      avatar,
-      identityPublicKey:
-        identityPublicKey === undefined ? existing.identityPublicKey : identityPublicKey,
+      status,
+      customStatus: customStatus === undefined ? existing.customStatus : customStatus,
     });
     return { ...prev, members: next };
   });
 }
 
-/** Update a member's presence status. */
-export function updatePresence(userId: number, status: UserStatus): void {
-  membersStore.setState((prev) => {
-    const existing = prev.members.get(userId);
-    if (!existing) return prev;
-    const next = new Map(prev.members);
-    next.set(userId, { ...existing, status });
-    return { ...prev, members: next };
-  });
+/** The name to render for a member: display name when set, username otherwise.
+ *  The one place that answers it, so the member list, message rows and the
+ *  profile popup cannot disagree. */
+export function memberDisplayName(member: Pick<Member, "username" | "displayName">): string {
+  const display = member.displayName;
+  if (typeof display === "string" && display.trim().length > 0) return display;
+  return member.username;
 }
 
 /** Mark a user as typing in a channel. Auto-clears after 5 seconds. */
diff --git a/Client/tauri-client/src/stores/messages.store.ts b/Client/tauri-client/src/stores/messages.store.ts
index d50f1d26..4f00de9a 100644
--- a/Client/tauri-client/src/stores/messages.store.ts
+++ b/Client/tauri-client/src/stores/messages.store.ts
@@ -9,6 +9,7 @@ import type {
   ChatMessagePayload,
   ChatEditedPayload,
   ChatDeletedPayload,
+  ChatBulkDeletedPayload,
   ReactionUpdatePayload,
   MessageUser,
   Attachment,
@@ -49,6 +50,14 @@ export interface Message {
   readonly correlationId: string | null;
   /** Error code when status === "failed" (e.g. "SLOW_MODE", "FORBIDDEN"). */
   readonly errorCode: string | null;
+  /**
+   * Server-resolved mentioned user IDs. Optional so the many inline Message
+   * fixtures need not restate it; undefined means "the server didn't say",
+   * which sends rendering down the local @token resolution path.
+   */
+  readonly mentions?: readonly number[];
+  /** Whether an honoured @everyone/@here is present. Optional, as above. */
+  readonly mentionsEveryone?: boolean;
 }
 
 export interface MessagesState {
@@ -65,6 +74,14 @@ export interface MessagesState {
    * never requested) — the message region then renders normally/empty.
    */
   readonly historyLoadState: ReadonlyMap<number, "loading" | "error">;
+  /**
+   * Channels whose loaded window is an around-window detached from the live
+   * tail: newer messages exist on the server below what is rendered. While a
+   * channel is here the list shows a "Jump to Present" pill and incoming
+   * broadcasts are *not* appended — they belong below the window, and
+   * appending them would fake continuity across a gap.
+   */
+  readonly detachedChannels: ReadonlySet<number>;
 }
 
 // -----------------------------------------------------------------------------
@@ -87,6 +104,8 @@ function chatPayloadToMessage(payload: ChatMessagePayload): Message {
     status: "sent",
     correlationId: null,
     errorCode: null,
+    mentions: payload.mentions,
+    mentionsEveryone: payload.mentions_everyone,
   };
 }
 
@@ -106,6 +125,8 @@ function messageResponseToMessage(response: MessageResponse): Message {
     status: "sent",
     correlationId: null,
     errorCode: null,
+    mentions: response.mentions,
+    mentionsEveryone: response.mentions_everyone,
   };
 }
 
@@ -122,6 +143,7 @@ const INITIAL_STATE: MessagesState = {
   loadedChannels: new Set(),
   hasMore: new Map(),
   historyLoadState: new Map(),
+  detachedChannels: new Set(),
 };
 
 // -----------------------------------------------------------------------------
@@ -174,7 +196,11 @@ export function addMessage(payload: ChatMessagePayload): void {
       return { ...prev, messagesByChannel: updated };
     }
 
-    // 3. Append as a new message.
+    // 3. Append as a new message — unless the channel is showing a detached
+    //    around-window, in which case the new message belongs to the live tail
+    //    below the gap and must wait for "Jump to Present".
+    if (prev.detachedChannels.has(channelId)) return prev;
+
     let updatedMsgs = [...existing, message];
     // Evict oldest messages if over the cap
     if (updatedMsgs.length > MAX_MESSAGES_PER_CHANNEL) {
@@ -312,16 +338,94 @@ export function setMessages(
     const updatedLoadState = new Map(prev.historyLoadState);
     updatedLoadState.delete(channelId);
 
+    // Loading the plain tail always reattaches: this *is* the live end.
+    const updatedDetached = new Set(prev.detachedChannels);
+    updatedDetached.delete(channelId);
+
     return {
       ...prev,
       messagesByChannel: updatedMessages,
       loadedChannels: updatedLoaded,
       hasMore: updatedHasMore,
       historyLoadState: updatedLoadState,
+      detachedChannels: updatedDetached,
     };
   });
 }
 
+/**
+ * Replace a channel's loaded window with an around-window centred on a jump
+ * target. Unlike setMessages the payload is already oldest-first, so it is not
+ * reversed.
+ *
+ * `hasMoreAfter` marks the window as detached from the live tail: the list
+ * offers "Jump to Present" and live broadcasts stop being appended until
+ * reattachToPresent (or a fresh setMessages) lands.
+ */
+export function setAroundMessages(
+  channelId: number,
+  messages: readonly MessageResponse[],
+  hasMoreBefore: boolean,
+  hasMoreAfter: boolean,
+): void {
+  const converted = messages.map(messageResponseToMessage);
+  // Defensive: the server caps a window at 100, so this never fires today.
+  // If it ever does, keep the older head — dropping the newest end is what the
+  // detached flag below already describes, whereas dropping the head would
+  // silently move the window past the jump target.
+  const trimmed =
+    converted.length > MAX_MESSAGES_PER_CHANNEL
+      ? converted.slice(0, MAX_MESSAGES_PER_CHANNEL)
+      : converted;
+  messagesStore.setState((prev) => {
+    const updatedMessages = new Map(prev.messagesByChannel);
+    updatedMessages.set(channelId, trimmed);
+
+    const updatedLoaded = new Set(prev.loadedChannels);
+    updatedLoaded.add(channelId);
+
+    const updatedHasMore = new Map(prev.hasMore);
+    updatedHasMore.set(channelId, hasMoreBefore);
+
+    const updatedLoadState = new Map(prev.historyLoadState);
+    updatedLoadState.delete(channelId);
+
+    const updatedDetached = new Set(prev.detachedChannels);
+    // Trimming the tail of an oversized window also strands newer messages,
+    // so the window is detached either way.
+    if (hasMoreAfter || trimmed.length < converted.length) {
+      updatedDetached.add(channelId);
+    } else {
+      updatedDetached.delete(channelId);
+    }
+
+    return {
+      ...prev,
+      messagesByChannel: updatedMessages,
+      loadedChannels: updatedLoaded,
+      hasMore: updatedHasMore,
+      historyLoadState: updatedLoadState,
+      detachedChannels: updatedDetached,
+    };
+  });
+}
+
+/**
+ * Drop a channel's detached window so the next history fetch reloads the live
+ * tail. Clears the loaded flag too — otherwise MessageController short-circuits
+ * on "already loaded" and the stale window stays on screen.
+ */
+export function reattachToPresent(channelId: number): void {
+  messagesStore.setState((prev) => {
+    if (!prev.detachedChannels.has(channelId)) return prev;
+    const updatedDetached = new Set(prev.detachedChannels);
+    updatedDetached.delete(channelId);
+    const updatedLoaded = new Set(prev.loadedChannels);
+    updatedLoaded.delete(channelId);
+    return { ...prev, detachedChannels: updatedDetached, loadedChannels: updatedLoaded };
+  });
+}
+
 /** Prepend older messages for infinite scroll.
  *  The server returns messages newest-first; we reverse to chronological order. */
 export function prependMessages(
@@ -361,7 +465,13 @@ export function editMessage(payload: ChatEditedPayload): void {
 
     const updatedList = channelMessages.map((msg) =>
       msg.id === payload.message_id
-        ? { ...msg, content: payload.content, editedAt: payload.edited_at }
+        ? {
+            ...msg,
+            content: payload.content,
+            editedAt: payload.edited_at,
+            mentions: payload.mentions,
+            mentionsEveryone: payload.mentions_everyone,
+          }
         : msg,
     );
 
@@ -387,6 +497,30 @@ export function deleteMessage(payload: ChatDeletedPayload): void {
   });
 }
 
+/**
+ * Soft-delete every id in one purge. Renders exactly like a single delete —
+ * the rows stay as tombstones — but touches the channel's list once instead of
+ * once per message.
+ */
+export function bulkDeleteMessages(payload: ChatBulkDeletedPayload): void {
+  if (payload.ids.length === 0) return;
+  messagesStore.setState((prev) => {
+    const channelMessages = prev.messagesByChannel.get(payload.channel_id);
+    if (!channelMessages) return prev;
+
+    const purged = new Set(payload.ids);
+    if (!channelMessages.some((msg) => purged.has(msg.id) && !msg.deleted)) return prev;
+
+    const updatedList = channelMessages.map((msg) =>
+      purged.has(msg.id) ? { ...msg, deleted: true } : msg,
+    );
+
+    const updatedMessages = new Map(prev.messagesByChannel);
+    updatedMessages.set(payload.channel_id, updatedList);
+    return { ...prev, messagesByChannel: updatedMessages };
+  });
+}
+
 /** Toggle the pinned state of a message (optimistic update after API call). */
 export function setMessagePinned(channelId: number, messageId: number, pinned: boolean): void {
   messagesStore.setState((prev) => {
@@ -457,12 +591,16 @@ export function clearChannelMessages(channelId: number): void {
     const updatedLoadState = new Map(prev.historyLoadState);
     updatedLoadState.delete(channelId);
 
+    const updatedDetached = new Set(prev.detachedChannels);
+    updatedDetached.delete(channelId);
+
     return {
       ...prev,
       messagesByChannel: updatedMessages,
       loadedChannels: updatedLoaded,
       hasMore: updatedHasMore,
       historyLoadState: updatedLoadState,
+      detachedChannels: updatedDetached,
     };
   });
 }
@@ -531,3 +669,18 @@ export function hasMoreMessages(channelId: number): boolean {
 export function getHistoryLoadState(channelId: number): "loading" | "error" | null {
   return messagesStore.select((s) => s.historyLoadState.get(channelId) ?? null);
 }
+
+/**
+ * Whether the channel's loaded window is an around-window detached from the
+ * live tail — newer messages exist below what is rendered.
+ */
+export function isWindowDetached(channelId: number): boolean {
+  return messagesStore.select((s) => s.detachedChannels.has(channelId));
+}
+
+/** Whether a message id is present in a channel's loaded window. */
+export function hasMessageLoaded(channelId: number, messageId: number): boolean {
+  return messagesStore.select(
+    (s) => s.messagesByChannel.get(channelId)?.some((m) => m.id === messageId) ?? false,
+  );
+}
diff --git a/Client/tauri-client/src/stores/voice.store.ts b/Client/tauri-client/src/stores/voice.store.ts
index 416c94ce..43bfb11b 100644
--- a/Client/tauri-client/src/stores/voice.store.ts
+++ b/Client/tauri-client/src/stores/voice.store.ts
@@ -22,6 +22,12 @@ export interface VoiceUser {
   readonly speaking: boolean;
   readonly camera: boolean;
   readonly screenshare: boolean;
+  /** Moderator-imposed (MUTE_MEMBERS). muted/deafened are always set alongside
+   *  these, so they only change how the row is presented. The store always sets
+   *  them; optional only so the inline VoiceUser test fixtures need not restate
+   *  them (same convention as VoiceState.peerVerifications). */
+  readonly serverMuted?: boolean;
+  readonly serverDeafened?: boolean;
 }
 
 /** Observable voice-session lifecycle status, surfaced so the UI can
@@ -60,6 +66,11 @@ export interface VoiceState {
   readonly voiceConfigs: ReadonlyMap<number, VoiceConfig>; // channelId -> VoiceConfig
   readonly localMuted: boolean;
   readonly localDeafened: boolean;
+  /** Set from the local user's own voice_state: while true the widget refuses
+   *  to send an unmute, which the server would reject anyway. Always written by
+   *  the store; optional for the same fixture reason as peerVerifications. */
+  readonly localServerMuted?: boolean;
+  readonly localServerDeafened?: boolean;
   readonly localCamera: boolean;
   readonly localScreenshare: boolean;
   /** Epoch ms when the local user joined the current voice channel (for elapsed timer). */
@@ -81,6 +92,8 @@ const INITIAL_STATE: VoiceState = {
   voiceConfigs: new Map(),
   localMuted: false,
   localDeafened: false,
+  localServerMuted: false,
+  localServerDeafened: false,
   localCamera: false,
   localScreenshare: false,
   joinedAt: null,
@@ -99,6 +112,8 @@ export function resetVoiceStore(): void {
     voiceConfigs: new Map(),
     localMuted: false,
     localDeafened: false,
+    localServerMuted: false,
+    localServerDeafened: false,
     localCamera: false,
     localScreenshare: false,
     joinedAt: null,
@@ -127,6 +142,8 @@ export function setVoiceStates(states: readonly ReadyVoiceState[]): void {
       speaking: false,
       camera: false,
       screenshare: false,
+      serverMuted: vs.server_muted ?? false,
+      serverDeafened: vs.server_deafened ?? false,
     });
   }
 
@@ -153,8 +170,13 @@ export function setVoiceStates(states: readonly ReadyVoiceState[]): void {
   }));
 }
 
-/** Update or add a user's voice state from a voice_state event. */
+/** Update or add a user's voice state from a voice_state event. When the event
+ *  describes the signed-in user it also mirrors the moderator-imposed flags
+ *  into localServerMuted/localServerDeafened, which gate the widget controls. */
 export function updateVoiceState(payload: VoiceStatePayload): void {
+  const currentUserId = authStore.getState().user?.id ?? 0;
+  const serverMuted = payload.server_muted ?? false;
+  const serverDeafened = payload.server_deafened ?? false;
   voiceStore.setState((prev) => {
     const nextChannels = new Map(prev.voiceUsers);
     const existingChannel = prev.voiceUsers.get(payload.channel_id);
@@ -168,10 +190,20 @@ export function updateVoiceState(payload: VoiceStatePayload): void {
       speaking: payload.speaking,
       camera: payload.camera,
       screenshare: payload.screenshare,
+      serverMuted,
+      serverDeafened,
     });
 
     nextChannels.set(payload.channel_id, nextUsers);
-    return { ...prev, voiceUsers: nextChannels };
+    if (payload.user_id !== currentUserId) {
+      return { ...prev, voiceUsers: nextChannels };
+    }
+    return {
+      ...prev,
+      voiceUsers: nextChannels,
+      localServerMuted: serverMuted,
+      localServerDeafened: serverDeafened,
+    };
   });
 }
 
@@ -216,13 +248,21 @@ export function joinVoiceChannel(channelId: number): void {
 export function leaveVoiceChannel(): void {
   const currentUserId = authStore.getState().user?.id ?? 0;
   voiceStore.setState((prev) => {
+    const cleared = {
+      currentChannelId: null,
+      joinedAt: null,
+      voiceStatus: "idle" as const,
+      // Server mute lives with the voice session; a new session starts clean.
+      localServerMuted: false,
+      localServerDeafened: false,
+    };
     const channelId = prev.currentChannelId;
     if (channelId === null || currentUserId === 0) {
-      return { ...prev, currentChannelId: null, joinedAt: null, voiceStatus: "idle" };
+      return { ...prev, ...cleared };
     }
     const existingChannel = prev.voiceUsers.get(channelId);
     if (!existingChannel || !existingChannel.has(currentUserId)) {
-      return { ...prev, currentChannelId: null, joinedAt: null, voiceStatus: "idle" };
+      return { ...prev, ...cleared };
     }
     const nextChannels = new Map(prev.voiceUsers);
     const nextUsers = new Map(existingChannel);
@@ -232,13 +272,7 @@ export function leaveVoiceChannel(): void {
     } else {
       nextChannels.set(channelId, nextUsers);
     }
-    return {
-      ...prev,
-      currentChannelId: null,
-      joinedAt: null,
-      voiceStatus: "idle",
-      voiceUsers: nextChannels,
-    };
+    return { ...prev, ...cleared, voiceUsers: nextChannels };
   });
 }
 
diff --git a/Client/tauri-client/src/styles/app.css b/Client/tauri-client/src/styles/app.css
index 62f439af..4bb197cb 100644
--- a/Client/tauri-client/src/styles/app.css
+++ b/Client/tauri-client/src/styles/app.css
@@ -1,7 +1,11 @@
 /* Main app styles — extracted from ui-mockup.html */
 
 /* ═══ Layout ═══ */
-.app { display: flex; flex: 1; min-height: 0; }
+.app {
+  display: flex;
+  flex: 1;
+  min-height: 0;
+}
 
 /* ── SVG Icon base ── */
 .icon {
@@ -12,107 +16,282 @@
 
 /* ── Unified Sidebar ── */
 .unified-sidebar {
-  width: 260px; background: var(--bg-secondary);
-  display: flex; flex-direction: column; flex-shrink: 0; overflow: hidden;
+  width: 260px;
+  background: var(--bg-secondary);
+  display: flex;
+  flex-direction: column;
+  flex-shrink: 0;
+  overflow: hidden;
 }
 .unified-sidebar-header {
-  height: 44px; padding: 0 14px;
-  display: flex; align-items: center; gap: 10px;
+  height: 44px;
+  padding: 0 14px;
+  display: flex;
+  align-items: center;
+  gap: 10px;
   border-bottom: 1px solid var(--border-glow, var(--border));
   flex-shrink: 0;
 }
 .unified-sidebar-header .server-icon-sm {
-  width: 28px; height: 28px; border-radius: var(--radius-md);
+  width: 28px;
+  height: 28px;
+  border-radius: var(--radius-md);
   background: var(--accent-gradient, var(--accent));
-  display: flex; align-items: center; justify-content: center;
-  color: white; font-size: 11px; font-weight: 700;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  color: white;
+  font-size: 11px;
+  font-weight: 700;
+}
+.unified-sidebar-header .server-name {
+  color: white;
+  font-weight: 700;
+  font-size: 13px;
+}
+.unified-sidebar-header .server-online {
+  color: var(--text-micro);
+  font-size: 9px;
 }
-.unified-sidebar-header .server-name { color: white; font-weight: 700; font-size: 13px; }
-.unified-sidebar-header .server-online { color: var(--text-micro); font-size: 9px; }
 .sidebar-invite-btn {
-  margin-left: auto; padding: 4px 10px; border-radius: var(--radius-sm);
-  background: var(--accent-primary, var(--accent)); color: white;
-  font-size: 11px; font-weight: 600; cursor: pointer;
-  transition: background var(--transition-fast), opacity var(--transition-fast);
+  margin-left: auto;
+  padding: 4px 10px;
+  border-radius: var(--radius-sm);
+  background: var(--accent-primary, var(--accent));
+  color: white;
+  font-size: 11px;
+  font-weight: 600;
+  cursor: pointer;
+  transition:
+    background var(--transition-fast),
+    opacity var(--transition-fast);
   flex-shrink: 0;
 }
-.sidebar-invite-btn:hover { opacity: 0.85; }
-.sidebar-divider { height: 1px; background: var(--border-glow, var(--border)); margin: 8px 12px; }
+.sidebar-invite-btn:hover {
+  opacity: 0.85;
+}
+.sidebar-divider {
+  height: 1px;
+  background: var(--border-glow, var(--border));
+  margin: 8px 12px;
+}
 
 /* ── Channel Sidebar ── */
 .channel-sidebar {
-  width: 260px; background: var(--bg-secondary);
-  display: flex; flex-direction: column; flex-shrink: 0;
+  width: 260px;
+  background: var(--bg-secondary);
+  display: flex;
+  flex-direction: column;
+  flex-shrink: 0;
   overflow: hidden;
 }
 .channel-sidebar-header {
-  height: 48px; padding: 0 16px;
-  display: flex; align-items: center; justify-content: space-between;
-  border-bottom: none; box-shadow: var(--elevation-low); cursor: pointer; flex-shrink: 0;
+  height: 48px;
+  padding: 0 16px;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  border-bottom: none;
+  box-shadow: var(--elevation-low);
+  cursor: pointer;
+  flex-shrink: 0;
   transition: background 0.1s ease;
 }
-.channel-sidebar-header:hover { background: var(--bg-hover); }
-.channel-sidebar-header h2 { font-size: 15px; font-weight: 700; color: white; }
-.channel-list { flex: 1; overflow-y: auto; padding: 8px 0; }
+.channel-sidebar-header:hover {
+  background: var(--bg-hover);
+}
+.channel-sidebar-header h2 {
+  font-size: 15px;
+  font-weight: 700;
+  color: white;
+}
+/* Mark All as Read — only rendered visible while something is unread. */
+.sidebar-mark-all-read {
+  display: none;
+  align-items: center;
+  justify-content: center;
+  width: 24px;
+  height: 24px;
+  flex-shrink: 0;
+  border: none;
+  background: transparent;
+  border-radius: var(--radius-sm);
+  color: var(--text-muted);
+  cursor: pointer;
+  padding: 0;
+}
+.sidebar-mark-all-read.visible {
+  display: flex;
+}
+.sidebar-mark-all-read:hover {
+  background: var(--bg-hover);
+  color: var(--text-normal);
+}
+.channel-list {
+  flex: 1;
+  overflow-y: auto;
+  padding: 8px 0;
+}
 
 .category {
   padding: 16px 8px 4px 16px;
-  display: flex; align-items: center; gap: 4px;
-  cursor: pointer; user-select: none;
+  display: flex;
+  align-items: center;
+  gap: 4px;
+  cursor: pointer;
+  user-select: none;
 }
 .category-arrow {
   color: var(--text-muted);
-  transition: transform .2s; display: inline-flex; align-items: center;
+  transition: transform 0.2s;
+  display: inline-flex;
+  align-items: center;
 }
 .category-name {
-  font-size: 11px; font-weight: 700;
-  color: var(--text-faint); letter-spacing: .5px; text-transform: uppercase;
+  font-size: 11px;
+  font-weight: 700;
+  color: var(--text-faint);
+  letter-spacing: 0.5px;
+  text-transform: uppercase;
 }
 .category-add-btn {
-  margin-left: auto; font-size: 16px; color: var(--text-faint);
-  cursor: pointer; padding: 0 4px; line-height: 1; opacity: 0;
-  transition: opacity .15s, color .15s;
+  margin-left: auto;
+  font-size: 16px;
+  color: var(--text-faint);
+  cursor: pointer;
+  padding: 0 4px;
+  line-height: 1;
+  opacity: 0;
+  transition:
+    opacity 0.15s,
+    color 0.15s;
+}
+.category:hover .category-add-btn {
+  opacity: 1;
+}
+.category-add-btn:hover {
+  color: var(--text-normal);
+}
+.category-channels {
+  overflow: hidden;
+  transition: max-height 0.2s;
+}
+.category.collapsed + .category-channels {
+  max-height: 0 !important;
+  overflow: hidden;
 }
-.category:hover .category-add-btn { opacity: 1; }
-.category-add-btn:hover { color: var(--text-normal); }
-.category-channels { overflow: hidden; transition: max-height .2s; }
-.category.collapsed + .category-channels { max-height: 0 !important; overflow: hidden; }
 
 .channel-item {
-  display: flex; align-items: center; gap: 6px;
-  padding: 6px 8px; margin: 1px 8px;
-  border-radius: var(--radius-sm); cursor: pointer;
-  color: var(--text-muted); transition: all .1s;
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  padding: 6px 8px;
+  margin: 1px 8px;
+  border-radius: var(--radius-sm);
+  cursor: pointer;
+  color: var(--text-muted);
+  transition: all 0.1s;
   position: relative;
 }
-.channel-item:hover { background: var(--bg-hover); color: var(--text-normal); }
-.channel-item.active { background: var(--bg-active); color: white; }
+.channel-item:hover {
+  background: var(--bg-hover);
+  color: var(--text-normal);
+}
+.channel-item.active {
+  background: var(--bg-active);
+  color: white;
+}
 /* Voice join/leave frozen while the WS socket is down (docs/architecture/ux/README.md §3). */
-.channel-item.voice.disabled { opacity: 0.5; cursor: not-allowed; }
-.channel-item.voice.disabled:hover { background: transparent; color: var(--text-muted); }
-.channel-draggable { cursor: grab; }
-.channel-draggable:active { cursor: grabbing; }
-.channel-reordering { user-select: none; cursor: grabbing !important; }
-.channel-reordering * { cursor: grabbing !important; }
-.channel-draggable.dragging { opacity: .3; }
+.channel-item.voice.disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+.channel-item.voice.disabled:hover {
+  background: transparent;
+  color: var(--text-muted);
+}
+.channel-draggable {
+  cursor: grab;
+}
+.channel-draggable:active {
+  cursor: grabbing;
+}
+.channel-reordering {
+  user-select: none;
+  cursor: grabbing !important;
+}
+.channel-reordering * {
+  cursor: grabbing !important;
+}
+.channel-draggable.dragging {
+  opacity: 0.3;
+}
 .channel-drop-indicator {
-  box-shadow: 0 2px 0 var(--accent) inset, 0 -2px 0 var(--accent) inset;
-  background: rgba(88, 101, 242, .15);
+  box-shadow:
+    0 2px 0 var(--accent) inset,
+    0 -2px 0 var(--accent) inset;
+  background: rgba(88, 101, 242, 0.15);
   border-radius: var(--radius-sm);
 }
-.channel-item .ch-icon { opacity: .6; flex-shrink: 0; width: 20px; text-align: center; display: flex; align-items: center; justify-content: center; }
-.channel-item.active .ch-icon { opacity: 1; }
-.channel-item .ch-name { font-size: 14px; flex: 1; }
+.channel-item .ch-icon {
+  opacity: 0.6;
+  flex-shrink: 0;
+  width: 20px;
+  text-align: center;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+}
+.channel-item.active .ch-icon {
+  opacity: 1;
+}
+.channel-item .ch-name {
+  font-size: 14px;
+  flex: 1;
+}
 .channel-item .unread-badge {
-  background: var(--accent); color: white;
-  font-size: 10px; font-weight: 700;
-  min-width: 18px; height: 18px; border-radius: 9px;
-  display: flex; align-items: center; justify-content: center; padding: 0 4px;
+  background: var(--accent);
+  color: white;
+  font-size: 10px;
+  font-weight: 700;
+  min-width: 18px;
+  height: 18px;
+  border-radius: 9px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 0 4px;
+}
+.channel-item .unread-badge:empty {
+  display: none;
+}
+/* Mention badge — red, and rendered instead of (never beside) the unread badge. */
+.channel-item .mention-badge {
+  background: var(--red);
+  color: white;
+  font-size: 10px;
+  font-weight: 700;
+  min-width: 18px;
+  height: 18px;
+  border-radius: 9px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 0 4px;
+}
+.channel-item .mention-badge:empty {
+  display: none;
+}
+.channel-item.mentioned .ch-name {
+  color: white;
+  font-weight: 600;
+}
+.channel-item.unread .ch-name {
+  color: white;
+  font-weight: 600;
 }
-.channel-item .unread-badge:empty { display: none; }
-.channel-item.unread .ch-name { color: white; font-weight: 600; }
 .channel-item.unread::before {
-  content: '';
+  content: "";
   position: absolute;
   left: 0;
   top: 50%;
@@ -124,39 +303,88 @@
 }
 
 /* Voice users nested in sidebar */
-.voice-users-list { padding: 2px 0 4px 36px; }
+.voice-users-list {
+  padding: 2px 0 4px 36px;
+}
 .voice-user-item {
-  display: flex; align-items: center; gap: 6px;
-  padding: 3px 8px; border-radius: var(--radius-sm);
-  cursor: pointer; font-size: 13px; color: var(--text-muted);
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  padding: 3px 8px;
+  border-radius: var(--radius-sm);
+  cursor: pointer;
+  font-size: 13px;
+  color: var(--text-muted);
   overflow: hidden;
 }
 .voice-user-item .vu-name {
-  overflow: hidden; text-overflow: ellipsis; white-space: nowrap; min-width: 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  min-width: 0;
+}
+.voice-user-item:hover {
+  background: var(--bg-hover);
+  color: var(--text-normal);
 }
-.voice-user-item:hover { background: var(--bg-hover); color: var(--text-normal); }
 .voice-user-item .vu-avatar {
-  width: 20px; height: 20px; border-radius: var(--radius-circle);
-  display: flex; align-items: center; justify-content: center;
-  font-size: 9px; font-weight: 700; color: white; flex-shrink: 0;
+  width: 20px;
+  height: 20px;
+  border-radius: var(--radius-circle);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: 9px;
+  font-weight: 700;
+  color: white;
+  flex-shrink: 0;
 }
 .voice-user-item.speaking .vu-avatar {
-  box-shadow: 0 0 0 2px var(--green), 0 0 8px rgba(35, 165, 90, 0.3);
+  box-shadow:
+    0 0 0 2px var(--green),
+    0 0 8px rgba(35, 165, 90, 0.3);
   animation: speak-pulse 1.5s ease-in-out infinite;
 }
 @keyframes speak-pulse {
-  0%, 100% { box-shadow: 0 0 0 2px var(--green), 0 0 8px rgba(35, 165, 90, 0.3); }
-  50% { box-shadow: 0 0 0 2px var(--green), 0 0 14px rgba(35, 165, 90, 0.5); }
+  0%,
+  100% {
+    box-shadow:
+      0 0 0 2px var(--green),
+      0 0 8px rgba(35, 165, 90, 0.3);
+  }
+  50% {
+    box-shadow:
+      0 0 0 2px var(--green),
+      0 0 14px rgba(35, 165, 90, 0.5);
+  }
 }
 .voice-user-item .vu-status,
-.voice-user-item .vu-muted { margin-left: 2px; display: flex; align-items: center; flex-shrink: 0; }
-.voice-user-item .vu-status { color: var(--text-muted); }
-.voice-user-item .vu-muted { color: var(--red); }
+.voice-user-item .vu-muted {
+  margin-left: 2px;
+  display: flex;
+  align-items: center;
+  flex-shrink: 0;
+}
+.voice-user-item .vu-status {
+  color: var(--text-muted);
+}
+.voice-user-item .vu-muted {
+  color: var(--red);
+}
 .voice-user-item .vu-name + .vu-status,
-.voice-user-item .vu-name + .vu-muted { margin-left: auto; }
+.voice-user-item .vu-name + .vu-muted {
+  margin-left: auto;
+}
 /* E2EE identity verification badge (F3 TOFU); color + cursor set inline per state. */
-.voice-user-item .vu-verify { margin-left: 2px; display: flex; align-items: center; flex-shrink: 0; }
-.voice-user-item .vu-name + .vu-verify { margin-left: auto; }
+.voice-user-item .vu-verify {
+  margin-left: 2px;
+  display: flex;
+  align-items: center;
+  flex-shrink: 0;
+}
+.voice-user-item .vu-name + .vu-verify {
+  margin-left: auto;
+}
 
 /* ── LIVE badge (voice channel sidebar) ── */
 .vu-live-badge {
@@ -186,8 +414,12 @@
   box-shadow: 0 0 4px rgba(0, 200, 255, 0.08);
   display: block;
 }
-.vu-preview video.preview-camera { object-fit: cover; }
-.vu-preview video.preview-screen { object-fit: cover; }
+.vu-preview video.preview-camera {
+  object-fit: cover;
+}
+.vu-preview video.preview-screen {
+  object-fit: cover;
+}
 .vu-preview-placeholder {
   width: 100%;
   aspect-ratio: 16 / 9;
@@ -217,178 +449,425 @@
 
 /* Voice widget (above user bar, when connected) */
 .voice-widget {
-  background: var(--bg-secondary); border-top: 1px solid var(--border);
-  padding: 8px; flex-shrink: 0; display: none;
+  background: var(--bg-secondary);
+  border-top: 1px solid var(--border);
+  padding: 8px;
+  flex-shrink: 0;
+  display: none;
+}
+.voice-widget.visible {
+  display: block;
+}
+.vw-header {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 4px 8px;
+  font-size: 12px;
+}
+.vw-connected {
+  color: var(--green);
+  font-weight: 700;
 }
-.voice-widget.visible { display: block; }
-.vw-header { display: flex; align-items: center; gap: 8px; padding: 4px 8px; font-size: 12px; }
-.vw-connected { color: var(--green); font-weight: 700; }
 /* In-progress lifecycle states use amber; the call is not yet secured/live. */
-.vw-connected.vw-securing, .vw-connected.vw-reconnecting { color: var(--yellow, #f0b232); }
+.vw-connected.vw-securing,
+.vw-connected.vw-reconnecting {
+  color: var(--yellow, #f0b232);
+}
 .vw-secured {
-  display: inline-flex; align-items: center; gap: 3px;
-  color: var(--green); font-size: 11px; font-weight: 600;
+  display: inline-flex;
+  align-items: center;
+  gap: 3px;
+  color: var(--green);
+  font-size: 11px;
+  font-weight: 600;
+}
+.vw-timer {
+  color: var(--green);
+  font-size: 11px;
+  opacity: 0.8;
+  font-variant-numeric: tabular-nums;
+}
+.vw-channel {
+  color: var(--text-muted);
 }
-.vw-timer { color: var(--green); font-size: 11px; opacity: 0.8; font-variant-numeric: tabular-nums; }
-.vw-channel { color: var(--text-muted); }
 /* Frozen while the WS socket is down: controls are visibly non-interactive. */
-.vw-controls--frozen button { opacity: 0.5; cursor: not-allowed; }
-.vw-controls--frozen button:hover { background: var(--bg-active); color: var(--text-muted); }
-.vw-controls { display: flex; gap: 4px; padding: 4px 4px 0; }
+.vw-controls--frozen button {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+.vw-controls--frozen button:hover {
+  background: var(--bg-active);
+  color: var(--text-muted);
+}
+.vw-controls {
+  display: flex;
+  gap: 4px;
+  padding: 4px 4px 0;
+}
 .vw-controls button {
-  flex: 1; height: 32px; border-radius: var(--radius-sm);
-  background: var(--bg-active); color: var(--text-muted);
-  font-size: 14px; transition: all .1s;
-  display: flex; align-items: center; justify-content: center;
+  flex: 1;
+  height: 32px;
+  border-radius: var(--radius-sm);
+  background: var(--bg-active);
+  color: var(--text-muted);
+  font-size: 14px;
+  transition: all 0.1s;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+}
+.vw-controls button:hover {
+  background: var(--bg-hover);
+  color: var(--text-normal);
+}
+.vw-controls button.active-ctrl {
+  background: rgba(242, 63, 67, 0.2);
+  color: var(--red);
+}
+.vw-controls button.disconnect {
+  background: transparent;
+  color: var(--red);
+}
+.vw-controls button.disconnect:hover {
+  background: rgba(242, 63, 67, 0.15);
 }
-.vw-controls button:hover { background: var(--bg-hover); color: var(--text-normal); }
-.vw-controls button.active-ctrl { background: rgba(242,63,67,.2); color: var(--red); }
-.vw-controls button.disconnect { background: transparent; color: var(--red); }
-.vw-controls button.disconnect:hover { background: rgba(242,63,67,.15); }
 .vw-grant-mic {
-  display: block; width: calc(100% - 8px); margin: 4px 4px 0;
-  padding: 6px 12px; border-radius: var(--radius-sm); border: none;
-  background: var(--accent); color: #fff; font-size: 12px;
-  font-weight: 600; font-family: var(--font-body); cursor: pointer;
+  display: block;
+  width: calc(100% - 8px);
+  margin: 4px 4px 0;
+  padding: 6px 12px;
+  border-radius: var(--radius-sm);
+  border: none;
+  background: var(--accent);
+  color: #fff;
+  font-size: 12px;
+  font-weight: 600;
+  font-family: var(--font-body);
+  cursor: pointer;
   transition: filter var(--transition-normal);
 }
-.vw-grant-mic:hover { filter: brightness(1.1); }
-.vw-grant-mic:disabled { opacity: 0.6; cursor: wait; }
+.vw-grant-mic:hover {
+  filter: brightness(1.1);
+}
+.vw-grant-mic:disabled {
+  opacity: 0.6;
+  cursor: wait;
+}
 .vw-signal {
-  margin-left: auto; display: flex; align-items: center; gap: 4px;
-  cursor: pointer; padding: 2px 4px; border-radius: var(--radius-sm);
-  transition: background .1s;
+  margin-left: auto;
+  display: flex;
+  align-items: center;
+  gap: 4px;
+  cursor: pointer;
+  padding: 2px 4px;
+  border-radius: var(--radius-sm);
+  transition: background 0.1s;
+}
+.vw-signal:hover {
+  background: var(--bg-active);
+}
+.vw-ping {
+  font-size: 11px;
+  font-weight: 600;
 }
-.vw-signal:hover { background: var(--bg-active); }
-.vw-ping { font-size: 11px; font-weight: 600; }
 .vw-stats {
-  padding: 10px 12px; background: var(--bg-tertiary);
-  border-bottom: 1px solid var(--border); display: none;
+  padding: 10px 12px;
+  background: var(--bg-tertiary);
+  border-bottom: 1px solid var(--border);
+  display: none;
+}
+.vw-stats.visible {
+  display: block;
 }
-.vw-stats.visible { display: block; }
 .vw-stats-title {
-  font-size: 11px; font-weight: 700; color: var(--text-normal);
-  text-transform: uppercase; letter-spacing: 0.5px; margin-bottom: 8px;
+  font-size: 11px;
+  font-weight: 700;
+  color: var(--text-normal);
+  text-transform: uppercase;
+  letter-spacing: 0.5px;
+  margin-bottom: 8px;
 }
 .vw-stats-grid {
-  display: grid; grid-template-columns: 1fr 1fr;
-  gap: 10px; margin-bottom: 8px;
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 10px;
+  margin-bottom: 8px;
+}
+.vw-stats-col-label {
+  font-size: 11px;
+  font-weight: 700;
+  margin-bottom: 4px;
+}
+.vw-stats-col-label.out {
+  color: var(--green);
+}
+.vw-stats-col-label.in {
+  color: var(--yellow, #f0b232);
 }
-.vw-stats-col-label { font-size: 11px; font-weight: 700; margin-bottom: 4px; }
-.vw-stats-col-label.out { color: var(--green); }
-.vw-stats-col-label.in { color: var(--yellow, #f0b232); }
 .vw-stats-row {
-  font-size: 11px; color: var(--text-muted); line-height: 1.7;
+  font-size: 11px;
+  color: var(--text-muted);
+  line-height: 1.7;
+}
+.vw-stats-row span {
+  color: var(--text-normal);
 }
-.vw-stats-row span { color: var(--text-normal); }
 .vw-stats-totals {
-  border-top: 1px solid var(--border); padding-top: 8px;
+  border-top: 1px solid var(--border);
+  padding-top: 8px;
 }
 .vw-stats-totals-label {
-  font-size: 11px; font-weight: 700; color: var(--accent, #5865f2);
+  font-size: 11px;
+  font-weight: 700;
+  color: var(--accent, #5865f2);
   margin-bottom: 4px;
 }
 .vw-stats-totals-row {
-  display: flex; justify-content: space-between;
-  font-size: 11px; color: var(--text-muted);
+  display: flex;
+  justify-content: space-between;
+  font-size: 11px;
+  color: var(--text-muted);
+}
+.vw-stats-totals-row span {
+  color: var(--text-normal);
 }
-.vw-stats-totals-row span { color: var(--text-normal); }
 
 /* ── User Bar ── */
 .user-bar {
-  height: 52px; background: rgba(17,18,20,.6);
-  display: flex; align-items: center;
-  padding: 0 8px; gap: 8px; flex-shrink: 0;
+  height: 52px;
+  background: rgba(17, 18, 20, 0.6);
+  display: flex;
+  align-items: center;
+  padding: 0 8px;
+  gap: 8px;
+  flex-shrink: 0;
 }
 .user-bar .ub-avatar {
-  width: 32px; height: 32px; border-radius: var(--radius-circle);
-  flex-shrink: 0; position: relative;
-  display: flex; align-items: center; justify-content: center;
-  font-weight: 700; font-size: 14px; color: white; cursor: pointer;
+  width: 32px;
+  height: 32px;
+  border-radius: var(--radius-circle);
+  flex-shrink: 0;
+  position: relative;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-weight: 700;
+  font-size: 14px;
+  color: white;
+  cursor: pointer;
 }
 .user-bar .status-dot {
-  position: absolute; bottom: -1px; right: -1px;
-  width: 12px; height: 12px; border-radius: var(--radius-circle);
-  border: 3px solid rgba(17,18,20,.6);
+  position: absolute;
+  bottom: -1px;
+  right: -1px;
+  width: 12px;
+  height: 12px;
+  border-radius: var(--radius-circle);
+  border: 3px solid rgba(17, 18, 20, 0.6);
+}
+.user-bar .ub-info {
+  flex: 1;
+  min-width: 0;
+  display: flex;
+  flex-direction: column;
+}
+.user-bar .ub-name {
+  font-size: 13px;
+  font-weight: 600;
+  color: white;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  line-height: 1.2;
+}
+.user-bar .ub-status {
+  font-size: 11px;
+  color: var(--text-muted);
+  line-height: 1.2;
+}
+.user-bar .ub-controls {
+  display: flex;
+  gap: 2px;
 }
-.user-bar .ub-info { flex: 1; min-width: 0; display: flex; flex-direction: column; }
-.user-bar .ub-name { font-size: 13px; font-weight: 600; color: white; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; line-height: 1.2; }
-.user-bar .ub-status { font-size: 11px; color: var(--text-muted); line-height: 1.2; }
-.user-bar .ub-controls { display: flex; gap: 2px; }
 .user-bar .ub-controls button {
-  width: 32px; height: 32px; border-radius: var(--radius-sm);
-  background: transparent; color: var(--text-muted);
-  display: flex; align-items: center; justify-content: center;
-  font-size: 16px; transition: all .1s;
+  width: 32px;
+  height: 32px;
+  border-radius: var(--radius-sm);
+  background: transparent;
+  color: var(--text-muted);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: 16px;
+  transition: all 0.1s;
+}
+.user-bar .ub-controls button:hover {
+  background: var(--bg-hover);
+  color: var(--text-normal);
+}
+.user-bar .ub-controls button.active-ctrl {
+  color: var(--red);
 }
-.user-bar .ub-controls button:hover { background: var(--bg-hover); color: var(--text-normal); }
-.user-bar .ub-controls button.active-ctrl { color: var(--red); }
 
 /* Status picker popup */
 .status-picker {
-  position: absolute; bottom: 60px; left: 8px;
-  background: var(--bg-primary); border: 1px solid var(--border);
-  border-radius: var(--radius-md); padding: 6px;
-  box-shadow: 0 8px 24px rgba(0,0,0,.5);
-  z-index: 100; display: none; min-width: 160px;
+  position: absolute;
+  bottom: 60px;
+  left: 8px;
+  background: var(--bg-primary);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-md);
+  padding: 6px;
+  box-shadow: 0 8px 24px rgba(0, 0, 0, 0.5);
+  z-index: 100;
+  display: none;
+  min-width: 160px;
+}
+.status-picker.open {
+  display: block;
 }
-.status-picker.open { display: block; }
 .status-option {
-  display: flex; align-items: center; gap: 8px;
-  padding: 8px 10px; border-radius: var(--radius-sm);
-  cursor: pointer; font-size: 13px; color: var(--text-normal);
-  background: transparent; width: 100%; text-align: left;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 8px 10px;
+  border-radius: var(--radius-sm);
+  cursor: pointer;
+  font-size: 13px;
+  color: var(--text-normal);
+  background: transparent;
+  width: 100%;
+  text-align: left;
   transition: background 0.1s ease;
 }
-.status-option:hover { background: var(--bg-hover); }
+.status-option:hover {
+  background: var(--bg-hover);
+}
 .status-option .so-dot {
-  width: 10px; height: 10px; border-radius: var(--radius-circle); flex-shrink: 0;
+  width: 10px;
+  height: 10px;
+  border-radius: var(--radius-circle);
+  flex-shrink: 0;
 }
 
 /* ── Chat Area ── */
-.chat-area { flex: 1; display: flex; flex-direction: column; min-width: 0; background: var(--bg-primary); }
+.chat-area {
+  flex: 1;
+  display: flex;
+  flex-direction: column;
+  min-width: 0;
+  background: var(--bg-primary);
+}
 
 .chat-header {
-  height: 48px; padding: 0 16px;
-  display: flex; align-items: center; gap: 12px;
-  border-bottom: none; box-shadow: var(--elevation-low); flex-shrink: 0;
+  height: 48px;
+  padding: 0 16px;
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  border-bottom: none;
+  box-shadow: var(--elevation-low);
+  flex-shrink: 0;
+}
+.chat-header .ch-hash {
+  color: var(--text-micro);
+  font-size: 22px;
+  font-weight: 600;
+}
+.chat-header .ch-name {
+  font-size: 15px;
+  font-weight: 700;
+  color: white;
+}
+.chat-header .ch-divider {
+  width: 1px;
+  height: 24px;
+  background: var(--border);
+}
+.chat-header .ch-topic {
+  font-size: 13px;
+  color: var(--text-muted);
+  flex: 1;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.chat-header .ch-tools {
+  display: flex;
+  gap: 4px;
+  flex-shrink: 0;
 }
-.chat-header .ch-hash { color: var(--text-micro); font-size: 22px; font-weight: 600; }
-.chat-header .ch-name { font-size: 15px; font-weight: 700; color: white; }
-.chat-header .ch-divider { width: 1px; height: 24px; background: var(--border); }
-.chat-header .ch-topic { font-size: 13px; color: var(--text-muted); flex: 1; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
-.chat-header .ch-tools { display: flex; gap: 4px; flex-shrink: 0; }
 .chat-header .ch-tools button {
-  width: 28px; height: 28px; border-radius: var(--radius-sm);
-  background: transparent; color: var(--text-muted);
-  font-size: 16px; transition: all .1s;
-  display: flex; align-items: center; justify-content: center;
+  width: 28px;
+  height: 28px;
+  border-radius: var(--radius-sm);
+  background: transparent;
+  color: var(--text-muted);
+  font-size: 16px;
+  transition: all 0.1s;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+}
+.chat-header .ch-tools button:hover {
+  background: var(--bg-hover);
+  color: var(--text-normal);
+}
+.chat-header .ch-tools button.active {
+  color: white;
 }
-.chat-header .ch-tools button:hover { background: var(--bg-hover); color: var(--text-normal); }
-.chat-header .ch-tools button.active { color: white; }
 .chat-header .search-input {
-  width: 160px; height: 28px; border-radius: var(--radius-sm);
-  background: var(--bg-tertiary); color: var(--text-muted); font-size: 12px;
-  padding: 0 8px; transition: width .3s;
+  width: 160px;
+  height: 28px;
+  border-radius: var(--radius-sm);
+  background: var(--bg-tertiary);
+  color: var(--text-muted);
+  font-size: 12px;
+  padding: 0 8px;
+  transition: width 0.3s;
+}
+.chat-header .search-input::placeholder {
+  color: var(--text-micro);
+}
+.chat-header .search-input:focus {
+  width: 240px;
+  color: var(--text-normal);
 }
-.chat-header .search-input::placeholder { color: var(--text-micro); }
-.chat-header .search-input:focus { width: 240px; color: var(--text-normal); }
 
 /* ── Slot wrappers (inside .chat-area flex column) ── */
-.messages-slot { flex: 1; min-height: 0; display: flex; flex-direction: column; }
-.typing-slot { flex-shrink: 0; }
-.input-slot { flex-shrink: 0; }
+.messages-slot {
+  flex: 1;
+  min-height: 0;
+  display: flex;
+  flex-direction: column;
+  /* Containing block for the NSFW age gate, which covers exactly this slot. */
+  position: relative;
+}
+.typing-slot {
+  flex-shrink: 0;
+}
+.input-slot {
+  flex-shrink: 0;
+}
 
 /* ── Messages ── */
 .messages-container {
-  flex: 1; overflow-y: auto; padding: 16px 0;
+  flex: 1;
+  overflow-y: auto;
+  padding: 16px 0;
   overscroll-behavior: contain;
   contain: strict;
   position: relative;
 }
 /* Scroll anchoring: only the bottom anchor element pins, everything else opts out */
-.messages-container > * { overflow-anchor: none; }
-.scroll-anchor { overflow-anchor: auto; height: 1px; }
+.messages-container > * {
+  overflow-anchor: none;
+}
+.scroll-anchor {
+  overflow-anchor: auto;
+  height: 1px;
+}
 /* ── Scroll-to-bottom floating button ── */
 .scroll-to-bottom-btn {
   position: absolute;
@@ -404,10 +883,12 @@
   cursor: pointer;
   opacity: 0;
   transform: translateY(10px);
-  transition: opacity 0.15s ease, transform 0.15s ease;
+  transition:
+    opacity 0.15s ease,
+    transform 0.15s ease;
   pointer-events: none;
   z-index: 5;
-  box-shadow: 0 2px 8px rgba(0,0,0,0.3);
+  box-shadow: 0 2px 8px rgba(0, 0, 0, 0.3);
 }
 .scroll-to-bottom-btn.visible {
   opacity: 1;
@@ -418,86 +899,315 @@
   background: var(--bg-hover);
   color: var(--text-primary);
 }
+/* ── Jump to Present pill ──
+   Shown only while the loaded window is an around-window detached from the
+   live tail: the bottom of the list is not "now", and this is the only thing
+   that says so. Sits above the scroll-to-bottom button, which means something
+   different (scroll within the window). */
+.jump-to-present-pill {
+  position: absolute;
+  bottom: 8px;
+  left: 50%;
+  transform: translate(-50%, 10px);
+  padding: 6px 14px;
+  border: none;
+  border-radius: var(--radius-pill, 999px);
+  background: var(--accent);
+  color: white;
+  font-size: 13px;
+  font-weight: 600;
+  cursor: pointer;
+  opacity: 0;
+  pointer-events: none;
+  transition:
+    opacity 0.15s ease,
+    transform 0.15s ease;
+  z-index: 6;
+  box-shadow: 0 2px 8px rgba(0, 0, 0, 0.3);
+}
+
+.jump-to-present-pill.visible {
+  opacity: 1;
+  transform: translate(-50%, 0);
+  pointer-events: auto;
+}
+
+.jump-to-present-pill:hover {
+  filter: brightness(1.1);
+}
+
+/* ── Jump target flash ──
+   The row a jump landed on, briefly tinted so the eye can find it after the
+   scroll. Applied by MessageList.scrollToMessage for 1.5s. */
+.highlight-flash {
+  animation: jump-flash 1.5s ease-out;
+}
+
+@keyframes jump-flash {
+  0%,
+  55% {
+    background: color-mix(in srgb, var(--accent) 22%, transparent);
+  }
+  100% {
+    background: transparent;
+  }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .highlight-flash {
+    animation-duration: 0.01ms;
+    background: color-mix(in srgb, var(--accent) 22%, transparent);
+  }
+  .jump-to-present-pill {
+    transition: none;
+  }
+}
+
 /* ── Channel welcome (empty state) ── */
 .channel-welcome {
-  display: flex; flex-direction: column; align-items: flex-start;
-  padding: 16px 32px; margin-bottom: 16px;
+  display: flex;
+  flex-direction: column;
+  align-items: flex-start;
+  padding: 16px 32px;
+  margin-bottom: 16px;
 }
 .channel-welcome-icon {
-  width: 80px; height: 80px; border-radius: var(--radius-circle);
-  background: var(--bg-tertiary); color: var(--text-muted);
-  display: flex; align-items: center; justify-content: center;
-  font-size: 68px; font-weight: 700; line-height: 1;
-  margin-bottom: 16px; flex-shrink: 0;
+  width: 80px;
+  height: 80px;
+  border-radius: var(--radius-circle);
+  background: var(--bg-tertiary);
+  color: var(--text-muted);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: 68px;
+  font-weight: 700;
+  line-height: 1;
+  margin-bottom: 16px;
+  flex-shrink: 0;
 }
 .channel-welcome-title {
-  font-size: 24px; font-weight: 700; color: white;
+  font-size: 24px;
+  font-weight: 700;
+  color: white;
   margin: 0 0 8px;
 }
 .channel-welcome-text {
-  font-size: 14px; color: var(--text-muted); margin: 0;
+  font-size: 14px;
+  color: var(--text-muted);
+  margin: 0;
 }
 
 /* ── Message history fetch states (loading / inline error + Retry) ── */
-.messages-loading, .messages-load-error {
-  display: flex; flex-direction: column; align-items: center; justify-content: center;
-  gap: 12px; padding: 48px 0; color: var(--text-muted);
+.messages-loading,
+.messages-load-error {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  gap: 12px;
+  padding: 48px 0;
+  color: var(--text-muted);
 }
-.messages-loading .spinner { width: 24px; height: 24px; }
-.messages-loading-text, .messages-load-error-text {
-  font-size: 13px; color: var(--text-muted); margin: 0;
+.messages-loading .spinner {
+  width: 24px;
+  height: 24px;
+}
+.messages-loading-text,
+.messages-load-error-text {
+  font-size: 13px;
+  color: var(--text-muted);
+  margin: 0;
 }
 .messages-retry-btn {
-  background: transparent; border: 1px solid currentColor; color: var(--text-muted);
-  border-radius: 4px; padding: 4px 16px; font-size: 13px; cursor: pointer;
+  background: transparent;
+  border: 1px solid currentColor;
+  color: var(--text-muted);
+  border-radius: 4px;
+  padding: 4px 16px;
+  font-size: 13px;
+  cursor: pointer;
+}
+.messages-retry-btn:hover {
+  background: var(--bg-hover);
+  color: var(--text-primary);
 }
-.messages-retry-btn:hover { background: var(--bg-hover); color: var(--text-primary); }
 
 .msg-day-divider {
-  display: flex; align-items: center; gap: 8px;
-  padding: 8px 16px 16px; margin-bottom: 8px;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 8px 16px 16px;
+  margin-bottom: 8px;
+}
+.msg-day-divider .line {
+  flex: 1;
+  height: 1px;
+  background: var(--border);
+}
+.msg-day-divider .date {
+  font-size: 12px;
+  font-weight: 700;
+  color: var(--text-muted);
+}
+
+/* New-messages divider — same shape as the day divider, accented red so the
+   reader's resume point is findable at a glance. */
+.msg-new-divider {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 4px 16px 8px;
+}
+.msg-new-divider .line {
+  flex: 1;
+  height: 1px;
+  background: var(--red);
+}
+.msg-new-divider .label {
+  font-size: 10px;
+  font-weight: 700;
+  letter-spacing: 0.5px;
+  color: white;
+  background: var(--red);
+  padding: 1px 6px;
+  border-radius: 4px;
 }
-.msg-day-divider .line { flex: 1; height: 1px; background: var(--border); }
-.msg-day-divider .date { font-size: 12px; font-weight: 700; color: var(--text-muted); }
 
 .message {
-  padding: 2px var(--message-content-right) 2px var(--message-content-left); position: relative;
+  padding: 2px var(--message-content-right) 2px var(--message-content-left);
+  position: relative;
   min-height: 2.75rem;
   margin-top: var(--message-group-spacing);
   contain: layout style;
   transition: background 0.1s ease;
   border-left: 2px solid transparent;
 }
-.message:first-child, .msg-day-divider + .message { margin-top: 0; }
-.message:hover { background: var(--bg-modifier-hover); }
-.message.grouped { min-height: 1.375rem; margin-top: var(--message-inline-spacing); }
+.message:first-child,
+.msg-day-divider + .message {
+  margin-top: 0;
+}
+.message:hover {
+  background: var(--bg-modifier-hover);
+}
+.message.grouped {
+  min-height: 1.375rem;
+  margin-top: var(--message-inline-spacing);
+}
 .message .msg-avatar {
-  position: absolute; left: var(--avatar-offset-left); top: 4px;
-  width: var(--avatar-size); height: var(--avatar-size); border-radius: var(--radius-circle);
-  display: flex; align-items: center; justify-content: center;
-  font-weight: 700; font-size: 16px; color: white;
-  cursor: pointer; overflow: hidden;
+  position: absolute;
+  left: var(--avatar-offset-left);
+  top: 4px;
+  width: var(--avatar-size);
+  height: var(--avatar-size);
+  border-radius: var(--radius-circle);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-weight: 700;
+  font-size: 16px;
+  color: white;
+  cursor: pointer;
+  overflow: hidden;
+}
+.message .msg-avatar:hover {
+  opacity: 0.8;
+}
+.message.grouped .msg-avatar {
+  display: none;
 }
-.message .msg-avatar:hover { opacity: 0.8; }
-.message.grouped .msg-avatar { display: none; }
 .message .msg-hover-time {
-  position: absolute; left: var(--avatar-offset-left); top: 50%; transform: translateY(-50%);
-  width: var(--avatar-size); text-align: center;
-  font-size: 0.6875rem; color: var(--text-micro);
+  position: absolute;
+  left: var(--avatar-offset-left);
+  top: 50%;
+  transform: translateY(-50%);
+  width: var(--avatar-size);
+  text-align: center;
+  font-size: 0.6875rem;
+  color: var(--text-micro);
   font-variant-numeric: tabular-nums;
   display: none;
 }
-.message.grouped:hover .msg-hover-time { display: block; }
-.message .msg-header { display: flex; align-items: baseline; gap: 8px; }
-.message.grouped .msg-header { display: none; }
-.message .msg-author { font-weight: 600; font-size: var(--font-size-lg); cursor: pointer; text-decoration-color: currentColor; }
-.message .msg-author:hover { text-decoration: underline; text-decoration-color: currentColor; }
-.message .msg-time { font-size: var(--font-size-xs); color: var(--text-micro); font-variant-numeric: tabular-nums; }
-.message .msg-edited { font-size: 10px; color: var(--text-micro); }
-.message .msg-text { line-height: 1.45; word-break: break-word; }
+.message.grouped:hover .msg-hover-time {
+  display: block;
+}
+.message .msg-header {
+  display: flex;
+  align-items: baseline;
+  gap: 8px;
+}
+.message.grouped .msg-header {
+  display: none;
+}
+.message .msg-author {
+  font-weight: 600;
+  font-size: var(--font-size-lg);
+  cursor: pointer;
+  text-decoration-color: currentColor;
+}
+.message .msg-author:hover {
+  text-decoration: underline;
+  text-decoration-color: currentColor;
+}
+.message .msg-time {
+  font-size: var(--font-size-xs);
+  color: var(--text-micro);
+  font-variant-numeric: tabular-nums;
+}
+.message .msg-edited {
+  font-size: 10px;
+  color: var(--text-micro);
+}
+.message .msg-text {
+  line-height: 1.45;
+  word-break: break-word;
+}
 .message .msg-text code {
-  font-family: var(--font-mono); background: var(--bg-tertiary);
-  padding: 2px 5px; border-radius: 3px; font-size: 13px;
+  font-family: var(--font-mono);
+  background: var(--bg-tertiary);
+  padding: 2px 5px;
+  border-radius: 3px;
+  font-size: 13px;
+}
+
+/* Custom emoji — inline images that stand in for a :shortcode: token.
+   Sized in a way that keeps the line height of ordinary text: 22px matches the
+   cap height of the 16px message font closely enough that a line with emoji
+   does not jump taller than the one above it. */
+.custom-emoji {
+  width: 22px;
+  height: 22px;
+  object-fit: contain;
+  vertical-align: -0.3em;
+  margin: 0 1px;
+  /* An emoji whose bytes have not arrived (or never will) falls back to its
+     alt text, so the box must not clip the shortcode. */
+  min-width: 22px;
+}
+
+/* A message that is nothing but emoji renders them large, Discord-style. The
+   class sits on .msg-text so it sizes the unicode glyphs and the custom-emoji
+   images together — nothing downstream needs to know. */
+.message .msg-text-jumbo {
+  font-size: 48px;
+  line-height: 1.15;
+}
+.message .msg-text-jumbo .custom-emoji {
+  width: 48px;
+  height: 48px;
+  min-width: 48px;
+  vertical-align: -0.1em;
+  margin: 0 2px;
+}
+
+/* In a reaction pill the emoji sits next to the count, so it follows the
+   pill's own 14px scale rather than the message body's. */
+.reaction-chip .custom-emoji {
+  width: 18px;
+  height: 18px;
+  min-width: 18px;
+  vertical-align: middle;
+  margin: 0;
 }
 
 /* @mention highlights */
@@ -508,143 +1218,368 @@
   padding: 0 2px;
   font-weight: 500;
   cursor: pointer;
-  transition: background var(--transition-fast), color var(--transition-fast);
+  transition:
+    background var(--transition-fast),
+    color var(--transition-fast);
 }
 .mention:hover {
   background: var(--accent);
   color: white;
 }
+/* A mention of the signed-in user (or an honoured @everyone/@here) reads
+   louder than a mention of someone else. */
+.mention.mention-self {
+  background: color-mix(in srgb, var(--yellow) 28%, transparent);
+  color: var(--yellow);
+  font-weight: 600;
+}
+.mention.mention-self:hover {
+  background: var(--yellow);
+  color: var(--bg-tertiary);
+}
+/* Whole-row highlight: Discord-style left accent + tinted background. */
 .message.mentioned {
-  background: rgba(240, 178, 50, 0.08);
-  border-left: 2px solid var(--yellow);
+  background: color-mix(in srgb, var(--yellow) 8%, transparent);
+  box-shadow: inset 2px 0 0 var(--yellow);
 }
 .message.mentioned:hover {
-  background: rgba(240, 178, 50, 0.12);
+  background: color-mix(in srgb, var(--yellow) 12%, transparent);
+}
+
+/* #channel links inside message text */
+.channel-mention {
+  background: color-mix(in srgb, var(--accent) 26%, transparent);
+  color: var(--text-link);
+  border-radius: 3px;
+  padding: 0 2px;
+  font-weight: 500;
+  cursor: pointer;
+  transition:
+    background var(--transition-fast),
+    color var(--transition-fast);
+}
+.channel-mention:hover,
+.channel-mention:focus-visible {
+  background: var(--accent);
+  color: white;
+  outline: none;
+}
+/* owncord://message/… permalinks pasted into chat, rendered as a compact chip
+   instead of a raw URL. Unresolvable links stay plain text and never get here. */
+.message-link-chip {
+  display: inline-flex;
+  align-items: center;
+  gap: 5px;
+  background: color-mix(in srgb, var(--accent) 18%, transparent);
+  border-radius: 4px;
+  padding: 0 5px;
+  font-size: 0.9em;
+  cursor: pointer;
+  vertical-align: baseline;
+  transition:
+    background var(--transition-fast),
+    color var(--transition-fast);
+}
+
+.message-link-chip .mlc-channel {
+  color: var(--text-link);
+  font-weight: 500;
+}
+
+.message-link-chip .mlc-action {
+  color: var(--text-muted);
+  font-size: 0.85em;
+  text-transform: uppercase;
+  letter-spacing: 0.03em;
+}
+
+.message-link-chip:hover,
+.message-link-chip:focus-visible {
+  background: var(--accent);
+  outline: none;
+}
+
+.message-link-chip:hover .mlc-channel,
+.message-link-chip:focus-visible .mlc-channel,
+.message-link-chip:hover .mlc-action,
+.message-link-chip:focus-visible .mlc-action {
+  color: white;
 }
 
 /* Reply */
 .msg-reply-ref {
-  display: flex; align-items: center; gap: 6px;
-  font-size: 12px; color: var(--text-muted);
-  margin-bottom: 4px; margin-left: -36px; padding-left: 36px;
-  position: relative; cursor: pointer;
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  font-size: 12px;
+  color: var(--text-muted);
+  margin-bottom: 4px;
+  margin-left: -36px;
+  padding-left: 36px;
+  position: relative;
+  cursor: pointer;
 }
 .msg-reply-ref::before {
-  content: ''; position: absolute; left: 20px; bottom: 50%;
-  width: 24px; height: 12px;
+  content: "";
+  position: absolute;
+  left: 20px;
+  bottom: 50%;
+  width: 24px;
+  height: 12px;
   border-left: 2px solid var(--text-micro);
   border-top: 2px solid var(--text-micro);
   border-radius: 6px 0 0 0;
 }
-.msg-reply-ref .rr-author { color: var(--text-normal); font-weight: 600; }
-.msg-reply-ref .rr-text { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; max-width: 300px; }
-.msg-reply-ref:hover .rr-text { color: var(--text-normal); }
+.msg-reply-ref .rr-author {
+  color: var(--text-normal);
+  font-weight: 600;
+}
+.msg-reply-ref .rr-text {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  max-width: 300px;
+}
+.msg-reply-ref:hover .rr-text {
+  color: var(--text-normal);
+}
+/* The bar is a jump control, so it needs a visible keyboard focus ring. */
+.msg-reply-ref:focus-visible {
+  outline: 2px solid var(--accent);
+  outline-offset: 2px;
+  border-radius: 3px;
+}
+
 .rr-avatar {
-  width: 16px; height: 16px; border-radius: var(--radius-circle);
-  font-size: 8px; font-weight: 700; color: white;
-  display: flex; align-items: center; justify-content: center;
+  width: 16px;
+  height: 16px;
+  border-radius: var(--radius-circle);
+  font-size: 8px;
+  font-weight: 700;
+  color: white;
+  display: flex;
+  align-items: center;
+  justify-content: center;
   flex-shrink: 0;
 }
 
 /* URL links in messages */
-.msg-link { color: var(--text-link, #00aff4); text-decoration: none; }
-.msg-link:hover { text-decoration: underline; }
+.msg-link {
+  color: var(--text-link, #00aff4);
+  text-decoration: none;
+}
+.msg-link:hover {
+  text-decoration: underline;
+}
 
 /* URL embeds */
 .msg-embed {
-  margin-top: 8px; border-left: 4px solid var(--accent);
-  border-radius: var(--radius-sm); background: var(--bg-secondary);
-  overflow: hidden; max-width: 420px;
+  margin-top: 8px;
+  border-left: 4px solid var(--accent);
+  border-radius: var(--radius-sm);
+  background: var(--bg-secondary);
+  overflow: hidden;
+  max-width: 420px;
 }
 .msg-embed-youtube {
-  width: 420px; max-width: 100%;
+  width: 420px;
+  max-width: 100%;
+}
+.msg-embed-yt-header {
+  padding: 10px 12px 6px;
 }
-.msg-embed-yt-header { padding: 10px 12px 6px; }
 .msg-embed-yt-title {
-  font-size: 14px; font-weight: 600;
-  color: var(--text-link, #00aff4); text-decoration: none;
-  display: block; overflow: hidden;
-  text-overflow: ellipsis; white-space: nowrap;
+  font-size: 14px;
+  font-weight: 600;
+  color: var(--text-link, #00aff4);
+  text-decoration: none;
+  display: block;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.msg-embed-yt-title:hover {
+  text-decoration: underline;
 }
-.msg-embed-yt-title:hover { text-decoration: underline; }
 .msg-embed-yt-player {
-  position: relative; cursor: pointer;
+  position: relative;
+  cursor: pointer;
 }
 .msg-embed-thumb {
-  display: block; width: 100%; height: auto;
+  display: block;
+  width: 100%;
+  height: auto;
 }
 .msg-embed-play {
-  position: absolute; top: 50%; left: 50%;
+  position: absolute;
+  top: 50%;
+  left: 50%;
   transform: translate(-50%, -50%);
-  width: 48px; height: 48px; border-radius: var(--radius-circle);
-  background: rgba(0,0,0,.7); color: white;
-  display: flex; align-items: center; justify-content: center;
+  width: 48px;
+  height: 48px;
+  border-radius: var(--radius-circle);
+  background: rgba(0, 0, 0, 0.7);
+  color: white;
+  display: flex;
+  align-items: center;
+  justify-content: center;
   pointer-events: none;
-  transition: background .15s;
+  transition: background 0.15s;
+}
+.msg-embed-yt-player:hover .msg-embed-play {
+  background: var(--red);
 }
-.msg-embed-yt-player:hover .msg-embed-play { background: var(--red); }
 .msg-embed-iframe {
-  width: 100%; height: 236px;
+  width: 100%;
+  height: 236px;
   border: none;
 }
 .msg-embed-link {
-  display: flex; flex-direction: column;
-  padding: 12px 16px; max-width: 520px;
+  display: flex;
+  flex-direction: column;
+  padding: 12px 16px;
+  max-width: 520px;
+}
+.msg-embed-link-content {
+  min-width: 0;
 }
-.msg-embed-link-content { min-width: 0; }
 .msg-embed-host {
-  font-size: 12px; font-weight: 600; color: var(--text-faint);
+  font-size: 12px;
+  font-weight: 600;
+  color: var(--text-faint);
   margin-bottom: 4px;
 }
 .msg-embed-link-title {
-  font-size: 16px; font-weight: 600;
-  color: var(--text-link, #00aff4); text-decoration: none;
-  display: -webkit-box; -webkit-line-clamp: 2; -webkit-box-orient: vertical;
-  overflow: hidden; line-height: 1.3;
+  font-size: 16px;
+  font-weight: 600;
+  color: var(--text-link, #00aff4);
+  text-decoration: none;
+  display: -webkit-box;
+  -webkit-line-clamp: 2;
+  -webkit-box-orient: vertical;
+  overflow: hidden;
+  line-height: 1.3;
+}
+.msg-embed-link-title:hover {
+  text-decoration: underline;
 }
-.msg-embed-link-title:hover { text-decoration: underline; }
 .msg-embed-link-desc {
-  font-size: 14px; color: var(--text-muted); margin-top: 6px;
-  line-height: 1.45; overflow: hidden;
-  display: -webkit-box; -webkit-line-clamp: 3; -webkit-box-orient: vertical;
+  font-size: 14px;
+  color: var(--text-muted);
+  margin-top: 6px;
+  line-height: 1.45;
+  overflow: hidden;
+  display: -webkit-box;
+  -webkit-line-clamp: 3;
+  -webkit-box-orient: vertical;
+}
+.msg-embed-link-image {
+  margin-top: 10px;
 }
-.msg-embed-link-image { margin-top: 10px; }
 .msg-embed-link-img {
-  max-width: 100%; max-height: 300px; object-fit: cover;
+  max-width: 100%;
+  max-height: 300px;
+  object-fit: cover;
   border-radius: var(--radius-sm);
 }
 .msg-embed-url {
-  font-size: 13px; color: var(--text-link, #00aff4);
-  text-decoration: none; word-break: break-all;
+  font-size: 13px;
+  color: var(--text-link, #00aff4);
+  text-decoration: none;
+  word-break: break-all;
+}
+.msg-embed-url:hover {
+  text-decoration: underline;
 }
-.msg-embed-url:hover { text-decoration: underline; }
 
 /* Reactions */
-.msg-reactions { display: flex; gap: 4px; flex-wrap: wrap; margin-top: 4px; }
+.msg-reactions {
+  display: flex;
+  gap: 4px;
+  flex-wrap: wrap;
+  margin-top: 4px;
+}
 .reaction-chip {
-  display: flex; align-items: center; gap: 4px;
-  padding: 2px 8px; border-radius: var(--radius-md);
-  background: rgba(88,101,242,.15); border: 1px solid rgba(88,101,242,.3);
-  font-size: 14px; cursor: pointer; transition: all .1s;
+  display: flex;
+  align-items: center;
+  gap: 4px;
+  padding: 2px 8px;
+  border-radius: var(--radius-md);
+  background: rgba(88, 101, 242, 0.15);
+  border: 1px solid rgba(88, 101, 242, 0.3);
+  font-size: 14px;
+  cursor: pointer;
+  transition: all 0.1s;
+}
+.reaction-chip:hover {
+  background: rgba(88, 101, 242, 0.3);
+}
+.reaction-chip.me {
+  border-color: var(--accent);
+}
+.reaction-chip .rc-count {
+  font-size: 12px;
+  color: var(--text-normal);
 }
-.reaction-chip:hover { background: rgba(88,101,242,.3); }
-.reaction-chip.me { border-color: var(--accent); }
-.reaction-chip .rc-count { font-size: 12px; color: var(--text-normal); }
 .reaction-chip.add-reaction {
-  background: transparent; border: 1px dashed var(--border);
-  color: var(--text-micro); font-size: 14px; padding: 2px 6px;
+  background: transparent;
+  border: 1px dashed var(--border);
+  color: var(--text-micro);
+  font-size: 14px;
+  padding: 2px 6px;
+}
+.reaction-chip.add-reaction:hover {
+  border-color: var(--text-muted);
+  color: var(--text-muted);
+}
+
+/* Who-reacted tooltip — anchored above the pill it belongs to. */
+.reaction-chip {
+  position: relative;
+}
+.reaction-tooltip {
+  position: absolute;
+  bottom: calc(100% + 6px);
+  left: 0;
+  z-index: 50;
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  max-width: 260px;
+  padding: 6px 10px;
+  background: var(--bg-floating, var(--bg-tertiary));
+  border: 1px solid var(--border);
+  border-radius: var(--radius-md);
+  box-shadow: 0 4px 12px rgba(0, 0, 0, 0.35);
+  pointer-events: none;
+  cursor: default;
+}
+.reaction-tooltip-names {
+  font-size: 13px;
+  font-weight: 600;
+  color: var(--text-normal);
+  overflow-wrap: anywhere;
+}
+.reaction-tooltip-emoji {
+  font-size: 11px;
+  color: var(--text-muted);
 }
-.reaction-chip.add-reaction:hover { border-color: var(--text-muted); color: var(--text-muted); }
 
 /* Code block */
 .msg-codeblock-wrap {
   position: relative;
 }
 .msg-codeblock {
-  background: var(--bg-tertiary); border: 1px solid var(--border);
-  border-radius: var(--radius-md); padding: 12px; margin-top: 4px;
-  font-family: var(--font-mono); font-size: 13px;
-  line-height: 1.5; overflow-x: auto; white-space: pre;
+  background: var(--bg-tertiary);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-md);
+  padding: 12px;
+  margin-top: 4px;
+  font-family: var(--font-mono);
+  font-size: 13px;
+  line-height: 1.5;
+  overflow-x: auto;
+  white-space: pre;
 }
 .msg-codeblock-copy {
   position: absolute;
@@ -653,13 +1588,15 @@
   padding: 2px 8px;
   font-size: 12px;
   background: var(--bg-tertiary);
-  border: 1px solid var(--border-color, rgba(255,255,255,0.1));
+  border: 1px solid var(--border-color, rgba(255, 255, 255, 0.1));
   border-radius: var(--radius-sm);
   color: var(--text-muted);
   cursor: pointer;
   opacity: 0;
   pointer-events: none;
-  transition: opacity 0.15s ease, background 0.1s ease;
+  transition:
+    opacity 0.15s ease,
+    background 0.1s ease;
 }
 .msg-codeblock-wrap:hover .msg-codeblock-copy {
   opacity: 1;
@@ -669,291 +1606,808 @@
   background: var(--bg-hover);
   color: var(--text-primary);
 }
+/* Language label for a tagged fence (```ts). */
+.msg-codeblock-lang {
+  position: absolute;
+  top: 4px;
+  left: 10px;
+  font-family: var(--font-mono);
+  font-size: 10px;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+  color: var(--text-micro);
+  pointer-events: none;
+  user-select: none;
+}
+
+.msg-codeblock-lang + .msg-codeblock {
+  padding-top: 20px;
+}
+
+/* Syntax highlighting — hues come from theme tokens so custom themes and the
+   light theme recolour along with everything else. */
+.msg-codeblock .tok-comment {
+  color: var(--text-micro);
+  font-style: italic;
+}
+
+.msg-codeblock .tok-string {
+  color: var(--green);
+}
+
+.msg-codeblock .tok-number {
+  color: var(--yellow);
+}
+
+.msg-codeblock .tok-keyword {
+  color: var(--text-link);
+}
+
+/* Markdown blocks */
+/* Paragraph runs keep their newlines; block children handle their own layout. */
+.message .msg-text .md-p {
+  white-space: pre-wrap;
+}
+
+.message .msg-text > *:first-child {
+  margin-top: 0;
+}
+
+.message .msg-text > *:last-child {
+  margin-bottom: 0;
+}
+
+.md-bold {
+  font-weight: 700;
+}
+
+.md-italic {
+  font-style: italic;
+}
+
+.md-underline {
+  text-decoration: underline;
+  text-underline-offset: 2px;
+}
+
+.md-strike {
+  text-decoration: line-through;
+}
+
+.md-heading {
+  margin: 8px 0 4px;
+  font-weight: 700;
+  line-height: 1.3;
+  color: var(--header-primary);
+}
+
+.md-h1 {
+  font-size: 1.5em;
+}
+
+.md-h2 {
+  font-size: 1.25em;
+}
+
+.md-h3 {
+  font-size: 1.1em;
+}
+
+.md-quote {
+  margin: 2px 0;
+  padding: 0 8px 0 12px;
+  border-left: 4px solid var(--border-strong);
+  border-radius: 2px;
+  color: var(--text-normal);
+}
+
+.md-list {
+  margin: 2px 0;
+  padding-left: 22px;
+  list-style-position: outside;
+}
+
+ul.md-list {
+  list-style-type: disc;
+}
+
+ol.md-list {
+  list-style-type: decimal;
+}
+
+.md-list-nested {
+  margin: 0;
+  padding-left: 20px;
+}
+
+ul.md-list-nested {
+  list-style-type: circle;
+}
+
+.md-li {
+  margin: 1px 0;
+}
+
+.md-li::marker {
+  color: var(--text-muted);
+}
+
+/* Spoilers: obscured until asked for, one span at a time. */
+.msg-spoiler {
+  border-radius: 3px;
+  padding: 0 2px;
+  background: var(--bg-tertiary);
+  color: transparent;
+  cursor: pointer;
+  transition:
+    background var(--transition-fast),
+    color var(--transition-fast);
+}
+
+.msg-spoiler * {
+  visibility: hidden;
+}
+
+.msg-spoiler:hover {
+  background: color-mix(in srgb, var(--text-normal) 24%, var(--bg-tertiary));
+}
+
+.msg-spoiler:focus-visible {
+  outline: 2px solid var(--accent);
+  outline-offset: 1px;
+}
+
+.msg-spoiler.revealed {
+  background: color-mix(in srgb, var(--text-normal) 10%, transparent);
+  color: inherit;
+  cursor: auto;
+}
+
+.msg-spoiler.revealed * {
+  visibility: visible;
+}
 
 /* Image attachment */
 .msg-image {
-  position: relative; margin-top: 4px; max-width: 550px; border-radius: var(--radius-md);
-  overflow: hidden; cursor: pointer; contain: layout style;
+  position: relative;
+  margin-top: 4px;
+  max-width: 550px;
+  border-radius: var(--radius-md);
+  overflow: hidden;
+  cursor: pointer;
+  contain: layout style;
 }
 .msg-image img {
-  display: block; max-width: 100%; max-height: 300px;
-  object-fit: contain; border-radius: var(--radius-md);
+  display: block;
+  max-width: 100%;
+  max-height: 300px;
+  object-fit: contain;
+  border-radius: var(--radius-md);
 }
 .msg-image .placeholder-img {
-  width: 100%; height: 200px;
+  width: 100%;
+  height: 200px;
   background: linear-gradient(135deg, #1a1a2e, #16213e, #0f3460);
-  display: flex; align-items: center; justify-content: center;
-  color: var(--text-micro); font-size: 12px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  color: var(--text-micro);
+  font-size: 12px;
+}
+.msg-image .placeholder-img.loading {
+  opacity: 0.6;
 }
-.msg-image .placeholder-img.loading { opacity: .6; }
 
 /* GIF play/pause overlay */
 .gif-play-btn {
-  position: absolute; bottom: 8px; left: 8px;
-  width: 32px; height: 32px; border-radius: 50%;
-  background: rgba(0,0,0,.7); color: #fff;
-  border: none; cursor: pointer;
-  font-size: 14px; line-height: 32px; text-align: center;
-  opacity: 0; transition: opacity .15s ease;
-  z-index: 2; padding: 0;
-  display: flex; align-items: center; justify-content: center;
+  position: absolute;
+  bottom: 8px;
+  left: 8px;
+  width: 32px;
+  height: 32px;
+  border-radius: 50%;
+  background: rgba(0, 0, 0, 0.7);
+  color: #fff;
+  border: none;
+  cursor: pointer;
+  font-size: 14px;
+  line-height: 32px;
+  text-align: center;
+  opacity: 0;
+  transition: opacity 0.15s ease;
+  z-index: 2;
+  padding: 0;
+  display: flex;
+  align-items: center;
+  justify-content: center;
 }
 .msg-image:hover .gif-play-btn,
-.gif-paused .gif-play-btn { opacity: 1; }
-.gif-play-btn:hover { background: rgba(0,0,0,.9); }
-.gif-play-btn.playing { font-size: 11px; letter-spacing: 1px; }
+.gif-paused .gif-play-btn {
+  opacity: 1;
+}
+.gif-play-btn:hover {
+  background: rgba(0, 0, 0, 0.9);
+}
+.gif-play-btn.playing {
+  font-size: 11px;
+  letter-spacing: 1px;
+}
 .gif-paused::after {
-  content: "GIF"; position: absolute; top: 8px; left: 8px;
-  background: rgba(0,0,0,.7); color: #fff; font-size: 10px;
-  font-weight: 700; padding: 2px 6px; border-radius: 4px;
-  letter-spacing: .5px; pointer-events: none;
+  content: "GIF";
+  position: absolute;
+  top: 8px;
+  left: 8px;
+  background: rgba(0, 0, 0, 0.7);
+  color: #fff;
+  font-size: 10px;
+  font-weight: 700;
+  padding: 2px 6px;
+  border-radius: 4px;
+  letter-spacing: 0.5px;
+  pointer-events: none;
 }
 
 /* Image lightbox overlay */
 .image-lightbox {
-  position: fixed; inset: 0; z-index: 600;
-  background: rgba(0,0,0,.85);
-  display: flex; align-items: center; justify-content: center;
-  cursor: zoom-in; animation: fadeIn .2s ease;
+  position: fixed;
+  inset: 0;
+  z-index: 600;
+  background: rgba(0, 0, 0, 0.85);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  cursor: zoom-in;
+  animation: fadeIn 0.2s ease;
+}
+.image-lightbox.dragging {
+  cursor: grabbing;
 }
-.image-lightbox.dragging { cursor: grabbing; }
 .image-lightbox-wrap {
-  display: flex; align-items: center; justify-content: center;
+  display: flex;
+  align-items: center;
+  justify-content: center;
   overflow: visible;
 }
 .image-lightbox img {
-  max-width: 90vw; max-height: 90vh;
-  object-fit: contain; border-radius: var(--radius-sm);
-  box-shadow: 0 8px 48px rgba(0,0,0,.5);
-  transition: transform .1s ease;
-  cursor: zoom-in; user-select: none;
+  max-width: 90vw;
+  max-height: 90vh;
+  object-fit: contain;
+  border-radius: var(--radius-sm);
+  box-shadow: 0 8px 48px rgba(0, 0, 0, 0.5);
+  transition: transform 0.1s ease;
+  cursor: zoom-in;
+  user-select: none;
 }
 .image-lightbox-close {
-  position: absolute; top: 16px; right: 16px;
-  width: 36px; height: 36px; border-radius: var(--radius-circle);
-  background: rgba(0,0,0,.6); color: white; border: none;
-  font-size: 20px; cursor: pointer; display: flex;
-  align-items: center; justify-content: center; z-index: 1;
+  position: absolute;
+  top: 16px;
+  right: 16px;
+  width: 36px;
+  height: 36px;
+  border-radius: var(--radius-circle);
+  background: rgba(0, 0, 0, 0.6);
+  color: white;
+  border: none;
+  font-size: 20px;
+  cursor: pointer;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  z-index: 1;
+}
+.image-lightbox-close:hover {
+  background: rgba(255, 255, 255, 0.2);
 }
-.image-lightbox-close:hover { background: rgba(255,255,255,.2); }
 
 /* File attachment */
 .msg-file {
-  margin-top: 4px; border: 1px solid var(--border);
-  border-radius: var(--radius-md); overflow: hidden; max-width: 400px;
+  margin-top: 4px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-md);
+  overflow: hidden;
+  max-width: 400px;
 }
 .msg-file-inner {
-  display: flex; align-items: center; gap: 12px;
-  padding: 12px; background: var(--bg-secondary);
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  padding: 12px;
+  background: var(--bg-secondary);
 }
 .msg-file-icon {
-  width: 36px; height: 36px; border-radius: var(--radius-sm);
-  background: var(--accent); color: white;
-  display: flex; align-items: center; justify-content: center;
+  width: 36px;
+  height: 36px;
+  border-radius: var(--radius-sm);
+  background: var(--accent);
+  color: white;
+  display: flex;
+  align-items: center;
+  justify-content: center;
   flex-shrink: 0;
 }
-.msg-file-name { font-size: 13px; color: var(--text-link); cursor: pointer; }
-.msg-file-name:hover { text-decoration: underline; }
-.msg-file-size { font-size: 11px; color: var(--text-muted); }
+.msg-file-meta {
+  min-width: 0;
+  flex: 1;
+}
+.msg-file-name {
+  font-size: 13px;
+  color: var(--text-link);
+  cursor: pointer;
+}
+.msg-file-name:hover {
+  text-decoration: underline;
+}
+.msg-file-size {
+  font-size: 11px;
+  color: var(--text-muted);
+}
 .msg-file-download {
-  margin-left: auto; width: 32px; height: 32px;
-  border-radius: var(--radius-sm); background: transparent;
-  color: var(--text-muted); font-size: 16px; cursor: pointer;
-  display: flex; align-items: center; justify-content: center;
-  border: none; transition: all .15s; flex-shrink: 0;
+  margin-left: auto;
+  width: 32px;
+  height: 32px;
+  border-radius: var(--radius-sm);
+  background: transparent;
+  color: var(--text-muted);
+  font-size: 16px;
+  cursor: pointer;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  border: none;
+  transition: all 0.15s;
+  flex-shrink: 0;
+}
+.msg-file-download:hover {
+  background: var(--bg-hover);
+  color: var(--text-normal);
+}
+
+/* Inline video attachment — shares the .msg-image box so a video is capped to
+   the same max width/height as an image and never widens the message column. */
+.msg-video {
+  cursor: default;
+  background: #000;
+}
+.msg-video video {
+  display: block;
+  max-width: 100%;
+  max-height: 300px;
+  border-radius: var(--radius-md);
+}
+.msg-media-overlay {
+  position: absolute;
+  top: 8px;
+  right: 8px;
+  z-index: 2;
+  opacity: 0;
+  transition: opacity 0.15s ease;
+}
+.msg-video:hover .msg-media-overlay {
+  opacity: 1;
+}
+.msg-media-overlay .msg-file-download {
+  margin-left: 0;
+  background: rgba(0, 0, 0, 0.6);
+  color: #fff;
+}
+.msg-media-overlay .msg-file-download:hover {
+  background: rgba(0, 0, 0, 0.85);
+}
+
+/* Inline audio attachment — the file chip layout with a player under the name. */
+.msg-audio {
+  max-width: 400px;
+}
+.msg-audio audio {
+  display: block;
+  width: 100%;
+  margin-top: 6px;
+  height: 32px;
+}
+
+/* A media attachment whose authenticated fetch failed keeps its download
+   affordance; the player is just dimmed so it does not read as loading. */
+.msg-media-failed video,
+.msg-media-failed audio {
+  opacity: 0.4;
+}
+.msg-media-failed .msg-media-overlay {
+  opacity: 1;
 }
-.msg-file-download:hover { background: var(--bg-hover); color: var(--text-normal); }
 
 /* ── Update Banner ── */
 .update-banner {
-  display: flex; align-items: center; gap: 12px;
-  padding: 8px 16px; background: var(--accent);
-  color: #fff; font-size: 13px; font-weight: 500;
-  flex-shrink: 0; z-index: 100;
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  padding: 8px 16px;
+  background: var(--accent);
+  color: #fff;
+  font-size: 13px;
+  font-weight: 500;
+  flex-shrink: 0;
+  z-index: 100;
+}
+.update-banner-text {
+  flex: 1;
 }
-.update-banner-text { flex: 1; }
 .update-banner-btn {
-  padding: 4px 12px; border-radius: var(--radius-sm);
-  font-size: 12px; font-weight: 600; cursor: pointer;
-  border: none; transition: opacity .15s;
+  padding: 4px 12px;
+  border-radius: var(--radius-sm);
+  font-size: 12px;
+  font-weight: 600;
+  cursor: pointer;
+  border: none;
+  transition: opacity 0.15s;
+}
+.update-banner-btn:hover {
+  opacity: 0.85;
+}
+.update-banner-install {
+  background: #fff;
+  color: var(--accent);
+}
+.update-banner-later {
+  background: rgba(255, 255, 255, 0.2);
+  color: #fff;
 }
-.update-banner-btn:hover { opacity: 0.85; }
-.update-banner-install { background: #fff; color: var(--accent); }
-.update-banner-later { background: rgba(255,255,255,0.2); color: #fff; }
 
 /* System message */
 .system-msg {
-  display: flex; align-items: center; gap: 8px;
+  display: flex;
+  align-items: center;
+  gap: 8px;
   padding: 4px var(--message-content-right) 4px var(--message-content-left);
-  margin-top: 4px; position: relative;
+  margin-top: 4px;
+  position: relative;
+}
+.system-msg .sm-icon {
+  color: var(--green);
+  display: inline-flex;
+  align-items: center;
+}
+.system-msg .sm-text {
+  font-size: 13px;
+  color: var(--text-muted);
+}
+.system-msg .sm-text strong {
+  color: var(--text-normal);
+}
+.system-msg .sm-time {
+  font-size: 11px;
+  color: var(--text-micro);
+  margin-left: auto;
 }
-.system-msg .sm-icon { color: var(--green); display: inline-flex; align-items: center; }
-.system-msg .sm-text { font-size: 13px; color: var(--text-muted); }
-.system-msg .sm-text strong { color: var(--text-normal); }
-.system-msg .sm-time { font-size: 11px; color: var(--text-micro); margin-left: auto; }
 
 /* Message hover actions */
 .msg-actions-bar {
-  position: absolute; top: -16px; right: 16px;
-  display: flex; gap: 2px;
-  background: var(--bg-secondary); border: 1px solid var(--border);
-  border-radius: var(--radius-sm); padding: 2px;
-  opacity: 0; pointer-events: none;
+  position: absolute;
+  top: -16px;
+  right: 16px;
+  display: flex;
+  gap: 2px;
+  background: var(--bg-secondary);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  padding: 2px;
+  opacity: 0;
+  pointer-events: none;
   transition: opacity 0.1s ease;
-  box-shadow: 0 2px 8px rgba(0,0,0,.3); z-index: 5;
+  box-shadow: 0 2px 8px rgba(0, 0, 0, 0.3);
+  z-index: 5;
+}
+.message:hover .msg-actions-bar {
+  opacity: 1;
+  pointer-events: auto;
+  animation: actionBarPop 0.1s ease;
 }
-.message:hover .msg-actions-bar { opacity: 1; pointer-events: auto; animation: actionBarPop 0.1s ease; }
 .msg-actions-bar button {
-  width: 28px; height: 28px; border-radius: var(--radius-sm);
-  background: transparent; color: var(--text-muted);
-  font-size: 14px; transition: all .1s;
-  display: flex; align-items: center; justify-content: center;
+  width: 28px;
+  height: 28px;
+  border-radius: var(--radius-sm);
+  background: transparent;
+  color: var(--text-muted);
+  font-size: 14px;
+  transition: all 0.1s;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+}
+.msg-actions-bar button:hover {
+  background: var(--bg-hover);
+  color: var(--text-normal);
 }
-.msg-actions-bar button:hover { background: var(--bg-hover); color: var(--text-normal); }
 
 /* Reply compose bar */
 .reply-bar {
-  display: none; padding: 8px 16px 0;
+  display: none;
+  padding: 8px 16px 0;
   flex-shrink: 0;
 }
-.reply-bar.visible { display: flex; align-items: center; gap: 8px; }
+.reply-bar.visible {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
 .reply-bar-inner {
-  flex: 1; background: var(--bg-input);
+  flex: 1;
+  background: var(--bg-input);
   border-radius: var(--radius-md) var(--radius-md) 0 0;
-  padding: 8px 12px; font-size: 13px; color: var(--text-muted);
-  display: flex; align-items: center; gap: 8px;
+  padding: 8px 12px;
+  font-size: 13px;
+  color: var(--text-muted);
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+.reply-bar-inner strong {
+  color: var(--text-normal);
 }
-.reply-bar-inner strong { color: var(--text-normal); }
 .reply-bar .reply-close {
-  width: 24px; height: 24px; border-radius: var(--radius-sm);
-  background: transparent; color: var(--text-muted); font-size: 16px;
-  display: flex; align-items: center; justify-content: center;
+  width: 24px;
+  height: 24px;
+  border-radius: var(--radius-sm);
+  background: transparent;
+  color: var(--text-muted);
+  font-size: 16px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
   margin-left: auto;
 }
-.reply-bar .reply-close:hover { color: var(--text-normal); }
+.reply-bar .reply-close:hover {
+  color: var(--text-normal);
+}
 
 /* Typing indicator */
 .typing-bar {
-  height: 24px; padding: 0 16px;
-  display: flex; align-items: center; gap: 8px;
-  font-size: 12px; color: var(--text-muted); flex-shrink: 0;
+  height: 24px;
+  padding: 0 16px;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  font-size: 12px;
+  color: var(--text-muted);
+  flex-shrink: 0;
+}
+.typing-bar:empty {
+  height: 0;
+}
+.typing-dots {
+  display: inline-flex;
+  gap: 3px;
 }
-.typing-bar:empty { height: 0; }
-.typing-dots { display: inline-flex; gap: 3px; }
 .typing-dots span {
-  width: 4px; height: 4px; border-radius: 50%;
-  background: var(--text-muted); animation: typingAnim 1.4s infinite;
+  width: 4px;
+  height: 4px;
+  border-radius: 50%;
+  background: var(--text-muted);
+  animation: typingAnim 1.4s infinite;
+}
+.typing-dots span:nth-child(2) {
+  animation-delay: 0.2s;
+}
+.typing-dots span:nth-child(3) {
+  animation-delay: 0.4s;
 }
-.typing-dots span:nth-child(2) { animation-delay: .2s; }
-.typing-dots span:nth-child(3) { animation-delay: .4s; }
 
 /* Message input */
-.message-input-wrap { padding: 0 16px 20px; flex-shrink: 0; position: relative; }
-.message-input-wrap.reply-active { padding-top: 0; }
+.message-input-wrap {
+  padding: 0 16px 20px;
+  flex-shrink: 0;
+  position: relative;
+}
+.message-input-wrap.reply-active {
+  padding-top: 0;
+}
 /* Attachment preview bar (above input box) */
 .attachment-preview-bar {
-  display: none; gap: 8px; padding: 8px 8px 4px;
-  background: var(--bg-input); border-radius: var(--radius-md) var(--radius-md) 0 0;
+  display: none;
+  gap: 8px;
+  padding: 8px 8px 4px;
+  background: var(--bg-input);
+  border-radius: var(--radius-md) var(--radius-md) 0 0;
   border-bottom: 1px solid var(--border);
   flex-wrap: wrap;
 }
-.attachment-preview-bar.visible { display: flex; }
+.attachment-preview-bar.visible {
+  display: flex;
+}
 .attachment-preview-item {
-  position: relative; border-radius: var(--radius-sm);
-  overflow: hidden; background: var(--bg-secondary);
+  position: relative;
+  border-radius: var(--radius-sm);
+  overflow: hidden;
+  background: var(--bg-secondary);
 }
 .attachment-preview-img {
-  display: block; max-width: 120px; max-height: 120px;
-  object-fit: cover; border-radius: var(--radius-sm);
+  display: block;
+  max-width: 120px;
+  max-height: 120px;
+  object-fit: cover;
+  border-radius: var(--radius-sm);
 }
 .attachment-preview-file {
-  display: flex; align-items: center; gap: 6px;
-  padding: 8px 12px; font-size: 20px;
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  padding: 8px 12px;
+  font-size: 20px;
 }
 .attachment-preview-name {
-  font-size: 12px; color: var(--text-muted); max-width: 80px;
-  overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+  font-size: 12px;
+  color: var(--text-muted);
+  max-width: 80px;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
 }
 .attachment-preview-remove {
-  position: absolute; top: 2px; right: 2px;
-  width: 20px; height: 20px; border-radius: var(--radius-circle);
-  background: rgba(0,0,0,.7); color: white;
-  font-size: 14px; display: flex; align-items: center;
-  justify-content: center; cursor: pointer; border: none;
-  transition: background .15s;
+  position: absolute;
+  top: 2px;
+  right: 2px;
+  width: 20px;
+  height: 20px;
+  border-radius: var(--radius-circle);
+  background: rgba(0, 0, 0, 0.7);
+  color: white;
+  font-size: 14px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  cursor: pointer;
+  border: none;
+  transition: background 0.15s;
+}
+.attachment-preview-remove:hover {
+  background: rgba(255, 255, 255, 0.2);
+}
+.attachment-preview-item.uploading {
+  opacity: 0.6;
 }
-.attachment-preview-remove:hover { background: rgba(255,255,255,.2); }
-.attachment-preview-item.uploading { opacity: .6; }
 .attachment-preview-spinner {
-  position: absolute; top: 50%; left: 50%;
+  position: absolute;
+  top: 50%;
+  left: 50%;
   transform: translate(-50%, -50%);
   animation: spinCentered 1s linear infinite;
 }
-@keyframes spinCentered { to { transform: translate(-50%, -50%) rotate(360deg); } }
+@keyframes spinCentered {
+  to {
+    transform: translate(-50%, -50%) rotate(360deg);
+  }
+}
 @keyframes iconSpin {
-  from { transform: rotate(0deg); }
-  to { transform: rotate(360deg); }
+  from {
+    transform: rotate(0deg);
+  }
+  to {
+    transform: rotate(360deg);
+  }
 }
 .icon[data-icon="loader"] {
   animation: iconSpin 1s linear infinite;
 }
 .attachment-upload-error {
-  padding: 6px 10px; font-size: 12px; color: var(--red);
-  background: rgba(237,66,69,.1); border-radius: var(--radius-sm);
+  padding: 6px 10px;
+  font-size: 12px;
+  color: var(--red);
+  background: rgba(237, 66, 69, 0.1);
+  border-radius: var(--radius-sm);
 }
 .attachment-preview-bar.visible + .message-input-box {
   border-radius: 0 0 var(--radius-md) var(--radius-md);
 }
 
 .message-input-box {
-  background: var(--bg-input); border-radius: var(--radius-md);
-  display: flex; align-items: flex-end; padding: 4px;
+  background: var(--bg-input);
+  border-radius: var(--radius-md);
+  display: flex;
+  align-items: flex-end;
+  padding: 4px;
   border: 1px solid transparent;
   transition: border-color 0.15s ease;
 }
-.message-input-box:focus-within { border-color: var(--accent); box-shadow: 0 0 0 1px var(--accent); }
-.message-input-box.reply-mode { border-radius: 0 0 var(--radius-md) var(--radius-md); }
+.message-input-box:focus-within {
+  border-color: var(--accent);
+  box-shadow: 0 0 0 1px var(--accent);
+}
+.message-input-box.reply-mode {
+  border-radius: 0 0 var(--radius-md) var(--radius-md);
+}
 .input-btn {
-  width: 36px; height: 36px; border-radius: var(--radius-sm);
-  background: transparent; color: var(--text-muted);
-  font-size: 18px; transition: background 0.1s ease, color 0.1s ease; flex-shrink: 0;
-  display: flex; align-items: center; justify-content: center;
+  width: 36px;
+  height: 36px;
+  border-radius: var(--radius-sm);
+  background: transparent;
+  color: var(--text-muted);
+  font-size: 18px;
+  transition:
+    background 0.1s ease,
+    color 0.1s ease;
+  flex-shrink: 0;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+}
+.input-btn:hover {
+  background: var(--bg-hover);
+  color: var(--text-normal);
 }
-.input-btn:hover { background: var(--bg-hover); color: var(--text-normal); }
 .msg-textarea {
-  flex: 1; background: transparent; color: var(--text-normal);
-  font-size: 14px; resize: none; padding: 8px 4px;
-  min-height: 36px; max-height: 200px; line-height: 1.4;
+  flex: 1;
+  background: transparent;
+  color: var(--text-normal);
+  font-size: 14px;
+  resize: none;
+  padding: 8px 4px;
+  min-height: 36px;
+  max-height: 200px;
+  line-height: 1.4;
+}
+.msg-textarea::placeholder {
+  color: var(--text-micro);
+}
+.msg-textarea:disabled {
+  cursor: not-allowed;
+  opacity: 0.7;
 }
-.msg-textarea::placeholder { color: var(--text-micro); }
-.msg-textarea:disabled { cursor: not-allowed; opacity: 0.7; }
 /* Composer disabled (offline / read-only / no permission): dim the whole bar. */
-.message-input-wrap.composer-disabled .message-input-box { opacity: 0.6; }
-.message-input-wrap.composer-disabled .input-btn { cursor: not-allowed; }
+.message-input-wrap.composer-disabled .message-input-box {
+  opacity: 0.6;
+}
+.message-input-wrap.composer-disabled .input-btn {
+  cursor: not-allowed;
+}
 
 /* ── Optimistic send states ── */
 /* Pending: the row is dimmed until the server confirms it. */
-.message.pending { opacity: 0.6; }
+.message.pending {
+  opacity: 0.6;
+}
 /* Failed: tint + an inline retry/discard affordance. */
-.message.failed { opacity: 0.9; }
+.message.failed {
+  opacity: 0.9;
+}
 .msg-send-failed {
-  display: flex; align-items: center; gap: 8px;
-  margin-top: 4px; font-size: 12px; color: var(--danger, #e57373);
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  margin-top: 4px;
+  font-size: 12px;
+  color: var(--danger, #e57373);
 }
-.msg-send-failed-text { flex-shrink: 0; }
-.msg-send-retry, .msg-send-discard {
-  background: transparent; border: 1px solid currentColor; color: inherit;
-  border-radius: 4px; padding: 1px 8px; font-size: 12px; cursor: pointer;
+.msg-send-failed-text {
+  flex-shrink: 0;
+}
+.msg-send-retry,
+.msg-send-discard {
+  background: transparent;
+  border: 1px solid currentColor;
+  color: inherit;
+  border-radius: 4px;
+  padding: 1px 8px;
+  font-size: 12px;
+  cursor: pointer;
+}
+.msg-send-retry:hover,
+.msg-send-discard:hover {
+  background: rgba(229, 115, 115, 0.15);
 }
-.msg-send-retry:hover, .msg-send-discard:hover { background: rgba(229, 115, 115, 0.15); }
 
 /* ── Member List ── */
 .member-list {
-  width: 240px; background: var(--bg-secondary);
-  flex-shrink: 0; overflow-y: auto; padding: 8px 0;
-  transition: width .2s;
+  width: 240px;
+  background: var(--bg-secondary);
+  flex-shrink: 0;
+  overflow-y: auto;
+  padding: 8px 0;
+  transition: width 0.2s;
+}
+.member-list.hidden {
+  width: 0;
+  padding: 0;
+  overflow: hidden;
 }
-.member-list.hidden { width: 0; padding: 0; overflow: hidden; }
 .sidebar-members-section {
   border-top: 1px solid var(--border-glow, var(--border));
   overflow: hidden;
@@ -988,25 +2442,40 @@
 }
 .sidebar-dm-list {
   overflow: hidden;
-  transition: max-height .2s;
+  transition: max-height 0.2s;
 }
 .sidebar-dm-section .category.collapsed + .sidebar-dm-list {
   max-height: 0 !important;
   overflow: hidden;
 }
 .dm-header-unread-badge {
-  background: var(--red); color: white; border-radius: 10px;
-  padding: 0 6px; font-size: 0.65rem; font-weight: 700;
-  min-width: 16px; text-align: center; line-height: 16px;
-  margin-left: 4px; flex-shrink: 0;
+  background: var(--red);
+  color: white;
+  border-radius: 10px;
+  padding: 0 6px;
+  font-size: 0.65rem;
+  font-weight: 700;
+  min-width: 16px;
+  text-align: center;
+  line-height: 16px;
+  margin-left: 4px;
+  flex-shrink: 0;
 }
 .sidebar-dm-view-all {
-  display: block; width: 100%; padding: 4px 16px;
-  background: transparent; border: none; color: var(--text-link);
-  font-size: 0.75rem; cursor: pointer; text-align: left;
-  transition: color .15s;
+  display: block;
+  width: 100%;
+  padding: 4px 16px;
+  background: transparent;
+  border: none;
+  color: var(--text-link);
+  font-size: 0.75rem;
+  cursor: pointer;
+  text-align: left;
+  transition: color 0.15s;
+}
+.sidebar-dm-view-all:hover {
+  color: var(--accent);
 }
-.sidebar-dm-view-all:hover { color: var(--accent); }
 .sidebar-members-section .member-list {
   width: 100%;
 }
@@ -1016,14 +2485,18 @@
   font-size: 10px;
 }
 .sidebar-members-section .member-item {
-  padding: 2px 8px; margin: 0 6px; gap: 6px;
+  padding: 2px 8px;
+  margin: 0 6px;
+  gap: 6px;
 }
 .sidebar-members-section .member-item .mi-avatar {
-  width: 22px; height: 22px;
+  width: 22px;
+  height: 22px;
   font-size: 9px;
 }
 .sidebar-members-section .member-item .mi-status {
-  width: 8px; height: 8px;
+  width: 8px;
+  height: 8px;
   border-width: 2px;
 }
 .sidebar-members-section .member-item .mi-name {
@@ -1031,536 +2504,1199 @@
 }
 .member-role-group {
   padding: 16px 16px 4px;
-  font-size: 11px; font-weight: 700;
-  color: var(--text-faint); text-transform: uppercase; letter-spacing: .5px;
+  font-size: 11px;
+  font-weight: 700;
+  color: var(--text-faint);
+  text-transform: uppercase;
+  letter-spacing: 0.5px;
 }
 .member-item {
-  display: flex; align-items: center; gap: 8px;
-  padding: 4px 8px; margin: 1px 8px;
-  border-radius: var(--radius-sm); cursor: pointer; transition: background .1s;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 4px 8px;
+  margin: 1px 8px;
+  border-radius: var(--radius-sm);
+  cursor: pointer;
+  transition: background 0.1s;
+}
+.member-item:hover {
+  background: var(--bg-hover);
 }
-.member-item:hover { background: var(--bg-hover); }
 .member-item .mi-avatar {
-  width: 32px; height: 32px; border-radius: var(--radius-circle);
-  flex-shrink: 0; position: relative;
-  display: flex; align-items: center; justify-content: center;
-  font-weight: 700; font-size: 13px; color: white;
+  width: 32px;
+  height: 32px;
+  border-radius: var(--radius-circle);
+  flex-shrink: 0;
+  position: relative;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-weight: 700;
+  font-size: 13px;
+  color: white;
 }
 .member-item .mi-status {
-  position: absolute; bottom: -1px; right: -1px;
-  width: 12px; height: 12px; border-radius: var(--radius-circle);
+  position: absolute;
+  bottom: -1px;
+  right: -1px;
+  width: 12px;
+  height: 12px;
+  border-radius: var(--radius-circle);
   border: 3px solid var(--bg-secondary);
 }
-.member-item .mi-name { font-size: 14px; font-weight: 500; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
-.member-item.offline { opacity: .3; }
-.member-item.offline .mi-avatar { filter: saturate(0.3); }
+.member-item .mi-name {
+  font-size: 14px;
+  font-weight: 500;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.member-item.offline {
+  opacity: 0.3;
+}
+.member-item.offline .mi-avatar {
+  filter: saturate(0.3);
+}
 
 /* ── User Profile Popup ── */
 .user-popup {
-  position: fixed; z-index: 200;
-  background: var(--bg-primary); border: 1px solid var(--border);
-  border-radius: var(--radius-md); width: 300px;
-  box-shadow: 0 8px 32px rgba(0,0,0,.6);
-  display: none; overflow: hidden;
+  position: fixed;
+  z-index: 200;
+  background: var(--bg-primary);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-md);
+  width: 300px;
+  box-shadow: 0 8px 32px rgba(0, 0, 0, 0.6);
+  display: none;
+  overflow: hidden;
+}
+.user-popup.open {
+  display: block;
+}
+.up-banner {
+  height: 60px;
+}
+.up-body {
+  padding: 36px 16px 16px;
+  position: relative;
 }
-.user-popup.open { display: block; }
-.up-banner { height: 60px; }
-.up-body { padding: 36px 16px 16px; position: relative; }
 .up-avatar {
-  width: 64px; height: 64px; border-radius: var(--radius-circle);
-  position: absolute; top: -32px; left: 16px;
-  display: flex; align-items: center; justify-content: center;
-  font-weight: 700; font-size: 24px; color: white;
+  width: 64px;
+  height: 64px;
+  border-radius: var(--radius-circle);
+  position: absolute;
+  top: -32px;
+  left: 16px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-weight: 700;
+  font-size: 24px;
+  color: white;
   border: 4px solid var(--bg-primary);
 }
-.up-name { font-size: 18px; font-weight: 700; color: white; }
-.up-role { font-size: 12px; margin-top: 2px; }
-.up-section { margin-top: 12px; background: var(--bg-secondary); border-radius: var(--radius-md); padding: 12px; }
-.up-section-title { font-size: 11px; font-weight: 700; color: var(--text-faint); text-transform: uppercase; letter-spacing: .5px; margin-bottom: 6px; }
-.up-section-text { font-size: 13px; color: var(--text-normal); }
-.up-roles { display: flex; gap: 4px; flex-wrap: wrap; margin-top: 8px; }
+.up-name {
+  font-size: 18px;
+  font-weight: 700;
+  color: white;
+}
+.up-role {
+  font-size: 12px;
+  margin-top: 2px;
+}
+.up-section {
+  margin-top: 12px;
+  background: var(--bg-secondary);
+  border-radius: var(--radius-md);
+  padding: 12px;
+}
+.up-section-title {
+  font-size: 11px;
+  font-weight: 700;
+  color: var(--text-faint);
+  text-transform: uppercase;
+  letter-spacing: 0.5px;
+  margin-bottom: 6px;
+}
+.up-section-text {
+  font-size: 13px;
+  color: var(--text-normal);
+}
+.up-roles {
+  display: flex;
+  gap: 4px;
+  flex-wrap: wrap;
+  margin-top: 8px;
+}
 .up-role-tag {
-  display: flex; align-items: center; gap: 4px;
-  padding: 2px 8px; border-radius: var(--radius-pill);
-  background: var(--bg-hover); font-size: 11px; color: var(--text-normal);
+  display: flex;
+  align-items: center;
+  gap: 4px;
+  padding: 2px 8px;
+  border-radius: var(--radius-pill);
+  background: var(--bg-hover);
+  font-size: 11px;
+  color: var(--text-normal);
+}
+.up-role-dot {
+  width: 8px;
+  height: 8px;
+  border-radius: 50%;
 }
-.up-role-dot { width: 8px; height: 8px; border-radius: 50%; }
 
 /* ── Emoji Picker ── */
 .emoji-picker {
-  position: absolute; z-index: 200;
-  bottom: 100%; right: 0;
-  background: var(--bg-primary); border: 1px solid var(--border);
-  border-radius: var(--radius-md); width: 320px;
-  box-shadow: 0 8px 32px rgba(0,0,0,.6);
-  display: none; overflow: hidden;
+  position: absolute;
+  z-index: 200;
+  bottom: 100%;
+  right: 0;
+  background: var(--bg-primary);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-md);
+  width: 320px;
+  box-shadow: 0 8px 32px rgba(0, 0, 0, 0.6);
+  display: none;
+  overflow: hidden;
   margin-bottom: 4px;
 }
-.emoji-picker.open { display: block; }
+.emoji-picker.open {
+  display: block;
+}
+
+/* Mention autocomplete — anchored above the composer, same shell as the pickers */
+.mention-autocomplete {
+  position: absolute;
+  z-index: 200;
+  bottom: 100%;
+  left: 0;
+  right: 0;
+  background: var(--bg-primary);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-md);
+  box-shadow: 0 8px 32px rgba(0, 0, 0, 0.6);
+  overflow: hidden;
+  margin-bottom: 4px;
+}
+.mention-autocomplete .ma-list {
+  max-height: 240px;
+  overflow-y: auto;
+}
+.ma-item {
+  display: flex;
+  align-items: baseline;
+  gap: 8px;
+  padding: 6px 12px;
+  cursor: pointer;
+  font-size: 14px;
+}
+.ma-item--active,
+.ma-item:hover {
+  background: var(--bg-modifier-hover);
+}
+.ma-item .ma-name {
+  color: var(--text-normal);
+  font-weight: 500;
+}
+.ma-item .ma-detail {
+  color: var(--text-muted);
+  font-size: 12px;
+  margin-left: auto;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+/* The `:shortcode` popup shows what it is about to insert, so a row reads as
+   the emoji rather than as its name. Fixed width keeps the labels aligned
+   whether the preview is a glyph or a custom-emoji image. */
+.emoji-autocomplete .ea-preview {
+  width: 20px;
+  min-width: 20px;
+  font-size: 18px;
+  line-height: 1;
+  text-align: center;
+}
+.emoji-autocomplete .ea-preview .custom-emoji {
+  width: 18px;
+  height: 18px;
+  min-width: 18px;
+  vertical-align: middle;
+  margin: 0;
+}
+/* A custom emoji in the picker grid fills its cell like a glyph would. */
+.ep-emoji-custom .custom-emoji {
+  width: 24px;
+  height: 24px;
+  min-width: 24px;
+  vertical-align: middle;
+  margin: 0;
+}
 .ep-header {
-  padding: 12px; border-bottom: 1px solid var(--border);
+  padding: 12px;
+  border-bottom: 1px solid var(--border);
 }
 .ep-search {
-  width: 100%; background: var(--bg-tertiary);
-  border: none; border-radius: var(--radius-sm);
-  padding: 8px 10px; color: var(--text-normal); font-size: 13px;
+  width: 100%;
+  background: var(--bg-tertiary);
+  border: none;
+  border-radius: var(--radius-sm);
+  padding: 8px 10px;
+  color: var(--text-normal);
+  font-size: 13px;
+}
+.ep-search::placeholder {
+  color: var(--text-micro);
 }
-.ep-search::placeholder { color: var(--text-micro); }
 .ep-category-label {
-  padding: 8px 12px 4px; font-size: 11px; font-weight: 700;
-  color: var(--text-faint); text-transform: uppercase; letter-spacing: .5px;
+  padding: 8px 12px 4px;
+  font-size: 11px;
+  font-weight: 700;
+  color: var(--text-faint);
+  text-transform: uppercase;
+  letter-spacing: 0.5px;
 }
 .ep-grid {
-  display: grid; grid-template-columns: repeat(8, 1fr);
-  gap: 2px; padding: 4px 8px 8px;
+  display: grid;
+  grid-template-columns: repeat(8, 1fr);
+  gap: 2px;
+  padding: 4px 8px 8px;
 }
 .ep-emoji {
-  width: 100%; aspect-ratio: 1;
-  display: flex; align-items: center; justify-content: center;
-  font-size: 22px; cursor: pointer; border-radius: var(--radius-sm);
-  background: transparent; transition: background .1s;
+  width: 100%;
+  aspect-ratio: 1;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: 22px;
+  cursor: pointer;
+  border-radius: var(--radius-sm);
+  background: transparent;
+  transition: background 0.1s;
+}
+.ep-emoji:hover {
+  background: var(--bg-hover);
 }
-.ep-emoji:hover { background: var(--bg-hover); }
 
 /* ── GIF Picker ── */
 .gif-picker {
-  position: absolute; z-index: 200;
-  bottom: 100%; right: 0;
-  background: var(--bg-primary); border: 1px solid var(--border);
-  border-radius: var(--radius-md); width: 320px; height: 400px;
-  box-shadow: 0 8px 32px rgba(0,0,0,.6);
-  display: none; overflow: hidden;
+  position: absolute;
+  z-index: 200;
+  bottom: 100%;
+  right: 0;
+  background: var(--bg-primary);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-md);
+  width: 320px;
+  height: 400px;
+  box-shadow: 0 8px 32px rgba(0, 0, 0, 0.6);
+  display: none;
+  overflow: hidden;
   margin-bottom: 4px;
   flex-direction: column;
 }
-.gif-picker.open { display: flex; }
+.gif-picker.open {
+  display: flex;
+}
 .gp-header {
-  padding: 12px; border-bottom: 1px solid var(--border);
+  padding: 12px;
+  border-bottom: 1px solid var(--border);
   flex-shrink: 0;
 }
 .gp-search {
-  width: 100%; background: var(--bg-tertiary);
-  border: none; border-radius: var(--radius-sm);
-  padding: 8px 10px; color: var(--text-normal); font-size: 13px;
+  width: 100%;
+  background: var(--bg-tertiary);
+  border: none;
+  border-radius: var(--radius-sm);
+  padding: 8px 10px;
+  color: var(--text-normal);
+  font-size: 13px;
+}
+.gp-search::placeholder {
+  color: var(--text-micro);
 }
-.gp-search::placeholder { color: var(--text-micro); }
 .gp-attribution {
-  font-size: 10px; color: var(--text-micro);
-  padding: 4px 0 0; text-align: center;
+  font-size: 10px;
+  color: var(--text-micro);
+  padding: 4px 0 0;
+  text-align: center;
 }
 .gp-grid-area {
-  flex: 1; overflow-y: auto; padding: 8px;
+  flex: 1;
+  overflow-y: auto;
+  padding: 8px;
 }
 .gp-grid {
-  display: grid; grid-template-columns: 1fr 1fr;
+  display: grid;
+  grid-template-columns: 1fr 1fr;
   gap: 6px;
 }
 .gp-item {
-  position: relative; cursor: pointer; border-radius: var(--radius-sm);
-  overflow: hidden; transition: transform .1s;
+  position: relative;
+  cursor: pointer;
+  border-radius: var(--radius-sm);
+  overflow: hidden;
+  transition: transform 0.1s;
+}
+.gp-item:hover {
+  transform: scale(1.03);
 }
-.gp-item:hover { transform: scale(1.03); }
 .klipy-watermark {
-  position: absolute; bottom: 6px; left: 6px;
-  height: 18px; width: auto; pointer-events: none;
+  position: absolute;
+  bottom: 6px;
+  left: 6px;
+  height: 18px;
+  width: auto;
+  pointer-events: none;
   opacity: 0.9;
 }
 .gp-img {
-  width: 100%; display: block; object-fit: cover;
+  width: 100%;
+  display: block;
+  object-fit: cover;
   border-radius: var(--radius-sm);
-  min-height: 80px; background: var(--bg-tertiary);
+  min-height: 80px;
+  background: var(--bg-tertiary);
 }
 .gp-loading {
-  padding: 48px 0; text-align: center;
-  color: var(--text-faint); font-size: 13px;
+  padding: 48px 0;
+  text-align: center;
+  color: var(--text-faint);
+  font-size: 13px;
 }
 .gp-empty {
-  padding: 48px 0; text-align: center;
-  color: var(--text-faint); font-size: 13px;
+  padding: 48px 0;
+  text-align: center;
+  color: var(--text-faint);
+  font-size: 13px;
 }
 
 /* ── Settings Overlay (app) ── */
 .settings-overlay {
-  position: fixed; top: 0; left: 0; right: 0; bottom: 0;
-  background: rgba(0, 0, 0, 0.7); backdrop-filter: blur(8px);
-  z-index: 500; display: none;
-  align-items: center; justify-content: center;
+  position: fixed;
+  top: 0;
+  left: 0;
+  right: 0;
+  bottom: 0;
+  background: rgba(0, 0, 0, 0.7);
+  backdrop-filter: blur(8px);
+  z-index: 500;
+  display: none;
+  align-items: center;
+  justify-content: center;
+}
+.settings-overlay.open {
+  display: flex;
 }
-.settings-overlay.open { display: flex; }
 .settings-panel {
-  display: flex; width: 900px; max-width: calc(100vw - 80px);
-  height: 80vh; max-height: 720px;
-  background: var(--bg-primary); border-radius: 12px;
-  overflow: hidden; box-shadow: 0 8px 32px rgba(0, 0, 0, 0.5);
+  display: flex;
+  width: 900px;
+  max-width: calc(100vw - 80px);
+  height: 80vh;
+  max-height: 720px;
+  background: var(--bg-primary);
+  border-radius: 12px;
+  overflow: hidden;
+  box-shadow: 0 8px 32px rgba(0, 0, 0, 0.5);
   position: relative;
 }
 .settings-sidebar {
-  width: 220px; background: var(--bg-secondary);
-  padding: 24px 8px 16px; overflow-y: auto; flex-shrink: 0;
-  display: flex; flex-direction: column;
+  width: 220px;
+  background: var(--bg-secondary);
+  padding: 24px 8px 16px;
+  overflow-y: auto;
+  flex-shrink: 0;
+  display: flex;
+  flex-direction: column;
   border-radius: 12px 0 0 12px;
 }
 .settings-cat {
-  padding: 8px 12px 4px; font-size: 11px; font-weight: 700;
-  color: var(--text-faint); text-transform: uppercase; letter-spacing: .5px;
+  padding: 8px 12px 4px;
+  font-size: 11px;
+  font-weight: 700;
+  color: var(--text-faint);
+  text-transform: uppercase;
+  letter-spacing: 0.5px;
 }
 .settings-nav-item {
-  display: flex; align-items: center; gap: 8px;
-  padding: 6px 12px; margin: 1px 0;
-  border-radius: var(--radius-sm); cursor: pointer;
-  font-size: 14px; color: var(--text-muted);
-  transition: all .1s; background: transparent; width: 100%; text-align: left;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 6px 12px;
+  margin: 1px 0;
+  border-radius: var(--radius-sm);
+  cursor: pointer;
+  font-size: 14px;
+  color: var(--text-muted);
+  transition: all 0.1s;
+  background: transparent;
+  width: 100%;
+  text-align: left;
+}
+.settings-nav-item:hover {
+  background: var(--bg-hover);
+  color: var(--text-normal);
+}
+.settings-nav-item.active {
+  background: var(--bg-active);
+  color: white;
+}
+.settings-sep {
+  height: 1px;
+  background: var(--border);
+  margin: 8px 12px;
+}
+.settings-nav-item.danger {
+  color: var(--red);
+}
+.settings-nav-item.danger:hover {
+  background: rgba(242, 63, 67, 0.1);
 }
-.settings-nav-item:hover { background: var(--bg-hover); color: var(--text-normal); }
-.settings-nav-item.active { background: var(--bg-active); color: white; }
-.settings-sep { height: 1px; background: var(--border); margin: 8px 12px; }
-.settings-nav-item.danger { color: var(--red); }
-.settings-nav-item.danger:hover { background: rgba(242,63,67,.1); }
 
 .settings-content {
-  flex: 1; overflow-y: auto; padding: 48px 40px; max-width: 720px;
+  flex: 1;
+  overflow-y: auto;
+  padding: 48px 40px;
+  max-width: 720px;
+}
+.settings-content h1 {
+  font-size: 20px;
+  font-weight: 700;
+  color: white;
+  margin-bottom: 24px;
 }
-.settings-content h1 { font-size: 20px; font-weight: 700; color: white; margin-bottom: 24px; }
 .settings-content h3 {
-  font-size: 11px; font-weight: 700;
-  color: var(--text-faint); text-transform: uppercase;
-  letter-spacing: .5px; margin: 24px 0 8px;
+  font-size: 11px;
+  font-weight: 700;
+  color: var(--text-faint);
+  text-transform: uppercase;
+  letter-spacing: 0.5px;
+  margin: 24px 0 8px;
 }
 .settings-close-btn {
-  width: 36px; height: 36px; border-radius: var(--radius-circle);
-  background: transparent; border: 2px solid var(--border-strong);
-  color: var(--text-muted); font-size: 18px;
-  display: flex; align-items: center; justify-content: center;
-  cursor: pointer; transition: all .15s;
+  width: 36px;
+  height: 36px;
+  border-radius: var(--radius-circle);
+  background: transparent;
+  border: 2px solid var(--border-strong);
+  color: var(--text-muted);
+  font-size: 18px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  cursor: pointer;
+  transition: all 0.15s;
+}
+.settings-close-btn:hover {
+  border-color: var(--text-normal);
+  color: var(--text-normal);
 }
-.settings-close-btn:hover { border-color: var(--text-normal); color: var(--text-normal); }
 
 /* Settings panes */
-.settings-pane { display: none; }
-.settings-pane.active { display: block; }
+.settings-pane {
+  display: none;
+}
+.settings-pane.active {
+  display: block;
+}
 .setting-row {
-  display: flex; align-items: center; justify-content: space-between;
-  padding: 16px 0; border-bottom: 1px solid var(--border);
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 16px 0;
+  border-bottom: 1px solid var(--border);
+}
+.setting-row:last-child {
+  border-bottom: none;
+}
+.setting-label {
+  font-size: 14px;
+  color: var(--text-normal);
+}
+.setting-desc {
+  font-size: 13px;
+  color: var(--text-muted);
+  margin-top: 4px;
 }
-.setting-row:last-child { border-bottom: none; }
-.setting-label { font-size: 14px; color: var(--text-normal); }
-.setting-desc { font-size: 13px; color: var(--text-muted); margin-top: 4px; }
 .toggle {
-  width: 40px; height: 24px; border-radius: 12px;
-  background: var(--text-faint); cursor: pointer;
-  position: relative; transition: background .2s; flex-shrink: 0;
+  width: 40px;
+  height: 24px;
+  border-radius: 12px;
+  background: var(--text-faint);
+  cursor: pointer;
+  position: relative;
+  transition: background 0.2s;
+  flex-shrink: 0;
+}
+.toggle.on {
+  background: var(--green);
 }
-.toggle.on { background: var(--green); }
 .toggle::after {
-  content: ''; position: absolute;
-  width: 18px; height: 18px; border-radius: 50%;
-  background: white; top: 3px; left: 3px; transition: transform .2s;
+  content: "";
+  position: absolute;
+  width: 18px;
+  height: 18px;
+  border-radius: 50%;
+  background: white;
+  top: 3px;
+  left: 3px;
+  transition: transform 0.2s;
+}
+.toggle.on::after {
+  transform: translateX(16px);
 }
-.toggle.on::after { transform: translateX(16px); }
 .settings-select {
-  background: var(--bg-tertiary); color: var(--text-normal);
-  border: 1px solid var(--border); border-radius: var(--radius-sm);
-  padding: 8px 12px; font-size: 14px; width: 200px; cursor: pointer;
+  background: var(--bg-tertiary);
+  color: var(--text-normal);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  padding: 8px 12px;
+  font-size: 14px;
+  width: 200px;
+  cursor: pointer;
 }
 /* ── Mic Level Meter ── */
-.mic-meter-wrap { margin-bottom: 12px; }
+.mic-meter-wrap {
+  margin-bottom: 12px;
+}
 .mic-meter-bar {
-  position: relative; height: 8px; border-radius: 4px;
-  background: var(--bg-tertiary); overflow: visible;
+  position: relative;
+  height: 8px;
+  border-radius: 4px;
+  background: var(--bg-tertiary);
+  overflow: visible;
   cursor: pointer;
 }
 .mic-meter-level {
-  height: 100%; border-radius: 4px; width: 0%;
-  background: #43b581; transition: width 50ms linear;
+  height: 100%;
+  border-radius: 4px;
+  width: 0%;
+  background: #43b581;
+  transition: width 50ms linear;
   pointer-events: none;
 }
 .mic-meter-threshold {
-  position: absolute; top: -5px; width: 12px; height: 18px;
-  background: #fff; border-radius: 6px; left: 50%;
-  transform: translateX(-50%); opacity: 0.9;
-  cursor: grab; pointer-events: auto; z-index: 1;
-  box-shadow: 0 1px 3px rgba(0,0,0,0.4);
+  position: absolute;
+  top: -5px;
+  width: 12px;
+  height: 18px;
+  background: #fff;
+  border-radius: 6px;
+  left: 50%;
+  transform: translateX(-50%);
+  opacity: 0.9;
+  cursor: grab;
+  pointer-events: auto;
+  z-index: 1;
+  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.4);
   transition: opacity 0.1s;
 }
-.mic-meter-threshold:hover { opacity: 1; }
-.mic-meter-threshold:active { cursor: grabbing; opacity: 1; }
-.slider-row { display: flex; align-items: center; gap: 12px; }
+.mic-meter-threshold:hover {
+  opacity: 1;
+}
+.mic-meter-threshold:active {
+  cursor: grabbing;
+  opacity: 1;
+}
+.slider-row {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+}
 .settings-slider {
-  flex: 1; -webkit-appearance: none; appearance: none;
-  height: 6px; border-radius: 3px;
-  background: var(--bg-tertiary); outline: none;
+  flex: 1;
+  -webkit-appearance: none;
+  appearance: none;
+  height: 6px;
+  border-radius: 3px;
+  background: var(--bg-tertiary);
+  outline: none;
 }
 .settings-slider::-webkit-slider-thumb {
-  -webkit-appearance: none; width: 16px; height: 16px;
-  border-radius: 50%; background: var(--accent); cursor: pointer;
+  -webkit-appearance: none;
+  width: 16px;
+  height: 16px;
+  border-radius: 50%;
+  background: var(--accent);
+  cursor: pointer;
+}
+.slider-val {
+  font-size: 13px;
+  color: var(--text-muted);
+  min-width: 40px;
+  text-align: right;
 }
-.slider-val { font-size: 13px; color: var(--text-muted); min-width: 40px; text-align: right; }
 .account-card {
-  background: var(--bg-secondary); border-radius: var(--radius-md);
-  overflow: hidden; margin-bottom: 24px;
+  background: var(--bg-secondary);
+  border-radius: var(--radius-md);
+  overflow: hidden;
+  margin-bottom: 24px;
 }
 .ac-btn {
-  padding: 8px 16px; border-radius: var(--radius-sm);
-  background: var(--accent); color: white;
-  font-size: 13px; font-weight: 600; transition: background .15s; margin-left: auto;
+  padding: 8px 16px;
+  border-radius: var(--radius-sm);
+  background: var(--accent);
+  color: white;
+  font-size: 13px;
+  font-weight: 600;
+  transition: background 0.15s;
+  margin-left: auto;
+}
+.ac-btn:hover {
+  background: var(--accent-hover);
 }
-.ac-btn:hover { background: var(--accent-hover); }
 .ac-btn.account-delete-btn {
-  background: var(--red); margin-left: 0;
+  background: var(--red);
+  margin-left: 0;
+}
+.ac-btn.account-delete-btn:hover {
+  background: #d83135;
+}
+.ac-btn.account-delete-btn:disabled {
+  opacity: 0.6;
+  cursor: not-allowed;
 }
-.ac-btn.account-delete-btn:hover { background: #d83135; }
-.ac-btn.account-delete-btn:disabled { opacity: .6; cursor: not-allowed; }
 .account-delete-confirm {
-  background: rgba(242,63,67,.06); border: 1px solid rgba(242,63,67,.2);
-  border-radius: var(--radius-sm); padding: 16px; margin-top: 12px;
+  background: rgba(242, 63, 67, 0.06);
+  border: 1px solid rgba(242, 63, 67, 0.2);
+  border-radius: var(--radius-sm);
+  padding: 16px;
+  margin-top: 12px;
 }
 
 /* ── Discord-style account profile card ── */
 .account-banner {
-  height: 100px; border-radius: var(--radius-md) var(--radius-md) 0 0;
+  height: 100px;
+  border-radius: var(--radius-md) var(--radius-md) 0 0;
   background: var(--accent);
 }
 .account-avatar-wrap {
-  position: relative; margin-top: -40px; margin-left: 16px; width: 80px;
+  position: relative;
+  margin-top: -40px;
+  margin-left: 16px;
+  width: 80px;
 }
 .account-avatar-large {
-  width: 80px; height: 80px; border-radius: 50%;
-  background: var(--accent); display: flex; align-items: center;
-  justify-content: center; font-weight: 700; font-size: 32px;
-  color: white; border: 4px solid var(--bg-secondary);
+  width: 80px;
+  height: 80px;
+  border-radius: 50%;
+  background: var(--accent);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-weight: 700;
+  font-size: 32px;
+  color: white;
+  border: 4px solid var(--bg-secondary);
 }
 .account-status-dot {
-  position: absolute; bottom: 4px; right: 4px;
-  width: 14px; height: 14px; border-radius: 50%;
-  background: var(--green); border: 3px solid var(--bg-secondary);
+  position: absolute;
+  bottom: 4px;
+  right: 4px;
+  width: 14px;
+  height: 14px;
+  border-radius: 50%;
+  background: var(--green);
+  border: 3px solid var(--bg-secondary);
 }
 .account-header {
-  display: flex; align-items: center; justify-content: space-between;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
   padding: 12px 16px 16px;
 }
-.account-header-name { font-size: 20px; font-weight: 700; color: white; }
+.account-header-name {
+  font-size: 20px;
+  font-weight: 700;
+  color: white;
+}
 .account-fields {
-  background: var(--bg-primary); border-radius: var(--radius-md);
-  margin: 0 16px 16px; padding: 0;
+  background: var(--bg-primary);
+  border-radius: var(--radius-md);
+  margin: 0 16px 16px;
+  padding: 0;
 }
 .account-field {
-  display: flex; align-items: center; justify-content: space-between;
-  padding: 14px 12px; border-bottom: 1px solid var(--border);
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 14px 12px;
+  border-bottom: 1px solid var(--border);
+}
+.account-field:last-child {
+  border-bottom: none;
+}
+.account-field-label {
+  font-size: 12px;
+  font-weight: 700;
+  color: var(--text-muted);
+  text-transform: uppercase;
+}
+.account-field-value {
+  font-size: 15px;
+  color: var(--text-normal);
+  margin-top: 4px;
 }
-.account-field:last-child { border-bottom: none; }
-.account-field-label { font-size: 12px; font-weight: 700; color: var(--text-muted); text-transform: uppercase; }
-.account-field-value { font-size: 15px; color: var(--text-normal); margin-top: 4px; }
 .account-field-edit {
-  padding: 4px 16px; border-radius: var(--radius-sm);
-  background: var(--bg-active); color: white; font-size: 13px; font-weight: 500;
-  cursor: pointer; transition: background .15s;
+  padding: 4px 16px;
+  border-radius: var(--radius-sm);
+  background: var(--bg-active);
+  color: white;
+  font-size: 13px;
+  font-weight: 500;
+  cursor: pointer;
+  transition: background 0.15s;
+}
+.account-field-edit:hover {
+  background: var(--bg-hover);
 }
-.account-field-edit:hover { background: var(--bg-hover); }
 
 /* Section separator */
-.settings-separator { height: 1px; background: var(--border); margin: 24px 0; }
+.settings-separator {
+  height: 1px;
+  background: var(--border);
+  margin: 24px 0;
+}
 
 /* Section title (larger heading like Discord's "Password and Authentication") */
 .settings-section-title {
-  font-size: 18px; font-weight: 700; color: white; margin-bottom: 16px;
+  font-size: 18px;
+  font-weight: 700;
+  color: white;
+  margin-bottom: 16px;
 }
 
 /* ── Account tab: status selector ── */
-.settings-status-options { display: flex; flex-direction: column; gap: 2px; }
+.settings-status-options {
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+}
 .settings-status-option {
-  display: flex; align-items: center; padding: 8px 12px;
-  border-radius: 4px; cursor: pointer; gap: 12px;
+  display: flex;
+  align-items: center;
+  padding: 8px 12px;
+  border-radius: 4px;
+  cursor: pointer;
+  gap: 12px;
   transition: background 0.1s ease;
 }
-.settings-status-option:hover { background: var(--bg-active); }
-.settings-status-option.active { background: var(--bg-active); }
+.settings-status-option:hover {
+  background: var(--bg-active);
+}
+.settings-status-option.active {
+  background: var(--bg-active);
+}
 .settings-status-dot {
-  width: 12px; height: 12px; border-radius: 50%; flex-shrink: 0;
+  width: 12px;
+  height: 12px;
+  border-radius: 50%;
+  flex-shrink: 0;
+}
+.settings-status-label {
+  font-size: 14px;
+  font-weight: 500;
+  color: var(--text-normal);
+}
+.settings-status-desc {
+  font-size: 12px;
+  color: var(--text-muted);
+  margin-top: 1px;
 }
-.settings-status-label { font-size: 14px; font-weight: 500; color: var(--text-normal); }
-.settings-status-desc { font-size: 12px; color: var(--text-muted); margin-top: 1px; }
 
 /* ── Settings Sidebar Enhancements ── */
 /* Profile section at top of sidebar */
 .settings-sidebar-profile {
-  display: flex; align-items: center; gap: 12px;
-  padding: 0 12px 16px; margin-bottom: 8px;
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  padding: 0 12px 16px;
+  margin-bottom: 8px;
 }
 .settings-sidebar-avatar {
-  width: 40px; height: 40px; border-radius: 50%;
-  background: var(--accent); display: flex; align-items: center;
-  justify-content: center; font-weight: 700; font-size: 16px;
-  color: white; flex-shrink: 0;
+  width: 40px;
+  height: 40px;
+  border-radius: 50%;
+  background: var(--accent);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-weight: 700;
+  font-size: 16px;
+  color: white;
+  flex-shrink: 0;
+}
+.settings-sidebar-name {
+  font-size: 14px;
+  font-weight: 600;
+  color: white;
+}
+.settings-sidebar-edit {
+  font-size: 12px;
+  color: var(--text-muted);
+  cursor: pointer;
+}
+.settings-sidebar-edit:hover {
+  color: var(--text-normal);
+  text-decoration: underline;
 }
-.settings-sidebar-name { font-size: 14px; font-weight: 600; color: white; }
-.settings-sidebar-edit { font-size: 12px; color: var(--text-muted); cursor: pointer; }
-.settings-sidebar-edit:hover { color: var(--text-normal); text-decoration: underline; }
 
 /* Nav item icon sizing and opacity */
-.settings-nav-item .icon { width: 18px; height: 18px; opacity: 0.7; flex-shrink: 0; }
-.settings-nav-item.active .icon { opacity: 1; }
+.settings-nav-item .icon {
+  width: 18px;
+  height: 18px;
+  opacity: 0.7;
+  flex-shrink: 0;
+}
+.settings-nav-item.active .icon {
+  opacity: 1;
+}
 
 /* Close button wrap with ESC label */
 .settings-close-wrap {
-  position: absolute; top: 12px; right: 16px;
-  text-align: center; z-index: 10;
-  display: flex; flex-direction: column; align-items: center; gap: 4px;
+  position: absolute;
+  top: 12px;
+  right: 16px;
+  text-align: center;
+  z-index: 10;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 4px;
+}
+.settings-esc-label {
+  font-size: 11px;
+  color: var(--text-muted);
+  font-weight: 600;
 }
-.settings-esc-label { font-size: 11px; color: var(--text-muted); font-weight: 600; }
 
 /* Sidebar logout section at bottom */
-.settings-sidebar-logout { margin-top: auto; padding-top: 8px; }
-.theme-options { display: flex; gap: 12px; margin-top: 8px; }
+.settings-sidebar-logout {
+  margin-top: auto;
+  padding-top: 8px;
+}
+.theme-options {
+  display: flex;
+  gap: 12px;
+  margin-top: 8px;
+}
 .theme-opt {
-  width: 80px; height: 56px; border-radius: var(--radius-md);
-  cursor: pointer; border: 2px solid transparent;
-  display: flex; align-items: center; justify-content: center;
-  font-size: 12px; font-weight: 600; transition: all .15s;
+  width: 80px;
+  height: 56px;
+  border-radius: var(--radius-md);
+  cursor: pointer;
+  border: 2px solid transparent;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: 12px;
+  font-weight: 600;
+  transition: all 0.15s;
+}
+.theme-opt:hover {
+  border-color: var(--border-strong);
+}
+.theme-opt.active {
+  border-color: var(--accent);
+}
+.theme-opt.dark {
+  background: #313338;
+  color: white;
+}
+.theme-opt.light {
+  background: #f2f3f5;
+  color: #313338;
+}
+.theme-opt.midnight {
+  background: #0d0d0d;
+  color: #b5bac1;
 }
-.theme-opt:hover { border-color: var(--border-strong); }
-.theme-opt.active { border-color: var(--accent); }
-.theme-opt.dark { background: #313338; color: white; }
-.theme-opt.light { background: #f2f3f5; color: #313338; }
-.theme-opt.midnight { background: #0d0d0d; color: #b5bac1; }
 /* Accent color picker */
 .accent-swatches {
-  display: flex; flex-wrap: wrap; gap: 8px; margin-bottom: 12px;
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px;
+  margin-bottom: 12px;
 }
 .accent-swatch {
-  width: 28px; height: 28px; border-radius: 50%;
-  cursor: pointer; border: none; outline: none;
-  transition: transform .12s;
+  width: 28px;
+  height: 28px;
+  border-radius: 50%;
+  cursor: pointer;
+  border: none;
+  outline: none;
+  transition: transform 0.12s;
+}
+.accent-swatch:hover {
+  transform: scale(1.1);
 }
-.accent-swatch:hover { transform: scale(1.1); }
 .accent-swatch.active {
-  box-shadow: 0 0 0 2px white, 0 0 0 4px currentColor;
+  box-shadow:
+    0 0 0 2px white,
+    0 0 0 4px currentColor;
 }
 .accent-hex-row {
-  display: flex; align-items: center; gap: 4px; margin-top: 4px;
+  display: flex;
+  align-items: center;
+  gap: 4px;
+  margin-top: 4px;
 }
 .accent-hex-prefix {
-  font-size: 14px; color: var(--text-muted); user-select: none;
+  font-size: 14px;
+  color: var(--text-muted);
+  user-select: none;
 }
 .keybind-section-header {
-  font-size: 12px; font-weight: 600; color: var(--text-muted);
-  text-transform: uppercase; letter-spacing: 0.5px; margin: 4px 0 8px 0;
+  font-size: 12px;
+  font-weight: 600;
+  color: var(--text-muted);
+  text-transform: uppercase;
+  letter-spacing: 0.5px;
+  margin: 4px 0 8px 0;
 }
 .keybind-row {
-  display: flex; align-items: center; justify-content: space-between;
-  padding: 12px 0; border-bottom: 1px solid var(--border);
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 12px 0;
+  border-bottom: 1px solid var(--border);
 }
 .kbd {
-  background: var(--bg-tertiary); border: 1px solid var(--border);
-  border-radius: var(--radius-sm); padding: 4px 8px;
-  font-family: var(--font-mono); font-size: 12px; color: var(--text-normal);
+  background: var(--bg-tertiary);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  padding: 4px 8px;
+  font-family: var(--font-mono);
+  font-size: 12px;
+  color: var(--text-normal);
 }
 
 /* ── Context Menu ── */
 .context-menu {
-  position: fixed; z-index: 300;
-  background: var(--bg-primary); border: 1px solid var(--border);
-  border-radius: var(--radius-sm); padding: 4px;
-  box-shadow: 0 8px 24px rgba(0,0,0,.5);
+  position: fixed;
+  z-index: 300;
+  background: var(--bg-primary);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  padding: 4px;
+  box-shadow: 0 8px 24px rgba(0, 0, 0, 0.5);
   min-width: 180px;
   animation: contextMenuPop 0.1s ease;
 }
 .context-menu-item {
-  display: flex; align-items: center; gap: 8px;
-  padding: 8px 10px; border-radius: var(--radius-sm);
-  cursor: pointer; font-size: 13px; color: var(--text-normal);
-  background: transparent; width: 100%; text-align: left;
-  transition: background 0.1s ease, color 0.1s ease;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 8px 10px;
+  border-radius: var(--radius-sm);
+  cursor: pointer;
+  font-size: 13px;
+  color: var(--text-normal);
+  background: transparent;
+  width: 100%;
+  text-align: left;
+  transition:
+    background 0.1s ease,
+    color 0.1s ease;
+}
+.context-menu-item:hover {
+  background: var(--accent);
+  color: white;
+}
+.context-menu-item.danger {
+  color: var(--red);
+}
+.context-menu-item.danger:hover {
+  background: var(--red);
+  color: white;
+}
+.context-menu-item.disabled {
+  color: var(--text-muted);
+  cursor: default;
+}
+.context-menu-item.disabled:hover {
+  background: transparent;
+  color: var(--text-muted);
+}
+.context-menu-sep {
+  height: 1px;
+  background: var(--border);
+  margin: 4px 0;
+}
+
+/* Submenu trigger inside the voice-user menu: anchors the absolutely
+   positioned .context-menu__submenu flyout to this row. */
+.context-menu-item--submenu {
+  position: relative;
+}
+/* A moderator-imposed mute reads differently from a self-mute. */
+.vu-muted.vu-server-muted {
+  color: var(--red);
 }
-.context-menu-item:hover { background: var(--accent); color: white; }
-.context-menu-item.danger { color: var(--red); }
-.context-menu-item.danger:hover { background: var(--red); color: white; }
-.context-menu-sep { height: 1px; background: var(--border); margin: 4px 0; }
 
 /* AdminActions (member/channel menus) uses BEM names — these had no rules at
    all, so those menus rendered unstyled: no hover, no danger colour, and a
    "submenu" that pushed the menu open instead of flying out. */
 .context-menu__item {
   position: relative;
-  display: flex; align-items: center; gap: 8px;
-  padding: 8px 10px; border-radius: var(--radius-sm);
-  cursor: pointer; font-size: 13px; color: var(--text-normal);
-  background: transparent; width: 100%; text-align: left;
-  transition: background 0.1s ease, color 0.1s ease;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 8px 10px;
+  border-radius: var(--radius-sm);
+  cursor: pointer;
+  font-size: 13px;
+  color: var(--text-normal);
+  background: transparent;
+  width: 100%;
+  text-align: left;
+  transition:
+    background 0.1s ease,
+    color 0.1s ease;
+}
+.context-menu__item:hover {
+  background: var(--accent);
+  color: white;
+}
+.context-menu__item--active {
+  color: var(--accent);
+  font-weight: 600;
+}
+.context-menu__item--active:hover {
+  color: white;
+}
+.context-menu__item--danger {
+  color: var(--red);
+}
+.context-menu__item--danger:hover {
+  background: var(--red);
+  color: white;
+}
+.context-menu__item--pending {
+  opacity: 0.7;
+  cursor: default;
+  pointer-events: none;
+}
+.context-menu__separator {
+  height: 1px;
+  background: var(--border);
+  margin: 4px 0;
 }
-.context-menu__item:hover { background: var(--accent); color: white; }
-.context-menu__item--active { color: var(--accent); font-weight: 600; }
-.context-menu__item--active:hover { color: white; }
-.context-menu__item--danger { color: var(--red); }
-.context-menu__item--danger:hover { background: var(--red); color: white; }
-.context-menu__item--pending { opacity: 0.7; cursor: default; pointer-events: none; }
-.context-menu__separator { height: 1px; background: var(--border); margin: 4px 0; }
 .context-menu__submenu {
-  position: absolute; left: 100%; top: 0;
-  background: var(--bg-primary); border: 1px solid var(--border);
-  border-radius: var(--radius-sm); padding: 4px;
-  box-shadow: 0 8px 24px rgba(0,0,0,.5);
-  min-width: 140px; z-index: 1;
+  position: absolute;
+  left: 100%;
+  top: 0;
+  background: var(--bg-primary);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  padding: 4px;
+  box-shadow: 0 8px 24px rgba(0, 0, 0, 0.5);
+  min-width: 140px;
+  z-index: 1;
+}
+.context-menu__reason {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
 }
-.context-menu__reason { display: flex; flex-direction: column; gap: 6px; }
 
 /* ── Toast Notification ── */
 .toast-container {
-  position: fixed; bottom: 24px; left: 50%;
+  position: fixed;
+  bottom: 24px;
+  left: 50%;
   transform: translateX(-50%);
-  z-index: 9999; display: flex; flex-direction: column; gap: 8px;
+  z-index: 9999;
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
   pointer-events: none;
 }
 .toast {
-  background: var(--bg-secondary); border: 1px solid var(--border);
-  border-radius: var(--radius-md); padding: 12px 20px;
-  font-size: 13px; color: var(--text-normal);
-  box-shadow: 0 8px 24px rgba(0,0,0,.5);
-  opacity: 0; transition: opacity .3s;
+  background: var(--bg-secondary);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-md);
+  padding: 12px 20px;
+  font-size: 13px;
+  color: var(--text-normal);
+  box-shadow: 0 8px 24px rgba(0, 0, 0, 0.5);
+  opacity: 0;
+  transition: opacity 0.3s;
   pointer-events: none;
 }
-.toast.show { opacity: 1; animation: toastSlideUp 0.3s ease; }
-.toast-info { border-left: 4px solid var(--accent); }
-.toast-error { border-left: 4px solid var(--red); }
-.toast-success { border-left: 4px solid var(--green); }
+.toast.show {
+  opacity: 1;
+  animation: toastSlideUp 0.3s ease;
+}
+.toast-info {
+  border-left: 4px solid var(--accent);
+}
+.toast-error {
+  border-left: 4px solid var(--red);
+}
+.toast-success {
+  border-left: 4px solid var(--green);
+}
 
 /* ── Reconnecting Banner ── */
 .reconnecting-banner {
-  background: var(--yellow); color: #1e1f22;
-  text-align: center; padding: 6px 16px;
-  font-size: 13px; font-weight: 600;
-  flex-shrink: 0; display: none;
+  background: var(--yellow);
+  color: #1e1f22;
+  text-align: center;
+  padding: 6px 16px;
+  font-size: 13px;
+  font-weight: 600;
+  flex-shrink: 0;
+  display: none;
+}
+.reconnecting-banner.visible {
+  display: block;
 }
-.reconnecting-banner.visible { display: block; }
 
 /* ── Search Overlay ── */
 .search-overlay {
-  position: fixed; inset: 0;
+  position: fixed;
+  inset: 0;
   background: var(--bg-overlay);
-  display: none; align-items: flex-start; justify-content: center;
-  padding-top: 80px; z-index: 400;
+  display: none;
+  align-items: flex-start;
+  justify-content: center;
+  padding-top: 80px;
+  z-index: 400;
+}
+.search-overlay.open {
+  display: flex;
 }
-.search-overlay.open { display: flex; }
 .search-overlay-box {
-  width: 540px; background: var(--bg-primary);
+  width: 540px;
+  background: var(--bg-primary);
   border-radius: var(--radius-md);
-  box-shadow: 0 8px 48px rgba(0,0,0,.5);
+  box-shadow: 0 8px 48px rgba(0, 0, 0, 0.5);
   overflow: hidden;
 }
 .search-overlay-input {
-  width: 100%; padding: 16px 20px;
-  background: transparent; color: var(--text-normal);
-  font-size: 16px; border: none;
+  width: 100%;
+  padding: 16px 20px;
+  background: transparent;
+  color: var(--text-normal);
+  font-size: 16px;
+  border: none;
+}
+.search-overlay-input::placeholder {
+  color: var(--text-micro);
 }
-.search-overlay-input::placeholder { color: var(--text-micro); }
 .search-overlay-results {
-  max-height: 400px; overflow-y: auto;
+  max-height: 400px;
+  overflow-y: auto;
   border-top: 1px solid var(--border);
 }
 .search-overlay-status {
-  padding: 12px 20px; color: var(--text-micro); font-size: 14px;
+  padding: 12px 20px;
+  color: var(--text-micro);
+  font-size: 14px;
 }
 .search-result-item {
-  padding: 10px 20px; cursor: pointer;
+  padding: 10px 20px;
+  cursor: pointer;
   border-bottom: 1px solid var(--border);
   transition: background 0.1s;
 }
@@ -1569,370 +3705,797 @@
   background: var(--bg-secondary);
 }
 .search-result-header {
-  display: flex; align-items: center; gap: 8px;
-  margin-bottom: 4px; font-size: 12px;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  margin-bottom: 4px;
+  font-size: 12px;
 }
 .search-result-channel {
-  color: var(--text-micro); font-weight: 600;
+  color: var(--text-micro);
+  font-weight: 600;
 }
 .search-result-author {
-  color: var(--text-normal); font-weight: 600;
+  color: var(--text-normal);
+  font-weight: 600;
 }
 .search-result-time {
-  color: var(--text-micro); margin-left: auto; font-size: 11px;
+  color: var(--text-micro);
+  margin-left: auto;
+  font-size: 11px;
 }
 .search-result-content {
-  color: var(--text-muted); font-size: 13px;
-  white-space: nowrap; overflow: hidden; text-overflow: ellipsis;
+  color: var(--text-muted);
+  font-size: 13px;
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
 }
 
 /* ── DM Back Header ── */
 .dm-back-header {
-  height: 44px; padding: 0 14px;
-  display: flex; align-items: center; gap: 10px;
+  height: 44px;
+  padding: 0 14px;
+  display: flex;
+  align-items: center;
+  gap: 10px;
   border-bottom: 1px solid var(--border-glow, var(--border));
-  cursor: pointer; transition: background var(--transition-fast);
+  cursor: pointer;
+  transition: background var(--transition-fast);
+}
+.dm-back-header:hover {
+  background: var(--bg-hover);
+}
+.dm-back-arrow {
+  color: var(--accent-primary, var(--accent));
+  font-size: 16px;
+}
+.dm-back-info {
+  flex: 1;
+}
+.dm-back-title {
+  color: var(--accent-primary, var(--accent));
+  font-weight: 600;
+  font-size: 12px;
+}
+.dm-back-subtitle {
+  color: var(--text-micro);
+  font-size: 9px;
 }
-.dm-back-header:hover { background: var(--bg-hover); }
-.dm-back-arrow { color: var(--accent-primary, var(--accent)); font-size: 16px; }
-.dm-back-info { flex: 1; }
-.dm-back-title { color: var(--accent-primary, var(--accent)); font-weight: 600; font-size: 12px; }
-.dm-back-subtitle { color: var(--text-micro); font-size: 9px; }
 
 /* ── Friends / DM View ── */
 .dm-sidebar-header {
-  padding: 8px; flex-shrink: 0;
+  padding: 8px;
+  flex-shrink: 0;
 }
 .dm-search {
-  width: 100%; background: var(--bg-tertiary);
-  border: none; border-radius: var(--radius-sm);
-  padding: 8px 10px; color: var(--text-normal); font-size: 13px;
+  width: 100%;
+  background: var(--bg-tertiary);
+  border: none;
+  border-radius: var(--radius-sm);
+  padding: 8px 10px;
+  color: var(--text-normal);
+  font-size: 13px;
 }
-.dm-search::placeholder { color: var(--text-micro); }
-
-.dm-nav-item {
-  display: flex; align-items: center; gap: 10px;
-  padding: 8px 12px; margin: 1px 8px;
-  border-radius: var(--radius-sm); cursor: pointer;
-  color: var(--text-muted); transition: all .1s; font-size: 14px;
+.dm-search::placeholder {
+  color: var(--text-micro);
 }
-.dm-nav-item:hover { background: var(--bg-hover); color: var(--text-normal); }
-.dm-nav-item.active { background: var(--bg-active); color: white; }
-.dm-nav-item .dm-nav-icon { font-size: 18px; width: 20px; text-align: center; }
 
 .dm-section-label {
   padding: 16px 16px 4px;
-  font-size: 11px; font-weight: 700;
-  color: var(--text-faint); letter-spacing: .5px; text-transform: uppercase;
-  display: flex; align-items: center; justify-content: space-between;
+  font-size: 11px;
+  font-weight: 700;
+  color: var(--text-faint);
+  letter-spacing: 0.5px;
+  text-transform: uppercase;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
 }
 .dm-section-label .dm-add {
-  width: 18px; height: 18px; border-radius: var(--radius-sm);
-  background: transparent; color: var(--text-muted);
-  font-size: 16px; display: flex; align-items: center; justify-content: center;
-  cursor: pointer; transition: color .1s;
+  width: 18px;
+  height: 18px;
+  border-radius: var(--radius-sm);
+  background: transparent;
+  color: var(--text-muted);
+  font-size: 16px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  cursor: pointer;
+  transition: color 0.1s;
+}
+.dm-section-label .dm-add:hover {
+  color: var(--text-normal);
 }
-.dm-section-label .dm-add:hover { color: var(--text-normal); }
 
 .dm-item {
-  display: flex; align-items: center; gap: 10px;
-  padding: 6px 8px; margin: 1px 8px;
-  border-radius: var(--radius-sm); cursor: pointer;
-  color: var(--text-muted); transition: all .1s;
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  padding: 6px 8px;
+  margin: 1px 8px;
+  border-radius: var(--radius-sm);
+  cursor: pointer;
+  color: var(--text-muted);
+  transition: all 0.1s;
+}
+.dm-item:hover {
+  background: var(--bg-hover);
+  color: var(--text-normal);
+}
+.dm-item.active {
+  background: var(--bg-active);
+  color: white;
 }
-.dm-item:hover { background: var(--bg-hover); color: var(--text-normal); }
-.dm-item.active { background: var(--bg-active); color: white; }
 .dm-item .dm-avatar {
-  width: 32px; height: 32px; border-radius: var(--radius-circle);
-  flex-shrink: 0; position: relative;
-  display: flex; align-items: center; justify-content: center;
-  font-weight: 700; font-size: 13px; color: white;
+  width: 32px;
+  height: 32px;
+  border-radius: var(--radius-circle);
+  flex-shrink: 0;
+  position: relative;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-weight: 700;
+  font-size: 13px;
+  color: white;
 }
 .dm-item .dm-avatar .dm-status {
-  position: absolute; bottom: -1px; right: -1px;
-  width: 12px; height: 12px; border-radius: var(--radius-circle);
+  position: absolute;
+  bottom: -1px;
+  right: -1px;
+  width: 12px;
+  height: 12px;
+  border-radius: var(--radius-circle);
   border: 3px solid var(--bg-secondary);
 }
-.dm-item.active .dm-avatar .dm-status { border-color: var(--bg-active); }
-.dm-item .dm-name { font-size: 14px; flex: 1; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.dm-item.active .dm-avatar .dm-status {
+  border-color: var(--bg-active);
+}
+.dm-item .dm-name {
+  font-size: 14px;
+  flex: 1;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
 .dm-item .dm-close {
-  width: 20px; height: 20px; border-radius: var(--radius-sm);
-  background: transparent; color: var(--text-micro);
-  font-size: 14px; display: none; align-items: center; justify-content: center;
+  width: 20px;
+  height: 20px;
+  border-radius: var(--radius-sm);
+  background: transparent;
+  color: var(--text-micro);
+  font-size: 14px;
+  display: none;
+  align-items: center;
+  justify-content: center;
   cursor: pointer;
 }
-.dm-item:hover .dm-close { display: flex; }
-.dm-item .dm-close:hover { color: var(--text-normal); }
+.dm-item:hover .dm-close {
+  display: flex;
+}
+.dm-item .dm-close:hover {
+  color: var(--text-normal);
+}
 .dm-item .dm-unread {
-  width: 8px; height: 8px; border-radius: 50%;
-  background: white; flex-shrink: 0;
+  width: 8px;
+  height: 8px;
+  border-radius: 50%;
+  background: white;
+  flex-shrink: 0;
+}
+/* Numeric unread / mention badges — same shape as the channel list's. */
+.dm-item .dm-unread-badge,
+.dm-item .dm-mention-badge {
+  color: white;
+  font-size: 10px;
+  font-weight: 700;
+  min-width: 18px;
+  height: 18px;
+  border-radius: 9px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 0 4px;
+  flex-shrink: 0;
+}
+.dm-item .dm-unread-badge {
+  background: var(--accent);
+}
+.dm-item .dm-mention-badge {
+  background: var(--red);
 }
 
 /* Friends list (main area when Home > Friends is active) */
 .friends-view {
-  flex: 1; display: flex; flex-direction: column;
+  flex: 1;
+  display: flex;
+  flex-direction: column;
   background: var(--bg-primary);
 }
 .friends-header {
-  height: 48px; padding: 0 16px;
-  display: flex; align-items: center; gap: 16px;
-  border-bottom: none; box-shadow: var(--elevation-low); flex-shrink: 0;
+  height: 48px;
+  padding: 0 16px;
+  display: flex;
+  align-items: center;
+  gap: 16px;
+  border-bottom: none;
+  box-shadow: var(--elevation-low);
+  flex-shrink: 0;
 }
 .friends-header .fh-title {
-  font-size: 15px; font-weight: 700; color: white;
-  display: flex; align-items: center; gap: 8px;
+  font-size: 15px;
+  font-weight: 700;
+  color: white;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+.friends-header .fh-title .fh-icon {
+  font-size: 20px;
+}
+.friends-header .fh-divider {
+  width: 1px;
+  height: 24px;
+  background: var(--border);
 }
-.friends-header .fh-title .fh-icon { font-size: 20px; }
-.friends-header .fh-divider { width: 1px; height: 24px; background: var(--border); }
 .friends-tab {
-  padding: 4px 10px; border-radius: var(--radius-sm);
-  font-size: 13px; font-weight: 500; color: var(--text-muted);
-  cursor: pointer; transition: all .1s; background: transparent;
+  padding: 4px 10px;
+  border-radius: var(--radius-sm);
+  font-size: 13px;
+  font-weight: 500;
+  color: var(--text-muted);
+  cursor: pointer;
+  transition: all 0.1s;
+  background: transparent;
+}
+.friends-tab:hover {
+  background: var(--bg-hover);
+  color: var(--text-normal);
+}
+.friends-tab.active {
+  background: var(--bg-active);
+  color: white;
 }
-.friends-tab:hover { background: var(--bg-hover); color: var(--text-normal); }
-.friends-tab.active { background: var(--bg-active); color: white; }
 .friends-tab.add-friend {
-  background: var(--green); color: white; font-weight: 600;
+  background: var(--green);
+  color: white;
+  font-weight: 600;
+}
+.friends-tab.add-friend:hover {
+  background: #1e8e4c;
 }
-.friends-tab.add-friend:hover { background: #1e8e4c; }
 
-.friends-list { flex: 1; overflow-y: auto; padding: 8px 16px; }
+.friends-list {
+  flex: 1;
+  overflow-y: auto;
+  padding: 8px 16px;
+}
 .friends-search-bar {
   padding: 8px 0 16px;
 }
 .friends-search {
-  width: 100%; background: var(--bg-tertiary);
-  border: none; border-radius: var(--radius-sm);
-  padding: 10px 12px; color: var(--text-normal); font-size: 13px;
+  width: 100%;
+  background: var(--bg-tertiary);
+  border: none;
+  border-radius: var(--radius-sm);
+  padding: 10px 12px;
+  color: var(--text-normal);
+  font-size: 13px;
+}
+.friends-search::placeholder {
+  color: var(--text-micro);
 }
-.friends-search::placeholder { color: var(--text-micro); }
 .friends-count {
-  font-size: 11px; font-weight: 700;
-  color: var(--text-faint); text-transform: uppercase;
-  letter-spacing: .5px; padding: 8px 0;
+  font-size: 11px;
+  font-weight: 700;
+  color: var(--text-faint);
+  text-transform: uppercase;
+  letter-spacing: 0.5px;
+  padding: 8px 0;
 }
 
 .friend-item {
-  display: flex; align-items: center; gap: 12px;
+  display: flex;
+  align-items: center;
+  gap: 12px;
   padding: 10px 8px;
   border-top: 1px solid var(--border);
-  cursor: pointer; transition: background .1s;
+  cursor: pointer;
+  transition: background 0.1s;
   border-radius: var(--radius-sm);
 }
-.friend-item:hover { background: var(--bg-hover); }
+.friend-item:hover {
+  background: var(--bg-hover);
+}
 .friend-item .fi-avatar {
-  width: 40px; height: 40px; border-radius: var(--radius-circle);
-  flex-shrink: 0; position: relative;
-  display: flex; align-items: center; justify-content: center;
-  font-weight: 700; font-size: 16px; color: white;
+  width: 40px;
+  height: 40px;
+  border-radius: var(--radius-circle);
+  flex-shrink: 0;
+  position: relative;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-weight: 700;
+  font-size: 16px;
+  color: white;
 }
 .friend-item .fi-status-dot {
-  position: absolute; bottom: 0; right: 0;
-  width: 14px; height: 14px; border-radius: var(--radius-circle);
+  position: absolute;
+  bottom: 0;
+  right: 0;
+  width: 14px;
+  height: 14px;
+  border-radius: var(--radius-circle);
   border: 3px solid var(--bg-primary);
 }
-.friend-item:hover .fi-status-dot { border-color: var(--bg-hover); }
-.friend-item .fi-info { flex: 1; }
-.friend-item .fi-name { font-size: 14px; font-weight: 600; color: white; }
-.friend-item .fi-status-text { font-size: 12px; color: var(--text-muted); }
+.friend-item:hover .fi-status-dot {
+  border-color: var(--bg-hover);
+}
+.friend-item .fi-info {
+  flex: 1;
+}
+.friend-item .fi-name {
+  font-size: 14px;
+  font-weight: 600;
+  color: white;
+}
+.friend-item .fi-status-text {
+  font-size: 12px;
+  color: var(--text-muted);
+}
 .friend-item .fi-actions {
-  display: flex; gap: 6px; opacity: 0; transition: opacity .1s;
+  display: flex;
+  gap: 6px;
+  opacity: 0;
+  transition: opacity 0.1s;
+}
+.friend-item:hover .fi-actions {
+  opacity: 1;
 }
-.friend-item:hover .fi-actions { opacity: 1; }
 .fi-action-btn {
-  width: 36px; height: 36px; border-radius: var(--radius-circle);
-  background: var(--bg-secondary); color: var(--text-muted);
-  display: flex; align-items: center; justify-content: center;
-  font-size: 16px; transition: all .1s; cursor: pointer; border: none;
+  width: 36px;
+  height: 36px;
+  border-radius: var(--radius-circle);
+  background: var(--bg-secondary);
+  color: var(--text-muted);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: 16px;
+  transition: all 0.1s;
+  cursor: pointer;
+  border: none;
+}
+.fi-action-btn:hover {
+  background: var(--bg-active);
+  color: var(--text-normal);
 }
-.fi-action-btn:hover { background: var(--bg-active); color: var(--text-normal); }
 
 /* Add friend form */
 .add-friend-form {
   padding: 24px;
 }
 .add-friend-form h2 {
-  font-size: 16px; font-weight: 700; color: white; margin-bottom: 4px;
+  font-size: 16px;
+  font-weight: 700;
+  color: white;
+  margin-bottom: 4px;
 }
 .add-friend-form p {
-  font-size: 13px; color: var(--text-muted); margin-bottom: 16px;
+  font-size: 13px;
+  color: var(--text-muted);
+  margin-bottom: 16px;
 }
 .add-friend-input-row {
-  display: flex; gap: 8px;
+  display: flex;
+  gap: 8px;
 }
 .add-friend-input {
-  flex: 1; background: var(--bg-tertiary);
-  border: 1px solid var(--border); border-radius: var(--radius-sm);
-  padding: 12px; color: var(--text-normal); font-size: 14px;
+  flex: 1;
+  background: var(--bg-tertiary);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  padding: 12px;
+  color: var(--text-normal);
+  font-size: 14px;
+}
+.add-friend-input:focus {
+  border-color: var(--accent);
+  box-shadow: 0 0 0 1px var(--accent);
+}
+.add-friend-input::placeholder {
+  color: var(--text-micro);
 }
-.add-friend-input:focus { border-color: var(--accent); box-shadow: 0 0 0 1px var(--accent); }
-.add-friend-input::placeholder { color: var(--text-micro); }
 .add-friend-submit {
-  padding: 12px 20px; border-radius: var(--radius-sm);
-  background: var(--accent); color: white;
-  font-size: 14px; font-weight: 600; transition: background .15s;
+  padding: 12px 20px;
+  border-radius: var(--radius-sm);
+  background: var(--accent);
+  color: white;
+  font-size: 14px;
+  font-weight: 600;
+  transition: background 0.15s;
   white-space: nowrap;
 }
-.add-friend-submit:hover { background: var(--accent-hover); }
+.add-friend-submit:hover {
+  background: var(--accent-hover);
+}
 
 /* DM chat header */
 .dm-chat-header {
-  height: 48px; padding: 0 16px;
-  display: flex; align-items: center; gap: 10px;
-  border-bottom: none; box-shadow: var(--elevation-low); flex-shrink: 0;
+  height: 48px;
+  padding: 0 16px;
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  border-bottom: none;
+  box-shadow: var(--elevation-low);
+  flex-shrink: 0;
 }
 .dm-chat-header .dch-avatar {
-  width: 24px; height: 24px; border-radius: var(--radius-circle);
-  display: flex; align-items: center; justify-content: center;
-  font-weight: 700; font-size: 10px; color: white;
+  width: 24px;
+  height: 24px;
+  border-radius: var(--radius-circle);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-weight: 700;
+  font-size: 10px;
+  color: white;
+}
+.dm-chat-header .dch-name {
+  font-size: 15px;
+  font-weight: 700;
+  color: white;
+}
+.dm-chat-header .dch-status {
+  font-size: 12px;
+  color: var(--text-muted);
 }
-.dm-chat-header .dch-name { font-size: 15px; font-weight: 700; color: white; }
-.dm-chat-header .dch-status { font-size: 12px; color: var(--text-muted); }
 
 /* DM profile sidebar */
 .dm-profile {
-  width: 340px; background: var(--bg-secondary);
-  flex-shrink: 0; overflow-y: auto;
-  transition: width .2s;
+  width: 340px;
+  background: var(--bg-secondary);
+  flex-shrink: 0;
+  overflow-y: auto;
+  transition: width 0.2s;
+}
+.dm-profile.hidden {
+  width: 0;
+  overflow: hidden;
+}
+.dm-profile-banner {
+  height: 120px;
+}
+.dm-profile-body {
+  padding: 48px 16px 16px;
+  position: relative;
 }
-.dm-profile.hidden { width: 0; overflow: hidden; }
-.dm-profile-banner { height: 120px; }
-.dm-profile-body { padding: 48px 16px 16px; position: relative; }
 .dm-profile-avatar {
-  width: 80px; height: 80px; border-radius: var(--radius-circle);
-  position: absolute; top: -40px; left: 16px;
-  display: flex; align-items: center; justify-content: center;
-  font-weight: 700; font-size: 28px; color: white;
+  width: 80px;
+  height: 80px;
+  border-radius: var(--radius-circle);
+  position: absolute;
+  top: -40px;
+  left: 16px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-weight: 700;
+  font-size: 28px;
+  color: white;
   border: 6px solid var(--bg-secondary);
 }
-.dm-profile-name { font-size: 20px; font-weight: 700; color: white; }
-.dm-profile-role { font-size: 12px; margin-top: 2px; }
+.dm-profile-name {
+  font-size: 20px;
+  font-weight: 700;
+  color: white;
+}
+.dm-profile-role {
+  font-size: 12px;
+  margin-top: 2px;
+}
 .dm-profile-section {
-  margin-top: 16px; background: var(--bg-primary);
-  border-radius: var(--radius-md); padding: 12px;
+  margin-top: 16px;
+  background: var(--bg-primary);
+  border-radius: var(--radius-md);
+  padding: 12px;
 }
 .dm-profile-section-title {
-  font-size: 11px; font-weight: 700; color: var(--text-faint);
-  text-transform: uppercase; letter-spacing: .5px; margin-bottom: 8px;
+  font-size: 11px;
+  font-weight: 700;
+  color: var(--text-faint);
+  text-transform: uppercase;
+  letter-spacing: 0.5px;
+  margin-bottom: 8px;
+}
+.dm-profile-section-text {
+  font-size: 13px;
+  color: var(--text-normal);
+  line-height: 1.5;
 }
-.dm-profile-section-text { font-size: 13px; color: var(--text-normal); line-height: 1.5; }
 .dm-profile-mutual {
-  display: flex; align-items: center; gap: 8px;
+  display: flex;
+  align-items: center;
+  gap: 8px;
   padding: 6px 0;
 }
 .dm-profile-mutual .dpm-avatar {
-  width: 24px; height: 24px; border-radius: var(--radius-circle);
-  display: flex; align-items: center; justify-content: center;
-  font-weight: 700; font-size: 9px; color: white; flex-shrink: 0;
+  width: 24px;
+  height: 24px;
+  border-radius: var(--radius-circle);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-weight: 700;
+  font-size: 9px;
+  color: white;
+  flex-shrink: 0;
+}
+.dm-profile-mutual .dpm-name {
+  font-size: 13px;
+  color: var(--text-muted);
 }
-.dm-profile-mutual .dpm-name { font-size: 13px; color: var(--text-muted); }
 
 /* ── Virtual scroll content fade-in on channel switch ── */
 .virtual-content {
   animation: virtualFadeIn 0.1s ease;
 }
 @keyframes virtualFadeIn {
-  from { opacity: 0; transform: translateY(2px); }
-  to   { opacity: 1; transform: translateY(0); }
+  from {
+    opacity: 0;
+    transform: translateY(2px);
+  }
+  to {
+    opacity: 1;
+    transform: translateY(0);
+  }
 }
 
 /* ═══ Animations ═══ */
 @keyframes fadeIn {
-  from { opacity: 0; transform: translateY(4px); }
-  to { opacity: 1; transform: translateY(0); }
+  from {
+    opacity: 0;
+    transform: translateY(4px);
+  }
+  to {
+    opacity: 1;
+    transform: translateY(0);
+  }
 }
 @keyframes slideIn {
-  from { opacity: 0; transform: scale(.95); }
-  to { opacity: 1; transform: scale(1); }
+  from {
+    opacity: 0;
+    transform: scale(0.95);
+  }
+  to {
+    opacity: 1;
+    transform: scale(1);
+  }
 }
 @keyframes typingAnim {
-  0%, 60%, 100% { opacity: .3; transform: translateY(0); }
-  30% { opacity: 1; transform: translateY(-3px); }
+  0%,
+  60%,
+  100% {
+    opacity: 0.3;
+    transform: translateY(0);
+  }
+  30% {
+    opacity: 1;
+    transform: translateY(-3px);
+  }
 }
 @keyframes contextMenuPop {
-  from { opacity: 0; transform: scale(0.95); }
-  to   { opacity: 1; transform: scale(1); }
+  from {
+    opacity: 0;
+    transform: scale(0.95);
+  }
+  to {
+    opacity: 1;
+    transform: scale(1);
+  }
 }
 @keyframes pickerPop {
-  from { opacity: 0; transform: translateY(10px) scale(0.95); }
-  to   { opacity: 1; transform: translateY(0) scale(1); }
+  from {
+    opacity: 0;
+    transform: translateY(10px) scale(0.95);
+  }
+  to {
+    opacity: 1;
+    transform: translateY(0) scale(1);
+  }
 }
 @keyframes actionBarPop {
-  from { opacity: 0; transform: scale(0.95); }
-  to   { opacity: 1; transform: scale(1); }
+  from {
+    opacity: 0;
+    transform: scale(0.95);
+  }
+  to {
+    opacity: 1;
+    transform: scale(1);
+  }
 }
 @keyframes toastSlideUp {
-  from { opacity: 0; transform: translateY(16px); }
-  to   { opacity: 1; transform: translateY(0); }
+  from {
+    opacity: 0;
+    transform: translateY(16px);
+  }
+  to {
+    opacity: 1;
+    transform: translateY(0);
+  }
 }
 
-.user-popup.open { animation: slideIn .15s cubic-bezier(0.34, 1.56, 0.64, 1); }
-.emoji-picker.open, .gif-picker.open { animation: pickerPop .15s cubic-bezier(0.4, 0, 0.2, 1); }
-.settings-overlay.open { animation: fadeIn .2s ease; }
-.settings-panel { animation: settingsScale .2s cubic-bezier(0.2, 0, 0, 1); }
+.user-popup.open {
+  animation: slideIn 0.15s cubic-bezier(0.34, 1.56, 0.64, 1);
+}
+.emoji-picker.open,
+.gif-picker.open {
+  animation: pickerPop 0.15s cubic-bezier(0.4, 0, 0.2, 1);
+}
+.settings-overlay.open {
+  animation: fadeIn 0.2s ease;
+}
+.settings-panel {
+  animation: settingsScale 0.2s cubic-bezier(0.2, 0, 0, 1);
+}
 @keyframes settingsScale {
-  from { opacity: 0; transform: scale(0.95); }
-  to   { opacity: 1; transform: scale(1); }
+  from {
+    opacity: 0;
+    transform: scale(0.95);
+  }
+  to {
+    opacity: 1;
+    transform: scale(1);
+  }
 }
 
 /* ═══ Compact Mode ═══ */
 /* Messages: hide avatars, inline timestamp + author, tighter spacing */
-.compact-mode .message { padding: 2px 16px 2px 40px; min-height: 20px; margin-top: 4px; }
-.compact-mode .message.grouped { min-height: 16px; margin-top: 0; }
-.compact-mode .message .msg-avatar { width: 24px; height: 24px; font-size: 10px; top: 2px; left: 8px; }
-.compact-mode .message.grouped .msg-avatar { display: none; }
+.compact-mode .message {
+  padding: 2px 16px 2px 40px;
+  min-height: 20px;
+  margin-top: 4px;
+}
+.compact-mode .message.grouped {
+  min-height: 16px;
+  margin-top: 0;
+}
+.compact-mode .message .msg-avatar {
+  width: 24px;
+  height: 24px;
+  font-size: 10px;
+  top: 2px;
+  left: 8px;
+}
+.compact-mode .message.grouped .msg-avatar {
+  display: none;
+}
 .compact-mode .message .msg-hover-time {
   display: none;
 }
-.compact-mode .message.grouped .msg-hover-time { display: block; }
-.compact-mode .message .msg-header { display: flex; }
-.compact-mode .message.grouped .msg-header { display: none; }
-.compact-mode .message .msg-text { line-height: 1.25; font-size: 13px; }
-.compact-mode .message .msg-time { display: none; }
-/* Reactions and embeds */
-.compact-mode .msg-reactions { margin-top: 2px; }
-.compact-mode .msg-day-divider { padding: 4px 16px 4px; margin-bottom: 2px; }
-/* Channel sidebar */
-.compact-mode .channel-item { padding: 3px 8px; }
-.compact-mode .channel-item .ch-name { font-size: 13px; }
-.compact-mode .channel-sidebar-header { height: 40px; }
-.compact-mode .category { padding: 10px 8px 2px 16px; }
-/* Chat header */
-.compact-mode .chat-header { height: 38px; }
-/* Empty states */
-.channel-list-empty, .member-list-empty {
-  display: flex; flex-direction: column; align-items: center; justify-content: center;
-  padding: 32px 16px; text-align: center; gap: 4px;
+.compact-mode .message.grouped .msg-hover-time {
+  display: block;
 }
-.channel-list-empty-text, .member-list-empty-text {
-  color: var(--text-muted); font-size: var(--font-size-md);
+.compact-mode .message .msg-header {
+  display: flex;
+}
+.compact-mode .message.grouped .msg-header {
+  display: none;
+}
+.compact-mode .message .msg-text {
+  line-height: 1.25;
+  font-size: 13px;
+}
+.compact-mode .message .msg-time {
+  display: none;
+}
+/* Reactions and embeds */
+.compact-mode .msg-reactions {
+  margin-top: 2px;
+}
+.compact-mode .msg-day-divider {
+  padding: 4px 16px 4px;
+  margin-bottom: 2px;
+}
+/* Channel sidebar */
+.compact-mode .channel-item {
+  padding: 3px 8px;
+}
+.compact-mode .channel-item .ch-name {
+  font-size: 13px;
+}
+.compact-mode .channel-sidebar-header {
+  height: 40px;
+}
+.compact-mode .category {
+  padding: 10px 8px 2px 16px;
+}
+/* Chat header */
+.compact-mode .chat-header {
+  height: 38px;
+}
+/* Empty states */
+.channel-list-empty,
+.member-list-empty {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  padding: 32px 16px;
+  text-align: center;
+  gap: 4px;
+}
+.channel-list-empty-text,
+.member-list-empty-text {
+  color: var(--text-muted);
+  font-size: var(--font-size-md);
 }
 .channel-list-empty-hint {
-  color: var(--text-faint); font-size: var(--font-size-xs);
+  color: var(--text-faint);
+  font-size: var(--font-size-xs);
 }
 
 /* Members */
-.compact-mode .member-item { padding: 2px 8px; }
-.compact-mode .member-item .mi-avatar { width: 24px; height: 24px; font-size: 10px; }
-.compact-mode .member-item .mi-name { font-size: 13px; }
-.compact-mode .member-role-group { padding: 12px 16px 2px; }
+.compact-mode .member-item {
+  padding: 2px 8px;
+}
+.compact-mode .member-item .mi-avatar {
+  width: 24px;
+  height: 24px;
+  font-size: 10px;
+}
+.compact-mode .member-item .mi-name {
+  font-size: 13px;
+}
+.compact-mode .member-role-group {
+  padding: 12px 16px 2px;
+}
 /* Voice */
-.compact-mode .voice-user-item { padding: 2px 8px; font-size: 12px; }
-.compact-mode .voice-user-item .vu-avatar { width: 16px; height: 16px; font-size: 7px; }
-.compact-mode .vu-preview { margin: 1px 0; }
+.compact-mode .voice-user-item {
+  padding: 2px 8px;
+  font-size: 12px;
+}
+.compact-mode .voice-user-item .vu-avatar {
+  width: 16px;
+  height: 16px;
+  font-size: 7px;
+}
+.compact-mode .vu-preview {
+  margin: 1px 0;
+}
 .compact-mode .vu-preview video,
-.compact-mode .vu-preview-placeholder { aspect-ratio: 16 / 9; }
+.compact-mode .vu-preview-placeholder {
+  aspect-ratio: 16 / 9;
+}
 /* User bar */
-.compact-mode .user-bar { height: 42px; }
-.compact-mode .user-bar .ub-avatar { width: 28px; height: 28px; font-size: 12px; }
+.compact-mode .user-bar {
+  height: 42px;
+}
+.compact-mode .user-bar .ub-avatar {
+  width: 28px;
+  height: 28px;
+  font-size: 12px;
+}
 /* Messages container */
-.compact-mode .messages-container { padding: 8px 0; }
+.compact-mode .messages-container {
+  padding: 8px 0;
+}
 
 /* ═══ Pinned Messages Panel ═══ */
 
 @keyframes pinned-enter {
-  from { opacity: 0; transform: translateY(-8px); }
-  to   { opacity: 1; transform: translateY(0); }
+  from {
+    opacity: 0;
+    transform: translateY(-8px);
+  }
+  to {
+    opacity: 1;
+    transform: translateY(0);
+  }
 }
 
 .pinned-panel {
@@ -1970,7 +4533,11 @@
   gap: 8px;
 }
 
-.pinned-panel__title-group { display: flex; align-items: center; gap: 8px; }
+.pinned-panel__title-group {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
 
 .pinned-panel__count {
   background: var(--bg-active);
@@ -1996,7 +4563,9 @@
   border-radius: var(--radius-sm);
   transition: color 0.15s;
 }
-.pinned-panel__close:hover { color: var(--text-normal); }
+.pinned-panel__close:hover {
+  color: var(--text-normal);
+}
 
 .pinned-panel__list {
   flex: 1;
@@ -2005,8 +4574,12 @@
   scrollbar-width: thin;
   scrollbar-color: var(--bg-active) transparent;
 }
-.pinned-panel__list::-webkit-scrollbar { width: 6px; }
-.pinned-panel__list::-webkit-scrollbar-track { background: transparent; }
+.pinned-panel__list::-webkit-scrollbar {
+  width: 6px;
+}
+.pinned-panel__list::-webkit-scrollbar-track {
+  background: transparent;
+}
 .pinned-panel__list::-webkit-scrollbar-thumb {
   background: var(--bg-active);
   border-radius: 3px;
@@ -2021,8 +4594,12 @@
   position: relative;
   transition: background 0.15s;
 }
-.pinned-msg:last-child { margin-bottom: 0; }
-.pinned-msg:hover { background: var(--bg-hover); }
+.pinned-msg:last-child {
+  margin-bottom: 0;
+}
+.pinned-msg:hover {
+  background: var(--bg-hover);
+}
 
 .pinned-msg__row {
   display: flex;
@@ -2085,7 +4662,9 @@
   flex-direction: row;
   gap: 4px;
 }
-.pinned-msg:hover .pinned-msg__actions { display: flex; }
+.pinned-msg:hover .pinned-msg__actions {
+  display: flex;
+}
 
 .pinned-msg__actions button {
   width: 28px;
@@ -2099,7 +4678,9 @@
   display: flex;
   align-items: center;
   justify-content: center;
-  transition: color 0.15s, background 0.15s;
+  transition:
+    color 0.15s,
+    background 0.15s;
 }
 .pinned-msg__actions button:hover {
   color: var(--text-normal);
@@ -2135,13 +4716,22 @@
   border-radius: var(--radius-sm);
 }
 .skeleton--shimmer {
-  background: linear-gradient(90deg, var(--bg-secondary) 0%, var(--bg-hover) 50%, var(--bg-secondary) 100%);
+  background: linear-gradient(
+    90deg,
+    var(--bg-secondary) 0%,
+    var(--bg-hover) 50%,
+    var(--bg-secondary) 100%
+  );
   background-size: 200% 100%;
   animation: shimmer 1.5s ease-in-out infinite;
 }
 @keyframes shimmer {
-  0%   { background-position: 200% 0; }
-  100% { background-position: -200% 0; }
+  0% {
+    background-position: 200% 0;
+  }
+  100% {
+    background-position: -200% 0;
+  }
 }
 .skeleton-avatar {
   width: 40px;
@@ -2153,9 +4743,15 @@
   margin-bottom: 4px;
   border-radius: var(--radius-sm);
 }
-.skeleton-line--short { width: 60%; }
-.skeleton-line--medium { width: 80%; }
-.skeleton-line--long { width: 95%; }
+.skeleton-line--short {
+  width: 60%;
+}
+.skeleton-line--medium {
+  width: 80%;
+}
+.skeleton-line--long {
+  width: 95%;
+}
 .skeleton-msg {
   display: flex;
   gap: 12px;
@@ -2184,7 +4780,7 @@
   max-width: 200px;
 }
 .tooltip::after {
-  content: '';
+  content: "";
   position: absolute;
   border: 5px solid transparent;
 }
@@ -2213,19 +4809,32 @@
   border-left-color: #111214;
 }
 @keyframes tooltipFadeIn {
-  from { opacity: 0; transform: translateY(2px); }
-  to   { opacity: 1; transform: translateY(0); }
+  from {
+    opacity: 0;
+    transform: translateY(2px);
+  }
+  to {
+    opacity: 1;
+    transform: translateY(0);
+  }
 }
 
 /* ═══ Responsive ═══ */
 @media (max-width: 1200px) {
-  .member-list { width: 0; padding: 0; overflow: hidden; }
+  .member-list {
+    width: 0;
+    padding: 0;
+    overflow: hidden;
+  }
 }
 @media (max-width: 800px) {
-  .channel-sidebar, .unified-sidebar { width: 0; overflow: hidden; }
+  .channel-sidebar,
+  .unified-sidebar {
+    width: 0;
+    overflow: hidden;
+  }
 }
 
-
 /* ── Video Grid ────────────────────────────────────── */
 
 .video-grid-slot {
@@ -2455,7 +5064,8 @@
 }
 
 /* Accessibility: reduced motion */
-.reduced-motion, .reduced-motion * {
+.reduced-motion,
+.reduced-motion * {
   animation-duration: 0s !important;
   transition-duration: 0s !important;
 }
@@ -2474,38 +5084,428 @@
 
 /* ── Quick-Switch Overlay ── */
 .quick-switch-backdrop {
-  position: fixed; inset: 0; z-index: 200;
+  position: fixed;
+  inset: 0;
+  z-index: 200;
   background: var(--bg-overlay);
-  display: flex; align-items: center; justify-content: center;
+  display: flex;
+  align-items: center;
+  justify-content: center;
 }
 .quick-switch-modal {
-  width: 380px; max-width: 90vw;
-  background: var(--bg-primary); border: 1px solid var(--border-glow, var(--border));
-  border-radius: var(--radius-lg); overflow: hidden;
-  box-shadow: 0 16px 48px rgba(0,0,0,.6);
+  width: 380px;
+  max-width: 90vw;
+  background: var(--bg-primary);
+  border: 1px solid var(--border-glow, var(--border));
+  border-radius: var(--radius-lg);
+  overflow: hidden;
+  box-shadow: 0 16px 48px rgba(0, 0, 0, 0.6);
+}
+.quick-switch-header {
+  padding: 20px 20px 12px;
+}
+.quick-switch-header h2 {
+  font-size: 16px;
+  font-weight: 700;
+  color: white;
+  margin: 0 0 4px;
+}
+.quick-switch-subtitle {
+  font-size: 12px;
+  color: var(--text-micro);
+  margin: 0;
+}
+.quick-switch-list {
+  padding: 0 12px 8px;
 }
-.quick-switch-header { padding: 20px 20px 12px; }
-.quick-switch-header h2 { font-size: 16px; font-weight: 700; color: white; margin: 0 0 4px; }
-.quick-switch-subtitle { font-size: 12px; color: var(--text-micro); margin: 0; }
-.quick-switch-list { padding: 0 12px 8px; }
 .quick-switch-item {
-  display: flex; align-items: center; gap: 12px;
-  padding: 10px 12px; border-radius: var(--radius-md);
-  cursor: pointer; border: 1px solid transparent;
-  transition: background var(--transition-fast), border-color var(--transition-fast);
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  padding: 10px 12px;
+  border-radius: var(--radius-md);
+  cursor: pointer;
+  border: 1px solid transparent;
+  transition:
+    background var(--transition-fast),
+    border-color var(--transition-fast);
+}
+.quick-switch-item:hover {
+  background: var(--bg-hover);
+  border-color: var(--border-glow, transparent);
+}
+.quick-switch-item.current {
+  background: var(--bg-active);
+  border-color: var(--border-glow, var(--border));
+  cursor: default;
+}
+.quick-switch-item.add-new {
+  border-style: dashed;
+  border-color: var(--border);
+  color: var(--accent-primary, var(--accent));
 }
-.quick-switch-item:hover { background: var(--bg-hover); border-color: var(--border-glow, transparent); }
-.quick-switch-item.current { background: var(--bg-active); border-color: var(--border-glow, var(--border)); cursor: default; }
-.quick-switch-item.add-new { border-style: dashed; border-color: var(--border); color: var(--accent-primary, var(--accent)); }
 .quick-switch-icon {
-  width: 36px; height: 36px; border-radius: var(--radius-md);
-  background: var(--bg-secondary); display: flex; align-items: center; justify-content: center;
-  font-weight: 700; font-size: 14px; color: var(--text-muted); flex-shrink: 0;
+  width: 36px;
+  height: 36px;
+  border-radius: var(--radius-md);
+  background: var(--bg-secondary);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-weight: 700;
+  font-size: 14px;
+  color: var(--text-muted);
+  flex-shrink: 0;
+}
+.quick-switch-item.current .quick-switch-icon {
+  background: var(--accent-gradient, var(--accent));
+  color: white;
+}
+.quick-switch-item.add-new .quick-switch-icon {
+  background: transparent;
+  font-size: 20px;
+  color: inherit;
+}
+.quick-switch-info {
+  flex: 1;
+  min-width: 0;
+}
+.quick-switch-name {
+  font-size: 13px;
+  font-weight: 600;
+  color: var(--text-normal);
+}
+.quick-switch-host {
+  font-size: 10px;
+  color: var(--text-micro);
+}
+.quick-switch-connected-dot {
+  width: 8px;
+  height: 8px;
+  border-radius: 50%;
+  background: var(--green);
+  flex-shrink: 0;
+}
+.quick-switch-footer {
+  padding: 12px;
+  text-align: center;
+  font-size: 12px;
+  color: var(--text-micro);
+}
+
+/* ── Channel feature flags ── */
+
+/* Age-restriction marker on a channel row. Sits beside the name rather than
+   replacing the "#" glyph, so the row still reads as a channel; the unread and
+   mention states already own the row's colour, so this stays neutral. */
+.channel-item .ch-nsfw {
+  display: inline-flex;
+  align-items: center;
+  color: var(--text-faint);
+  flex-shrink: 0;
+}
+.channel-item.unread .ch-nsfw,
+.channel-item.active .ch-nsfw {
+  color: var(--text-muted);
+}
+
+/* "3/5" on a voice channel that has a user limit. Pushed to the right edge
+   like the unread badge; a readout only — the server owns capacity. */
+.channel-item .ch-capacity {
+  margin-left: auto;
+  font-size: 10px;
+  font-weight: 600;
+  color: var(--text-micro);
+  flex-shrink: 0;
+}
+
+/* Entry point to the admin panel's audit log. Deliberately quieter than the
+   Invite button beside it: it leaves the app for the browser. */
+.sidebar-audit-btn {
+  margin-left: 6px;
+  padding: 4px 10px;
+  border-radius: var(--radius-sm);
+  background: transparent;
+  border: 1px solid var(--border-strong, var(--border));
+  color: var(--text-muted);
+  font-size: 11px;
+  font-weight: 600;
+  cursor: pointer;
+  transition:
+    color var(--transition-fast),
+    border-color var(--transition-fast);
+  flex-shrink: 0;
+}
+.sidebar-audit-btn:hover {
+  color: var(--text-normal);
+  border-color: var(--accent);
+}
+
+/* ── NSFW age gate ── */
+
+/* Covers the message area of a flagged channel until the reader accepts. Not a
+   modal: the channel is mounted and live underneath, and the sidebar and header
+   stay usable, so declining is a normal navigation rather than a trap. */
+.nsfw-gate {
+  position: absolute;
+  inset: 0;
+  z-index: 5;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 24px;
+  background: var(--bg-primary);
+}
+.nsfw-gate-card {
+  max-width: 420px;
+  text-align: center;
+}
+.nsfw-gate-icon {
+  color: var(--red);
+  margin-bottom: 12px;
+  display: flex;
+  justify-content: center;
+}
+.nsfw-gate-title {
+  font-size: 18px;
+  font-weight: 700;
+  color: var(--text-normal);
+  margin-bottom: 8px;
+}
+.nsfw-gate-body {
+  font-size: 14px;
+  line-height: 1.6;
+  color: var(--text-muted);
+  margin-bottom: 8px;
+}
+.nsfw-gate-note {
+  font-size: 12px;
+  line-height: 1.5;
+  color: var(--text-faint);
+  margin-bottom: 20px;
+}
+.nsfw-gate-actions {
+  display: flex;
+  gap: 8px;
+  justify-content: center;
+}
+
+/* ── Phase 6: avatars, display names, custom status ── */
+
+/*
+ * Every avatar surface (message row, reply preview, member list, user bar,
+ * profile popup, account card) is a fixed-size circle that until now held a
+ * single letter. An uploaded picture has to fill that same circle exactly,
+ * whatever the source aspect ratio, so it is cover-cropped rather than
+ * letterboxed — the server refuses anything over 1024px but does not force a
+ * square, and a stretched face is worse than a centred crop.
+ */
+.avatar-img {
+  width: 100%;
+  height: 100%;
+  object-fit: cover;
+  border-radius: inherit;
+  display: block;
+}
+
+/* The member row grew a second line, so the name column stacks. */
+.member-item .mi-text {
+  display: flex;
+  flex-direction: column;
+  min-width: 0;
+  overflow: hidden;
+}
+.member-item .mi-custom-status {
+  font-size: 12px;
+  color: var(--text-muted);
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+/* Profile popup: the @handle under a display name, and the status line. */
+.upp-username-handle {
+  font-size: 13px;
+  color: var(--text-muted);
+  margin-top: -2px;
+}
+.upp-username-handle:empty,
+.upp-custom-status:empty {
+  display: none;
+}
+.upp-custom-status {
+  font-size: 13px;
+  color: var(--text-secondary, var(--text-muted));
+  margin: 4px 0;
+  overflow-wrap: anywhere;
+}
+
+/* Status picker: the custom-status input sits below the four options. */
+.status-picker-divider {
+  height: 1px;
+  background: var(--border);
+  margin: 4px 0;
+}
+.status-picker-custom {
+  padding: 6px 8px;
+}
+.status-picker-custom-input {
+  width: 100%;
+  box-sizing: border-box;
+  background: var(--bg-input, var(--bg-active));
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm, 4px);
+  color: var(--text-primary);
+  font-size: 13px;
+  padding: 6px 8px;
+}
+.status-picker-custom-input:focus {
+  outline: none;
+  border-color: var(--accent);
+}
+
+/* Account tab: the avatar uploader sits under the profile card. */
+.account-avatar-upload {
+  margin: 12px 0 4px;
+}
+
+/* ── Group DMs ─────────────────────────────────────────────────────────── */
+
+/* Two overlapping faces instead of one avatar. The stack is the same size as
+   a single avatar so a mixed list of 1:1 and group rows stays on one grid. */
+.dm-avatar-stack {
+  position: relative;
+  background: transparent !important;
+}
+.dm-avatar-stack .dm-avatar-face {
+  position: absolute;
+  border-radius: 50%;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: 0.65rem;
+  color: white;
+  overflow: hidden;
+  border: 2px solid var(--bg-secondary);
+}
+.dm-avatar-stack .dm-avatar-face-0 {
+  width: 68%;
+  height: 68%;
+  top: 0;
+  left: 0;
+}
+.dm-avatar-stack .dm-avatar-face-1 {
+  width: 68%;
+  height: 68%;
+  bottom: 0;
+  right: 0;
+}
+
+.dm-member-count {
+  margin-left: auto;
+  font-size: 0.7rem;
+  color: var(--text-micro);
+  padding: 0 4px;
+}
+
+.dm-member-picker-item.selected {
+  background: var(--bg-active);
+}
+.dm-member-picker-item.selected::after {
+  content: "\2713";
+  margin-left: 6px;
+  color: var(--green);
+}
+
+/* ── Muted channels ────────────────────────────────────────────────────── */
+
+/* A mute dims, it does not hide: the conversation is still there, it has just
+   stopped asking for attention. The mention badge is deliberately untouched. */
+.channel-item.muted .ch-name,
+.dm-item.muted .dm-name {
+  opacity: 0.45;
+}
+.unread-badge.muted,
+.dm-unread-badge.muted {
+  background: var(--text-micro) !important;
+  opacity: 0.7;
+}
+
+.settings-muted-list {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+  margin-top: 8px;
+}
+.settings-muted-row {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 6px 8px;
+  border-radius: var(--radius-sm);
+  background: var(--bg-tertiary);
+}
+.settings-muted-row .settings-muted-name {
+  flex: 1;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+/* ── Incoming call banner ──────────────────────────────────────────────── */
+
+/* A banner, not a modal: a ring is an offer, and blocking the whole app until
+   a 30-second timer expires is not an offer. */
+.incoming-call-banner {
+  position: fixed;
+  top: 16px;
+  left: 50%;
+  transform: translateX(-50%);
+  z-index: 1200;
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  padding: 12px 16px;
+  border-radius: var(--radius-md, 8px);
+  background: var(--bg-floating, var(--bg-secondary));
+  border: 1px solid var(--border, rgba(255, 255, 255, 0.1));
+  box-shadow: 0 8px 24px rgb(0 0 0 / 40%);
+  max-width: min(92vw, 460px);
+}
+.incoming-call-icon {
+  display: flex;
+  align-items: center;
+  color: var(--green);
+}
+.incoming-call-info {
+  flex: 1;
+  min-width: 0;
+}
+.incoming-call-title {
+  font-weight: 600;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.incoming-call-subtitle {
+  font-size: 0.75rem;
+  color: var(--text-muted);
+}
+.incoming-call-actions {
+  display: flex;
+  gap: 8px;
+  flex-shrink: 0;
+}
+
+.call-btn {
+  background: none;
+  border: none;
+  color: var(--text-muted);
+  cursor: pointer;
+  display: flex;
+  align-items: center;
+  padding: 4px;
+}
+.call-btn:hover {
+  color: var(--green);
 }
-.quick-switch-item.current .quick-switch-icon { background: var(--accent-gradient, var(--accent)); color: white; }
-.quick-switch-item.add-new .quick-switch-icon { background: transparent; font-size: 20px; color: inherit; }
-.quick-switch-info { flex: 1; min-width: 0; }
-.quick-switch-name { font-size: 13px; font-weight: 600; color: var(--text-normal); }
-.quick-switch-host { font-size: 10px; color: var(--text-micro); }
-.quick-switch-connected-dot { width: 8px; height: 8px; border-radius: 50%; background: var(--green); flex-shrink: 0; }
-.quick-switch-footer { padding: 12px; text-align: center; font-size: 12px; color: var(--text-micro); }
diff --git a/Client/tauri-client/src/styles/login.css b/Client/tauri-client/src/styles/login.css
index 8128a3a8..c71c40ea 100644
--- a/Client/tauri-client/src/styles/login.css
+++ b/Client/tauri-client/src/styles/login.css
@@ -2,130 +2,256 @@
 
 /* ═══ Page layout ═══ */
 .connect-page {
-  display: flex; height: 100vh; position: relative; overflow: hidden;
+  display: flex;
+  height: 100vh;
+  position: relative;
+  overflow: hidden;
 }
 
 /* ═══ Animated background ═══ */
 .connect-page::before {
-  content: ''; position: absolute; inset: 0;
+  content: "";
+  position: absolute;
+  inset: 0;
   background:
-    radial-gradient(ellipse 600px 400px at 15% 80%, rgba(88,101,242,.08) 0%, transparent 70%),
-    radial-gradient(ellipse 500px 350px at 85% 20%, rgba(88,101,242,.06) 0%, transparent 70%),
-    radial-gradient(ellipse 300px 300px at 50% 50%, rgba(35,165,90,.04) 0%, transparent 70%);
-  pointer-events: none; z-index: 0;
+    radial-gradient(ellipse 600px 400px at 15% 80%, rgba(88, 101, 242, 0.08) 0%, transparent 70%),
+    radial-gradient(ellipse 500px 350px at 85% 20%, rgba(88, 101, 242, 0.06) 0%, transparent 70%),
+    radial-gradient(ellipse 300px 300px at 50% 50%, rgba(35, 165, 90, 0.04) 0%, transparent 70%);
+  pointer-events: none;
+  z-index: 0;
   animation: bgShift 20s ease-in-out infinite alternate;
 }
 
 /* ═══ Settings gear (top-right) ═══ */
 .settings-gear {
-  position: absolute; top: 16px; right: 16px; z-index: 10;
-  width: 36px; height: 36px; border-radius: var(--radius-md);
-  background: transparent; color: var(--text-faint);
-  display: flex; align-items: center; justify-content: center;
-  transition: all .2s;
+  position: absolute;
+  top: 16px;
+  right: 16px;
+  z-index: 10;
+  width: 36px;
+  height: 36px;
+  border-radius: var(--radius-md);
+  background: transparent;
+  color: var(--text-faint);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  transition: all 0.2s;
+}
+.settings-gear:hover {
+  background: var(--bg-hover);
+  color: var(--text-normal);
+  transform: rotate(30deg);
+}
+.settings-gear svg {
+  width: 20px;
+  height: 20px;
 }
-.settings-gear:hover { background: var(--bg-hover); color: var(--text-normal); transform: rotate(30deg); }
-.settings-gear svg { width: 20px; height: 20px; }
 
 /* ═══════════════════════════════════════════
    LEFT PANEL — Saved Server Profiles
    ═══════════════════════════════════════════ */
 .server-panel {
-  width: 320px; background: linear-gradient(160deg, #1a1a2e 0%, #0f3460 50%, #16213e 100%);
-  display: flex; flex-direction: column; flex-shrink: 0;
-  z-index: 1; position: relative; overflow: hidden;
+  width: 320px;
+  background: linear-gradient(160deg, #1a1a2e 0%, #0f3460 50%, #16213e 100%);
+  display: flex;
+  flex-direction: column;
+  flex-shrink: 0;
+  z-index: 1;
+  position: relative;
+  overflow: hidden;
   animation: slideInLeft 0.5s ease-out;
 }
 .server-panel::before {
-  content: ''; position: absolute; inset: 0; pointer-events: none;
+  content: "";
+  position: absolute;
+  inset: 0;
+  pointer-events: none;
   background:
-    radial-gradient(ellipse 200px 200px at 30% 20%, rgba(139,92,246,.12) 0%, transparent 70%),
-    radial-gradient(ellipse 150px 150px at 70% 80%, rgba(35,165,90,.06) 0%, transparent 70%);
+    radial-gradient(ellipse 200px 200px at 30% 20%, rgba(139, 92, 246, 0.12) 0%, transparent 70%),
+    radial-gradient(ellipse 150px 150px at 70% 80%, rgba(35, 165, 90, 0.06) 0%, transparent 70%);
   animation: bgShift 20s ease-in-out infinite alternate;
 }
 .server-panel-header {
   padding: 16px 20px 12px;
-  border-bottom: 1px solid rgba(255,255,255,.06);
+  border-bottom: 1px solid rgba(255, 255, 255, 0.06);
   flex-shrink: 0;
-  display: flex; align-items: center; justify-content: space-between;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
 }
 .server-panel-header h2 {
-  font-size: 11px; font-weight: 700; color: rgba(255,255,255,.3);
-  letter-spacing: .05em; text-transform: uppercase;
+  font-size: 11px;
+  font-weight: 700;
+  color: rgba(255, 255, 255, 0.3);
+  letter-spacing: 0.05em;
+  text-transform: uppercase;
 }
 /* OC Branding */
 .server-branding {
-  padding: 24px 20px 20px; text-align: center;
-  position: relative; z-index: 1;
+  padding: 24px 20px 20px;
+  text-align: center;
+  position: relative;
+  z-index: 1;
+}
+.oc-logo {
+  display: block;
+  margin: 0 auto 8px;
+}
+.oc-glow-layer {
+  animation: glowPulse 4s ease-in-out infinite;
+}
+.brand-name {
+  font-size: 20px;
+  font-weight: 700;
+  color: white;
+  margin-bottom: 4px;
+}
+.brand-tagline {
+  font-size: 12px;
+  color: rgba(255, 255, 255, 0.45);
+  line-height: 1.4;
 }
-.oc-logo { display: block; margin: 0 auto 8px; }
-.oc-glow-layer { animation: glowPulse 4s ease-in-out infinite; }
-.brand-name { font-size: 20px; font-weight: 700; color: white; margin-bottom: 4px; }
-.brand-tagline { font-size: 12px; color: rgba(255,255,255,.45); line-height: 1.4; }
 
-.header-actions { display: flex; gap: 4px; }
+.header-actions {
+  display: flex;
+  gap: 4px;
+}
 .header-btn {
-  width: 28px; height: 28px; border-radius: var(--radius-sm);
-  background: transparent; color: rgba(255,255,255,.3);
-  display: flex; align-items: center; justify-content: center;
-  transition: all .15s; font-size: 14px;
+  width: 28px;
+  height: 28px;
+  border-radius: var(--radius-sm);
+  background: transparent;
+  color: rgba(255, 255, 255, 0.3);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  transition: all 0.15s;
+  font-size: 14px;
+}
+.header-btn:hover {
+  background: var(--bg-hover);
+  color: rgba(255, 255, 255, 0.7);
+}
+.header-btn svg {
+  width: 14px;
+  height: 14px;
 }
-.header-btn:hover { background: var(--bg-hover); color: rgba(255,255,255,.7); }
-.header-btn svg { width: 14px; height: 14px; }
 
 /* Server list */
-.server-list { flex: 1; overflow-y: auto; padding: 8px; }
+.server-list {
+  flex: 1;
+  overflow-y: auto;
+  padding: 8px;
+}
 .server-item {
-  display: flex; align-items: center; gap: 8px;
-  border-left: 3px solid transparent; border-radius: 0 8px 8px 0;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  border-left: 3px solid transparent;
+  border-radius: 0 8px 8px 0;
   padding: 8px 10px;
-  cursor: pointer; transition: background .15s;
+  cursor: pointer;
+  transition: background 0.15s;
   position: relative;
-  opacity: 0; animation: slideInLeft 0.4s ease-out forwards;
+  opacity: 0;
+  animation: slideInLeft 0.4s ease-out forwards;
+}
+.server-item:nth-child(1) {
+  animation-delay: 0.3s;
+}
+.server-item:nth-child(2) {
+  animation-delay: 0.4s;
+}
+.server-item:nth-child(3) {
+  animation-delay: 0.5s;
+}
+.server-item:nth-child(4) {
+  animation-delay: 0.6s;
+}
+.server-item:nth-child(5) {
+  animation-delay: 0.7s;
+}
+.server-item:hover {
+  background: rgba(255, 255, 255, 0.04);
+}
+.server-item.active {
+  background: rgba(139, 92, 246, 0.15);
+  border-left-color: #8b5cf6;
 }
-.server-item:nth-child(1) { animation-delay: 0.3s; }
-.server-item:nth-child(2) { animation-delay: 0.4s; }
-.server-item:nth-child(3) { animation-delay: 0.5s; }
-.server-item:nth-child(4) { animation-delay: 0.6s; }
-.server-item:nth-child(5) { animation-delay: 0.7s; }
-.server-item:hover { background: rgba(255,255,255,.04); }
-.server-item.active { background: rgba(139,92,246,.15); border-left-color: #8b5cf6; }
 .server-item .srv-icon {
-  width: 28px; height: 28px; border-radius: 6px;
-  display: flex; align-items: center; justify-content: center;
-  font-weight: 700; font-size: 12px; color: white;
-  flex-shrink: 0; transition: border-radius .2s;
+  width: 28px;
+  height: 28px;
+  border-radius: 6px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-weight: 700;
+  font-size: 12px;
+  color: white;
+  flex-shrink: 0;
+  transition: border-radius 0.2s;
   position: relative;
 }
 .server-item:hover .srv-icon,
-.server-item.active .srv-icon { border-radius: 10px; }
-.server-item .srv-info { flex: 1; min-width: 0; }
+.server-item.active .srv-icon {
+  border-radius: 10px;
+}
+.server-item .srv-info {
+  flex: 1;
+  min-width: 0;
+}
 .server-item .srv-name {
-  font-size: 12px; font-weight: 600; color: rgba(255,255,255,.6);
-  white-space: nowrap; overflow: hidden; text-overflow: ellipsis;
+  font-size: 12px;
+  font-weight: 600;
+  color: rgba(255, 255, 255, 0.6);
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+.server-item.active .srv-name {
+  color: white;
 }
-.server-item.active .srv-name { color: white; }
 .server-item .srv-meta {
-  display: flex; align-items: center; gap: 6px; margin-top: 2px;
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  margin-top: 2px;
 }
 .server-item .srv-host {
-  font-size: 10px; color: rgba(255,255,255,.3);
-  white-space: nowrap; overflow: hidden; text-overflow: ellipsis;
+  font-size: 10px;
+  color: rgba(255, 255, 255, 0.3);
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
 }
 .server-item .srv-last {
-  font-size: 10px; color: var(--text-micro);
+  font-size: 10px;
+  color: var(--text-micro);
   white-space: nowrap;
 }
 
 /* Status dot on icon */
 .srv-status-dot {
-  width: 10px; height: 10px; border-radius: 50%;
-  margin-left: auto; flex-shrink: 0; position: static;
+  width: 10px;
+  height: 10px;
+  border-radius: 50%;
+  margin-left: auto;
+  flex-shrink: 0;
+  position: static;
+}
+.srv-status-dot.online {
+  background: var(--green);
+}
+.srv-status-dot.slow {
+  background: var(--yellow);
+}
+.srv-status-dot.offline {
+  background: var(--red);
+}
+.srv-status-dot.unknown {
+  background: var(--text-micro);
 }
-.srv-status-dot.online { background: var(--green); }
-.srv-status-dot.slow { background: var(--yellow); }
-.srv-status-dot.offline { background: var(--red); }
-.srv-status-dot.unknown { background: var(--text-micro); }
 .srv-status-dot.checking {
   background: var(--text-micro);
   animation: pulse 1s ease-in-out infinite;
@@ -133,94 +259,198 @@
 
 /* Status text labels */
 .srv-status-text {
-  font-size: 9px; font-weight: 600; margin-left: auto; flex-shrink: 0;
+  font-size: 9px;
+  font-weight: 600;
+  margin-left: auto;
+  flex-shrink: 0;
   text-transform: uppercase;
 }
-.srv-status-text.online { color: var(--green); }
-.srv-status-text.offline { color: var(--red); }
-.srv-status-text.unknown { color: var(--text-micro); }
+.srv-status-text.online {
+  color: var(--green);
+}
+.srv-status-text.offline {
+  color: var(--red);
+}
+.srv-status-text.unknown {
+  color: var(--text-micro);
+}
 
 /* Latency badge */
 .srv-latency {
-  font-size: 10px; color: var(--text-micro); font-family: var(--font-mono);
+  font-size: 10px;
+  color: var(--text-micro);
+  font-family: var(--font-mono);
   white-space: nowrap;
 }
-.srv-latency.good { color: var(--green); }
-.srv-latency.warn { color: var(--yellow); }
-.srv-latency.bad { color: var(--red); }
+.srv-latency.good {
+  color: var(--green);
+}
+.srv-latency.warn {
+  color: var(--yellow);
+}
+.srv-latency.bad {
+  color: var(--red);
+}
 
 /* Action buttons on server item */
 .srv-actions {
-  display: flex; gap: 2px; opacity: 0; transition: opacity .15s; flex-shrink: 0;
+  display: flex;
+  gap: 2px;
+  opacity: 0;
+  transition: opacity 0.15s;
+  flex-shrink: 0;
+}
+.server-item:hover .srv-actions {
+  opacity: 1;
+}
+.srv-actions:has(.auto-login.active) {
+  opacity: 1;
 }
-.server-item:hover .srv-actions { opacity: 1; }
-.srv-actions:has(.auto-login.active) { opacity: 1; }
 .srv-btn {
-  width: 26px; height: 26px; border-radius: var(--radius-sm);
-  background: transparent; color: var(--text-faint);
-  display: flex; align-items: center; justify-content: center;
-  font-size: 13px; transition: all .15s;
+  width: 26px;
+  height: 26px;
+  border-radius: var(--radius-sm);
+  background: transparent;
+  color: var(--text-faint);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: 13px;
+  transition: all 0.15s;
+}
+.srv-btn:hover {
+  background: var(--bg-active);
+  color: var(--text-normal);
+}
+.srv-btn.danger:hover {
+  background: var(--red);
+  color: white;
+}
+.srv-btn.auto-login {
+  color: var(--text-micro);
+}
+.srv-btn.auto-login.active {
+  color: var(--accent);
+  opacity: 1;
+}
+.srv-btn.auto-login:hover {
+  color: var(--accent);
 }
-.srv-btn:hover { background: var(--bg-active); color: var(--text-normal); }
-.srv-btn.danger:hover { background: var(--red); color: white; }
-.srv-btn.auto-login { color: var(--text-micro); }
-.srv-btn.auto-login.active { color: var(--accent); opacity: 1; }
-.srv-btn.auto-login:hover { color: var(--accent); }
 
 /* Online users count */
 .srv-online-users {
-  font-size: 10px; color: var(--text-micro); white-space: nowrap;
+  font-size: 10px;
+  color: var(--text-micro);
+  white-space: nowrap;
+}
+.srv-online-users.has-users {
+  color: var(--green);
 }
-.srv-online-users.has-users { color: var(--green); }
 
 /* Auto-connect indicator */
-.srv-auto { font-size: 10px; color: var(--accent); margin-left: 4px; }
+.srv-auto {
+  font-size: 10px;
+  color: var(--accent);
+  margin-left: 4px;
+}
 
 /* Empty state */
 .server-empty {
-  flex: 1; display: flex; flex-direction: column;
-  align-items: center; justify-content: center; gap: 8px;
+  flex: 1;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  gap: 8px;
   padding: 40px;
 }
 .server-empty-icon {
-  width: 64px; height: 64px; border-radius: 16px;
-  background: var(--bg-hover); display: flex;
-  align-items: center; justify-content: center;
+  width: 64px;
+  height: 64px;
+  border-radius: 16px;
+  background: var(--bg-hover);
+  display: flex;
+  align-items: center;
+  justify-content: center;
   margin-bottom: 8px;
 }
-.server-empty-icon svg { width: 28px; height: 28px; color: var(--text-micro); }
-.server-empty h3 { font-size: 16px; color: var(--text-faint); font-weight: 600; }
-.server-empty p { font-size: 13px; color: var(--text-micro); text-align: center; line-height: 1.5; }
+.server-empty-icon svg {
+  width: 28px;
+  height: 28px;
+  color: var(--text-micro);
+}
+.server-empty h3 {
+  font-size: 16px;
+  color: var(--text-faint);
+  font-weight: 600;
+}
+.server-empty p {
+  font-size: 13px;
+  color: var(--text-micro);
+  text-align: center;
+  line-height: 1.5;
+}
 
 /* Footer */
 .server-panel-footer {
-  padding: 10px 12px; border-top: 1px solid rgba(255,255,255,.06); flex-shrink: 0;
-  display: flex; gap: 6px;
+  padding: 10px 12px;
+  border-top: 1px solid rgba(255, 255, 255, 0.06);
+  flex-shrink: 0;
+  display: flex;
+  gap: 6px;
 }
 .btn-add-server {
-  flex: 1; padding: 8px; border-radius: var(--radius-sm);
-  background: transparent; color: var(--text-muted);
-  font-size: 13px; transition: all .15s;
-  display: flex; align-items: center; justify-content: center; gap: 6px;
+  flex: 1;
+  padding: 8px;
+  border-radius: var(--radius-sm);
+  background: transparent;
+  color: var(--text-muted);
+  font-size: 13px;
+  transition: all 0.15s;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 6px;
+}
+.btn-add-server:hover {
+  background: var(--bg-hover);
+  color: var(--text-normal);
 }
-.btn-add-server:hover { background: var(--bg-hover); color: var(--text-normal); }
 .btn-footer-icon {
-  width: 32px; height: 32px; border-radius: var(--radius-sm);
-  background: transparent; color: var(--text-faint);
-  display: flex; align-items: center; justify-content: center;
-  transition: all .15s; flex-shrink: 0;
+  width: 32px;
+  height: 32px;
+  border-radius: var(--radius-sm);
+  background: transparent;
+  color: var(--text-faint);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  transition: all 0.15s;
+  flex-shrink: 0;
+}
+.btn-footer-icon:hover {
+  background: var(--bg-hover);
+  color: var(--text-normal);
+}
+.btn-footer-icon svg {
+  width: 16px;
+  height: 16px;
 }
-.btn-footer-icon:hover { background: var(--bg-hover); color: var(--text-normal); }
-.btn-footer-icon svg { width: 16px; height: 16px; }
 
 /* Protocol tip */
 .protocol-tip {
-  padding: 6px 20px 10px; font-size: 11px; color: var(--text-micro);
-  text-align: center; line-height: 1.4;
+  padding: 6px 20px 10px;
+  font-size: 11px;
+  color: var(--text-micro);
+  text-align: center;
+  line-height: 1.4;
 }
 .protocol-tip code {
-  font-family: var(--font-mono); font-size: 10px;
-  background: var(--bg-hover); padding: 1px 4px; border-radius: 2px;
+  font-family: var(--font-mono);
+  font-size: 10px;
+  background: var(--bg-hover);
+  padding: 1px 4px;
+  border-radius: 2px;
   color: var(--text-faint);
 }
 
@@ -228,602 +458,1261 @@
    RIGHT PANEL — Login / Register / 2FA form
    ═══════════════════════════════════════════ */
 .form-panel {
-  flex: 1; display: flex; align-items: center; justify-content: center;
-  z-index: 1; position: relative; padding: 40px;
+  flex: 1;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  z-index: 1;
+  position: relative;
+  padding: 40px;
   animation: slideInRight 0.5s ease-out 0.1s both;
 }
 .form-container {
-  width: 100%; max-width: 400px;
-  animation: formSlideIn .5s cubic-bezier(.16,1,.3,1);
+  width: 100%;
+  max-width: 400px;
+  animation: formSlideIn 0.5s cubic-bezier(0.16, 1, 0.3, 1);
 }
 
 /* Logo */
-.form-logo { text-align: center; margin-bottom: 28px; }
+.form-logo {
+  text-align: center;
+  margin-bottom: 28px;
+}
 .form-logo-mark {
-  width: 56px; height: 56px; border-radius: 16px;
-  background: var(--accent); display: inline-flex;
-  align-items: center; justify-content: center;
+  width: 56px;
+  height: 56px;
+  border-radius: 16px;
+  background: var(--accent);
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
   margin-bottom: 12px;
-  box-shadow: 0 8px 32px rgba(88,101,242,.25);
+  box-shadow: 0 8px 32px rgba(88, 101, 242, 0.25);
+}
+.form-logo-mark svg {
+  width: 32px;
+  height: 32px;
 }
-.form-logo-mark svg { width: 32px; height: 32px; }
 .form-logo h1 {
   font-family: var(--font-display);
-  font-size: 28px; font-weight: 700; color: white;
-  letter-spacing: -.01em;
+  font-size: 28px;
+  font-weight: 700;
+  color: white;
+  letter-spacing: -0.01em;
+}
+.form-logo p {
+  font-size: 14px;
+  color: var(--text-muted);
+  margin-top: 4px;
 }
-.form-logo p { font-size: 14px; color: var(--text-muted); margin-top: 4px; }
 
 /* Banners */
 .error-banner {
-  background: rgba(45,18,20,1); border-radius: var(--radius-sm);
-  padding: 12px 14px; margin-bottom: 16px;
-  display: none; align-items: flex-start; gap: 8px;
-  animation: shakeX .4s ease-in-out;
+  background: rgba(45, 18, 20, 1);
+  border-radius: var(--radius-sm);
+  padding: 12px 14px;
+  margin-bottom: 16px;
+  display: none;
+  align-items: flex-start;
+  gap: 8px;
+  animation: shakeX 0.4s ease-in-out;
+}
+.error-banner.visible {
+  display: flex;
+}
+.error-banner-icon {
+  color: #f38688;
+  font-size: 16px;
+  flex-shrink: 0;
+  margin-top: 1px;
+}
+.error-banner-text {
+  color: #f38688;
+  font-size: 13px;
+  line-height: 1.4;
 }
-.error-banner.visible { display: flex; }
-.error-banner-icon { color: #f38688; font-size: 16px; flex-shrink: 0; margin-top: 1px; }
-.error-banner-text { color: #f38688; font-size: 13px; line-height: 1.4; }
 .success-banner {
-  background: rgba(35,165,90,.12); border-radius: var(--radius-sm);
-  padding: 12px 14px; margin-bottom: 16px;
-  display: none; align-items: center; gap: 8px;
+  background: rgba(35, 165, 90, 0.12);
+  border-radius: var(--radius-sm);
+  padding: 12px 14px;
+  margin-bottom: 16px;
+  display: none;
+  align-items: center;
+  gap: 8px;
+}
+.success-banner.visible {
+  display: flex;
+}
+.success-banner-icon {
+  color: var(--green);
+  font-size: 16px;
+  flex-shrink: 0;
+}
+.success-banner-text {
+  color: var(--green);
+  font-size: 13px;
 }
-.success-banner.visible { display: flex; }
-.success-banner-icon { color: var(--green); font-size: 16px; flex-shrink: 0; }
-.success-banner-text { color: var(--green); font-size: 13px; }
 
 /* Form fields */
-.form-group { margin-bottom: 16px; }
-.form-group--hidden { display: none; }
-.form-row { display: flex; gap: 12px; }
-.form-row .form-group { flex: 1; }
-.form-row .form-group.port-field { flex: 0 0 100px; }
+.form-group {
+  margin-bottom: 16px;
+}
+.form-group--hidden {
+  display: none;
+}
+.form-row {
+  display: flex;
+  gap: 12px;
+}
+.form-row .form-group {
+  flex: 1;
+}
+.form-row .form-group.port-field {
+  flex: 0 0 100px;
+}
 .form-label {
-  display: block; font-size: 11px; font-weight: 700;
-  color: var(--text-muted); letter-spacing: .02em;
-  text-transform: uppercase; margin-bottom: 6px;
+  display: block;
+  font-size: 11px;
+  font-weight: 700;
+  color: var(--text-muted);
+  letter-spacing: 0.02em;
+  text-transform: uppercase;
+  margin-bottom: 6px;
+}
+.form-label .required {
+  color: var(--red);
+  margin-left: 2px;
 }
-.form-label .required { color: var(--red); margin-left: 2px; }
 .form-input {
-  width: 100%; padding: 12px 14px;
-  background: var(--bg-input); color: var(--text-normal);
-  border: 1px solid var(--border); border-radius: 12px;
-  font-size: 14px; transition: border-color .2s, box-shadow .2s;
+  width: 100%;
+  padding: 12px 14px;
+  background: var(--bg-input);
+  color: var(--text-normal);
+  border: 1px solid var(--border);
+  border-radius: 12px;
+  font-size: 14px;
+  transition:
+    border-color 0.2s,
+    box-shadow 0.2s;
+}
+.form-input::placeholder {
+  color: var(--text-micro);
+}
+.form-input:hover {
+  border-color: var(--border-strong);
+}
+.form-input:focus {
+  border-color: var(--accent);
+  box-shadow: 0 0 0 3px rgba(88, 101, 242, 0.2);
+}
+.form-input.error {
+  border-color: var(--red);
 }
-.form-input::placeholder { color: var(--text-micro); }
-.form-input:hover { border-color: var(--border-strong); }
-.form-input:focus { border-color: var(--accent); box-shadow: 0 0 0 3px rgba(88,101,242,.2); }
-.form-input.error { border-color: var(--red); }
 
 /* Password field */
-.password-wrapper { position: relative; }
-.password-wrapper .form-input { padding-right: 40px; }
+.password-wrapper {
+  position: relative;
+}
+.password-wrapper .form-input {
+  padding-right: 40px;
+}
 .password-toggle {
-  position: absolute; right: 8px; top: 50%; transform: translateY(-50%);
-  background: transparent; color: var(--text-faint); padding: 4px;
-  border-radius: var(--radius-sm); font-size: 16px; transition: color .15s;
+  position: absolute;
+  right: 8px;
+  top: 50%;
+  transform: translateY(-50%);
+  background: transparent;
+  color: var(--text-faint);
+  padding: 4px;
+  border-radius: var(--radius-sm);
+  font-size: 16px;
+  transition: color 0.15s;
+}
+.password-toggle:hover {
+  color: var(--text-normal);
 }
-.password-toggle:hover { color: var(--text-normal); }
 
 /* Checkbox */
 .form-checkbox {
-  display: flex; align-items: center; gap: 8px;
-  cursor: pointer; margin-bottom: 16px; user-select: none;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  cursor: pointer;
+  margin-bottom: 16px;
+  user-select: none;
+}
+.form-checkbox input {
+  display: none;
 }
-.form-checkbox input { display: none; }
 .checkbox-box {
-  width: 18px; height: 18px; border-radius: var(--radius-sm);
-  border: 2px solid var(--border-strong); background: transparent;
-  display: flex; align-items: center; justify-content: center;
-  transition: all .15s; flex-shrink: 0;
+  width: 18px;
+  height: 18px;
+  border-radius: var(--radius-sm);
+  border: 2px solid var(--border-strong);
+  background: transparent;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  transition: all 0.15s;
+  flex-shrink: 0;
+}
+.checkbox-box svg {
+  opacity: 0;
+  transition: opacity 0.15s;
+}
+.form-checkbox:hover .checkbox-box {
+  border-color: var(--accent);
 }
-.checkbox-box svg { opacity: 0; transition: opacity .15s; }
-.form-checkbox:hover .checkbox-box { border-color: var(--accent); }
 .form-checkbox input:checked + .checkbox-box {
-  background: var(--accent); border-color: var(--accent);
+  background: var(--accent);
+  border-color: var(--accent);
+}
+.form-checkbox input:checked + .checkbox-box svg {
+  opacity: 1;
+}
+.checkbox-label {
+  font-size: 13px;
+  color: var(--text-muted);
 }
-.form-checkbox input:checked + .checkbox-box svg { opacity: 1; }
-.checkbox-label { font-size: 13px; color: var(--text-muted); }
 
 /* Remember password */
 .remember-password-group {
-  display: flex; align-items: center; gap: 8px;
-  margin-bottom: 16px; margin-top: -8px;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  margin-bottom: 16px;
+  margin-top: -8px;
 }
 .remember-password-group input[type="checkbox"] {
-  width: 18px; height: 18px; accent-color: var(--accent);
-  cursor: pointer; margin: 0; border-radius: 6px;
+  width: 18px;
+  height: 18px;
+  accent-color: var(--accent);
+  cursor: pointer;
+  margin: 0;
+  border-radius: 6px;
 }
 .remember-password-label {
-  font-size: 13px; color: var(--text-muted);
-  cursor: pointer; user-select: none;
+  font-size: 13px;
+  color: var(--text-muted);
+  cursor: pointer;
+  user-select: none;
 }
 
 /* Primary button */
 .btn-primary {
-  width: 100%; padding: 12px; border-radius: 12px;
+  width: 100%;
+  padding: 12px;
+  border-radius: 12px;
   background: linear-gradient(135deg, #5865f2, #4752c4);
-  color: white; font-size: 15px; font-weight: 600;
-  transition: all .2s; position: relative; overflow: hidden;
-  box-shadow: 0 2px 12px rgba(88,101,242,.3);
+  color: white;
+  font-size: 15px;
+  font-weight: 600;
+  transition: all 0.2s;
+  position: relative;
+  overflow: hidden;
+  box-shadow: 0 2px 12px rgba(88, 101, 242, 0.3);
+}
+.btn-primary:hover {
+  background: linear-gradient(135deg, #6872f5, #5460d9);
+  box-shadow: 0 4px 16px rgba(88, 101, 242, 0.4);
 }
-.btn-primary:hover { background: linear-gradient(135deg, #6872f5, #5460d9); box-shadow: 0 4px 16px rgba(88,101,242,.4); }
 .btn-primary:hover::after {
-  content: ''; position: absolute; inset: 0;
-  background: linear-gradient(110deg, transparent 25%, rgba(255,255,255,.1) 50%, transparent 75%);
+  content: "";
+  position: absolute;
+  inset: 0;
+  background: linear-gradient(
+    110deg,
+    transparent 25%,
+    rgba(255, 255, 255, 0.1) 50%,
+    transparent 75%
+  );
   background-size: 200% 100%;
   animation: shimmer 1.5s infinite;
 }
-.btn-primary:active { background: linear-gradient(135deg, #4752c4, #3b44b0); }
-.btn-primary:disabled { background: var(--border-strong); color: var(--text-faint); cursor: not-allowed; }
-.btn-primary.loading { pointer-events: none; }
-.btn-primary.loading .btn-text { opacity: 0; }
+.btn-primary:active {
+  background: linear-gradient(135deg, #4752c4, #3b44b0);
+}
+.btn-primary:disabled {
+  background: var(--border-strong);
+  color: var(--text-faint);
+  cursor: not-allowed;
+}
+.btn-primary.loading {
+  pointer-events: none;
+}
+.btn-primary.loading .btn-text {
+  opacity: 0;
+}
 .btn-primary .btn-spinner {
-  position: absolute; inset: 0;
-  display: none; align-items: center; justify-content: center;
+  position: absolute;
+  inset: 0;
+  display: none;
+  align-items: center;
+  justify-content: center;
+}
+.btn-primary.loading .btn-spinner {
+  display: flex;
 }
-.btn-primary.loading .btn-spinner { display: flex; }
 .spinner {
-  width: 18px; height: 18px; border: 2px solid rgba(255,255,255,.3);
-  border-top-color: white; border-radius: 50%;
-  animation: spin .6s linear infinite;
+  width: 18px;
+  height: 18px;
+  border: 2px solid rgba(255, 255, 255, 0.3);
+  border-top-color: white;
+  border-radius: 50%;
+  animation: spin 0.6s linear infinite;
 }
 
 /* Mode switch */
-.form-switch { margin-top: 12px; font-size: 13px; color: var(--text-faint); }
-.form-switch a { color: var(--text-link); cursor: pointer; text-decoration: none; }
-.form-switch a:hover { text-decoration: underline; }
+.form-switch {
+  margin-top: 12px;
+  font-size: 13px;
+  color: var(--text-faint);
+}
+.form-switch a {
+  color: var(--text-link);
+  cursor: pointer;
+  text-decoration: none;
+}
+.form-switch a:hover {
+  text-decoration: underline;
+}
 
 /* ═══ TOTP overlay (covers the form panel for 2FA input) ═══ */
 .totp-overlay {
-  position: absolute; inset: 0;
+  position: absolute;
+  inset: 0;
   background: var(--bg-primary);
-  display: flex; align-items: center; justify-content: center;
+  display: flex;
+  align-items: center;
+  justify-content: center;
   z-index: 10;
-  animation: formSlideIn .3s cubic-bezier(.16,1,.3,1);
+  animation: formSlideIn 0.3s cubic-bezier(0.16, 1, 0.3, 1);
+}
+.totp-overlay--hidden {
+  display: none;
 }
-.totp-overlay--hidden { display: none; }
 
 /* ═══ Auto-connect overlay ═══ */
 .auto-connect-overlay {
-  position: absolute; inset: 0;
+  position: absolute;
+  inset: 0;
   background: var(--bg-primary);
-  display: flex; align-items: center; justify-content: center;
+  display: flex;
+  align-items: center;
+  justify-content: center;
   z-index: 10;
-  animation: formSlideIn .3s cubic-bezier(.16,1,.3,1);
+  animation: formSlideIn 0.3s cubic-bezier(0.16, 1, 0.3, 1);
+}
+.auto-connect-overlay--hidden {
+  display: none;
 }
-.auto-connect-overlay--hidden { display: none; }
 .auto-connect-card {
-  text-align: center; padding: 40px;
+  text-align: center;
+  padding: 40px;
 }
 .auto-connect-spinner {
-  margin: 0 auto 20px; width: 48px; height: 48px;
+  margin: 0 auto 20px;
+  width: 48px;
+  height: 48px;
 }
 .auto-connect-spinner .spinner {
-  width: 48px; height: 48px;
+  width: 48px;
+  height: 48px;
   border-width: 3px;
 }
 .auto-connect-title {
-  font-size: 20px; font-weight: 700; color: white; margin-bottom: 8px;
+  font-size: 20px;
+  font-weight: 700;
+  color: white;
+  margin-bottom: 8px;
 }
 .auto-connect-server {
-  display: block; font-size: 14px; color: var(--accent); margin-bottom: 24px;
+  display: block;
+  font-size: 14px;
+  color: var(--accent);
+  margin-bottom: 24px;
 }
 .auto-connect-cancel {
-  font-size: 13px; color: var(--text-faint); cursor: pointer;
-  background: transparent; border: 1px solid var(--border); border-radius: var(--radius-md);
-  padding: 6px 20px; transition: all .15s;
+  font-size: 13px;
+  color: var(--text-faint);
+  cursor: pointer;
+  background: transparent;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-md);
+  padding: 6px 20px;
+  transition: all 0.15s;
+}
+.auto-connect-cancel:hover {
+  color: var(--text-normal);
+  border-color: var(--text-muted);
 }
-.auto-connect-cancel:hover { color: var(--text-normal); border-color: var(--text-muted); }
 
 /* ═══ 2FA / TOTP ═══ */
 .totp-icon {
-  width: 64px; height: 64px; border-radius: 50%;
-  background: var(--accent); display: flex;
-  align-items: center; justify-content: center;
-  margin: 0 auto 20px; box-shadow: 0 8px 32px rgba(88,101,242,.25);
+  width: 64px;
+  height: 64px;
+  border-radius: 50%;
+  background: var(--accent);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  margin: 0 auto 20px;
+  box-shadow: 0 8px 32px rgba(88, 101, 242, 0.25);
+}
+.totp-icon svg {
+  width: 32px;
+  height: 32px;
+  color: white;
+}
+.totp-title {
+  text-align: center;
+  font-size: 22px;
+  font-weight: 700;
+  color: white;
+  margin-bottom: 6px;
+}
+.totp-subtitle {
+  text-align: center;
+  font-size: 14px;
+  color: var(--text-muted);
+  margin-bottom: 24px;
+  line-height: 1.5;
 }
-.totp-icon svg { width: 32px; height: 32px; color: white; }
-.totp-title { text-align: center; font-size: 22px; font-weight: 700; color: white; margin-bottom: 6px; }
-.totp-subtitle { text-align: center; font-size: 14px; color: var(--text-muted); margin-bottom: 24px; line-height: 1.5; }
 .totp-inputs {
-  display: flex; gap: 8px; justify-content: center; margin-bottom: 24px;
+  display: flex;
+  gap: 8px;
+  justify-content: center;
+  margin-bottom: 24px;
 }
 .totp-digit {
-  width: 48px; height: 56px; border-radius: var(--radius-md);
-  background: var(--bg-input); border: 2px solid var(--border);
-  color: white; font-size: 24px; font-weight: 700;
-  text-align: center; transition: border-color .2s;
+  width: 48px;
+  height: 56px;
+  border-radius: var(--radius-md);
+  background: var(--bg-input);
+  border: 2px solid var(--border);
+  color: white;
+  font-size: 24px;
+  font-weight: 700;
+  text-align: center;
+  transition: border-color 0.2s;
   font-family: var(--font-mono);
 }
-.totp-digit:focus { border-color: var(--accent); }
-.totp-digit.filled { border-color: var(--accent); }
+.totp-digit:focus {
+  border-color: var(--accent);
+}
+.totp-digit.filled {
+  border-color: var(--accent);
+}
 .totp-back {
-  display: block; text-align: center; margin-top: 16px;
-  font-size: 13px; color: var(--text-faint); cursor: pointer;
+  display: block;
+  text-align: center;
+  margin-top: 16px;
+  font-size: 13px;
+  color: var(--text-faint);
+  cursor: pointer;
+}
+.totp-back:hover {
+  color: var(--text-link);
 }
-.totp-back:hover { color: var(--text-link); }
 .totp-backup-link {
-  display: block; text-align: center; margin-top: 8px;
-  font-size: 12px; color: var(--text-micro); cursor: pointer;
+  display: block;
+  text-align: center;
+  margin-top: 8px;
+  font-size: 12px;
+  color: var(--text-micro);
+  cursor: pointer;
+}
+.totp-backup-link:hover {
+  color: var(--text-link);
+  text-decoration: underline;
 }
-.totp-backup-link:hover { color: var(--text-link); text-decoration: underline; }
 
 /* ═══════════════════════════════════════════
    MODALS (shared)
    ═══════════════════════════════════════════ */
 .modal-overlay {
-  position: fixed; inset: 0; background: var(--bg-overlay);
-  display: none; align-items: center; justify-content: center;
+  position: fixed;
+  inset: 0;
+  background: var(--bg-overlay);
+  display: none;
+  align-items: center;
+  justify-content: center;
   z-index: 100;
 }
-.modal-overlay.visible { display: flex; }
+.modal-overlay.visible {
+  display: flex;
+}
 .modal {
-  background: var(--bg-primary); border-radius: var(--radius-md);
-  width: 440px; max-height: 80vh; overflow-y: auto;
-  box-shadow: 0 8px 48px rgba(0,0,0,.5);
-  animation: modalSlideIn .3s cubic-bezier(.16,1,.3,1);
+  background: var(--bg-primary);
+  border-radius: var(--radius-md);
+  width: 440px;
+  max-height: 80vh;
+  overflow-y: auto;
+  box-shadow: 0 8px 48px rgba(0, 0, 0, 0.5);
+  animation: modalSlideIn 0.3s cubic-bezier(0.16, 1, 0.3, 1);
 }
 .modal-header {
-  padding: 20px 24px 0; display: flex;
-  align-items: center; justify-content: space-between;
+  padding: 20px 24px 0;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+}
+.modal-header h3 {
+  font-size: 18px;
+  font-weight: 700;
+  color: white;
 }
-.modal-header h3 { font-size: 18px; font-weight: 700; color: white; }
 .modal-close {
-  background: transparent; color: var(--text-faint);
-  font-size: 20px; padding: 4px; border-radius: var(--radius-sm);
-  transition: color .15s;
+  background: transparent;
+  color: var(--text-faint);
+  font-size: 20px;
+  padding: 4px;
+  border-radius: var(--radius-sm);
+  transition: color 0.15s;
+}
+.modal-close:hover {
+  color: var(--text-normal);
+}
+.modal-body {
+  padding: 20px 24px;
 }
-.modal-close:hover { color: var(--text-normal); }
-.modal-body { padding: 20px 24px; }
 .modal-footer {
-  padding: 16px 24px; background: var(--bg-secondary);
+  padding: 16px 24px;
+  background: var(--bg-secondary);
   border-radius: 0 0 var(--radius-md) var(--radius-md);
-  display: flex; justify-content: flex-end; gap: 8px;
+  display: flex;
+  justify-content: flex-end;
+  gap: 8px;
 }
 .btn-cancel {
-  padding: 8px 16px; border-radius: var(--radius-sm);
-  background: transparent; color: var(--text-muted);
-  font-size: 13px; transition: all .15s;
+  padding: 8px 16px;
+  border-radius: var(--radius-sm);
+  background: transparent;
+  color: var(--text-muted);
+  font-size: 13px;
+  transition: all 0.15s;
+}
+.btn-cancel:hover {
+  color: var(--text-normal);
+  text-decoration: underline;
 }
-.btn-cancel:hover { color: var(--text-normal); text-decoration: underline; }
 .btn-modal-save {
-  padding: 8px 20px; border-radius: var(--radius-sm);
-  background: var(--accent); color: white;
-  font-size: 13px; font-weight: 600; transition: background .15s;
+  padding: 8px 20px;
+  border-radius: var(--radius-sm);
+  background: var(--accent);
+  color: white;
+  font-size: 13px;
+  font-weight: 600;
+  transition: background 0.15s;
+}
+.btn-modal-save:hover {
+  background: var(--accent-hover);
+}
+.modal-danger-text {
+  font-size: 14px;
+  color: var(--text-muted);
+  line-height: 1.6;
+  margin-bottom: 8px;
+}
+.modal-danger-text strong {
+  color: white;
 }
-.btn-modal-save:hover { background: var(--accent-hover); }
-.modal-danger-text { font-size: 14px; color: var(--text-muted); line-height: 1.6; margin-bottom: 8px; }
-.modal-danger-text strong { color: white; }
 .btn-danger {
-  padding: 8px 20px; border-radius: var(--radius-sm);
-  background: var(--red); color: white;
-  font-size: 13px; font-weight: 600; transition: background .15s;
+  padding: 8px 20px;
+  border-radius: var(--radius-sm);
+  background: var(--red);
+  color: white;
+  font-size: 13px;
+  font-weight: 600;
+  transition: background 0.15s;
+}
+.btn-danger:hover {
+  background: #d83135;
 }
-.btn-danger:hover { background: #d83135; }
 
 /* ═══════════════════════════════════════════
    CERTIFICATE TRUST DIALOG
    ═══════════════════════════════════════════ */
 .cert-warning {
-  width: 64px; height: 64px; border-radius: 50%;
-  background: rgba(240,178,50,.12); display: flex;
-  align-items: center; justify-content: center;
+  width: 64px;
+  height: 64px;
+  border-radius: 50%;
+  background: rgba(240, 178, 50, 0.12);
+  display: flex;
+  align-items: center;
+  justify-content: center;
   margin: 0 auto 16px;
 }
-.cert-warning svg { width: 32px; height: 32px; color: var(--yellow); }
-.cert-title { text-align: center; font-size: 18px; font-weight: 700; color: white; margin-bottom: 8px; }
-.cert-desc { text-align: center; font-size: 13px; color: var(--text-muted); margin-bottom: 20px; line-height: 1.5; }
+.cert-warning svg {
+  width: 32px;
+  height: 32px;
+  color: var(--yellow);
+}
+.cert-title {
+  text-align: center;
+  font-size: 18px;
+  font-weight: 700;
+  color: white;
+  margin-bottom: 8px;
+}
+.cert-desc {
+  text-align: center;
+  font-size: 13px;
+  color: var(--text-muted);
+  margin-bottom: 20px;
+  line-height: 1.5;
+}
 .cert-details {
-  background: var(--bg-tertiary); border-radius: var(--radius-sm);
-  padding: 14px 16px; margin-bottom: 16px; font-size: 12px;
+  background: var(--bg-tertiary);
+  border-radius: var(--radius-sm);
+  padding: 14px 16px;
+  margin-bottom: 16px;
+  font-size: 12px;
 }
 .cert-row {
-  display: flex; padding: 4px 0;
+  display: flex;
+  padding: 4px 0;
+}
+.cert-label {
+  color: var(--text-faint);
+  width: 90px;
+  flex-shrink: 0;
+}
+.cert-value {
+  color: var(--text-normal);
+  font-family: var(--font-mono);
+  font-size: 11px;
+  word-break: break-all;
+}
+.cert-fingerprint {
+  color: var(--yellow);
 }
-.cert-label { color: var(--text-faint); width: 90px; flex-shrink: 0; }
-.cert-value { color: var(--text-normal); font-family: var(--font-mono); font-size: 11px; word-break: break-all; }
-.cert-fingerprint { color: var(--yellow); }
 .cert-actions {
-  display: flex; gap: 8px; justify-content: center; margin-top: 8px;
+  display: flex;
+  gap: 8px;
+  justify-content: center;
+  margin-top: 8px;
 }
 .btn-ghost {
-  padding: 8px 16px; border-radius: var(--radius-sm);
-  background: var(--bg-hover); color: var(--text-muted);
-  font-size: 13px; transition: all .15s;
+  padding: 8px 16px;
+  border-radius: var(--radius-sm);
+  background: var(--bg-hover);
+  color: var(--text-muted);
+  font-size: 13px;
+  transition: all 0.15s;
+}
+.btn-ghost:hover {
+  background: var(--bg-active);
+  color: var(--text-normal);
 }
-.btn-ghost:hover { background: var(--bg-active); color: var(--text-normal); }
 
 /* ═══════════════════════════════════════════
    SETTINGS OVERLAY (full-screen, like Discord)
    ═══════════════════════════════════════════ */
 .settings-overlay {
-  position: fixed; inset: 0; background: var(--bg-primary);
-  display: none; z-index: 300; animation: settingsFadeIn .2s;
+  position: fixed;
+  inset: 0;
+  background: var(--bg-primary);
+  display: none;
+  z-index: 300;
+  animation: settingsFadeIn 0.2s;
+}
+.settings-overlay.visible {
+  display: flex;
 }
-.settings-overlay.visible { display: flex; }
 .settings-layout {
-  display: flex; width: 100%; height: 100%;
+  display: flex;
+  width: 100%;
+  height: 100%;
 }
 .settings-nav {
-  width: 220px; background: var(--bg-secondary);
-  padding: 60px 8px 20px; overflow-y: auto; flex-shrink: 0;
-  display: flex; flex-direction: column;
+  width: 220px;
+  background: var(--bg-secondary);
+  padding: 60px 8px 20px;
+  overflow-y: auto;
+  flex-shrink: 0;
+  display: flex;
+  flex-direction: column;
 }
 .settings-nav-title {
-  font-size: 11px; font-weight: 700; color: var(--text-faint);
-  letter-spacing: .05em; text-transform: uppercase;
-  padding: 8px 12px 4px; margin-top: 8px;
+  font-size: 11px;
+  font-weight: 700;
+  color: var(--text-faint);
+  letter-spacing: 0.05em;
+  text-transform: uppercase;
+  padding: 8px 12px 4px;
+  margin-top: 8px;
+}
+.settings-nav-title:first-child {
+  margin-top: 0;
 }
-.settings-nav-title:first-child { margin-top: 0; }
 .settings-nav-item {
-  padding: 8px 12px; border-radius: var(--radius-sm);
-  font-size: 14px; color: var(--text-muted);
-  cursor: pointer; transition: all .15s;
-  display: flex; align-items: center; gap: 8px;
-  background: transparent; text-align: left; width: 100%;
+  padding: 8px 12px;
+  border-radius: var(--radius-sm);
+  font-size: 14px;
+  color: var(--text-muted);
+  cursor: pointer;
+  transition: all 0.15s;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  background: transparent;
+  text-align: left;
+  width: 100%;
+}
+.settings-nav-item:hover {
+  background: var(--bg-hover);
+  color: var(--text-normal);
+}
+.settings-nav-item.active {
+  background: var(--bg-active);
+  color: white;
+}
+.settings-nav-item svg {
+  width: 16px;
+  height: 16px;
+  flex-shrink: 0;
 }
-.settings-nav-item:hover { background: var(--bg-hover); color: var(--text-normal); }
-.settings-nav-item.active { background: var(--bg-active); color: white; }
-.settings-nav-item svg { width: 16px; height: 16px; flex-shrink: 0; }
 .settings-nav-sep {
-  height: 1px; background: var(--border); margin: 4px 12px;
+  height: 1px;
+  background: var(--border);
+  margin: 4px 12px;
 }
 .settings-content {
-  flex: 1; padding: 60px 40px 40px; overflow-y: auto; max-width: 740px;
+  flex: 1;
+  padding: 60px 40px 40px;
+  overflow-y: auto;
+  max-width: 740px;
 }
 .settings-close {
-  position: absolute; top: 16px; right: 16px;
-  width: 36px; height: 36px; border-radius: 50%;
-  border: 2px solid var(--border-strong); background: transparent;
-  color: var(--text-faint); display: flex;
-  align-items: center; justify-content: center;
-  font-size: 18px; transition: all .15s; z-index: 310;
+  position: absolute;
+  top: 16px;
+  right: 16px;
+  width: 36px;
+  height: 36px;
+  border-radius: 50%;
+  border: 2px solid var(--border-strong);
+  background: transparent;
+  color: var(--text-faint);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: 18px;
+  transition: all 0.15s;
+  z-index: 310;
+}
+.settings-close:hover {
+  border-color: var(--text-normal);
+  color: var(--text-normal);
 }
-.settings-close:hover { border-color: var(--text-normal); color: var(--text-normal); }
 .settings-section-title {
-  font-size: 18px; font-weight: 700; color: white; margin-bottom: 20px;
+  font-size: 18px;
+  font-weight: 700;
+  color: white;
+  margin-bottom: 20px;
 }
 
 /* Settings form elements */
 .setting-row {
-  display: flex; align-items: center; justify-content: space-between;
-  padding: 14px 0; border-bottom: 1px solid var(--border);
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 14px 0;
+  border-bottom: 1px solid var(--border);
+}
+.setting-row:last-child {
+  border-bottom: none;
+}
+.setting-info {
+  flex: 1;
+}
+.setting-label {
+  font-size: 14px;
+  color: var(--text-normal);
+  margin-bottom: 2px;
+}
+.setting-desc {
+  font-size: 12px;
+  color: var(--text-faint);
+}
+.setting-control {
+  flex-shrink: 0;
+  margin-left: 16px;
 }
-.setting-row:last-child { border-bottom: none; }
-.setting-info { flex: 1; }
-.setting-label { font-size: 14px; color: var(--text-normal); margin-bottom: 2px; }
-.setting-desc { font-size: 12px; color: var(--text-faint); }
-.setting-control { flex-shrink: 0; margin-left: 16px; }
 
 /* Toggle switch */
 .toggle {
-  width: 40px; height: 22px; border-radius: 11px;
-  background: var(--border-strong); cursor: pointer;
-  position: relative; transition: background .2s;
+  width: 40px;
+  height: 22px;
+  border-radius: 11px;
+  background: var(--border-strong);
+  cursor: pointer;
+  position: relative;
+  transition: background 0.2s;
+}
+.toggle.on {
+  background: var(--green);
 }
-.toggle.on { background: var(--green); }
 .toggle::after {
-  content: ''; position: absolute;
-  width: 16px; height: 16px; border-radius: 50%;
-  background: white; top: 3px; left: 3px;
-  transition: transform .2s;
+  content: "";
+  position: absolute;
+  width: 16px;
+  height: 16px;
+  border-radius: 50%;
+  background: white;
+  top: 3px;
+  left: 3px;
+  transition: transform 0.2s;
+}
+.toggle.on::after {
+  transform: translateX(18px);
 }
-.toggle.on::after { transform: translateX(18px); }
 
 /* Select dropdown */
 .setting-select {
-  padding: 6px 28px 6px 10px; border-radius: var(--radius-sm);
-  background: var(--bg-input); color: var(--text-normal);
-  border: 1px solid var(--border); font-size: 13px;
-  appearance: none; cursor: pointer;
+  padding: 6px 28px 6px 10px;
+  border-radius: var(--radius-sm);
+  background: var(--bg-input);
+  color: var(--text-normal);
+  border: 1px solid var(--border);
+  font-size: 13px;
+  appearance: none;
+  cursor: pointer;
   background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' fill='%2380848e' viewBox='0 0 16 16'%3E%3Cpath d='M4 6l4 4 4-4'/%3E%3C/svg%3E");
-  background-repeat: no-repeat; background-position: right 8px center;
+  background-repeat: no-repeat;
+  background-position: right 8px center;
   min-width: 180px;
 }
-.setting-select:hover { border-color: var(--border-strong); }
-.setting-select:focus { border-color: var(--accent); }
+.setting-select:hover {
+  border-color: var(--border-strong);
+}
+.setting-select:focus {
+  border-color: var(--accent);
+}
 
 /* Slider */
 .setting-slider {
-  width: 160px; height: 6px; border-radius: 3px;
-  background: var(--border); appearance: none; cursor: pointer;
+  width: 160px;
+  height: 6px;
+  border-radius: 3px;
+  background: var(--border);
+  appearance: none;
+  cursor: pointer;
 }
 .setting-slider::-webkit-slider-thumb {
-  appearance: none; width: 16px; height: 16px;
-  border-radius: 50%; background: white;
-  box-shadow: 0 1px 4px rgba(0,0,0,.3);
+  appearance: none;
+  width: 16px;
+  height: 16px;
+  border-radius: 50%;
+  background: white;
+  box-shadow: 0 1px 4px rgba(0, 0, 0, 0.3);
 }
 
 /* VU meter mockup */
 .vu-meter {
-  height: 6px; border-radius: 3px; background: var(--border);
-  overflow: hidden; margin-top: 8px;
+  height: 6px;
+  border-radius: 3px;
+  background: var(--border);
+  overflow: hidden;
+  margin-top: 8px;
 }
 .vu-meter-fill {
-  height: 100%; border-radius: 3px; background: var(--green);
-  transition: width .1s;
+  height: 100%;
+  border-radius: 3px;
+  background: var(--green);
+  transition: width 0.1s;
 }
 
 /* Keybind capture */
 .keybind-btn {
-  padding: 6px 14px; border-radius: var(--radius-sm);
-  background: var(--bg-input); border: 1px solid var(--border);
-  color: var(--text-normal); font-size: 13px;
-  font-family: var(--font-mono); cursor: pointer;
-  transition: border-color .2s; min-width: 100px; text-align: center;
+  padding: 6px 14px;
+  border-radius: var(--radius-sm);
+  background: var(--bg-input);
+  border: 1px solid var(--border);
+  color: var(--text-normal);
+  font-size: 13px;
+  font-family: var(--font-mono);
+  cursor: pointer;
+  transition: border-color 0.2s;
+  min-width: 100px;
+  text-align: center;
+}
+.keybind-btn:hover {
+  border-color: var(--border-strong);
 }
-.keybind-btn:hover { border-color: var(--border-strong); }
 .keybind-btn.listening {
-  border-color: var(--accent); color: var(--accent);
+  border-color: var(--accent);
+  color: var(--accent);
   animation: pulse 1s ease-in-out infinite;
 }
 
 /* Mic test */
 .mic-test-btn {
-  padding: 8px 16px; border-radius: var(--radius-sm);
-  background: var(--accent); color: white; font-size: 13px;
-  font-weight: 600; transition: background .15s;
+  padding: 8px 16px;
+  border-radius: var(--radius-sm);
+  background: var(--accent);
+  color: white;
+  font-size: 13px;
+  font-weight: 600;
+  transition: background 0.15s;
+}
+.mic-test-btn:hover {
+  background: var(--accent-hover);
+}
+.mic-test-btn.active {
+  background: var(--red);
+}
+.mic-test-btn.active:hover {
+  background: #d83135;
 }
-.mic-test-btn:hover { background: var(--accent-hover); }
-.mic-test-btn.active { background: var(--red); }
-.mic-test-btn.active:hover { background: #d83135; }
 
 /* About section */
-.about-logo { text-align: center; margin-bottom: 24px; }
+.about-logo {
+  text-align: center;
+  margin-bottom: 24px;
+}
 .about-version {
-  text-align: center; font-size: 13px; color: var(--text-faint); margin-top: 8px;
+  text-align: center;
+  font-size: 13px;
+  color: var(--text-faint);
+  margin-top: 8px;
 }
 .about-links {
-  display: flex; gap: 16px; justify-content: center; margin-top: 16px;
+  display: flex;
+  gap: 16px;
+  justify-content: center;
+  margin-top: 16px;
 }
 .about-link {
-  font-size: 13px; color: var(--text-link); cursor: pointer;
-  background: transparent; padding: 0;
+  font-size: 13px;
+  color: var(--text-link);
+  cursor: pointer;
+  background: transparent;
+  padding: 0;
+}
+.about-link:hover {
+  text-decoration: underline;
 }
-.about-link:hover { text-decoration: underline; }
 
 /* ═══════════════════════════════════════════
    CONNECTION STATUS BAR
    ═══════════════════════════════════════════ */
 .status-bar {
-  position: absolute; bottom: 0; left: 0; right: 0;
-  height: 4px; z-index: 50; overflow: hidden; display: none;
+  position: absolute;
+  bottom: 0;
+  left: 0;
+  right: 0;
+  height: 4px;
+  z-index: 50;
+  overflow: hidden;
+  display: none;
+}
+.status-bar.visible {
+  display: block;
 }
-.status-bar.visible { display: block; }
 .status-bar-fill {
-  height: 100%; background: var(--accent);
-  width: 0; box-shadow: 0 0 12px rgba(88,101,242,.25);
+  height: 100%;
+  background: var(--accent);
+  width: 0;
+  box-shadow: 0 0 12px rgba(88, 101, 242, 0.25);
 }
 .status-bar.indeterminate .status-bar-fill {
-  width: 30%; animation: indeterminate 1.2s ease-in-out infinite;
+  width: 30%;
+  animation: indeterminate 1.2s ease-in-out infinite;
 }
 
 /* ═══════════════════════════════════════════
    CONNECTED OVERLAY
    ═══════════════════════════════════════════ */
 .connected-overlay {
-  position: fixed; inset: 0; background: var(--bg-primary);
-  display: none; align-items: center; justify-content: center;
-  flex-direction: column; gap: 12px; z-index: 200;
+  position: fixed;
+  inset: 0;
+  background: var(--bg-primary);
+  display: none;
+  align-items: center;
+  justify-content: center;
+  flex-direction: column;
+  gap: 12px;
+  z-index: 200;
+}
+.connected-overlay.visible {
+  display: flex;
 }
-.connected-overlay.visible { display: flex; }
 .connected-icon-wrap {
-  position: relative; margin-bottom: 4px;
+  position: relative;
+  margin-bottom: 4px;
 }
 .connected-srv-icon {
-  width: 72px; height: 72px; border-radius: 20px;
-  display: flex; align-items: center; justify-content: center;
-  font-size: 28px; font-weight: 700; color: white;
-  animation: checkPop .4s cubic-bezier(.16,1,.3,1);
+  width: 72px;
+  height: 72px;
+  border-radius: 20px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  font-size: 28px;
+  font-weight: 700;
+  color: white;
+  animation: checkPop 0.4s cubic-bezier(0.16, 1, 0.3, 1);
 }
 .connected-check-badge {
-  position: absolute; bottom: -4px; right: -4px;
-  width: 28px; height: 28px; border-radius: 50%;
-  background: var(--green); display: flex;
-  align-items: center; justify-content: center;
+  position: absolute;
+  bottom: -4px;
+  right: -4px;
+  width: 28px;
+  height: 28px;
+  border-radius: 50%;
+  background: var(--green);
+  display: flex;
+  align-items: center;
+  justify-content: center;
   border: 3px solid var(--bg-primary);
-  animation: checkPop .5s cubic-bezier(.16,1,.3,1) .1s both;
+  animation: checkPop 0.5s cubic-bezier(0.16, 1, 0.3, 1) 0.1s both;
+}
+.connected-check-badge svg {
+  width: 14px;
+  height: 14px;
+  color: white;
+}
+.connected-text {
+  font-size: 20px;
+  font-weight: 700;
+  color: white;
+}
+.connected-user {
+  font-size: 14px;
+  color: var(--text-muted);
 }
-.connected-check-badge svg { width: 14px; height: 14px; color: white; }
-.connected-text { font-size: 20px; font-weight: 700; color: white; }
-.connected-user { font-size: 14px; color: var(--text-muted); }
 .connected-motd {
-  font-size: 13px; color: var(--text-faint); text-align: center;
-  max-width: 340px; line-height: 1.5; margin-top: 4px;
+  font-size: 13px;
+  color: var(--text-faint);
+  text-align: center;
+  max-width: 340px;
+  line-height: 1.5;
+  margin-top: 4px;
   font-style: italic;
 }
 .connected-loader {
-  margin-top: 12px; display: flex; align-items: center; gap: 8px;
-  color: var(--text-micro); font-size: 12px;
+  margin-top: 12px;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  color: var(--text-micro);
+  font-size: 12px;
+}
+.connected-loader .spinner {
+  width: 14px;
+  height: 14px;
+  border-width: 1.5px;
 }
-.connected-loader .spinner { width: 14px; height: 14px; border-width: 1.5px; }
 
 /* ═══ Responsive ═══ */
 @media (max-width: 700px) {
-  .server-panel { width: 260px; }
-  .form-container { max-width: 340px; }
+  .server-panel {
+    width: 260px;
+  }
+  .form-container {
+    max-width: 340px;
+  }
 }
 
 /* ═══════════════════════════════════════════
    ANIMATIONS (@keyframes)
    ═══════════════════════════════════════════ */
 @keyframes bgShift {
-  0%   { opacity: 1; transform: scale(1); }
-  50%  { opacity: .7; transform: scale(1.05); }
-  100% { opacity: 1; transform: scale(1); }
+  0% {
+    opacity: 1;
+    transform: scale(1);
+  }
+  50% {
+    opacity: 0.7;
+    transform: scale(1.05);
+  }
+  100% {
+    opacity: 1;
+    transform: scale(1);
+  }
 }
 
 @keyframes pulse {
-  0%,100% { opacity: 1; }
-  50%     { opacity: .3; }
+  0%,
+  100% {
+    opacity: 1;
+  }
+  50% {
+    opacity: 0.3;
+  }
 }
 
 @keyframes formSlideIn {
-  from { opacity: 0; transform: translateY(16px); }
-  to   { opacity: 1; transform: translateY(0); }
+  from {
+    opacity: 0;
+    transform: translateY(16px);
+  }
+  to {
+    opacity: 1;
+    transform: translateY(0);
+  }
 }
 
 @keyframes shakeX {
-  0%,100% { transform: translateX(0); }
-  20%     { transform: translateX(-6px); }
-  40%     { transform: translateX(5px); }
-  60%     { transform: translateX(-4px); }
-  80%     { transform: translateX(2px); }
+  0%,
+  100% {
+    transform: translateX(0);
+  }
+  20% {
+    transform: translateX(-6px);
+  }
+  40% {
+    transform: translateX(5px);
+  }
+  60% {
+    transform: translateX(-4px);
+  }
+  80% {
+    transform: translateX(2px);
+  }
 }
 
 @keyframes spin {
-  to { transform: rotate(360deg); }
+  to {
+    transform: rotate(360deg);
+  }
 }
 
 @keyframes modalSlideIn {
-  from { opacity: 0; transform: translateY(24px) scale(.96); }
-  to   { opacity: 1; transform: translateY(0) scale(1); }
+  from {
+    opacity: 0;
+    transform: translateY(24px) scale(0.96);
+  }
+  to {
+    opacity: 1;
+    transform: translateY(0) scale(1);
+  }
 }
 
 @keyframes settingsFadeIn {
-  from { opacity: 0; }
-  to   { opacity: 1; }
+  from {
+    opacity: 0;
+  }
+  to {
+    opacity: 1;
+  }
 }
 
 @keyframes indeterminate {
-  0%   { transform: translateX(-100%); }
-  100% { transform: translateX(440%); }
+  0% {
+    transform: translateX(-100%);
+  }
+  100% {
+    transform: translateX(440%);
+  }
 }
 
 @keyframes checkPop {
-  from { transform: scale(0); opacity: 0; }
-  to   { transform: scale(1); opacity: 1; }
+  from {
+    transform: scale(0);
+    opacity: 0;
+  }
+  to {
+    transform: scale(1);
+    opacity: 1;
+  }
 }
 
 @keyframes slideInLeft {
-  from { transform: translateX(-30px); opacity: 0; }
-  to   { transform: translateX(0); opacity: 1; }
+  from {
+    transform: translateX(-30px);
+    opacity: 0;
+  }
+  to {
+    transform: translateX(0);
+    opacity: 1;
+  }
 }
 
 @keyframes slideInRight {
-  from { transform: translateX(30px); opacity: 0; }
-  to   { transform: translateX(0); opacity: 1; }
+  from {
+    transform: translateX(30px);
+    opacity: 0;
+  }
+  to {
+    transform: translateX(0);
+    opacity: 1;
+  }
 }
 
 @keyframes glowPulse {
-  0%, 100% { filter: blur(4px); opacity: 0.35; }
-  50%      { filter: blur(6px); opacity: 0.5; }
+  0%,
+  100% {
+    filter: blur(4px);
+    opacity: 0.35;
+  }
+  50% {
+    filter: blur(6px);
+    opacity: 0.5;
+  }
 }
 
 @keyframes shimmer {
-  0%   { background-position: -200% 0; }
-  100% { background-position: 200% 0; }
+  0% {
+    background-position: -200% 0;
+  }
+  100% {
+    background-position: 200% 0;
+  }
 }
 
 /* ═══ Reduced motion ═══ */
 @media (prefers-reduced-motion: reduce) {
-  .server-panel, .form-panel, .form-container, .server-item {
-    animation: none !important; opacity: 1 !important;
+  .server-panel,
+  .form-panel,
+  .form-container,
+  .server-item {
+    animation: none !important;
+    opacity: 1 !important;
   }
-  .connect-page::before, .server-panel::before, .oc-glow-layer {
+  .connect-page::before,
+  .server-panel::before,
+  .oc-glow-layer {
+    animation: none !important;
+  }
+  .btn-primary:hover::after {
     animation: none !important;
   }
-  .btn-primary:hover::after { animation: none !important; }
+}
+
+/* Form extras used by the channel edit modal: an inline hint under a control,
+   a checkbox row, and a titled sub-section (the voice-only limits block). */
+.form-hint {
+  margin-top: 6px;
+  font-size: 11px;
+  line-height: 1.45;
+  color: var(--text-faint);
+}
+.form-check {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  font-size: 13px;
+  color: var(--text-normal);
+  cursor: pointer;
+}
+.form-check input[type="checkbox"] {
+  width: 16px;
+  height: 16px;
+  accent-color: var(--accent);
+  cursor: pointer;
+}
+.form-section {
+  margin-top: 4px;
+  padding-top: 16px;
+  border-top: 1px solid var(--border);
+}
+.form-section-title {
+  font-size: 11px;
+  font-weight: 700;
+  letter-spacing: 0.02em;
+  text-transform: uppercase;
+  color: var(--text-muted);
+  margin-bottom: 12px;
 }
diff --git a/Client/tauri-client/tests/e2e/emoji-voicemod.parity.spec.ts b/Client/tauri-client/tests/e2e/emoji-voicemod.parity.spec.ts
new file mode 100644
index 00000000..52f0f0d0
--- /dev/null
+++ b/Client/tauri-client/tests/e2e/emoji-voicemod.parity.spec.ts
@@ -0,0 +1,308 @@
+/**
+ * Mocked E2E: custom-emoji shortcode autocomplete + render, and voice
+ * moderation context-menu gating.
+ *
+ * Feature 1 (":shortcode" autocomplete + render) is distinct from
+ * emoji-insertion.spec.ts, which covers the unicode emoji *picker* only.
+ * Here the composer's inline ":" autocomplete (EmojiAutocomplete.ts) is
+ * seeded with one custom emoji via GET /api/v1/emoji (the same REST route
+ * dispatcher.ts calls once on `ready`; emoji.store.ts is the only place a
+ * custom emoji can come from in this client).
+ *
+ * Feature 2 (voice moderation menu) reuses the ws_send capture pattern from
+ * social.parity.spec.ts to assert the exact outgoing message, not just the
+ * resulting DOM.
+ */
+import type { Page } from "@playwright/test";
+import { test, expect } from "@playwright/test";
+import {
+  buildTauriMockScript,
+  mockTauriFullSessionWithVoice,
+  navigateToMainPage,
+  navigateToMainPageReady,
+  emitWsMessageAndWait,
+  MOCK_LOGIN_RESPONSE,
+  MOCK_MESSAGES,
+  MOCK_PINNED_MESSAGES,
+  MOCK_ROLES,
+  MOCK_CHANNELS_WITH_CATEGORIES,
+  MOCK_MEMBERS_MULTI_ROLE,
+  MOCK_VOICE_STATE,
+  voiceWsHandlers,
+} from "./helpers";
+
+// ---------------------------------------------------------------------------
+// Call capture — records ws_send invocations (same pattern as
+// social.parity.spec.ts). Installed as a second init script, after the Tauri
+// mock sets up `invoke`, so it can see every outgoing call without touching
+// the shared helper file.
+// ---------------------------------------------------------------------------
+
+interface CapturedCall {
+  readonly cmd: string;
+  readonly message?: string;
+}
+
+function captureScript(): void {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  const internals = (window as any).__TAURI_INTERNALS__;
+  const orig = internals.invoke;
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  (window as any).__capturedCalls = [];
+  internals.invoke = async (cmd: string, args: unknown) => {
+    if (cmd === "ws_send") {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      (window as any).__capturedCalls.push({ cmd, message: (args as any)?.message });
+    }
+    return orig(cmd, args);
+  };
+}
+
+async function getCapturedCalls(page: Page): Promise<CapturedCall[]> {
+  return page.evaluate(() => {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    return ((window as any).__capturedCalls ?? []) as CapturedCall[];
+  });
+}
+
+/** Poll until a captured call matches, and return it. Avoids racing the async send. */
+async function waitForCapturedCall(
+  page: Page,
+  predicate: (call: CapturedCall) => boolean,
+  timeout = 5_000,
+): Promise<CapturedCall> {
+  let found: CapturedCall | undefined;
+  await expect(async () => {
+    const calls = await getCapturedCalls(page);
+    found = calls.find(predicate);
+    expect(found).toBeDefined();
+  }).toPass({ timeout });
+  return found!;
+}
+
+// ---------------------------------------------------------------------------
+// Feature 1: custom-emoji ":shortcode" autocomplete + message-list render
+// ---------------------------------------------------------------------------
+
+/** One custom emoji, seeded through GET /api/v1/emoji (dispatcher.ts calls
+ *  this once on `ready`; emoji.store.ts is the sole source custom-emoji
+ *  autocomplete and rendering read from — see EmojiAutocomplete.ts and
+ *  message-list/custom-emoji.ts). */
+const SEEDED_CUSTOM_EMOJI = { id: 1, shortcode: "partyparrot", url: "/api/v1/emoji/1/image" };
+
+async function mockSessionWithCustomEmoji(page: Page): Promise<void> {
+  await page.addInitScript(
+    buildTauriMockScript({
+      httpRoutes: [
+        { pattern: "/api/v1/health", status: 200, body: { status: "ok", version: "1.0.0" } },
+        { pattern: "/api/v1/auth/login", status: 200, body: MOCK_LOGIN_RESPONSE },
+        { pattern: "/messages", status: 200, body: MOCK_MESSAGES },
+        { pattern: "/pins", status: 200, body: MOCK_PINNED_MESSAGES },
+        // Longer, more specific pattern first (buildTauriMockScript sorts by
+        // pattern length, so this always outranks the shorter list route
+        // below): the authenticated emoji image fetch custom-emoji.ts makes.
+        { pattern: "/api/v1/emoji/1/image", status: 200, body: "fake-emoji-bytes" },
+        { pattern: "/api/v1/emoji", status: 200, body: [SEEDED_CUSTOM_EMOJI] },
+      ],
+      simulateWsFlow: true,
+    }),
+  );
+}
+
+test.describe("@parity Custom emoji — shortcode autocomplete and render", () => {
+  test.beforeEach(async ({ page }) => {
+    await mockSessionWithCustomEmoji(page);
+    await page.goto("/");
+    await navigateToMainPage(page);
+  });
+
+  test('typing ":" + prefix opens the autocomplete and selecting the row inserts the shortcode token', async ({
+    page,
+  }) => {
+    const textarea = page.locator("[data-testid='msg-textarea']");
+    const popup = page.locator("[data-testid='emoji-autocomplete']");
+    const row = page.locator("[data-testid='emoji-option-partyparrot']");
+
+    // GET /api/v1/emoji is fired once on `ready`, in parallel with the
+    // channel-sidebar render `navigateToMainPage` already waited on, so the
+    // response can still be in flight the instant this test starts typing.
+    // Retry the whole type-and-check cycle (never a bare sleep) until the
+    // store has caught up.
+    await expect(async () => {
+      await textarea.fill("");
+      await textarea.fill(":party");
+      await expect(popup).toBeVisible({ timeout: 1_000 });
+      await expect(row).toBeVisible({ timeout: 1_000 });
+    }).toPass({ timeout: 10_000 });
+
+    await expect(row.locator(".ma-name")).toHaveText(":partyparrot:");
+    await expect(row.locator(".ma-detail")).toHaveText("Server emoji");
+    // Custom emoji preview renders as an <img>, not a unicode character cell.
+    await expect(row.locator(".ea-preview img.custom-emoji")).toBeAttached();
+
+    await row.click();
+
+    await expect(popup).not.toBeVisible();
+    await expect(textarea).toHaveValue(":partyparrot: ");
+  });
+
+  test("a chat_message containing the shortcode renders the custom-emoji image", async ({
+    page,
+  }) => {
+    const messageId = 9001;
+    await emitWsMessageAndWait(
+      page,
+      {
+        type: "chat_message",
+        payload: {
+          id: messageId,
+          channel_id: 1,
+          user: { id: 2, username: "otheruser", avatar: "" },
+          content: "look at this :partyparrot: go",
+          timestamp: "2026-03-15T11:00:00Z",
+          edited_at: null,
+          attachments: [],
+          reactions: [],
+          reply_to: null,
+          pinned: false,
+          deleted: false,
+        },
+      },
+      page.locator(`[data-testid='message-${messageId}'] img.custom-emoji`),
+    );
+
+    const img = page.locator(`[data-testid='message-${messageId}'] img.custom-emoji`);
+    await expect(img).toHaveAttribute("alt", ":partyparrot:");
+    await expect(img).toHaveAttribute("data-shortcode", "partyparrot");
+    // The literal ":partyparrot:" text is replaced by the image node, not
+    // left behind as text alongside it.
+    await expect(page.locator(`[data-testid='message-${messageId}'] .msg-text`)).not.toContainText(
+      ":partyparrot:",
+    );
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Feature 2: voice-moderation context menu gating
+// ---------------------------------------------------------------------------
+
+test.describe("@parity Voice moderation menu — admin can moderate", () => {
+  test.beforeEach(async ({ page }) => {
+    await mockTauriFullSessionWithVoice(page);
+    await page.addInitScript(captureScript);
+    await page.goto("/");
+    await navigateToMainPageReady(page);
+  });
+
+  test("offers Server Mute and Disconnect, and Server Mute fires voice_mod_mute", async ({
+    page,
+  }) => {
+    // User 2 is a remote participant of "Voice Chat" (channel 10) in
+    // MOCK_VOICE_STATE — the local user (admin, all permissions) may
+    // moderate it.
+    const row = page.locator(".voice-user-item[data-voice-uid='2']");
+    await expect(row).toBeVisible({ timeout: 5_000 });
+    await row.click({ button: "right" });
+
+    const menu = page.locator(".user-vol-menu");
+    await expect(menu).toBeVisible({ timeout: 3_000 });
+    const muteItem = menu.locator("[data-action='server-mute']");
+    const disconnectItem = menu.locator("[data-action='voice-disconnect']");
+    await expect(muteItem).toHaveText("Server Mute");
+    await expect(disconnectItem).toHaveText("Disconnect");
+
+    await muteItem.click();
+
+    const call = await waitForCapturedCall(
+      page,
+      (c) => c.cmd === "ws_send" && (c.message ?? "").includes("voice_mod_mute"),
+    );
+    const parsed = JSON.parse(call.message ?? "{}") as {
+      type: string;
+      payload: { channel_id: number; user_id: number; muted: boolean };
+    };
+    expect(parsed.type).toBe("voice_mod_mute");
+    expect(parsed.payload).toEqual({ channel_id: 10, user_id: 2, muted: true });
+  });
+
+  test("Disconnect fires voice_mod_kick", async ({ page }) => {
+    const row = page.locator(".voice-user-item[data-voice-uid='3']");
+    await expect(row).toBeVisible({ timeout: 5_000 });
+    await row.click({ button: "right" });
+
+    const menu = page.locator(".user-vol-menu");
+    await expect(menu).toBeVisible({ timeout: 3_000 });
+    await menu.locator("[data-action='voice-disconnect']").click();
+
+    const call = await waitForCapturedCall(
+      page,
+      (c) => c.cmd === "ws_send" && (c.message ?? "").includes("voice_mod_kick"),
+    );
+    const parsed = JSON.parse(call.message ?? "{}") as {
+      type: string;
+      payload: { user_id: number };
+    };
+    expect(parsed.type).toBe("voice_mod_kick");
+    expect(parsed.payload).toEqual({ user_id: 3 });
+  });
+});
+
+// The local user's role name comes from `auth_ok`, which
+// buildTauriMockScript hardcodes to "admin" (MOCK_AUTH_OK) — not
+// overridable via readyOverrides.members, so a member-role *user* can't be
+// simulated without editing the shared mock builder. What canModerateVoice()
+// actually reads is the *permission bits behind that role name*
+// (permissionsForRole("admin") against the `ready.roles` list), which
+// readyOverrides.roles does control. Stripping MUTE_MEMBERS from "admin"
+// there is a faithful stand-in for "local user's role lacks voice-moderation
+// permission" without touching helpers.ts.
+async function mockVoiceSessionWithoutModPermission(page: Page): Promise<void> {
+  const rolesWithoutMute = MOCK_ROLES.map((r) =>
+    r.name === "admin" ? { ...r, permissions: 0x3 } : r,
+  );
+  await page.addInitScript(
+    buildTauriMockScript({
+      httpRoutes: [
+        { pattern: "/api/v1/health", status: 200, body: { status: "ok", version: "1.0.0" } },
+        { pattern: "/api/v1/auth/login", status: 200, body: MOCK_LOGIN_RESPONSE },
+        { pattern: "/messages", status: 200, body: MOCK_MESSAGES },
+      ],
+      simulateWsFlow: true,
+      wsHandlers: voiceWsHandlers(),
+      readyOverrides: {
+        channels: MOCK_CHANNELS_WITH_CATEGORIES,
+        members: MOCK_MEMBERS_MULTI_ROLE,
+        voice_states: MOCK_VOICE_STATE,
+        // buildTauriMockScript's typed `readyOverrides` doesn't list `roles`,
+        // but buildReadyPayload (its implementation) does support it — this
+        // cast bridges that gap without touching the shared helper file.
+        roles: rolesWithoutMute,
+      } as unknown as Parameters<typeof buildTauriMockScript>[0]["readyOverrides"],
+    }),
+  );
+}
+
+test.describe("@parity Voice moderation menu — gated without MUTE_MEMBERS", () => {
+  test.beforeEach(async ({ page }) => {
+    await mockVoiceSessionWithoutModPermission(page);
+    await page.goto("/");
+    await navigateToMainPageReady(page);
+  });
+
+  test("the moderation section is not offered when the local role lacks MUTE_MEMBERS", async ({
+    page,
+  }) => {
+    const row = page.locator(".voice-user-item[data-voice-uid='2']");
+    await expect(row).toBeVisible({ timeout: 5_000 });
+    await row.click({ button: "right" });
+
+    // The per-user volume control (available to everyone) still opens...
+    const menu = page.locator(".user-vol-menu");
+    await expect(menu).toBeVisible({ timeout: 3_000 });
+    await expect(menu.locator(".settings-slider")).toBeVisible();
+
+    // ...but the moderation section, which is gated on MUTE_MEMBERS, is gone.
+    await expect(menu.locator("[data-action='server-mute']")).toHaveCount(0);
+    await expect(menu.locator("[data-action='voice-disconnect']")).toHaveCount(0);
+  });
+});
diff --git a/Client/tauri-client/tests/e2e/gating-badges.parity.spec.ts b/Client/tauri-client/tests/e2e/gating-badges.parity.spec.ts
new file mode 100644
index 00000000..99e3b7a1
--- /dev/null
+++ b/Client/tauri-client/tests/e2e/gating-badges.parity.spec.ts
@@ -0,0 +1,212 @@
+import type { Page } from "@playwright/test";
+import { test, expect } from "@playwright/test";
+import {
+  buildTauriMockScript,
+  mockTauriFullSession,
+  navigateToMainPage,
+  navigateToMainPageReady,
+  emitWsMessage,
+  MOCK_MESSAGES,
+  MOCK_PINNED_MESSAGES,
+} from "./helpers";
+
+// ---------------------------------------------------------------------------
+// Custom mocks — this spec needs ready payloads the shared helpers don't
+// build (an nsfw channel, a pre-seeded mention_count), so it constructs them
+// inline with buildTauriMockScript, mirroring mockTauriFullSession.
+// ---------------------------------------------------------------------------
+
+/** MOCK_CHANNELS with #general (id 1) flagged nsfw. Channel 1 stays the
+ *  default-active channel, so login alone exercises "opening" the gated
+ *  channel — no extra click needed to trigger the mount. */
+const NSFW_CHANNELS = [
+  { id: 1, name: "general", type: "text", position: 0, category: null, nsfw: true },
+  { id: 2, name: "random", type: "text", position: 1, category: null },
+];
+
+/** MOCK_CHANNELS with #random (id 2) pre-seeded with a mention count, to
+ *  cover the ready-payload render path independent of any WS traffic. */
+const MENTION_SEEDED_CHANNELS = [
+  { id: 1, name: "general", type: "text", position: 0, category: null },
+  { id: 2, name: "random", type: "text", position: 1, category: null, mention_count: 3 },
+];
+
+async function mockTauriSessionWithChannels(page: Page, channels: unknown[]): Promise<void> {
+  await page.addInitScript(
+    buildTauriMockScript({
+      httpRoutes: [
+        { pattern: "/api/v1/health", status: 200, body: { status: "ok", version: "1.0.0" } },
+        {
+          pattern: "/api/v1/auth/login",
+          status: 200,
+          body: { token: "mock-session-token-abc123", requires_2fa: false },
+        },
+        { pattern: "/messages", status: 200, body: MOCK_MESSAGES },
+        { pattern: "/pins", status: 200, body: MOCK_PINNED_MESSAGES },
+      ],
+      simulateWsFlow: true,
+      readyOverrides: { channels },
+    }),
+  );
+}
+
+// ---------------------------------------------------------------------------
+// 1) NSFW age-gate
+// ---------------------------------------------------------------------------
+
+test.describe("@parity NSFW age-gate", () => {
+  test.beforeEach(async ({ page }) => {
+    await mockTauriSessionWithChannels(page, NSFW_CHANNELS);
+    await page.goto("/");
+  });
+
+  test("opening the nsfw channel shows the gate over the message area", async ({ page }) => {
+    // Channel 1 (nsfw) is auto-selected as the default active channel, so the
+    // gate mounts as part of ordinary login — no extra navigation needed.
+    await navigateToMainPage(page);
+
+    const gate = page.locator("[data-testid='nsfw-gate']");
+    await expect(gate).toBeVisible({ timeout: 10_000 });
+    await expect(gate).toContainText("general");
+  });
+
+  test("continuing past the gate reveals the message area", async ({ page }) => {
+    await navigateToMainPage(page);
+
+    const gate = page.locator("[data-testid='nsfw-gate']");
+    await expect(gate).toBeVisible({ timeout: 10_000 });
+
+    await page.locator("[data-testid='nsfw-gate-continue']").click();
+
+    await expect(gate).not.toBeVisible();
+    await expect(page.locator("[data-testid='message-101']")).toBeVisible({ timeout: 5_000 });
+  });
+
+  test("opening a normal channel shows no gate", async ({ page }) => {
+    await navigateToMainPage(page);
+
+    // Dismiss the gate on the default (nsfw) channel first so the click below
+    // is unambiguously about channel 2, not a leftover overlay from channel 1.
+    await page.locator("[data-testid='nsfw-gate-continue']").click();
+    await expect(page.locator("[data-testid='nsfw-gate']")).not.toBeVisible();
+
+    await page.locator("[data-testid='channel-2']").click();
+
+    await expect(page.locator("[data-testid='chat-header-name']")).toHaveText("random");
+    await expect(page.locator("[data-testid='nsfw-gate']")).not.toBeVisible();
+    await expect(page.locator(".messages-container")).toBeVisible();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// 2) Mention badge
+// ---------------------------------------------------------------------------
+
+test.describe("@parity mention badge", () => {
+  test("a channel with mention_count>0 in the ready payload renders the mention badge", async ({
+    page,
+  }) => {
+    await mockTauriSessionWithChannels(page, MENTION_SEEDED_CHANNELS);
+    await page.goto("/");
+    await navigateToMainPageReady(page);
+
+    const channelTwo = page.locator("[data-testid='channel-2']");
+    await expect(channelTwo).toHaveClass(/mentioned/);
+
+    const badge = page.locator("[data-testid='channel-mentions-2']");
+    await expect(badge).toBeVisible();
+    await expect(badge).toHaveText("3");
+  });
+
+  test("an incoming @-mention on a non-active channel bumps its badge", async ({ page }) => {
+    // Plain MOCK_CHANNELS (1 general, 2 random). Channel 1 is active by
+    // default, so a mention delivered to channel 2 exercises the live WS path
+    // through dispatcher's highlightsCurrentUser -> incrementMention.
+    await mockTauriFullSession(page);
+    await page.goto("/");
+    await navigateToMainPageReady(page);
+
+    const channelTwo = page.locator("[data-testid='channel-2']");
+    await expect(channelTwo).not.toHaveClass(/mentioned/);
+
+    await emitWsMessage(page, {
+      type: "chat_message",
+      payload: {
+        id: 900,
+        channel_id: 2,
+        user: { id: 2, username: "otheruser", avatar: "" },
+        content: "@testuser check this out",
+        timestamp: new Date().toISOString(),
+        edited_at: null,
+        attachments: [],
+        reactions: [],
+        reply_to: null,
+        pinned: false,
+        deleted: false,
+        mentions: [1],
+      },
+    });
+
+    await expect(channelTwo).toHaveClass(/mentioned/, { timeout: 5_000 });
+    const badge = page.locator("[data-testid='channel-mentions-2']");
+    await expect(badge).toBeVisible();
+    await expect(badge).toHaveText("1");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// 3) Per-channel mute
+// ---------------------------------------------------------------------------
+
+test.describe("@parity per-channel mute", () => {
+  test.beforeEach(async ({ page }) => {
+    await mockTauriFullSession(page);
+    await page.goto("/");
+    await navigateToMainPageReady(page);
+  });
+
+  test("right-clicking a text channel opens a context menu with a Mute item", async ({ page }) => {
+    const channelOne = page.locator("[data-testid='channel-1']");
+    await channelOne.click({ button: "right" });
+
+    const menu = page.locator("[data-testid='channel-context-menu']");
+    await expect(menu).toBeVisible({ timeout: 5_000 });
+
+    const muteItem = page.locator("[data-testid='ctx-mute-channel']");
+    await expect(muteItem).toBeVisible();
+    await expect(muteItem).toHaveText("Mute Channel");
+  });
+
+  test("clicking Mute toggles the channel's muted state and persists it", async ({ page }) => {
+    const channelOne = page.locator("[data-testid='channel-1']");
+    await channelOne.click({ button: "right" });
+    await page.locator("[data-testid='ctx-mute-channel']").click();
+
+    // The sidebar redraws on CHANNEL_MUTE_CHANGED, so re-query by testid.
+    await expect(page.locator("[data-testid='channel-1']")).toHaveClass(/muted/, {
+      timeout: 5_000,
+    });
+
+    // Persistence: the mute lives in localStorage under the settings prefix,
+    // independent of any store/WS round-trip (see @lib/channel-mutes).
+    const stored = await page.evaluate(() =>
+      localStorage.getItem("owncord:settings:mutedChannels"),
+    );
+    expect(JSON.parse(stored ?? "[]")).toContain(1);
+
+    // Re-opening the menu reflects the flipped state.
+    await page.locator("[data-testid='channel-1']").click({ button: "right" });
+    const muteItem = page.locator("[data-testid='ctx-mute-channel']");
+    await expect(muteItem).toHaveText("Unmute Channel");
+
+    // Toggle back off and confirm both the DOM class and storage clear.
+    await muteItem.click();
+    await expect(page.locator("[data-testid='channel-1']")).not.toHaveClass(/muted/, {
+      timeout: 5_000,
+    });
+    const storedAfter = await page.evaluate(() =>
+      localStorage.getItem("owncord:settings:mutedChannels"),
+    );
+    expect(JSON.parse(storedAfter ?? "[]")).not.toContain(1);
+  });
+});
diff --git a/Client/tauri-client/tests/e2e/social.parity.spec.ts b/Client/tauri-client/tests/e2e/social.parity.spec.ts
new file mode 100644
index 00000000..8bb6afca
--- /dev/null
+++ b/Client/tauri-client/tests/e2e/social.parity.spec.ts
@@ -0,0 +1,315 @@
+/**
+ * Mocked E2E: Social parity — group DM create/leave and role change via the
+ * member context menu.
+ *
+ * Both flows are HTTP-only from the client's side (no ws_send involved):
+ *   - Group DM create:  POST /api/v1/dms/group   (SidebarDmHelpers.handleCreateGroupDm)
+ *   - Group DM leave:   DELETE /api/v1/dms/{id}  (SidebarArea.closeOrLeaveDm → api.closeDm)
+ *   - Change Role:      PATCH /admin/api/users/{id} { role_id }  (SidebarMemberSection.onChangeRole)
+ *
+ * A second init script wraps window.__TAURI_INTERNALS__.invoke (installed
+ * *after* the one buildTauriMockScript installs) to record every HTTP fetch
+ * and ws_send call into window.__capturedCalls, so tests can assert the exact
+ * outgoing request/method/body instead of only the resulting DOM state.
+ */
+
+import { test, expect, type Page } from "@playwright/test";
+import {
+  buildTauriMockScript,
+  MOCK_LOGIN_RESPONSE,
+  MOCK_MESSAGES,
+  MOCK_PINNED_MESSAGES,
+  MOCK_ROLES,
+  MOCK_MEMBERS_MULTI_ROLE,
+  navigateToMainPage,
+  waitForWsReady,
+} from "./helpers";
+
+// ---------------------------------------------------------------------------
+// Call capture — records plugin:http|fetch and ws_send invocations
+// ---------------------------------------------------------------------------
+
+interface CapturedCall {
+  readonly cmd: string;
+  readonly method?: string;
+  readonly url?: string;
+  readonly body?: string | null;
+  readonly message?: string;
+}
+
+/** Installed as a second init script, after the Tauri mock sets up `invoke`. */
+function captureScript(): void {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  const internals = (window as any).__TAURI_INTERNALS__;
+  const orig = internals.invoke;
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  (window as any).__capturedCalls = [];
+  internals.invoke = async (cmd: string, args: unknown) => {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const a = args as any;
+    if (cmd === "plugin:http|fetch") {
+      const cfg = a?.clientConfig ?? {};
+      let body: string | null = null;
+      if (Array.isArray(cfg.data)) {
+        try {
+          body = new TextDecoder().decode(new Uint8Array(cfg.data));
+        } catch {
+          body = null;
+        }
+      }
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      (window as any).__capturedCalls.push({
+        cmd,
+        method: cfg.method,
+        url: cfg.url,
+        body,
+      });
+    } else if (cmd === "ws_send") {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      (window as any).__capturedCalls.push({ cmd, message: a?.message });
+    }
+    return orig(cmd, args);
+  };
+}
+
+async function getCapturedCalls(page: Page): Promise<CapturedCall[]> {
+  return page.evaluate(() => {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    return ((window as any).__capturedCalls ?? []) as CapturedCall[];
+  });
+}
+
+/** Poll until a captured call matches, and return it. Avoids racing the async request. */
+async function waitForCapturedCall(
+  page: Page,
+  predicate: (call: CapturedCall) => boolean,
+  timeout = 5_000,
+): Promise<CapturedCall> {
+  let found: CapturedCall | undefined;
+  await expect(async () => {
+    const calls = await getCapturedCalls(page);
+    found = calls.find(predicate);
+    expect(found).toBeDefined();
+  }).toPass({ timeout });
+  return found!;
+}
+
+// ---------------------------------------------------------------------------
+// Feature 1: Group DM create + leave
+// ---------------------------------------------------------------------------
+
+const GROUP_DM_CHANNEL_ID = 900;
+
+/** The group DM seeded in the ready payload, used for the render+leave slice. */
+const SEEDED_GROUP_DM = {
+  channel_id: GROUP_DM_CHANNEL_ID,
+  recipient: { id: 3, username: "member1", avatar: "", status: "idle" },
+  recipients: [
+    { id: 3, username: "member1", avatar: "", status: "idle" },
+    { id: 4, username: "member2", avatar: "", status: "dnd" },
+  ],
+  name: "Study Group",
+  is_group: true,
+  last_message_id: null,
+  last_message: "Hey everyone",
+  last_message_at: "2026-03-15T12:00:00Z",
+  unread_count: 0,
+  mention_count: 0,
+};
+
+/** The server's response to POST /dms/group, for the create-flow slice. */
+const CREATED_GROUP_DM = {
+  channel_id: 901,
+  recipient: { id: 2, username: "moderator1", avatar: "", status: "online" },
+  recipients: [
+    { id: 2, username: "moderator1", avatar: "", status: "online" },
+    { id: 3, username: "member1", avatar: "", status: "idle" },
+  ],
+  name: "",
+  is_group: true,
+  last_message_id: null,
+  last_message: "",
+  last_message_at: "2026-03-15T12:05:00Z",
+  unread_count: 0,
+  mention_count: 0,
+};
+
+async function mockSocialSession(page: Page): Promise<void> {
+  await page.addInitScript(
+    buildTauriMockScript({
+      httpRoutes: [
+        { pattern: "/api/v1/health", status: 200, body: { status: "ok", version: "1.0.0" } },
+        { pattern: "/api/v1/auth/login", status: 200, body: MOCK_LOGIN_RESPONSE },
+        { pattern: "/messages", status: 200, body: MOCK_MESSAGES },
+        { pattern: "/pins", status: 200, body: MOCK_PINNED_MESSAGES },
+        // More specific pattern first is not required — buildTauriMockScript
+        // sorts by pattern length, so "/api/v1/dms/group" always outranks the
+        // shorter generic "/api/v1/dms/" leave/close pattern below.
+        { pattern: "/api/v1/dms/group", status: 200, body: CREATED_GROUP_DM },
+        { pattern: "/api/v1/dms/", status: 200, body: { success: true } },
+        { pattern: "/admin/api/users/", status: 200, body: {} },
+      ],
+      simulateWsFlow: true,
+      readyOverrides: {
+        members: MOCK_MEMBERS_MULTI_ROLE,
+        dm_channels: [SEEDED_GROUP_DM],
+      },
+    }),
+  );
+  await page.addInitScript(captureScript);
+}
+
+test.describe("@parity Group DM create + leave", () => {
+  test.beforeEach(async ({ page }) => {
+    await mockSocialSession(page);
+    await page.goto("/");
+    await navigateToMainPage(page);
+    await waitForWsReady(page);
+  });
+
+  test("member picker creates a group DM from 2+ selected members", async ({ page }) => {
+    // Entry point: the "+" button in the embedded DM section (channels mode).
+    const newDmBtn = page.locator(".sidebar-dm-section .category-add-btn");
+    await expect(newDmBtn).toBeVisible({ timeout: 5_000 });
+    await newDmBtn.click();
+
+    const modal = page.locator(".dm-member-picker-modal");
+    await expect(modal).toBeVisible({ timeout: 5_000 });
+
+    // Select two members — the picker itself decides "group" once 2+ are picked.
+    const pick2 = page.locator("[data-testid='dm-picker-member-2']");
+    const pick3 = page.locator("[data-testid='dm-picker-member-3']");
+    await expect(pick2).toBeVisible();
+    await expect(pick3).toBeVisible();
+    await pick2.click();
+    await pick3.click();
+
+    const createBtn = page.locator("[data-testid='dm-picker-create']");
+    await expect(createBtn).toBeVisible();
+    await expect(createBtn).toHaveText("Create Group DM (3)");
+
+    await createBtn.click();
+
+    // Outgoing request: POST /api/v1/dms/group with both recipient ids.
+    const call = await waitForCapturedCall(
+      page,
+      (c) => c.cmd === "plugin:http|fetch" && (c.url ?? "").includes("/api/v1/dms/group"),
+    );
+    expect(call.method).toBe("POST");
+    const body = JSON.parse(call.body ?? "{}") as { recipient_ids: number[]; name: string };
+    expect(body.recipient_ids.toSorted()).toEqual([2, 3]);
+
+    // Round-trip observable effect: the app switches into the new group DM.
+    const backHeader = page.locator("[data-testid='dm-back-header']");
+    await expect(backHeader).toBeVisible({ timeout: 5_000 });
+  });
+
+  test("a group DM in dm_channels renders stacked avatars + member count, and Leave Group fires DELETE", async ({
+    page,
+  }) => {
+    // Open the seeded group DM from the channels-mode preview to switch into
+    // full DM sidebar mode, where DmSidebar renders the group-specific chrome.
+    const dmEntry = page.locator("[data-testid='dm-entry']").first();
+    await expect(dmEntry).toBeVisible({ timeout: 5_000 });
+    await dmEntry.click();
+
+    const groupItem = page.locator(`.dm-item[data-channel-id="${GROUP_DM_CHANNEL_ID}"]`);
+    await expect(groupItem).toBeVisible({ timeout: 5_000 });
+
+    // Stacked avatars + participant count (2 recipients + self = 3).
+    const avatarStack = page.locator(`[data-testid='dm-avatar-stack-${GROUP_DM_CHANNEL_ID}']`);
+    await expect(avatarStack).toBeVisible();
+    const memberCount = page.locator(`[data-testid='dm-members-${GROUP_DM_CHANNEL_ID}']`);
+    await expect(memberCount).toHaveText("3");
+
+    // Leave via the row's context menu (avoids relying on the hover-only close button).
+    await groupItem.click({ button: "right" });
+    const leaveItem = page.locator(`[data-testid='dm-close-${GROUP_DM_CHANNEL_ID}']`);
+    await expect(leaveItem).toBeVisible({ timeout: 5_000 });
+    await expect(leaveItem).toHaveText("Leave Group");
+    await leaveItem.click();
+
+    const call = await waitForCapturedCall(
+      page,
+      (c) =>
+        c.cmd === "plugin:http|fetch" &&
+        (c.url ?? "").includes(`/api/v1/dms/${GROUP_DM_CHANNEL_ID}`),
+    );
+    expect(call.method).toBe("DELETE");
+
+    // Observable effect: the row is gone (removed optimistically, per
+    // SidebarArea.closeOrLeaveDm's comment — it does not wait on the request).
+    await expect(groupItem).not.toBeVisible({ timeout: 5_000 });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Feature 2: Change Role via the member context menu
+// ---------------------------------------------------------------------------
+
+async function mockRoleChangeSession(page: Page): Promise<void> {
+  await page.addInitScript(
+    buildTauriMockScript({
+      httpRoutes: [
+        { pattern: "/api/v1/health", status: 200, body: { status: "ok", version: "1.0.0" } },
+        { pattern: "/api/v1/auth/login", status: 200, body: MOCK_LOGIN_RESPONSE },
+        { pattern: "/messages", status: 200, body: MOCK_MESSAGES },
+        { pattern: "/pins", status: 200, body: MOCK_PINNED_MESSAGES },
+        { pattern: "/admin/api/users/", status: 200, body: {} },
+      ],
+      simulateWsFlow: true,
+      readyOverrides: {
+        members: MOCK_MEMBERS_MULTI_ROLE,
+      },
+    }),
+  );
+  await page.addInitScript(captureScript);
+}
+
+test.describe("@parity Change Role via member context menu", () => {
+  test.beforeEach(async ({ page }) => {
+    await mockRoleChangeSession(page);
+    await page.goto("/");
+    await navigateToMainPage(page);
+    await waitForWsReady(page);
+  });
+
+  test("admin sees Change Role with role options, and picking one fires the role-change request", async ({
+    page,
+  }) => {
+    // testuser (local user, id 1) is "admin" — MANAGE_ROLES comes from the
+    // ADMINISTRATOR bit in MOCK_ROLES, so the full admin menu renders.
+    const target = page.locator("[data-testid='member-2']"); // moderator1, role "moderator"
+    await expect(target).toBeVisible({ timeout: 5_000 });
+    await target.click({ button: "right" });
+
+    const menu = page.locator(".context-menu").first();
+    await expect(menu).toBeVisible({ timeout: 5_000 });
+
+    const roleTrigger = menu.locator(".context-menu__item", { hasText: "Change Role" });
+    await expect(roleTrigger).toBeVisible();
+
+    // The submenu is hidden until hover (JS mouseenter, not pure CSS :hover).
+    await roleTrigger.hover();
+    const submenu = menu.locator(".context-menu__submenu");
+    await expect(submenu).toBeVisible();
+
+    // All three server roles are offered (MOCK_ROLES, minus "owner" — none seeded).
+    for (const role of MOCK_ROLES.map((r) => r.name)) {
+      await expect(submenu.locator(".context-menu__item", { hasText: role })).toBeVisible();
+    }
+
+    // moderator1 is currently "moderator" — pick "member" instead.
+    const memberOption = submenu.locator(".context-menu__item", { hasText: "member" }).first();
+    await memberOption.click();
+
+    // Outgoing request: PATCH /admin/api/users/2 { role_id: 3 } (member's id in MOCK_ROLES).
+    const call = await waitForCapturedCall(
+      page,
+      (c) => c.cmd === "plugin:http|fetch" && (c.url ?? "").includes("/admin/api/users/2"),
+    );
+    expect(call.method).toBe("PATCH");
+    const body = JSON.parse(call.body ?? "{}") as { role_id: number };
+    expect(body.role_id).toBe(3);
+  });
+});
diff --git a/Client/tauri-client/tests/helpers/test-utils.ts b/Client/tauri-client/tests/helpers/test-utils.ts
index 07673da5..01f31fc5 100644
--- a/Client/tauri-client/tests/helpers/test-utils.ts
+++ b/Client/tauri-client/tests/helpers/test-utils.ts
@@ -47,6 +47,7 @@ const MESSAGES_INITIAL: MessagesState = {
   loadedChannels: new Set(),
   hasMore: new Map(),
   historyLoadState: new Map(),
+  detachedChannels: new Set(),
 };
 
 const VOICE_INITIAL: VoiceState = {
@@ -99,6 +100,7 @@ export function resetAllStores(): void {
     loadedChannels: new Set(),
     hasMore: new Map(),
     historyLoadState: new Map(),
+    detachedChannels: new Set(),
   }));
   voiceStore.setState(() => ({
     ...VOICE_INITIAL,
diff --git a/Client/tauri-client/tests/integration/stores.test.ts b/Client/tauri-client/tests/integration/stores.test.ts
index 9bae2ce8..e8ae8217 100644
--- a/Client/tauri-client/tests/integration/stores.test.ts
+++ b/Client/tauri-client/tests/integration/stores.test.ts
@@ -125,6 +125,7 @@ function resetAllStores(): void {
     loadedChannels: new Set(),
     hasMore: new Map(),
     historyLoadState: new Map(),
+    detachedChannels: new Set(),
   }));
   voiceStore.setState(() => ({
     currentChannelId: null,
diff --git a/Client/tauri-client/tests/unit/account-tab-profile.test.ts b/Client/tauri-client/tests/unit/account-tab-profile.test.ts
new file mode 100644
index 00000000..ea8b232f
--- /dev/null
+++ b/Client/tauri-client/tests/unit/account-tab-profile.test.ts
@@ -0,0 +1,171 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import { buildAccountTab, validateAvatarFile } from "@components/settings/AccountTab";
+import { authStore } from "@stores/auth.store";
+import type { SettingsOverlayOptions } from "@components/SettingsOverlay";
+
+/**
+ * The Account tab's new job: edit the display name and about text, and upload
+ * an avatar. The upload is validated locally against the same rules the server
+ * enforces, so a picture that is going to be refused is refused before a
+ * megabyte goes over the wire.
+ */
+
+function setUser(patch: Record<string, unknown>): void {
+  authStore.setState(() => ({
+    token: "tok",
+    user: { id: 1, username: "alice", avatar: null, role: "member", ...patch } as never,
+    serverName: "s",
+    motd: null,
+    isAuthenticated: true,
+  }));
+}
+
+function makeOptions(overrides?: Partial<SettingsOverlayOptions>): SettingsOverlayOptions {
+  return {
+    onClose: vi.fn(),
+    onChangePassword: vi.fn().mockResolvedValue(undefined),
+    onUpdateProfile: vi.fn().mockResolvedValue(undefined),
+    onUploadAvatar: vi.fn().mockResolvedValue("/api/v1/files/abc"),
+    onLogout: vi.fn(),
+    onDeleteAccount: vi.fn().mockResolvedValue(undefined),
+    onStatusChange: vi.fn(),
+    onEnableTotp: vi.fn().mockResolvedValue({ qr_uri: "", backup_codes: [] }),
+    onConfirmTotp: vi.fn().mockResolvedValue(undefined),
+    onDisableTotp: vi.fn().mockResolvedValue(undefined),
+    ...overrides,
+  };
+}
+
+describe("validateAvatarFile", () => {
+  const ok = { width: 512, height: 512 };
+
+  it("accepts a PNG, JPEG or WebP within the caps", () => {
+    for (const type of ["image/png", "image/jpeg", "image/webp"]) {
+      expect(validateAvatarFile({ size: 1000, type }, ok)).toBeNull();
+    }
+  });
+
+  it("rejects a type the server refuses", () => {
+    // GIF is a real image and still refused — an animated avatar in every
+    // message row is a distraction the renderer cannot opt out of.
+    expect(validateAvatarFile({ size: 1000, type: "image/gif" }, ok)).toMatch(/PNG, JPEG or WebP/);
+    expect(validateAvatarFile({ size: 1000, type: "image/svg+xml" }, ok)).not.toBeNull();
+  });
+
+  it("rejects a file over 1 MB", () => {
+    expect(validateAvatarFile({ size: 1024 * 1024 + 1, type: "image/png" }, ok)).toMatch(/KB/);
+    // Exactly at the cap is fine.
+    expect(validateAvatarFile({ size: 1024 * 1024, type: "image/png" }, ok)).toBeNull();
+  });
+
+  it("rejects an image bigger than any surface renders", () => {
+    expect(
+      validateAvatarFile({ size: 1000, type: "image/png" }, { width: 2000, height: 100 }),
+    ).toMatch(/pixels/);
+    expect(
+      validateAvatarFile({ size: 1000, type: "image/png" }, { width: 1024, height: 1024 }),
+    ).toBeNull();
+  });
+
+  it("rejects a file that could not be decoded at all", () => {
+    expect(validateAvatarFile({ size: 1000, type: "image/png" }, null)).toMatch(
+      /could not be read/,
+    );
+  });
+});
+
+describe("Account tab profile fields", () => {
+  let container: HTMLDivElement;
+  let ac: AbortController;
+
+  beforeEach(() => {
+    localStorage.clear();
+    container = document.createElement("div");
+    document.body.appendChild(container);
+    ac = new AbortController();
+  });
+
+  afterEach(() => {
+    ac.abort();
+    container.remove();
+  });
+
+  it("pre-fills the display name and about from the signed-in user", () => {
+    setUser({ display_name: "Alice A.", about: "writes tests" });
+    container.appendChild(buildAccountTab(makeOptions(), ac.signal));
+
+    const name = container.querySelector<HTMLInputElement>('[data-testid="display-name-input"]')!;
+    const about = container.querySelector<HTMLTextAreaElement>('[data-testid="about-input"]')!;
+    expect(name.value).toBe("Alice A.");
+    expect(about.value).toBe("writes tests");
+  });
+
+  it("heads the card with the display name, falling back to the username", () => {
+    setUser({ display_name: "Alice A." });
+    container.appendChild(buildAccountTab(makeOptions(), ac.signal));
+    expect(container.querySelector(".account-header-name")?.textContent).toBe("Alice A.");
+    // The letter fallback follows the rendered name, not the username.
+    expect(container.querySelector('[data-testid="account-avatar"]')?.textContent).toBe("A");
+
+    container.replaceChildren();
+    setUser({ display_name: null });
+    container.appendChild(buildAccountTab(makeOptions(), ac.signal));
+    expect(container.querySelector(".account-header-name")?.textContent).toBe("alice");
+  });
+
+  it("sends both fields on save, empty string included", async () => {
+    setUser({ display_name: "Alice A.", about: "writes tests" });
+    const options = makeOptions();
+    container.appendChild(buildAccountTab(options, ac.signal));
+
+    const name = container.querySelector<HTMLInputElement>('[data-testid="display-name-input"]')!;
+    const about = container.querySelector<HTMLTextAreaElement>('[data-testid="about-input"]')!;
+    name.value = "  Ada  ";
+    about.value = "";
+    container.querySelector<HTMLButtonElement>('[data-testid="profile-save-btn"]')!.click();
+
+    // "" is the API's "clear it"; omitting the field would mean "leave it
+    // alone", so a blanked textarea has to be sent, not dropped.
+    await vi.waitFor(() => {
+      expect(options.onUpdateProfile).toHaveBeenCalledWith({ display_name: "Ada", about: "" });
+    });
+  });
+
+  it("surfaces a save failure without clearing the form", async () => {
+    setUser({});
+    const options = makeOptions({
+      onUpdateProfile: vi.fn().mockRejectedValue(new Error("display_name too long")),
+    });
+    container.appendChild(buildAccountTab(options, ac.signal));
+
+    const name = container.querySelector<HTMLInputElement>('[data-testid="display-name-input"]')!;
+    name.value = "Ada";
+    container.querySelector<HTMLButtonElement>('[data-testid="profile-save-btn"]')!.click();
+
+    await vi.waitFor(() => {
+      expect(container.querySelector('[data-testid="profile-error"]')?.textContent).toBe(
+        "display_name too long",
+      );
+    });
+    expect(name.value).toBe("Ada");
+  });
+
+  it("bounds the inputs at the server's caps", () => {
+    setUser({});
+    container.appendChild(buildAccountTab(makeOptions(), ac.signal));
+    expect(
+      container.querySelector('[data-testid="display-name-input"]')?.getAttribute("maxlength"),
+    ).toBe("32");
+    expect(container.querySelector('[data-testid="about-input"]')?.getAttribute("maxlength")).toBe(
+      "300",
+    );
+  });
+
+  it("offers an avatar uploader restricted to the accepted types", () => {
+    setUser({});
+    container.appendChild(buildAccountTab(makeOptions(), ac.signal));
+    const input = container.querySelector<HTMLInputElement>('[data-testid="avatar-file-input"]')!;
+    expect(input.getAttribute("accept")).toBe("image/png,image/jpeg,image/webp");
+    expect(container.querySelector('[data-testid="avatar-upload-btn"]')).not.toBeNull();
+  });
+});
diff --git a/Client/tauri-client/tests/unit/admin-actions.test.ts b/Client/tauri-client/tests/unit/admin-actions.test.ts
index d76119c4..b595f2d0 100644
--- a/Client/tauri-client/tests/unit/admin-actions.test.ts
+++ b/Client/tauri-client/tests/unit/admin-actions.test.ts
@@ -21,9 +21,14 @@ describe("AdminActions", () => {
         username: "TestUser",
         currentRole: "member",
         availableRoles: ["admin", "moderator", "member"],
+        showAdminActions: overrides?.showAdminActions ?? true,
+        isBlocked: overrides?.isBlocked ?? false,
+        onToggleBlock: overrides?.onToggleBlock ?? vi.fn(async () => {}),
         onKick: overrides?.onKick ?? vi.fn(async () => {}),
         onBan: overrides?.onBan ?? vi.fn(async () => {}),
         onChangeRole: overrides?.onChangeRole ?? vi.fn(async () => {}),
+        // Per-action gates (canKick/canBan/canManageRoles) come through as-is.
+        ...overrides,
       };
       const result = createMemberContextMenu(options);
       container.appendChild(result.element);
@@ -66,27 +71,27 @@ describe("AdminActions", () => {
       result.destroy();
     });
 
-    it("renders Kick and Ban items with danger class", () => {
+    it("renders Force Logout and Ban items with danger class", () => {
       const { result } = makeMenu();
       const dangerItems = result.element.querySelectorAll(".context-menu__item--danger");
       const texts = Array.from(dangerItems).map((i) => i.textContent);
-      expect(texts).toContain("Kick");
+      expect(texts).toContain("Force Logout");
       expect(texts).toContain("Ban");
       result.destroy();
     });
 
-    it("Kick requires double-click confirmation", () => {
+    it("Force Logout requires double-click confirmation", () => {
       const onKick = vi.fn(async () => {});
       const { result } = makeMenu({ onKick });
 
       const dangerItems = result.element.querySelectorAll(".context-menu__item--danger");
       const kickItem = Array.from(dangerItems).find(
-        (i) => i.textContent === "Kick",
+        (i) => i.textContent === "Force Logout",
       ) as HTMLDivElement;
 
       // First click changes text to confirmation
       kickItem.click();
-      expect(kickItem.textContent).toBe("Are you sure?");
+      expect(kickItem.textContent).toBe("Log them out?");
       expect(onKick).not.toHaveBeenCalled();
 
       // Second click confirms
@@ -117,7 +122,29 @@ describe("AdminActions", () => {
       confirm.click();
 
       // The server stores and displays the reason, so it's trimmed, not raw.
-      expect(onBan).toHaveBeenCalledWith("spamming");
+      // Default duration is 0 (permanent).
+      expect(onBan).toHaveBeenCalledWith("spamming", 0);
+      result.destroy();
+    });
+
+    it("Ban passes the selected duration in hours", () => {
+      const onBan = vi.fn(async () => {});
+      const { result } = makeMenu({ onBan });
+
+      const banItem = Array.from(
+        result.element.querySelectorAll(".context-menu__item--danger"),
+      ).find((i) => i.textContent === "Ban") as HTMLDivElement;
+      banItem.click();
+
+      const durationSelect = result.element.querySelector(
+        "[data-testid='ban-duration-select']",
+      ) as HTMLSelectElement;
+      expect(durationSelect).not.toBeNull();
+      durationSelect.value = "24";
+
+      (result.element.querySelector("[data-testid='ban-confirm']") as HTMLDivElement).click();
+
+      expect(onBan).toHaveBeenCalledWith("", 24);
       result.destroy();
     });
 
@@ -131,7 +158,7 @@ describe("AdminActions", () => {
       banItem.click();
       (result.element.querySelector("[data-testid='ban-confirm']") as HTMLDivElement).click();
 
-      expect(onBan).toHaveBeenCalledWith("");
+      expect(onBan).toHaveBeenCalledWith("", 0);
       result.destroy();
     });
 
@@ -159,7 +186,7 @@ describe("AdminActions", () => {
       result.destroy();
     });
 
-    it("Kick shows an in-flight state and disarms after a pause", async () => {
+    it("Force Logout shows an in-flight state and disarms after a pause", async () => {
       vi.useFakeTimers();
       try {
         let release: (() => void) | null = null;
@@ -172,23 +199,23 @@ describe("AdminActions", () => {
         const { result } = makeMenu({ onKick });
         const kickItem = Array.from(
           result.element.querySelectorAll(".context-menu__item--danger"),
-        ).find((i) => i.textContent === "Kick") as HTMLDivElement;
+        ).find((i) => i.textContent === "Force Logout") as HTMLDivElement;
 
-        // Armed, then left alone — a stray later click must not kick anyone.
+        // Armed, then left alone — a stray later click must not log anyone out.
         kickItem.click();
-        expect(kickItem.textContent).toBe("Are you sure?");
+        expect(kickItem.textContent).toBe("Log them out?");
         vi.advanceTimersByTime(5000);
-        expect(kickItem.textContent).toBe("Kick");
+        expect(kickItem.textContent).toBe("Force Logout");
         kickItem.click();
         expect(onKick).not.toHaveBeenCalled();
 
         kickItem.click();
         expect(onKick).toHaveBeenCalledOnce();
-        expect(kickItem.textContent).toBe("Kicking...");
+        expect(kickItem.textContent).toBe("Logging out...");
 
         release!();
         await vi.waitFor(() => {
-          expect(kickItem.textContent).toBe("Kick");
+          expect(kickItem.textContent).toBe("Force Logout");
         });
         result.destroy();
       } finally {
@@ -209,6 +236,90 @@ describe("AdminActions", () => {
       result.destroy();
       expect(container.querySelector(".context-menu")).toBeNull();
     });
+
+    it("renders only the Block item when showAdminActions is false", () => {
+      const { result } = makeMenu({ showAdminActions: false });
+      const items = result.element.querySelectorAll(".context-menu__item");
+      const texts = Array.from(items).map((i) => i.textContent);
+      expect(texts).toEqual(["Block"]);
+      result.destroy();
+    });
+
+    it("Block requires double-click confirmation", () => {
+      const onToggleBlock = vi.fn(async () => {});
+      const { result } = makeMenu({ showAdminActions: false, onToggleBlock });
+      const blockItem = result.element.querySelector<HTMLElement>('[data-testid="block-toggle"]');
+      expect(blockItem).not.toBeNull();
+      blockItem?.click();
+      expect(blockItem?.textContent).toBe("Are you sure?");
+      expect(onToggleBlock).not.toHaveBeenCalled();
+      blockItem?.click();
+      expect(onToggleBlock).toHaveBeenCalledOnce();
+      result.destroy();
+    });
+
+    it("Unblock fires on a single click when already blocked", () => {
+      const onToggleBlock = vi.fn(async () => {});
+      const { result } = makeMenu({ showAdminActions: false, isBlocked: true, onToggleBlock });
+      const blockItem = result.element.querySelector<HTMLElement>('[data-testid="block-toggle"]');
+      expect(blockItem?.textContent).toBe("Unblock");
+      blockItem?.click();
+      expect(onToggleBlock).toHaveBeenCalledOnce();
+      result.destroy();
+    });
+
+    it("admin menu also includes the Block item", () => {
+      const { result } = makeMenu();
+      const blockItem = result.element.querySelector('[data-testid="block-toggle"]');
+      expect(blockItem).not.toBeNull();
+      result.destroy();
+    });
+
+    // Per-action gates: the caller maps the server's KICK_MEMBERS /
+    // BAN_MEMBERS / MANAGE_ROLES bits onto these, so a moderator holding only
+    // some of them must not see the rest.
+    describe("per-action permission gates", () => {
+      /** Top-level item labels (role submenu entries share the item class). */
+      function topLevelLabels(el: HTMLElement): string[] {
+        return Array.from(el.children)
+          .filter((c) => c.classList.contains("context-menu__item"))
+          .map((c) => c.firstChild?.textContent ?? "");
+      }
+
+      it("omits Change Role when canManageRoles is false", () => {
+        const { result } = makeMenu({ canManageRoles: false });
+        const labels = topLevelLabels(result.element);
+        expect(labels).not.toContain("Change Role");
+        expect(result.element.querySelector(".context-menu__submenu")).toBeNull();
+        expect(labels).toContain("Force Logout");
+        expect(labels).toContain("Ban");
+        result.destroy();
+      });
+
+      it("omits Force Logout when canKick is false", () => {
+        const { result } = makeMenu({ canKick: false });
+        const labels = topLevelLabels(result.element);
+        expect(labels).not.toContain("Force Logout");
+        expect(labels).toContain("Ban");
+        result.destroy();
+      });
+
+      it("omits the whole ban flow when canBan is false", () => {
+        const { result } = makeMenu({ canBan: false });
+        const labels = topLevelLabels(result.element);
+        expect(labels).not.toContain("Ban");
+        expect(result.element.querySelector('[data-testid="ban-confirm"]')).toBeNull();
+        expect(labels).toContain("Force Logout");
+        expect(labels).toContain("Block");
+        result.destroy();
+      });
+
+      it("falls back to Block-only when no action bit is held", () => {
+        const { result } = makeMenu({ canKick: false, canBan: false, canManageRoles: false });
+        expect(topLevelLabels(result.element)).toEqual(["Block"]);
+        result.destroy();
+      });
+    });
   });
 
   describe("ChannelContextMenu", () => {
@@ -219,6 +330,8 @@ describe("AdminActions", () => {
         onEdit: overrides?.onEdit ?? vi.fn(),
         onDelete: overrides?.onDelete ?? vi.fn(async () => {}),
         onCreate: overrides?.onCreate ?? vi.fn(),
+        // Purge is opt-in: the section is absent unless the caller passes it.
+        ...(overrides?.onPurge !== undefined ? { onPurge: overrides.onPurge } : {}),
       };
       const result = createChannelContextMenu(options);
       container.appendChild(result.element);
@@ -292,5 +405,85 @@ describe("AdminActions", () => {
       result.destroy();
       expect(container.querySelector(".context-menu")).toBeNull();
     });
+
+    it("omits the purge section when onPurge is not supplied", () => {
+      const { result } = makeMenu();
+      expect(result.element.querySelector('[data-testid="ctx-purge-messages"]')).toBeNull();
+      result.destroy();
+    });
+
+    it("purge asks for a count before it fires and clamps to 1-100", async () => {
+      const onPurge = vi.fn(async () => {});
+      const { result } = makeMenu({ onPurge });
+
+      const trigger = result.element.querySelector(
+        '[data-testid="ctx-purge-messages"]',
+      ) as HTMLDivElement;
+      expect(trigger.textContent).toBe("Purge Messages…");
+
+      const form = result.element.querySelector('[data-testid="purge-form"]') as HTMLDivElement;
+      expect(form.style.display).toBe("none");
+      trigger.click();
+      expect(form.style.display).toBe("");
+      expect(onPurge).not.toHaveBeenCalled();
+
+      const input = result.element.querySelector(
+        '[data-testid="purge-count-input"]',
+      ) as HTMLInputElement;
+      input.value = "0";
+      (result.element.querySelector('[data-testid="purge-confirm"]') as HTMLDivElement).click();
+
+      await vi.waitFor(() => {
+        expect(onPurge).toHaveBeenCalledWith(1);
+      });
+      result.destroy();
+    });
+
+    it("purge falls back to the default count for a non-numeric entry", async () => {
+      const onPurge = vi.fn(async () => {});
+      const { result } = makeMenu({ onPurge });
+
+      (
+        result.element.querySelector('[data-testid="ctx-purge-messages"]') as HTMLDivElement
+      ).click();
+      const input = result.element.querySelector(
+        '[data-testid="purge-count-input"]',
+      ) as HTMLInputElement;
+      input.value = "";
+      (result.element.querySelector('[data-testid="purge-confirm"]') as HTMLDivElement).click();
+
+      await vi.waitFor(() => {
+        expect(onPurge).toHaveBeenCalledWith(50);
+      });
+      result.destroy();
+    });
+
+    it("purge shows an in-flight state and ignores a second click", async () => {
+      let release: (() => void) | null = null;
+      const onPurge = vi.fn(
+        () =>
+          new Promise<void>((resolve) => {
+            release = resolve;
+          }),
+      );
+      const { result } = makeMenu({ onPurge });
+
+      (
+        result.element.querySelector('[data-testid="ctx-purge-messages"]') as HTMLDivElement
+      ).click();
+      const confirm = result.element.querySelector(
+        '[data-testid="purge-confirm"]',
+      ) as HTMLDivElement;
+      confirm.click();
+      expect(confirm.textContent).toBe("Purging…");
+      confirm.click();
+      expect(onPurge).toHaveBeenCalledTimes(1);
+
+      release!();
+      await vi.waitFor(() => {
+        expect(confirm.textContent).toBe("Confirm Purge");
+      });
+      result.destroy();
+    });
   });
 });
diff --git a/Client/tauri-client/tests/unit/admin-panel.test.ts b/Client/tauri-client/tests/unit/admin-panel.test.ts
new file mode 100644
index 00000000..a19369e4
--- /dev/null
+++ b/Client/tauri-client/tests/unit/admin-panel.test.ts
@@ -0,0 +1,44 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+const openUrl = vi.fn(async () => {});
+vi.mock("@tauri-apps/plugin-opener", () => ({
+  openUrl,
+}));
+
+import { adminPanelUrl, openAdminPanel } from "@lib/admin-panel";
+
+describe("adminPanelUrl", () => {
+  it("points at the server's /admin path over https", () => {
+    expect(adminPanelUrl("chat.example.com")).toBe("https://chat.example.com/admin");
+  });
+
+  it("keeps an explicit port", () => {
+    expect(adminPanelUrl("localhost:8443")).toBe("https://localhost:8443/admin");
+  });
+
+  it("deep-links a section with a fragment", () => {
+    expect(adminPanelUrl("localhost:8443", "audit")).toBe("https://localhost:8443/admin#audit");
+  });
+
+  it("omits the fragment for an empty section", () => {
+    expect(adminPanelUrl("localhost:8443", "")).toBe("https://localhost:8443/admin");
+  });
+
+  // The REST client tunnels through a loopback TOFU proxy so the webview can
+  // reach a self-signed server. That origin means nothing to an external
+  // browser, so the panel URL must be the real host.
+  it("does not route through the local http proxy", () => {
+    expect(adminPanelUrl("localhost:8443")).not.toContain("127.0.0.1");
+  });
+});
+
+describe("openAdminPanel", () => {
+  beforeEach(() => {
+    openUrl.mockClear();
+  });
+
+  it("hands the URL to the system opener", async () => {
+    await openAdminPanel("localhost:8443", "audit");
+    expect(openUrl).toHaveBeenCalledWith("https://localhost:8443/admin#audit");
+  });
+});
diff --git a/Client/tauri-client/tests/unit/api.test.ts b/Client/tauri-client/tests/unit/api.test.ts
index 9049fe81..cb003b40 100644
--- a/Client/tauri-client/tests/unit/api.test.ts
+++ b/Client/tauri-client/tests/unit/api.test.ts
@@ -242,6 +242,50 @@ describe("API Client", () => {
       await api.getMessages(3);
       expect(fetchCallUrl()).toBe("https://localhost:8443/api/v1/channels/3/messages");
     });
+
+    it("getMessagesAround hits the around route with the message id in the path", async () => {
+      mockFetch.mockResolvedValue(
+        jsonResponse({ messages: [], has_more_before: false, has_more_after: false }),
+      );
+      await api.getMessagesAround(5, 4242);
+      expect(fetchCallUrl()).toBe("https://localhost:8443/api/v1/channels/5/messages/around/4242");
+    });
+
+    it("getMessagesAround passes the limit", async () => {
+      mockFetch.mockResolvedValue(
+        jsonResponse({ messages: [], has_more_before: false, has_more_after: false }),
+      );
+      await api.getMessagesAround(5, 42, { limit: 30 });
+      expect(fetchCallUrl()).toContain("limit=30");
+    });
+
+    it("getMessagesAround returns the has-more flags for both sides", async () => {
+      mockFetch.mockResolvedValue(
+        jsonResponse({ messages: [], has_more_before: true, has_more_after: false }),
+      );
+      const resp = await api.getMessagesAround(5, 42);
+      expect(resp.has_more_before).toBe(true);
+      expect(resp.has_more_after).toBe(false);
+    });
+
+    // The emoji is a path segment: unescaped it would either break the route or
+    // resolve to a different emoji than the one on the pill.
+    it("getReactionUsers percent-encodes the emoji in the path", async () => {
+      mockFetch.mockResolvedValue(jsonResponse({ users: [] }));
+      await api.getReactionUsers(5, 42, "👍");
+      expect(fetchCallUrl()).toBe(
+        "https://localhost:8443/api/v1/channels/5/messages/42/reactions/%F0%9F%91%8D/users",
+      );
+    });
+
+    it("getReactionUsers returns the reactor list", async () => {
+      mockFetch.mockResolvedValue(
+        jsonResponse({ users: [{ id: 1, username: "alice", avatar: "" }] }),
+      );
+      const resp = await api.getReactionUsers(5, 42, "👍");
+      expect(resp.users).toHaveLength(1);
+      expect(resp.users[0]?.username).toBe("alice");
+    });
   });
 
   describe("config management", () => {
@@ -300,6 +344,15 @@ describe("API Client", () => {
       expect(body.avatar).toBe("data:image/png;base64,abc");
     });
 
+    it("updateProfile sends display_name and about, empty string included", async () => {
+      mockFetch.mockResolvedValue(jsonResponse({ id: 1, username: "u" }));
+      // "" is how the API says "clear it"; omitting a field means "leave it
+      // alone", so the two must not be collapsed on the way out.
+      await api.updateProfile({ username: "u", display_name: "Ada L.", about: "" });
+      const body = JSON.parse(fetchCallOpts().body as string);
+      expect(body).toEqual({ username: "u", display_name: "Ada L.", about: "" });
+    });
+
     it("changePassword sends PUT /users/me/password", async () => {
       mockFetch.mockResolvedValue(jsonResponse(undefined, 204));
       await api.changePassword("oldpw", "newpw");
@@ -471,6 +524,21 @@ describe("API Client", () => {
       expect(fetchCallUrl()).toBe("https://localhost:8443/api/v1/channels/7/pins/99");
       expect(fetchCallOpts().method).toBe("DELETE");
     });
+
+    it("purgeMessages posts the limit to /channels/{id}/messages/purge", async () => {
+      mockFetch.mockResolvedValue(jsonResponse({ channel_id: 7, ids: [3, 2], count: 2 }));
+      const result = await api.purgeMessages(7, 25);
+      expect(fetchCallUrl()).toBe("https://localhost:8443/api/v1/channels/7/messages/purge");
+      expect(fetchCallOpts().method).toBe("POST");
+      expect(JSON.parse(String(fetchCallOpts().body))).toEqual({ limit: 25 });
+      expect(result.count).toBe(2);
+    });
+
+    it("purgeMessages includes before only when supplied", async () => {
+      mockFetch.mockResolvedValue(jsonResponse({ channel_id: 7, ids: [], count: 0 }));
+      await api.purgeMessages(7, 10, { before: 42 });
+      expect(JSON.parse(String(fetchCallOpts().body))).toEqual({ limit: 10, before: 42 });
+    });
   });
 
   describe("search endpoint", () => {
@@ -513,6 +581,48 @@ describe("API Client", () => {
       expect(result).toEqual({ url: "https://cdn/file.png", filename: "file.png" });
     });
 
+    it("uploadAvatar posts multipart to /users/me/avatar", async () => {
+      mockFetch.mockResolvedValue(
+        jsonResponse({
+          id: "abc",
+          filename: "me.png",
+          size: 100,
+          mime: "image/png",
+          url: "/api/v1/files/abc",
+        }),
+      );
+      const file = new File(["png"], "me.png", { type: "image/png" });
+      const result = await api.uploadAvatar(file);
+
+      expect(fetchCallUrl()).toBe("https://localhost:8443/api/v1/users/me/avatar");
+      expect(fetchCallOpts().method).toBe("POST");
+      expect(fetchCallOpts().body).toBeInstanceOf(FormData);
+      const headers = fetchCallOpts().headers as Record<string, string>;
+      expect(headers["Authorization"]).toBe("Bearer test-token");
+      // The browser has to set the multipart boundary itself.
+      expect(headers["Content-Type"]).toBeUndefined();
+      // The URL the server stored is what the caller needs back.
+      expect(result.url).toBe("/api/v1/files/abc");
+    });
+
+    it("uploadAvatar surfaces a rejected image as an ApiClientError", async () => {
+      mockFetch.mockResolvedValue(
+        errorResponse(400, "BAD_REQUEST", "avatar must be a PNG, JPEG or WebP image"),
+      );
+      const file = new File(["x"], "me.gif", { type: "image/gif" });
+      await expect(api.uploadAvatar(file)).rejects.toMatchObject({
+        status: 400,
+        code: "BAD_REQUEST",
+      });
+    });
+
+    it("uploadAvatar calls onUnauthorized on 401", async () => {
+      mockFetch.mockResolvedValue(errorResponse(401, "UNAUTHORIZED", "Invalid session"));
+      const file = new File(["x"], "me.png", { type: "image/png" });
+      await expect(api.uploadAvatar(file)).rejects.toMatchObject({ status: 401 });
+      expect(onUnauthorized).toHaveBeenCalledTimes(1);
+    });
+
     it("uploadFile throws ApiClientError on non-ok", async () => {
       mockFetch.mockResolvedValue(errorResponse(413, "FILE_TOO_LARGE", "File exceeds limit"));
       const file = new File(["x"], "big.bin");
@@ -591,12 +701,49 @@ describe("API Client", () => {
   });
 
   describe("emoji endpoints", () => {
-    it("getEmoji calls GET /emoji", async () => {
-      mockFetch.mockResolvedValue(jsonResponse([{ id: 1, name: "smile" }]));
-      const result = await api.getEmoji();
+    it("listEmoji calls GET /emoji", async () => {
+      mockFetch.mockResolvedValue(
+        jsonResponse([{ id: 1, shortcode: "smile", url: "/api/v1/emoji/1/image" }]),
+      );
+      const result = await api.listEmoji();
       expect(fetchCallUrl()).toBe("https://localhost:8443/api/v1/emoji");
       expect(fetchCallOpts().method).toBe("GET");
-      expect(result).toEqual([{ id: 1, name: "smile" }]);
+      expect(result).toEqual([{ id: 1, shortcode: "smile", url: "/api/v1/emoji/1/image" }]);
+    });
+
+    it("uploadEmoji POSTs multipart with the shortcode and file", async () => {
+      mockFetch.mockResolvedValue(
+        jsonResponse({ id: 7, shortcode: "wave", url: "/api/v1/emoji/7/image" }, 201),
+      );
+      const file = new File(["png"], "wave.png", { type: "image/png" });
+      const result = await api.uploadEmoji("wave", file);
+
+      expect(fetchCallUrl()).toBe("https://localhost:8443/api/v1/emoji");
+      const opts = fetchCallOpts();
+      expect(opts.method).toBe("POST");
+      const body = opts.body as FormData;
+      expect(body.get("shortcode")).toBe("wave");
+      expect(body.get("file")).toBe(file);
+      // The browser owns the multipart boundary — setting Content-Type breaks it.
+      expect((opts.headers as Record<string, string>)["Content-Type"]).toBeUndefined();
+      expect(result.shortcode).toBe("wave");
+    });
+
+    it("uploadEmoji calls onUnauthorized on 401", async () => {
+      mockFetch.mockResolvedValue(errorResponse(401, "UNAUTHORIZED", "Invalid session"));
+      const file = new File(["png"], "wave.png", { type: "image/png" });
+      await expect(api.uploadEmoji("wave", file)).rejects.toMatchObject({ status: 401 });
+      expect(onUnauthorized).toHaveBeenCalledTimes(1);
+    });
+
+    it("uploadEmoji surfaces a 403 without calling onUnauthorized", async () => {
+      mockFetch.mockResolvedValue(errorResponse(403, "FORBIDDEN", "insufficient permissions"));
+      const file = new File(["png"], "wave.png", { type: "image/png" });
+      await expect(api.uploadEmoji("wave", file)).rejects.toMatchObject({
+        status: 403,
+        code: "FORBIDDEN",
+      });
+      expect(onUnauthorized).not.toHaveBeenCalled();
     });
 
     it("deleteEmoji calls DELETE /emoji/{id}", async () => {
@@ -643,6 +790,35 @@ describe("API Client", () => {
       expect(result).toEqual({ channel: { id: 10, type: "dm" } });
     });
 
+    it("createGroupDm calls POST /dms/group with recipient_ids and a name", async () => {
+      mockFetch.mockResolvedValue(jsonResponse({ channel_id: 11, is_group: true }));
+      const result = await api.createGroupDm([2, 3], "Crew");
+      expect(fetchCallUrl()).toBe("https://localhost:8443/api/v1/dms/group");
+      expect(fetchCallOpts().method).toBe("POST");
+      expect(JSON.parse(fetchCallOpts().body as string)).toEqual({
+        recipient_ids: [2, 3],
+        name: "Crew",
+      });
+      expect(result).toEqual({ channel_id: 11, is_group: true });
+    });
+
+    it("createGroupDm sends an empty name when none is given", async () => {
+      mockFetch.mockResolvedValue(jsonResponse({ channel_id: 11 }));
+      await api.createGroupDm([2, 3]);
+      expect(JSON.parse(fetchCallOpts().body as string)).toEqual({
+        recipient_ids: [2, 3],
+        name: "",
+      });
+    });
+
+    it("renameGroupDm calls PATCH /dms/{channelId}", async () => {
+      mockFetch.mockResolvedValue(jsonResponse({ channel_id: 11, name: "New" }));
+      await api.renameGroupDm(11, "New");
+      expect(fetchCallUrl()).toBe("https://localhost:8443/api/v1/dms/11");
+      expect(fetchCallOpts().method).toBe("PATCH");
+      expect(JSON.parse(fetchCallOpts().body as string)).toEqual({ name: "New" });
+    });
+
     it("closeDm calls DELETE /dms/{channelId}", async () => {
       mockFetch.mockResolvedValue(jsonResponse(undefined, 204));
       await api.closeDm(10);
diff --git a/Client/tauri-client/tests/unit/attachments-auth.test.ts b/Client/tauri-client/tests/unit/attachments-auth.test.ts
new file mode 100644
index 00000000..c17b374e
--- /dev/null
+++ b/Client/tauri-client/tests/unit/attachments-auth.test.ts
@@ -0,0 +1,101 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const { fetchMock, getTokenMock, ensureHttpProxyMock } = vi.hoisted(() => ({
+  fetchMock: vi.fn<any>(),
+  getTokenMock: vi.fn<any>(),
+  ensureHttpProxyMock: vi.fn<any>(),
+}));
+
+vi.mock("@tauri-apps/plugin-http", () => ({
+  fetch: fetchMock,
+}));
+
+vi.mock("@lib/httpProxy", () => ({
+  ensureHttpProxy: ensureHttpProxyMock,
+}));
+
+vi.mock("@stores/auth.store", () => ({
+  getToken: getTokenMock,
+}));
+
+vi.mock("@lib/logger", () => ({
+  createLogger: () => ({ debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() }),
+}));
+
+vi.mock("@tauri-apps/plugin-dialog", () => ({ save: vi.fn() }));
+vi.mock("@tauri-apps/plugin-fs", () => ({ writeFile: vi.fn() }));
+vi.mock("@lib/icons", () => ({ createIcon: () => document.createElement("span") }));
+vi.mock("@lib/media-visibility", () => ({ observeMedia: vi.fn() }));
+vi.mock("../../src/components/message-list/media", () => ({ openImageLightbox: vi.fn() }));
+
+// No-op IndexedDB so fetchImageAsDataUrl falls through to the network path.
+vi.stubGlobal("indexedDB", {
+  open: () => {
+    const req: Record<string, unknown> = { onsuccess: null, onerror: null, onupgradeneeded: null };
+    Promise.resolve().then(() => {
+      const fn = req.onerror as ((ev: Event) => void) | null;
+      fn?.(new Event("error"));
+    });
+    return req;
+  },
+});
+
+import {
+  clearAttachmentCaches,
+  fetchImageAsDataUrl,
+  setServerHost,
+} from "../../src/components/message-list/attachments";
+
+function imageResponse() {
+  return {
+    ok: true,
+    headers: { get: () => "image/png" },
+    arrayBuffer: vi.fn().mockResolvedValue(Uint8Array.from([1, 2, 3]).buffer),
+  };
+}
+
+describe("attachment fetch authentication", () => {
+  beforeEach(() => {
+    fetchMock.mockReset();
+    getTokenMock.mockReset();
+    ensureHttpProxyMock.mockReset();
+    clearAttachmentCaches();
+    setServerHost("chat.example.com");
+  });
+
+  it("sends the bearer token through the TOFU proxy for server-hosted files", async () => {
+    getTokenMock.mockReturnValue("session-token");
+    ensureHttpProxyMock.mockResolvedValue("http://127.0.0.1:49812");
+    fetchMock.mockResolvedValue(imageResponse());
+
+    const result = await fetchImageAsDataUrl("https://chat.example.com/api/v1/files/abc-123");
+
+    expect(result).not.toBeNull();
+    expect(ensureHttpProxyMock).toHaveBeenCalledWith("chat.example.com");
+    expect(fetchMock).toHaveBeenCalledWith("http://127.0.0.1:49812/api/v1/files/abc-123", {
+      headers: { Authorization: "Bearer session-token" },
+    });
+  });
+
+  it("omits the Authorization header when no session token exists", async () => {
+    getTokenMock.mockReturnValue(null);
+    ensureHttpProxyMock.mockResolvedValue("http://127.0.0.1:49812");
+    fetchMock.mockResolvedValue(imageResponse());
+
+    await fetchImageAsDataUrl("https://chat.example.com/api/v1/files/abc-456");
+
+    expect(fetchMock).toHaveBeenCalledWith("http://127.0.0.1:49812/api/v1/files/abc-456", {
+      headers: {},
+    });
+  });
+
+  it("never sends the token to external hosts", async () => {
+    getTokenMock.mockReturnValue("session-token");
+    fetchMock.mockResolvedValue(imageResponse());
+
+    await fetchImageAsDataUrl("https://cdn.external.example/image.png");
+
+    expect(ensureHttpProxyMock).not.toHaveBeenCalled();
+    expect(fetchMock).toHaveBeenCalledWith("https://cdn.external.example/image.png");
+  });
+});
diff --git a/Client/tauri-client/tests/unit/attachments-media.test.ts b/Client/tauri-client/tests/unit/attachments-media.test.ts
new file mode 100644
index 00000000..d4c706e1
--- /dev/null
+++ b/Client/tauri-client/tests/unit/attachments-media.test.ts
@@ -0,0 +1,287 @@
+/**
+ * Inline media players for video/audio attachments.
+ *
+ * The property under test is the renderer's *shape decision*: which MIME types
+ * become a real player, which stay a download chip, and that the player's
+ * source goes through the same authenticated fetch images use (the files
+ * endpoint is permission-checked, so an unauthenticated <video src> would 401).
+ */
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const { fetchMock, saveMock, writeFileMock, createObjectURLMock, revokeObjectURLMock } = vi.hoisted(
+  () => ({
+    fetchMock: vi.fn(),
+    saveMock: vi.fn(),
+    writeFileMock: vi.fn(),
+    createObjectURLMock: vi.fn(),
+    revokeObjectURLMock: vi.fn(),
+  }),
+);
+
+vi.mock("@tauri-apps/plugin-http", () => ({ fetch: fetchMock }));
+vi.mock("@lib/httpProxy", () => ({
+  ensureHttpProxy: () => Promise.resolve("http://127.0.0.1:9999"),
+  stopHttpProxy: () => Promise.resolve(),
+}));
+vi.mock("@lib/logger", () => ({
+  createLogger: () => ({ debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() }),
+}));
+vi.mock("@tauri-apps/plugin-dialog", () => ({ save: saveMock }));
+vi.mock("@tauri-apps/plugin-fs", () => ({ writeFile: writeFileMock }));
+vi.mock("@lib/icons", () => ({ createIcon: () => document.createElement("span") }));
+vi.mock("@lib/media-visibility", () => ({ observeMedia: vi.fn() }));
+vi.mock("../../src/components/message-list/media", () => ({ openImageLightbox: vi.fn() }));
+vi.mock("@stores/auth.store", () => ({ getToken: () => "session-token" }));
+
+import {
+  clearAttachmentCaches,
+  fetchMediaAsObjectUrl,
+  isAudioMime,
+  isVideoMime,
+  renderAttachment,
+  setServerHost,
+} from "../../src/components/message-list/attachments";
+import type { Attachment } from "@lib/types";
+
+function att(overrides: Partial<Attachment> & Pick<Attachment, "mime">): Attachment {
+  return {
+    id: "a1",
+    url: "https://myserver.local:8443/api/v1/files/a1",
+    filename: "clip.bin",
+    size: 4096,
+    ...overrides,
+  };
+}
+
+beforeEach(() => {
+  fetchMock.mockReset();
+  createObjectURLMock.mockReset();
+  revokeObjectURLMock.mockReset();
+  createObjectURLMock.mockReturnValue("blob:mock-1");
+  // Patch the object-URL statics onto the real URL constructor — replacing the
+  // whole global would break `new URL(...)`, which isSafeUrl relies on.
+  URL.createObjectURL = createObjectURLMock;
+  URL.revokeObjectURL = revokeObjectURLMock;
+  clearAttachmentCaches();
+  setServerHost("myserver.local:8443");
+});
+
+describe("isVideoMime / isAudioMime", () => {
+  it("accepts the containers a <video> element can actually play", () => {
+    expect(isVideoMime("video/mp4")).toBe(true);
+    expect(isVideoMime("video/webm")).toBe(true);
+    expect(isVideoMime("video/ogg")).toBe(true);
+  });
+
+  it("accepts the common audio containers and their aliases", () => {
+    for (const mime of ["audio/mpeg", "audio/mp3", "audio/ogg", "audio/wav", "audio/x-wav"]) {
+      expect(isAudioMime(mime)).toBe(true);
+    }
+  });
+
+  it("ignores codec parameters and casing", () => {
+    expect(isVideoMime('VIDEO/MP4; codecs="avc1.42E01E"')).toBe(true);
+    expect(isAudioMime("Audio/Mpeg")).toBe(true);
+  });
+
+  it("rejects unknown containers rather than handing them to a player", () => {
+    expect(isVideoMime("video/x-matroska")).toBe(false);
+    expect(isVideoMime("video/quicktime")).toBe(false);
+    expect(isAudioMime("audio/flac")).toBe(false);
+  });
+
+  it("never matches SVG or other image types", () => {
+    expect(isVideoMime("image/svg+xml")).toBe(false);
+    expect(isAudioMime("image/svg+xml")).toBe(false);
+    expect(isVideoMime("image/png")).toBe(false);
+  });
+});
+
+describe("renderAttachment — video", () => {
+  it("renders an inline <video> with controls and metadata preload", () => {
+    fetchMock.mockResolvedValue({
+      ok: true,
+      headers: { get: () => "video/mp4" },
+      arrayBuffer: () => Promise.resolve(new Uint8Array([1, 2, 3]).buffer),
+    });
+
+    const el = renderAttachment(att({ mime: "video/mp4", filename: "clip.mp4" }));
+
+    expect(el.classList.contains("msg-video")).toBe(true);
+    // Shares the image box, so a video is capped to the same max dimensions.
+    expect(el.classList.contains("msg-image")).toBe(true);
+    const video = el.querySelector("video");
+    expect(video).not.toBeNull();
+    expect(video?.controls).toBe(true);
+    expect(video?.getAttribute("preload")).toBe("metadata");
+    expect(el.querySelector(".msg-file-download")).not.toBeNull();
+  });
+
+  it("sources the player from the authenticated fetch, not the raw URL", async () => {
+    fetchMock.mockResolvedValue({
+      ok: true,
+      headers: { get: () => "video/mp4" },
+      arrayBuffer: () => Promise.resolve(new Uint8Array([1, 2, 3]).buffer),
+    });
+
+    const el = renderAttachment(att({ mime: "video/webm", filename: "clip.webm" }));
+    const video = el.querySelector("video") as HTMLVideoElement;
+
+    await vi.waitFor(() => {
+      expect(video.src).toContain("blob:mock-1");
+    });
+
+    // Server-bound: routed through the cert-pinned proxy origin with the
+    // session bearer token attached.
+    const [url, init] = fetchMock.mock.calls[0] as [string, { headers: Record<string, string> }];
+    expect(url).toBe("http://127.0.0.1:9999/api/v1/files/a1");
+    expect(init.headers["Authorization"]).toBe("Bearer session-token");
+  });
+
+  it("marks the wrapper failed (keeping the download button) when the fetch fails", async () => {
+    fetchMock.mockResolvedValue({ ok: false, status: 403 });
+
+    const el = renderAttachment(att({ mime: "video/mp4", filename: "clip.mp4" }));
+
+    await vi.waitFor(() => {
+      expect(el.classList.contains("msg-media-failed")).toBe(true);
+    });
+    expect(el.querySelector("video")?.src).toBe("");
+    expect(el.querySelector(".msg-file-download")).not.toBeNull();
+  });
+
+  it("reuses one download when the same attachment is rendered twice", async () => {
+    fetchMock.mockResolvedValue({
+      ok: true,
+      headers: { get: () => "video/mp4" },
+      arrayBuffer: () => Promise.resolve(new Uint8Array([1, 2, 3]).buffer),
+    });
+
+    const first = renderAttachment(att({ mime: "video/mp4" }));
+    await vi.waitFor(() => {
+      expect((first.querySelector("video") as HTMLVideoElement).src).toContain("blob:");
+    });
+    const second = renderAttachment(att({ mime: "video/mp4" }));
+    await vi.waitFor(() => {
+      expect((second.querySelector("video") as HTMLVideoElement).src).toContain("blob:");
+    });
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(createObjectURLMock).toHaveBeenCalledTimes(1);
+  });
+
+  it("revokes cached blob URLs when the attachment caches are cleared", async () => {
+    fetchMock.mockResolvedValue({
+      ok: true,
+      headers: { get: () => "video/mp4" },
+      arrayBuffer: () => Promise.resolve(new Uint8Array([1]).buffer),
+    });
+
+    const el = renderAttachment(att({ mime: "video/mp4" }));
+    await vi.waitFor(() => {
+      expect((el.querySelector("video") as HTMLVideoElement).src).toContain("blob:");
+    });
+
+    clearAttachmentCaches();
+    expect(revokeObjectURLMock).toHaveBeenCalledWith("blob:mock-1");
+  });
+
+  it("evicts the oldest blob (FIFO) once the media cache cap is exceeded", async () => {
+    let nextBlobId = 0;
+    createObjectURLMock.mockImplementation(() => `blob:mock-${++nextBlobId}`);
+    fetchMock.mockResolvedValue({
+      ok: true,
+      headers: { get: () => "video/mp4" },
+      arrayBuffer: () => Promise.resolve(new Uint8Array([1]).buffer),
+    });
+
+    // One more than the cap (20) — the first URL fetched must be evicted (and
+    // its blob revoked) to make room for the last one, without ever growing
+    // past the cap.
+    const urls = Array.from(
+      { length: 21 },
+      (_, i) => `https://myserver.local:8443/api/v1/files/clip-${i}`,
+    );
+    for (const url of urls) {
+      await fetchMediaAsObjectUrl(url);
+    }
+
+    expect(revokeObjectURLMock).toHaveBeenCalledWith("blob:mock-1");
+    expect(revokeObjectURLMock).toHaveBeenCalledTimes(1);
+
+    // The evicted URL is gone from the cache — fetching it again re-downloads
+    // rather than reusing a stale entry.
+    fetchMock.mockClear();
+    await fetchMediaAsObjectUrl(urls[0]!);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+
+    // The most recently fetched entry is still cached (no refetch).
+    fetchMock.mockClear();
+    await fetchMediaAsObjectUrl(urls[urls.length - 1]!);
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+});
+
+describe("renderAttachment — audio", () => {
+  it("renders an inline <audio> row with filename, size, and download", () => {
+    fetchMock.mockResolvedValue({
+      ok: true,
+      headers: { get: () => "audio/mpeg" },
+      arrayBuffer: () => Promise.resolve(new Uint8Array([1]).buffer),
+    });
+
+    const el = renderAttachment(
+      att({ mime: "audio/mpeg", filename: "voice-note.mp3", size: 1536 }),
+    );
+
+    expect(el.classList.contains("msg-audio")).toBe(true);
+    const audio = el.querySelector("audio");
+    expect(audio).not.toBeNull();
+    expect(audio?.controls).toBe(true);
+    expect(audio?.getAttribute("preload")).toBe("metadata");
+    expect(el.querySelector(".msg-file-name")?.textContent).toBe("voice-note.mp3");
+    expect(el.querySelector(".msg-file-size")?.textContent).toBe("1.5 KB");
+    expect(el.querySelector(".msg-file-download")).not.toBeNull();
+    expect(el.querySelector("video")).toBeNull();
+  });
+
+  it("sets the player source from the authenticated fetch", async () => {
+    fetchMock.mockResolvedValue({
+      ok: true,
+      headers: { get: () => "audio/wav" },
+      arrayBuffer: () => Promise.resolve(new Uint8Array([1]).buffer),
+    });
+
+    const el = renderAttachment(att({ mime: "audio/wav", filename: "sound.wav" }));
+    const audio = el.querySelector("audio") as HTMLAudioElement;
+
+    await vi.waitFor(() => {
+      expect(audio.src).toContain("blob:mock-1");
+    });
+  });
+});
+
+describe("renderAttachment — unhandled types still get a chip", () => {
+  it.each([
+    ["application/zip", "archive.zip"],
+    ["image/svg+xml", "diagram.svg"],
+    ["video/x-matroska", "movie.mkv"],
+    ["audio/flac", "track.flac"],
+    ["text/plain", "notes.txt"],
+  ])("%s renders the download chip, not a player", (mime, filename) => {
+    const el = renderAttachment(att({ mime, filename }));
+
+    expect(el.querySelector("video")).toBeNull();
+    expect(el.querySelector("audio")).toBeNull();
+    expect(el.classList.contains("msg-file")).toBe(true);
+    expect(el.querySelector(".msg-file-name")?.textContent).toBe(filename);
+    expect(el.querySelector(".msg-file-download")).not.toBeNull();
+  });
+
+  it("falls back to the chip for a media MIME behind an unsafe URL", () => {
+    const el = renderAttachment(att({ mime: "video/mp4", url: "javascript:alert(1)" }));
+
+    expect(el.querySelector("video")).toBeNull();
+    expect(el.classList.contains("msg-file")).toBe(true);
+  });
+});
diff --git a/Client/tauri-client/tests/unit/attachments-render.test.ts b/Client/tauri-client/tests/unit/attachments-render.test.ts
index 7e7c9dea..558491e8 100644
--- a/Client/tauri-client/tests/unit/attachments-render.test.ts
+++ b/Client/tauri-client/tests/unit/attachments-render.test.ts
@@ -163,6 +163,11 @@ describe("isImageMime", () => {
     expect(isImageMime("image/gif")).toBe(true);
   });
 
+  // SVG can carry script, so it is deliberately not an inline image type.
+  it("returns false for image/svg+xml", () => {
+    expect(isImageMime("image/svg+xml")).toBe(false);
+  });
+
   it("returns false for application/pdf", () => {
     expect(isImageMime("application/pdf")).toBe(false);
   });
@@ -423,9 +428,10 @@ describe("fetchImageAsDataUrl — network fetch failure", () => {
     });
 
     // A server URL is rewritten to the loopback proxy origin (path + query
-    // preserved) and carries no danger option — the proxy pins the cert.
+    // preserved) and carries no danger option — the proxy pins the cert. The
+    // bearer token rides along when a session exists (none in this test).
     await fetchImageAsDataUrl("https://myserver.local:8443/img.png");
-    expect(fetchMock).toHaveBeenCalledWith("http://127.0.0.1:9999/img.png");
+    expect(fetchMock).toHaveBeenCalledWith("http://127.0.0.1:9999/img.png", { headers: {} });
 
     fetchMock.mockReset();
     clearAttachmentCaches();
diff --git a/Client/tauri-client/tests/unit/audio-elements.test.ts b/Client/tauri-client/tests/unit/audio-elements.test.ts
index 1088ffcc..dd9a3cb0 100644
--- a/Client/tauri-client/tests/unit/audio-elements.test.ts
+++ b/Client/tauri-client/tests/unit/audio-elements.test.ts
@@ -321,8 +321,8 @@ describe("AudioElements", () => {
       expect(() => elements.applyRemoteAudioSubscriptionState(true)).not.toThrow();
     });
 
-    it("unsubscribes all audio when deafened", () => {
-      const mockPub = { setSubscribed: vi.fn() };
+    it("unsubscribes voice audio when deafened", () => {
+      const mockPub = { source: "microphone", setSubscribed: vi.fn() };
       const mockParticipant = {
         audioTrackPublications: new Map([["pub-1", mockPub]]),
       };
@@ -336,8 +336,8 @@ describe("AudioElements", () => {
       expect(mockPub.setSubscribed).toHaveBeenCalledWith(false);
     });
 
-    it("re-subscribes all audio when undeafened", () => {
-      const mockPub = { setSubscribed: vi.fn() };
+    it("re-subscribes voice audio when undeafened", () => {
+      const mockPub = { source: "microphone", setSubscribed: vi.fn() };
       const mockParticipant = {
         audioTrackPublications: new Map([["pub-1", mockPub]]),
       };
@@ -350,6 +350,28 @@ describe("AudioElements", () => {
 
       expect(mockPub.setSubscribed).toHaveBeenCalledWith(true);
     });
+
+    it("leaves screenshare audio subscribed when deafened", () => {
+      // Muting/deafening yourself gates voices, not the stream someone is
+      // sharing — its audio keeps playing under its own per-tile controls.
+      const micPub = { source: "microphone", setSubscribed: vi.fn() };
+      const streamPub = { source: "screenShareAudio", setSubscribed: vi.fn() };
+      const mockParticipant = {
+        audioTrackPublications: new Map([
+          ["pub-mic", micPub],
+          ["pub-stream", streamPub],
+        ]),
+      };
+      const mockRoom = {
+        remoteParticipants: new Map([["user-1", mockParticipant]]),
+      } as any;
+      elements.setRoom(mockRoom);
+
+      elements.applyRemoteAudioSubscriptionState(true);
+
+      expect(micPub.setSubscribed).toHaveBeenCalledWith(false);
+      expect(streamPub.setSubscribed).not.toHaveBeenCalled();
+    });
   });
 
   describe("getEffectiveVolume", () => {
@@ -553,17 +575,19 @@ describe("AudioElements", () => {
       expect(publication.setSubscribed).toHaveBeenCalledWith(false);
     });
 
-    it("does not attach screenshare audio when locally deafened", () => {
+    it("attaches screenshare audio even when locally deafened", () => {
+      // Stream audio is exempt from the deafen gate: muting/deafening
+      // yourself silences voices, not the content someone is streaming.
       mockVoiceStoreState.localDeafened = true;
 
-      const { track, audioEl } = createMockTrack("audio", "track-deaf-ss");
+      const { track } = createMockTrack("audio", "track-deaf-ss");
       const publication = { source: "screenShareAudio", setSubscribed: vi.fn() };
       const participant = { identity: "user-42", setVolume: vi.fn() };
 
       elements.handleTrackSubscribedAudio(track as any, publication as any, participant as any);
 
-      expect(track.attach).not.toHaveBeenCalled();
-      expect(publication.setSubscribed).toHaveBeenCalledWith(false);
+      expect(track.attach).toHaveBeenCalled();
+      expect(publication.setSubscribed).not.toHaveBeenCalled();
     });
 
     it("attaches mic audio normally when not deafened", () => {
diff --git a/Client/tauri-client/tests/unit/auth.store.test.ts b/Client/tauri-client/tests/unit/auth.store.test.ts
index 31e78b25..cb072647 100644
--- a/Client/tauri-client/tests/unit/auth.store.test.ts
+++ b/Client/tauri-client/tests/unit/auth.store.test.ts
@@ -119,6 +119,21 @@ describe("auth store", () => {
       const after = authStore.getState();
       expect(before).not.toBe(after);
     });
+
+    it("records 'user' as the default logout reason", () => {
+      setAuth(TEST_TOKEN, TEST_USER, TEST_SERVER_NAME, TEST_MOTD);
+      clearAuth();
+      expect(authStore.getState().logoutReason).toBe("user");
+    });
+
+    it("records an explicit logout reason and resets it on the next setAuth", () => {
+      setAuth(TEST_TOKEN, TEST_USER, TEST_SERVER_NAME, TEST_MOTD);
+      clearAuth("server_shutdown");
+      expect(authStore.getState().logoutReason).toBe("server_shutdown");
+
+      setAuth(TEST_TOKEN, TEST_USER, TEST_SERVER_NAME, TEST_MOTD);
+      expect(authStore.getState().logoutReason).toBeUndefined();
+    });
   });
 
   // 4. getToken returns current token
diff --git a/Client/tauri-client/tests/unit/auto-idle.test.ts b/Client/tauri-client/tests/unit/auto-idle.test.ts
new file mode 100644
index 00000000..984f72f4
--- /dev/null
+++ b/Client/tauri-client/tests/unit/auto-idle.test.ts
@@ -0,0 +1,203 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import {
+  ACTIVITY_THROTTLE_MS,
+  AUTO_IDLE_DELAY_MS,
+  nextAutoStatus,
+  startAutoIdle,
+  type AutoIdleController,
+} from "@lib/autoIdle";
+import { loadUserStatus, loadUserStatusOrigin, saveUserStatus } from "@lib/userStatus";
+
+/**
+ * Auto-idle. The rule worth locking down is the narrow one: the timer may only
+ * move a status it is itself responsible for. Everything else — a manually
+ * chosen Idle, Do Not Disturb, Invisible — has to survive both the ten-minute
+ * timeout and the mouse moving again.
+ */
+
+/** A minimal event target the controller can listen on, so the tests don't
+ *  have to dispatch through jsdom's window and hope. */
+function createTarget(): Pick<Window, "addEventListener" | "removeEventListener"> & {
+  fire(): void;
+} {
+  const listeners = new Map<string, Set<EventListener>>();
+  return {
+    addEventListener(type: string, fn: EventListenerOrEventListenerObject, opts?: unknown): void {
+      const set = listeners.get(type) ?? new Set();
+      set.add(fn as EventListener);
+      listeners.set(type, set);
+      const signal = (opts as { signal?: AbortSignal } | undefined)?.signal;
+      signal?.addEventListener("abort", () => set.delete(fn as EventListener));
+    },
+    removeEventListener(type: string, fn: EventListenerOrEventListenerObject): void {
+      listeners.get(type)?.delete(fn as EventListener);
+    },
+    fire(): void {
+      for (const fn of listeners.get("mousemove") ?? []) fn(new Event("mousemove"));
+    },
+  } as never;
+}
+
+describe("nextAutoStatus", () => {
+  it("only turns a manual Online into Idle", () => {
+    expect(nextAutoStatus("online", "manual", true)).toBe("idle");
+    // A manually chosen Idle is a statement — there is nothing to promote.
+    expect(nextAutoStatus("idle", "manual", true)).toBeNull();
+    expect(nextAutoStatus("idle", "auto", true)).toBeNull();
+  });
+
+  it("never touches Do Not Disturb or Invisible", () => {
+    for (const status of ["dnd", "invisible"] as const) {
+      expect(nextAutoStatus(status, "manual", true)).toBeNull();
+      expect(nextAutoStatus(status, "manual", false)).toBeNull();
+      // Even if some path had marked them automatic, they stay put.
+      expect(nextAutoStatus(status, "auto", true)).toBeNull();
+      expect(nextAutoStatus(status, "auto", false)).toBeNull();
+    }
+  });
+
+  it("only undoes an Idle it set itself", () => {
+    expect(nextAutoStatus("idle", "auto", false)).toBe("online");
+    // The user picked Idle; coming back to the keyboard is not a request to
+    // leave it.
+    expect(nextAutoStatus("idle", "manual", false)).toBeNull();
+    expect(nextAutoStatus("online", "manual", false)).toBeNull();
+  });
+});
+
+describe("startAutoIdle", () => {
+  let controller: AutoIdleController | null = null;
+
+  beforeEach(() => {
+    localStorage.clear();
+    vi.useFakeTimers();
+  });
+
+  afterEach(() => {
+    controller?.destroy();
+    controller = null;
+    vi.useRealTimers();
+  });
+
+  it("flips a manual Online to Idle after the delay", () => {
+    saveUserStatus("online");
+    const onStatusChange = vi.fn();
+    controller = startAutoIdle({ onStatusChange, target: createTarget() });
+
+    vi.advanceTimersByTime(AUTO_IDLE_DELAY_MS - 1);
+    expect(onStatusChange).not.toHaveBeenCalled();
+
+    vi.advanceTimersByTime(1);
+    expect(onStatusChange).toHaveBeenCalledExactlyOnceWith("idle");
+    expect(loadUserStatus()).toBe("idle");
+    // Marked automatic, which is what lets the return-to-activity path know it
+    // is undoing its own work rather than a choice.
+    expect(loadUserStatusOrigin()).toBe("auto");
+  });
+
+  it("returns to Online on the first input after going idle", () => {
+    saveUserStatus("online");
+    const onStatusChange = vi.fn();
+    const target = createTarget();
+    controller = startAutoIdle({ onStatusChange, target });
+
+    vi.advanceTimersByTime(AUTO_IDLE_DELAY_MS);
+    expect(onStatusChange).toHaveBeenLastCalledWith("idle");
+
+    target.fire();
+    expect(onStatusChange).toHaveBeenLastCalledWith("online");
+    expect(loadUserStatus()).toBe("online");
+    expect(loadUserStatusOrigin()).toBe("manual");
+  });
+
+  it("re-arms on activity so a busy user never goes idle", () => {
+    saveUserStatus("online");
+    const onStatusChange = vi.fn();
+    const target = createTarget();
+    controller = startAutoIdle({ onStatusChange, target });
+
+    // Nudge the timer every half-delay for a few rounds.
+    for (let i = 0; i < 4; i++) {
+      vi.advanceTimersByTime(AUTO_IDLE_DELAY_MS / 2);
+      vi.setSystemTime(Date.now());
+      target.fire();
+    }
+    vi.advanceTimersByTime(AUTO_IDLE_DELAY_MS - 1);
+    expect(onStatusChange).not.toHaveBeenCalled();
+  });
+
+  it("throttles the re-arm bookkeeping", () => {
+    saveUserStatus("online");
+    const target = createTarget();
+    controller = startAutoIdle({ onStatusChange: vi.fn(), target });
+
+    // A burst of events inside the throttle window must not each restart the
+    // ten-minute clock from their own moment — only the first one counts.
+    vi.advanceTimersByTime(ACTIVITY_THROTTLE_MS / 2);
+    for (let i = 0; i < 50; i++) target.fire();
+
+    // The clock is still the one armed at the (single) accepted activity, so
+    // the flip still lands at the original deadline.
+    expect(loadUserStatus()).toBe("online");
+  });
+
+  it("leaves a manually chosen Do Not Disturb alone in both directions", () => {
+    saveUserStatus("dnd");
+    const onStatusChange = vi.fn();
+    const target = createTarget();
+    controller = startAutoIdle({ onStatusChange, target });
+
+    vi.advanceTimersByTime(AUTO_IDLE_DELAY_MS * 3);
+    target.fire();
+
+    expect(onStatusChange).not.toHaveBeenCalled();
+    expect(loadUserStatus()).toBe("dnd");
+  });
+
+  it("leaves a manually chosen Invisible alone", () => {
+    saveUserStatus("invisible");
+    const onStatusChange = vi.fn();
+    const target = createTarget();
+    controller = startAutoIdle({ onStatusChange, target });
+
+    vi.advanceTimersByTime(AUTO_IDLE_DELAY_MS * 2);
+    target.fire();
+
+    expect(onStatusChange).not.toHaveBeenCalled();
+    expect(loadUserStatus()).toBe("invisible");
+  });
+
+  it("leaves a manually chosen Idle alone when the user comes back", () => {
+    saveUserStatus("idle");
+    const onStatusChange = vi.fn();
+    const target = createTarget();
+    controller = startAutoIdle({ onStatusChange, target });
+
+    vi.advanceTimersByTime(AUTO_IDLE_DELAY_MS);
+    target.fire();
+
+    expect(onStatusChange).not.toHaveBeenCalled();
+    expect(loadUserStatus()).toBe("idle");
+  });
+
+  it("stops firing after destroy", () => {
+    saveUserStatus("online");
+    const onStatusChange = vi.fn();
+    controller = startAutoIdle({ onStatusChange, target: createTarget() });
+
+    controller.destroy();
+    controller = null;
+    vi.advanceTimersByTime(AUTO_IDLE_DELAY_MS * 2);
+
+    expect(onStatusChange).not.toHaveBeenCalled();
+  });
+
+  it("honours an injected delay", () => {
+    saveUserStatus("online");
+    const onStatusChange = vi.fn();
+    controller = startAutoIdle({ onStatusChange, target: createTarget(), delayMs: 5000 });
+
+    vi.advanceTimersByTime(5000);
+    expect(onStatusChange).toHaveBeenCalledExactlyOnceWith("idle");
+  });
+});
diff --git a/Client/tauri-client/tests/unit/autocomplete-filters.property.test.ts b/Client/tauri-client/tests/unit/autocomplete-filters.property.test.ts
new file mode 100644
index 00000000..9024df52
--- /dev/null
+++ b/Client/tauri-client/tests/unit/autocomplete-filters.property.test.ts
@@ -0,0 +1,224 @@
+/**
+ * Property tests for filterMentionSuggestions (MentionAutocomplete.ts) and
+ * filterEmojiSuggestions (EmojiAutocomplete.ts).
+ *
+ * Invariants under fuzzing:
+ *  - never throw on arbitrary query strings
+ *  - respect their MAX_*_SUGGESTIONS caps
+ *  - filterEmojiSuggestions returns [] for any query shorter than
+ *    MIN_EMOJI_QUERY
+ *  - @everyone/@here appear in filterMentionSuggestions only when the
+ *    signed-in role holds MENTION_EVERYONE
+ */
+
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import fc from "fast-check";
+
+vi.mock("@lib/livekitSession", () => ({
+  leaveVoice: vi.fn(),
+  switchInputDevice: vi.fn(),
+  switchOutputDevice: vi.fn(),
+  setVoiceSensitivity: vi.fn(),
+  setInputVolume: vi.fn(),
+  setOutputVolume: vi.fn(),
+  getSessionDebugInfo: vi.fn().mockReturnValue({}),
+}));
+
+import {
+  filterMentionSuggestions,
+  MAX_MENTION_SUGGESTIONS,
+} from "../../src/components/MentionAutocomplete";
+import {
+  filterEmojiSuggestions,
+  MAX_EMOJI_SUGGESTIONS,
+  MIN_EMOJI_QUERY,
+} from "../../src/components/EmojiAutocomplete";
+import { membersStore } from "../../src/stores/members.store";
+import { authStore } from "../../src/stores/auth.store";
+import { channelsStore, setRoles } from "../../src/stores/channels.store";
+import { emojiStore, setCustomEmoji, clearCustomEmoji } from "../../src/stores/emoji.store";
+import { Permission } from "../../src/lib/types";
+
+const NAMES = ["alice", "Alan", "Bob", "carol", "dave_99", "eve-ish"];
+
+function seedMembers(names: readonly string[] = NAMES): void {
+  membersStore.setState(() => ({
+    members: new Map(
+      names.map((n, i) => [
+        i + 1,
+        {
+          id: i + 1,
+          username: n,
+          avatar: null,
+          role: "member" as const,
+          status: "online" as const,
+        },
+      ]),
+    ),
+    typingUsers: new Map(),
+  }));
+}
+
+/** Sign in as a role, and register that role's permission mask. */
+function signInAs(role: string, permissions: number): void {
+  authStore.setState(() => ({
+    token: "t",
+    user: { id: 99, username: "me", avatar: null, role },
+    serverName: null,
+    motd: null,
+    isAuthenticated: true,
+  }));
+  channelsStore.setState(() => ({ channels: new Map(), activeChannelId: null, roles: [] }));
+  setRoles([{ id: 1, name: role, color: null, permissions }]);
+  channelsStore.flush();
+}
+
+beforeEach(() => {
+  seedMembers();
+  signInAs("member", Permission.SEND_MESSAGES);
+  clearCustomEmoji();
+  emojiStore.flush();
+  setCustomEmoji([
+    { id: 1, shortcode: "wave", url: "/api/v1/emoji/1/image" },
+    { id: 2, shortcode: "waffle", url: "/api/v1/emoji/2/image" },
+  ]);
+  emojiStore.flush();
+});
+
+const anyQuery = fc.string({ maxLength: 100 });
+/** Query-shaped fragments: letters, digits, the punctuation a mention/emoji
+ *  token can legally contain, and a few control characters thrown in. */
+const queryFragment = fc.string({
+  unit: fc.constantFrom(..."abcdefghijklmnopqrstuvwxyz0123456789_.- \n\t@#:".split("")),
+  maxLength: 40,
+});
+
+// ---------------------------------------------------------------------------
+// Never throws
+// ---------------------------------------------------------------------------
+
+describe("filterMentionSuggestions — never throws", () => {
+  it("never throws on arbitrary query strings", () => {
+    fc.assert(
+      fc.property(anyQuery, (q) => {
+        expect(() => filterMentionSuggestions(q)).not.toThrow();
+      }),
+      { numRuns: 300 },
+    );
+  });
+
+  it("never throws on query-shaped fragments, permission on or off", () => {
+    fc.assert(
+      fc.property(queryFragment, fc.boolean(), (q, everyone) => {
+        signInAs("r", everyone ? Permission.MENTION_EVERYONE : 0);
+        expect(() => filterMentionSuggestions(q)).not.toThrow();
+      }),
+      { numRuns: 300 },
+    );
+  });
+});
+
+describe("filterEmojiSuggestions — never throws", () => {
+  it("never throws on arbitrary query strings", () => {
+    fc.assert(
+      fc.property(anyQuery, (q) => {
+        expect(() => filterEmojiSuggestions(q)).not.toThrow();
+      }),
+      { numRuns: 300 },
+    );
+  });
+
+  it("never throws on query-shaped fragments", () => {
+    fc.assert(
+      fc.property(queryFragment, (q) => {
+        expect(() => filterEmojiSuggestions(q)).not.toThrow();
+      }),
+      { numRuns: 300 },
+    );
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Caps and floors
+// ---------------------------------------------------------------------------
+
+describe("filterMentionSuggestions — cap", () => {
+  it("never exceeds MAX_MENTION_SUGGESTIONS for any query", () => {
+    seedMembers(Array.from({ length: 60 }, (_, i) => `user${String(i).padStart(2, "0")}`));
+    fc.assert(
+      fc.property(queryFragment, (q) => {
+        expect(filterMentionSuggestions(q).length).toBeLessThanOrEqual(MAX_MENTION_SUGGESTIONS);
+      }),
+      { numRuns: 300 },
+    );
+  });
+});
+
+describe("filterEmojiSuggestions — cap and floor", () => {
+  it("never exceeds MAX_EMOJI_SUGGESTIONS for any query", () => {
+    fc.assert(
+      fc.property(queryFragment, (q) => {
+        expect(filterEmojiSuggestions(q).length).toBeLessThanOrEqual(MAX_EMOJI_SUGGESTIONS);
+      }),
+      { numRuns: 300 },
+    );
+  });
+
+  it("returns [] for every query shorter than MIN_EMOJI_QUERY", () => {
+    const shortQuery = fc.string({ maxLength: MIN_EMOJI_QUERY - 1 });
+    fc.assert(
+      fc.property(shortQuery, (q) => {
+        expect(filterEmojiSuggestions(q)).toEqual([]);
+      }),
+      { numRuns: 200 },
+    );
+  });
+
+  it("returns [] for the empty string and single characters specifically", () => {
+    expect(filterEmojiSuggestions("")).toEqual([]);
+    fc.assert(
+      fc.property(fc.string({ minLength: 1, maxLength: 1 }), (c) => {
+        expect(filterEmojiSuggestions(c)).toEqual([]);
+      }),
+      { numRuns: 100 },
+    );
+  });
+});
+
+// ---------------------------------------------------------------------------
+// MENTION_EVERYONE permission gate
+// ---------------------------------------------------------------------------
+
+describe("@everyone/@here only appear with MENTION_EVERYONE", () => {
+  it("never appear without the permission, for any query", () => {
+    fc.assert(
+      fc.property(queryFragment, (q) => {
+        signInAs("member", Permission.SEND_MESSAGES); // no MENTION_EVERYONE
+        const tokens = filterMentionSuggestions(q).map((s) => s.token);
+        expect(tokens).not.toContain("everyone");
+        expect(tokens).not.toContain("here");
+      }),
+      { numRuns: 300 },
+    );
+  });
+
+  it("only appear when the query is a prefix of the token, even with the permission", () => {
+    fc.assert(
+      fc.property(queryFragment, (q) => {
+        signInAs("mod", Permission.MENTION_EVERYONE);
+        const tokens = filterMentionSuggestions(q).map((s) => s.token);
+        const lower = q.toLowerCase();
+        if (tokens.includes("everyone")) expect("everyone".startsWith(lower)).toBe(true);
+        if (tokens.includes("here")) expect("here".startsWith(lower)).toBe(true);
+      }),
+      { numRuns: 300 },
+    );
+  });
+
+  it("ADMINISTRATOR implies the broadcast entries are offered too", () => {
+    signInAs("owner", Permission.ADMINISTRATOR);
+    const tokens = filterMentionSuggestions("").map((s) => s.token);
+    expect(tokens).toContain("everyone");
+    expect(tokens).toContain("here");
+  });
+});
diff --git a/Client/tauri-client/tests/unit/avatar.test.ts b/Client/tauri-client/tests/unit/avatar.test.ts
new file mode 100644
index 00000000..c33edf9b
--- /dev/null
+++ b/Client/tauri-client/tests/unit/avatar.test.ts
@@ -0,0 +1,141 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+
+const fetchImageAsDataUrl = vi.hoisted(() => vi.fn());
+
+// The real module reaches for the Tauri HTTP plugin and IndexedDB; only the
+// fetch entry point matters here, so it is stubbed and the URL helpers are
+// kept honest by reimplementing exactly what they do.
+vi.mock("@components/message-list/attachments", () => ({
+  fetchImageAsDataUrl,
+  isSafeUrl: (url: string) => url.startsWith("https://") || url.startsWith("http://"),
+  resolveServerUrl: (url: string) => (url.startsWith("http") ? url : `https://server.test${url}`),
+}));
+
+const { avatarInitial, createAvatarElement, isRenderableAvatar, resolveDisplayName } =
+  await import("@lib/avatar");
+
+describe("resolveDisplayName", () => {
+  it("prefers the display name when there is one", () => {
+    expect(resolveDisplayName({ username: "ada", displayName: "Ada L." })).toBe("Ada L.");
+  });
+
+  it("falls back to the username when the display name is absent, null or blank", () => {
+    expect(resolveDisplayName({ username: "ada" })).toBe("ada");
+    expect(resolveDisplayName({ username: "ada", displayName: null })).toBe("ada");
+    // Whitespace is not a name — the server trims, but an older row might not.
+    expect(resolveDisplayName({ username: "ada", displayName: "   " })).toBe("ada");
+  });
+});
+
+describe("avatarInitial", () => {
+  it("takes the first letter of the rendered name", () => {
+    expect(avatarInitial({ username: "ada", displayName: "Zoe" })).toBe("Z");
+    expect(avatarInitial({ username: "ada" })).toBe("A");
+  });
+
+  it("renders a deleted account as ?", () => {
+    expect(avatarInitial({ username: "gone", isDeleted: true })).toBe("?");
+  });
+
+  it("falls back to ? for a name with no letter to take", () => {
+    expect(avatarInitial({ username: "" })).toBe("?");
+  });
+});
+
+describe("isRenderableAvatar", () => {
+  it("accepts server-relative and https URLs", () => {
+    expect(isRenderableAvatar("/api/v1/files/abc")).toBe(true);
+    expect(isRenderableAvatar("https://cdn.example/pic.png")).toBe(true);
+  });
+
+  it("rejects nothing-to-render and unsafe schemes", () => {
+    expect(isRenderableAvatar(null)).toBe(false);
+    expect(isRenderableAvatar(undefined)).toBe(false);
+    expect(isRenderableAvatar("")).toBe(false);
+    // javascript:/data: are not avatars, and an <img> pointed at one is a
+    // liability rather than a picture.
+    expect(isRenderableAvatar("javascript:alert(1)")).toBe(false);
+  });
+});
+
+describe("createAvatarElement", () => {
+  beforeEach(() => {
+    fetchImageAsDataUrl.mockReset();
+  });
+
+  it("renders the letter fallback synchronously", () => {
+    fetchImageAsDataUrl.mockResolvedValue(null);
+    const el = createAvatarElement(
+      { username: "ada", avatar: null },
+      { className: "msg-avatar", background: "red" },
+    );
+    expect(el.className).toBe("msg-avatar");
+    expect(el.textContent).toBe("A");
+    expect(el.style.background).toBe("red");
+    expect(fetchImageAsDataUrl).not.toHaveBeenCalled();
+  });
+
+  it("never fetches for a deleted account", () => {
+    createAvatarElement(
+      { username: "gone", avatar: "/api/v1/files/x", isDeleted: true },
+      {
+        className: "msg-avatar",
+      },
+    );
+    expect(fetchImageAsDataUrl).not.toHaveBeenCalled();
+  });
+
+  it("swaps in the fetched image once the bytes arrive", async () => {
+    fetchImageAsDataUrl.mockResolvedValue("data:image/png;base64,AAA");
+    const el = createAvatarElement(
+      { username: "ada", displayName: "Ada L.", avatar: "/api/v1/files/abc" },
+      { className: "mi-avatar" },
+    );
+    // Attached, because the helper skips a swap into an element nobody is
+    // looking at.
+    document.body.appendChild(el);
+    // The letter is what renders in the meantime.
+    expect(el.textContent).toBe("A");
+
+    // The authenticated file route is resolved against the server host — the
+    // helper must not hand a relative URL to the fetcher.
+    expect(fetchImageAsDataUrl).toHaveBeenCalledWith("https://server.test/api/v1/files/abc");
+
+    await vi.waitFor(() => {
+      const img = el.querySelector("img");
+      expect(img).not.toBeNull();
+      expect(img?.getAttribute("src")).toBe("data:image/png;base64,AAA");
+      // Alt text is the name the reader sees, not the raw username.
+      expect(img?.getAttribute("alt")).toBe("Ada L.");
+    });
+    // The letter is removed rather than hidden, so it leaves the a11y tree.
+    expect(el.querySelector(".avatar-initial")).toBeNull();
+    el.remove();
+  });
+
+  it("keeps the letter when the fetch fails", async () => {
+    fetchImageAsDataUrl.mockResolvedValue(null);
+    const el = createAvatarElement(
+      { username: "ada", avatar: "/api/v1/files/abc" },
+      { className: "mi-avatar" },
+    );
+    document.body.appendChild(el);
+    await Promise.resolve();
+    await Promise.resolve();
+    expect(el.querySelector("img")).toBeNull();
+    expect(el.textContent).toBe("A");
+    el.remove();
+  });
+
+  it("does not swap into a detached element", async () => {
+    fetchImageAsDataUrl.mockResolvedValue("data:image/png;base64,AAA");
+    const el = createAvatarElement(
+      { username: "ada", avatar: "/api/v1/files/abc" },
+      { className: "mi-avatar" },
+    );
+    // Never attached — the row was torn down while the fetch was in flight.
+    await Promise.resolve();
+    await Promise.resolve();
+    expect(el.querySelector("img")).toBeNull();
+  });
+});
diff --git a/Client/tauri-client/tests/unit/call-ring.test.ts b/Client/tauri-client/tests/unit/call-ring.test.ts
new file mode 100644
index 00000000..cc641c6c
--- /dev/null
+++ b/Client/tauri-client/tests/unit/call-ring.test.ts
@@ -0,0 +1,204 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { createRingController, RING_TIMEOUT_MS } from "@lib/call-ring";
+import type { RingState } from "@lib/call-ring";
+
+/**
+ * Statechart harness. The timer is injected rather than faked globally so a
+ * test can fire the 30s timeout without also advancing every other timer in
+ * the module graph.
+ */
+function harness() {
+  const states: Array<RingState | null> = [];
+  const chimes: boolean[] = [];
+  const accepted: number[] = [];
+  const declined: number[] = [];
+  let pending: (() => void) | null = null;
+  let pendingMs = 0;
+  let cleared = 0;
+
+  const ctrl = createRingController({
+    onRingStateChange: (s) => states.push(s),
+    onChime: (playing) => chimes.push(playing),
+    onAccept: (id) => accepted.push(id),
+    onDecline: (id) => declined.push(id),
+    setTimer: (fn, ms) => {
+      pending = fn;
+      pendingMs = ms;
+      return 1 as unknown as ReturnType<typeof setTimeout>;
+    },
+    clearTimer: () => {
+      cleared += 1;
+      pending = null;
+    },
+  });
+
+  return {
+    ctrl,
+    states,
+    chimes,
+    accepted,
+    declined,
+    fireTimeout: () => pending?.(),
+    timerMs: () => pendingMs,
+    clearedCount: () => cleared,
+  };
+}
+
+const ring = (channelId = 5, fromUserId = 9): RingState => ({
+  channelId,
+  fromUserId,
+  fromUsername: "alice",
+});
+
+beforeEach(() => {
+  vi.restoreAllMocks();
+});
+
+describe("ring controller — incoming", () => {
+  it("starts ringing and reports the state", () => {
+    const h = harness();
+    h.ctrl.incoming(ring());
+
+    expect(h.ctrl.current()).toEqual(ring());
+    expect(h.states).toEqual([ring()]);
+    expect(h.chimes).toEqual([true]);
+  });
+
+  it("arms the 30 second timeout", () => {
+    const h = harness();
+    h.ctrl.incoming(ring());
+    expect(h.timerMs()).toBe(RING_TIMEOUT_MS);
+  });
+
+  // Two banners at once is two decisions the user did not ask to make; the
+  // newer ring is the one they can still answer.
+  it("replaces an existing ring for a different channel", () => {
+    const h = harness();
+    h.ctrl.incoming(ring(5));
+    h.ctrl.incoming(ring(6));
+
+    expect(h.ctrl.current()?.channelId).toBe(6);
+    expect(h.states).toEqual([ring(5), null, ring(6)]);
+    expect(h.chimes).toEqual([true, false, true]);
+  });
+});
+
+describe("ring controller — accept", () => {
+  it("joins the DM's voice channel and stops ringing", () => {
+    const h = harness();
+    h.ctrl.incoming(ring(5));
+    h.ctrl.accept();
+
+    expect(h.accepted).toEqual([5]);
+    expect(h.declined).toEqual([]);
+    expect(h.ctrl.current()).toBeNull();
+    expect(h.chimes).toEqual([true, false]);
+    expect(h.states).toEqual([ring(5), null]);
+  });
+
+  it("is a no-op when nothing is ringing", () => {
+    const h = harness();
+    h.ctrl.accept();
+    expect(h.accepted).toEqual([]);
+    expect(h.states).toEqual([]);
+  });
+
+  it("disarms the timeout", () => {
+    const h = harness();
+    h.ctrl.incoming(ring());
+    h.ctrl.accept();
+    expect(h.clearedCount()).toBeGreaterThan(0);
+    // A late timeout must not re-fire the state change.
+    h.fireTimeout();
+    expect(h.states).toEqual([ring(), null]);
+  });
+});
+
+describe("ring controller — decline", () => {
+  it("tells the ringer and stops ringing", () => {
+    const h = harness();
+    h.ctrl.incoming(ring(5));
+    h.ctrl.decline();
+
+    expect(h.declined).toEqual([5]);
+    expect(h.accepted).toEqual([]);
+    expect(h.ctrl.current()).toBeNull();
+    expect(h.chimes).toEqual([true, false]);
+  });
+
+  it("is a no-op when nothing is ringing", () => {
+    const h = harness();
+    h.ctrl.decline();
+    expect(h.declined).toEqual([]);
+  });
+});
+
+describe("ring controller — timeout", () => {
+  it("stops ringing after 30 seconds", () => {
+    const h = harness();
+    h.ctrl.incoming(ring(5));
+    h.fireTimeout();
+
+    expect(h.ctrl.current()).toBeNull();
+    expect(h.chimes).toEqual([true, false]);
+    expect(h.states).toEqual([ring(5), null]);
+  });
+
+  // A timeout means "nobody was there", and the ringer's own 30s window
+  // already covers it — sending a decline would claim a refusal that did not
+  // happen.
+  it("does not send a decline", () => {
+    const h = harness();
+    h.ctrl.incoming(ring(5));
+    h.fireTimeout();
+    expect(h.declined).toEqual([]);
+  });
+});
+
+describe("ring controller — cancel (declined elsewhere / ringer left)", () => {
+  it("stops ringing for the matching channel", () => {
+    const h = harness();
+    h.ctrl.incoming(ring(5));
+    h.ctrl.cancel(5);
+
+    expect(h.ctrl.current()).toBeNull();
+    expect(h.chimes).toEqual([true, false]);
+    // Cancel is not a refusal by this user, so nothing is sent back.
+    expect(h.declined).toEqual([]);
+    expect(h.accepted).toEqual([]);
+  });
+
+  // A stale signal for another conversation must not silence a live call.
+  it("ignores a cancel for a different channel", () => {
+    const h = harness();
+    h.ctrl.incoming(ring(5));
+    h.ctrl.cancel(6);
+
+    expect(h.ctrl.current()?.channelId).toBe(5);
+    expect(h.chimes).toEqual([true]);
+  });
+
+  it("is a no-op when nothing is ringing", () => {
+    const h = harness();
+    h.ctrl.cancel(5);
+    expect(h.states).toEqual([]);
+  });
+});
+
+describe("ring controller — destroy", () => {
+  it("stops the chime and clears the banner", () => {
+    const h = harness();
+    h.ctrl.incoming(ring());
+    h.ctrl.destroy();
+
+    expect(h.ctrl.current()).toBeNull();
+    expect(h.chimes).toEqual([true, false]);
+    expect(h.states).toEqual([ring(), null]);
+  });
+
+  it("is safe with nothing ringing", () => {
+    const h = harness();
+    h.ctrl.destroy();
+    expect(h.chimes).toEqual([]);
+  });
+});
diff --git a/Client/tauri-client/tests/unit/channel-controller.test.ts b/Client/tauri-client/tests/unit/channel-controller.test.ts
index 43e032b8..98830d93 100644
--- a/Client/tauri-client/tests/unit/channel-controller.test.ts
+++ b/Client/tauri-client/tests/unit/channel-controller.test.ts
@@ -87,6 +87,25 @@ vi.mock("@components/MessageInput", () => ({
   }),
 }));
 
+// The gate component itself is covered by nsfw-gate.test.ts; what the
+// controller owns is WHETHER and with what it is mounted.
+const { mockNsfwGateMount, mockNsfwGateDestroy, mockCreateNsfwGate, capturedNsfwOpts } = vi.hoisted(
+  () => ({
+    mockNsfwGateMount: vi.fn(),
+    mockNsfwGateDestroy: vi.fn(),
+    mockCreateNsfwGate: vi.fn(),
+    capturedNsfwOpts: { value: null as any },
+  }),
+);
+
+vi.mock("@components/NsfwGate", () => ({
+  createNsfwGate: (opts: any) => {
+    capturedNsfwOpts.value = opts;
+    mockCreateNsfwGate(opts);
+    return { mount: mockNsfwGateMount, destroy: mockNsfwGateDestroy };
+  },
+}));
+
 vi.mock("@components/TypingIndicator", () => ({
   createTypingIndicator: vi.fn(() => ({
     mount: mockTypingMount,
@@ -104,12 +123,22 @@ const { mockSetMessagePinned, mockAddOptimistic, mockMarkSendFailed, mockRemoveO
 
 const { mockRole } = vi.hoisted(() => ({ mockRole: { value: "member" } }));
 
+const { mockReattachToPresent, mockJumpToMessage } = vi.hoisted(() => ({
+  mockReattachToPresent: vi.fn(),
+  mockJumpToMessage: vi.fn(),
+}));
+
 vi.mock("@stores/messages.store", () => ({
   getChannelMessages: mockGetChannelMessages,
   setMessagePinned: mockSetMessagePinned,
   addOptimisticMessage: mockAddOptimistic,
   markSendFailed: mockMarkSendFailed,
   removeOptimistic: mockRemoveOptimistic,
+  reattachToPresent: mockReattachToPresent,
+}));
+
+vi.mock("@lib/message-navigation", () => ({
+  jumpToMessage: mockJumpToMessage,
 }));
 
 vi.mock("@stores/auth.store", () => ({
@@ -131,6 +160,10 @@ const { mockDmStoreGetState, mockMembersStoreGetState } = vi.hoisted(() => ({
     channels: [] as Array<{
       channelId: number;
       recipient: { id: number; username: string; avatar: string; status: string };
+      // Group DMs: the participant list, the optional name and the group flag.
+      participants: Array<{ id: number; username: string; avatar: string; status: string }>;
+      name: string;
+      isGroup: boolean;
       lastMessageId: number | null;
       lastMessage: string;
       lastMessageAt: string;
@@ -140,9 +173,16 @@ const { mockDmStoreGetState, mockMembersStoreGetState } = vi.hoisted(() => ({
   mockMembersStoreGetState: vi.fn(() => ({ members: new Map() })),
 }));
 
-vi.mock("@stores/dm.store", () => ({
-  dmStore: { getState: mockDmStoreGetState },
-}));
+vi.mock("@stores/dm.store", async () => {
+  // dmDisplayName is real: it is the single answer to "what is this DM
+  // called", and mocking it would let the controller and the sidebar disagree
+  // in a test while agreeing in production.
+  const actual = await vi.importActual<typeof import("@stores/dm.store")>("@stores/dm.store");
+  return {
+    dmStore: { getState: mockDmStoreGetState },
+    dmDisplayName: actual.dmDisplayName,
+  };
+});
 
 vi.mock("@stores/members.store", () => ({
   membersStore: { getState: mockMembersStoreGetState },
@@ -175,6 +215,7 @@ import { createChannelController } from "../../src/pages/main-page/ChannelContro
 import type { ChannelControllerOptions } from "../../src/pages/main-page/ChannelController";
 import { setConnectionStatus } from "@stores/ui.store";
 import { channelsStore, setChannels, setActiveChannel, setRoles } from "@stores/channels.store";
+import { acknowledgeNsfw } from "@lib/nsfw-gate";
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -418,6 +459,34 @@ describe("createChannelController", () => {
       expect(opts.msgCtrl.loadMessages).toHaveBeenCalledWith(42, expect.any(AbortSignal));
     });
 
+    it("onJumpToMessage routes a reply-bar jump through the shared jumper", () => {
+      const opts = makeOpts();
+      const ctrl = createChannelController(opts);
+      ctrl.mountChannel(42, "general");
+
+      capturedMessageListOpts.onJumpToMessage(1234);
+
+      // Scoped to the mounted channel: a reply always points inside it.
+      expect(mockJumpToMessage).toHaveBeenCalledWith(42, 1234);
+    });
+
+    it("onJumpToPresent reattaches the channel and refetches the live tail", () => {
+      const opts = makeOpts();
+      const ctrl = createChannelController(opts);
+      ctrl.mountChannel(42, "general");
+      (opts.msgCtrl.loadMessages as ReturnType<typeof vi.fn>).mockClear();
+
+      capturedMessageListOpts.onJumpToPresent();
+
+      // Reattaching first is what makes the refetch actually happen —
+      // loadMessages short-circuits while the channel is still "loaded".
+      expect(mockReattachToPresent).toHaveBeenCalledWith(42);
+      expect(opts.msgCtrl.loadMessages).toHaveBeenCalledWith(42, expect.any(AbortSignal));
+      expect(mockReattachToPresent.mock.invocationCallOrder[0]).toBeLessThan(
+        (opts.msgCtrl.loadMessages as ReturnType<typeof vi.fn>).mock.invocationCallOrder[0]!,
+      );
+    });
+
     it("onRetry re-sends the failed draft with a fresh correlation id", () => {
       const opts = makeOpts();
       let n = 0;
@@ -764,6 +833,9 @@ describe("createChannelController", () => {
           {
             channelId: 42,
             recipient: { id: 5, username: "alice", avatar: "", status: "online" },
+            participants: [{ id: 5, username: "alice", avatar: "", status: "online" }],
+            name: "",
+            isGroup: false,
             lastMessageId: null,
             lastMessage: "",
             lastMessageAt: "",
@@ -779,6 +851,7 @@ describe("createChannelController", () => {
         hashEl: document.createElement("span"),
         nameEl: document.createElement("span"),
         topicEl: document.createElement("span"),
+        callBtn: document.createElement("button"),
       };
       const opts = makeOpts({ chatHeaderRefs });
       const ctrl = createChannelController(opts);
@@ -798,6 +871,9 @@ describe("createChannelController", () => {
           {
             channelId: 42,
             recipient: { id: 5, username: "bob", avatar: "", status: "dnd" },
+            participants: [{ id: 5, username: "bob", avatar: "", status: "dnd" }],
+            name: "",
+            isGroup: false,
             lastMessageId: null,
             lastMessage: "",
             lastMessageAt: "",
@@ -813,6 +889,7 @@ describe("createChannelController", () => {
         hashEl: document.createElement("span"),
         nameEl: document.createElement("span"),
         topicEl: document.createElement("span"),
+        callBtn: document.createElement("button"),
       };
       const opts = makeOpts({ chatHeaderRefs });
       const ctrl = createChannelController(opts);
@@ -832,6 +909,7 @@ describe("createChannelController", () => {
         hashEl: document.createElement("span"),
         nameEl: document.createElement("span"),
         topicEl: document.createElement("span"),
+        callBtn: document.createElement("button"),
       };
       const opts = makeOpts({ chatHeaderRefs });
       const ctrl = createChannelController(opts);
@@ -849,6 +927,7 @@ describe("createChannelController", () => {
         hashEl: document.createElement("span"),
         nameEl: document.createElement("span"),
         topicEl: document.createElement("span"),
+        callBtn: document.createElement("button"),
       };
       const opts = makeOpts({ chatHeaderRefs });
       const ctrl = createChannelController(opts);
@@ -994,6 +1073,9 @@ describe("createChannelController", () => {
           {
             channelId: 42,
             recipient: { id: 5, username: "alice", avatar: "", status: "online" },
+            participants: [{ id: 5, username: "alice", avatar: "", status: "online" }],
+            name: "",
+            isGroup: false,
             lastMessageId: null,
             lastMessage: "",
             lastMessageAt: "",
@@ -1039,6 +1121,38 @@ describe("createChannelController", () => {
       ctrl.mountChannel(42, "general", "text");
       expect(blocksSubscribers).toHaveLength(0);
     });
+
+    // Discord semantics, mirrored by the server's requireDMNotBlocked: a group
+    // DM is a shared room, and gating one member's composer over a block with
+    // one other member would leave the group reading a conversation that person
+    // cannot join. Blocks are enforced when the group is created instead.
+    it("does not gate a group DM's composer on block state", () => {
+      mockDmStoreGetState.mockReturnValue({
+        channels: [
+          {
+            channelId: 42,
+            recipient: { id: 5, username: "alice", avatar: "", status: "online" },
+            participants: [
+              { id: 5, username: "alice", avatar: "", status: "online" },
+              { id: 6, username: "bob", avatar: "", status: "online" },
+            ],
+            name: "Crew",
+            isGroup: true,
+            lastMessageId: null,
+            lastMessage: "",
+            lastMessageAt: "",
+            unreadCount: 0,
+          },
+        ],
+      });
+      mockDmComposerBlockReason.mockReturnValue("You've blocked this user.");
+
+      const ctrl = createChannelController(makeOpts());
+      ctrl.mountChannel(42, "Crew", "dm");
+
+      expect(mockSetDisabled).toHaveBeenLastCalledWith(null);
+      expect(blocksSubscribers).toHaveLength(0);
+    });
   });
 
   describe("destroyChannel edge cases", () => {
@@ -1067,4 +1181,97 @@ describe("createChannelController", () => {
       expect(mockStartEdit).not.toHaveBeenCalled();
     });
   });
+  // ─── NSFW age gate ────────────────────────────────────────────────────────
+
+  describe("NSFW age gate", () => {
+    function seedChannel(nsfw: boolean): void {
+      setChannels([
+        {
+          id: 42,
+          name: "spicy",
+          type: "text",
+          category: null,
+          position: 0,
+          can_send: true,
+          nsfw,
+        },
+      ]);
+    }
+
+    beforeEach(() => {
+      sessionStorage.clear();
+      mockCreateNsfwGate.mockClear();
+      mockNsfwGateMount.mockClear();
+      mockNsfwGateDestroy.mockClear();
+      capturedNsfwOpts.value = null;
+    });
+
+    it("is not mounted for an unflagged channel", () => {
+      seedChannel(false);
+      const ctrl = createChannelController(makeOpts());
+      ctrl.mountChannel(42, "spicy");
+      expect(mockCreateNsfwGate).not.toHaveBeenCalled();
+      ctrl.destroyChannel();
+    });
+
+    it("mounts over the message area for a flagged channel", () => {
+      seedChannel(true);
+      const opts = makeOpts();
+      const ctrl = createChannelController(opts);
+      ctrl.mountChannel(42, "spicy");
+
+      expect(mockCreateNsfwGate).toHaveBeenCalledTimes(1);
+      expect(capturedNsfwOpts.value.channelId).toBe(42);
+      expect(capturedNsfwOpts.value.channelName).toBe("spicy");
+      // Over the messages, not over the whole app: the sidebar stays usable.
+      expect(mockNsfwGateMount).toHaveBeenCalledWith(opts.slots.messagesSlot);
+      ctrl.destroyChannel();
+    });
+
+    it("tears the gate down when Continue is accepted", () => {
+      seedChannel(true);
+      const ctrl = createChannelController(makeOpts());
+      ctrl.mountChannel(42, "spicy");
+
+      capturedNsfwOpts.value.onContinue();
+
+      expect(mockNsfwGateDestroy).toHaveBeenCalled();
+      ctrl.destroyChannel();
+    });
+
+    it("leaves the channel when the reader declines", () => {
+      seedChannel(true);
+      const ctrl = createChannelController(makeOpts());
+      ctrl.mountChannel(42, "spicy");
+
+      capturedNsfwOpts.value.onCancel();
+
+      expect(ctrl.currentChannelId).toBeNull();
+      expect(channelsStore.getState().activeChannelId).toBeNull();
+    });
+
+    // Once per session: the stored acknowledgement (written by the gate's
+    // Continue button, which is stubbed out here) is what suppresses the second
+    // ask, so switching away and back must not re-prompt.
+    it("does not mount for a channel already acknowledged this session", () => {
+      acknowledgeNsfw(42);
+      seedChannel(true);
+      const ctrl = createChannelController(makeOpts());
+
+      ctrl.mountChannel(42, "spicy");
+
+      expect(mockCreateNsfwGate).not.toHaveBeenCalled();
+      ctrl.destroyChannel();
+    });
+
+    it("destroys an unaccepted gate when the channel unmounts", () => {
+      seedChannel(true);
+      const ctrl = createChannelController(makeOpts());
+      ctrl.mountChannel(42, "spicy");
+
+      ctrl.destroyChannel();
+
+      expect(mockNsfwGateDestroy).toHaveBeenCalled();
+    });
+  });
 });
diff --git a/Client/tauri-client/tests/unit/channel-mute-ui.test.ts b/Client/tauri-client/tests/unit/channel-mute-ui.test.ts
new file mode 100644
index 00000000..40b29604
--- /dev/null
+++ b/Client/tauri-client/tests/unit/channel-mute-ui.test.ts
@@ -0,0 +1,185 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import {
+  attachChannelContextMenu,
+  CHANNEL_MUTE_CHANGED,
+} from "@components/channel-sidebar/context-menu";
+import { buildNotificationsTab } from "@components/settings/NotificationsTab";
+import { isChannelMuted, muteChannel, invalidateMuteCache } from "@lib/channel-mutes";
+import { channelsStore } from "@stores/channels.store";
+import { dmStore } from "@stores/dm.store";
+import type { Channel } from "@stores/channels.store";
+
+function channel(overrides: Partial<Channel> = {}): Channel {
+  return {
+    id: 5,
+    name: "general",
+    type: "text",
+    category: null,
+    position: 0,
+    unreadCount: 0,
+    mentionCount: 0,
+    lastMessageId: null,
+    canSend: true,
+    slowMode: 0,
+    topic: "",
+    nsfw: false,
+    voiceMaxUsers: 0,
+    voiceMaxVideo: 0,
+    ...overrides,
+  };
+}
+
+let container: HTMLDivElement;
+let ac: AbortController;
+
+beforeEach(() => {
+  localStorage.clear();
+  invalidateMuteCache();
+  container = document.createElement("div");
+  document.body.appendChild(container);
+  ac = new AbortController();
+});
+
+afterEach(() => {
+  ac.abort();
+  container.remove();
+  document.querySelectorAll(".channel-ctx-menu").forEach((el) => el.remove());
+});
+
+function openMenu(ch: Channel): HTMLElement {
+  const el = document.createElement("div");
+  container.appendChild(el);
+  attachChannelContextMenu(el, ch, ac.signal);
+  el.dispatchEvent(new MouseEvent("contextmenu", { bubbles: true, clientX: 4, clientY: 4 }));
+  return el;
+}
+
+describe("channel context menu — mute", () => {
+  it("offers Mute Channel for a text channel", () => {
+    openMenu(channel());
+    const item = document.querySelector('[data-testid="ctx-mute-channel"]');
+    expect(item).not.toBeNull();
+    expect(item!.textContent).toBe("Mute Channel");
+  });
+
+  it("says Unmute Channel when already muted", () => {
+    muteChannel(5);
+    openMenu(channel());
+    expect(document.querySelector('[data-testid="ctx-mute-channel"]')!.textContent).toBe(
+      "Unmute Channel",
+    );
+  });
+
+  it("toggles the mute on click", () => {
+    openMenu(channel());
+    (document.querySelector('[data-testid="ctx-mute-channel"]') as HTMLElement).click();
+    expect(isChannelMuted(5)).toBe(true);
+  });
+
+  it("bubbles a mute-changed event so the sidebar can redraw", () => {
+    const el = openMenu(channel());
+    const seen: number[] = [];
+    el.addEventListener(CHANNEL_MUTE_CHANGED, (e) => {
+      seen.push((e as CustomEvent<{ channelId: number }>).detail.channelId);
+    });
+
+    (document.querySelector('[data-testid="ctx-mute-channel"]') as HTMLElement).click();
+    expect(seen).toEqual([5]);
+  });
+
+  // A voice channel produces no notifications, so a mute there would be an
+  // affordance that cannot do anything.
+  it("does not offer Mute for a voice channel", () => {
+    openMenu(channel({ id: 6, type: "voice" }));
+    expect(document.querySelector('[data-testid="ctx-mute-channel"]')).toBeNull();
+  });
+
+  it("offers Mute for a DM channel", () => {
+    openMenu(channel({ id: 7, type: "dm" }));
+    expect(document.querySelector('[data-testid="ctx-mute-channel"]')).not.toBeNull();
+  });
+});
+
+describe("NotificationsTab — muted channel list", () => {
+  it("says nothing is muted when nothing is", () => {
+    const tab = buildNotificationsTab(ac.signal);
+    container.appendChild(tab);
+    expect(tab.querySelector('[data-testid="muted-empty"]')).not.toBeNull();
+  });
+
+  it("names a muted guild channel with a hash", () => {
+    channelsStore.setState((prev) => {
+      const next = new Map(prev.channels);
+      next.set(5, channel({ id: 5, name: "general" }));
+      return { ...prev, channels: next };
+    });
+    muteChannel(5);
+
+    const tab = buildNotificationsTab(ac.signal);
+    container.appendChild(tab);
+    expect(tab.querySelector('[data-testid="muted-channel-list"]')!.textContent).toContain(
+      "#general",
+    );
+  });
+
+  it("names a muted DM with an at-sign and its display name", () => {
+    dmStore.setState(() => ({
+      channels: [
+        {
+          channelId: 9,
+          recipient: { id: 2, username: "bob", avatar: "", status: "online" },
+          participants: [{ id: 2, username: "bob", avatar: "", status: "online" }],
+          name: "",
+          isGroup: false,
+          lastMessageId: null,
+          lastMessage: "",
+          lastMessageAt: "",
+          unreadCount: 0,
+          mentionCount: 0,
+        },
+      ],
+    }));
+    muteChannel(9);
+
+    const tab = buildNotificationsTab(ac.signal);
+    container.appendChild(tab);
+    expect(tab.querySelector('[data-testid="muted-channel-list"]')!.textContent).toContain("@bob");
+  });
+
+  // A mute can outlive the channel it names (deleted channel, left group). It
+  // is still listed, because otherwise there is no way to clear it.
+  it("still lists a mute for a channel it cannot name", () => {
+    channelsStore.setState((prev) => ({ ...prev, channels: new Map() }));
+    dmStore.setState(() => ({ channels: [] }));
+    muteChannel(4242);
+
+    const tab = buildNotificationsTab(ac.signal);
+    container.appendChild(tab);
+    expect(tab.querySelector('[data-testid="muted-channel-list"]')!.textContent).toContain(
+      "Channel 4242",
+    );
+  });
+
+  it("unmutes from the list and removes the row", () => {
+    muteChannel(5);
+    const tab = buildNotificationsTab(ac.signal);
+    container.appendChild(tab);
+
+    (tab.querySelector('[data-testid="unmute-5"]') as HTMLElement).click();
+    expect(isChannelMuted(5)).toBe(false);
+    expect(tab.querySelector('[data-testid="unmute-5"]')).toBeNull();
+    expect(tab.querySelector('[data-testid="muted-empty"]')).not.toBeNull();
+  });
+
+  it("lists several mutes in ascending order", () => {
+    muteChannel(9);
+    muteChannel(2);
+    const tab = buildNotificationsTab(ac.signal);
+    container.appendChild(tab);
+
+    const rows = [...tab.querySelectorAll(".settings-muted-row")];
+    expect(rows).toHaveLength(2);
+    expect(rows[0]!.textContent).toContain("Channel 2");
+    expect(rows[1]!.textContent).toContain("Channel 9");
+  });
+});
diff --git a/Client/tauri-client/tests/unit/channel-mutes.test.ts b/Client/tauri-client/tests/unit/channel-mutes.test.ts
new file mode 100644
index 00000000..b85ae41e
--- /dev/null
+++ b/Client/tauri-client/tests/unit/channel-mutes.test.ts
@@ -0,0 +1,161 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import {
+  isChannelMuted,
+  listMutedChannels,
+  muteChannel,
+  unmuteChannel,
+  toggleChannelMute,
+  notificationAllowed,
+  invalidateMuteCache,
+} from "@lib/channel-mutes";
+import { STORAGE_PREFIX } from "@lib/preferences";
+
+const KEY = `${STORAGE_PREFIX}mutedChannels`;
+
+beforeEach(() => {
+  localStorage.clear();
+  invalidateMuteCache();
+});
+
+describe("channel mutes — storage", () => {
+  it("starts with nothing muted", () => {
+    expect(listMutedChannels()).toEqual([]);
+    expect(isChannelMuted(7)).toBe(false);
+  });
+
+  it("persists a mute to localStorage under the settings prefix", () => {
+    muteChannel(7);
+    expect(isChannelMuted(7)).toBe(true);
+    expect(JSON.parse(localStorage.getItem(KEY)!)).toEqual([7]);
+  });
+
+  it("is idempotent in both directions", () => {
+    muteChannel(7);
+    muteChannel(7);
+    expect(listMutedChannels()).toEqual([7]);
+    unmuteChannel(7);
+    unmuteChannel(7);
+    expect(listMutedChannels()).toEqual([]);
+  });
+
+  it("toggles and reports the new state", () => {
+    expect(toggleChannelMute(3)).toBe(true);
+    expect(isChannelMuted(3)).toBe(true);
+    expect(toggleChannelMute(3)).toBe(false);
+    expect(isChannelMuted(3)).toBe(false);
+  });
+
+  it("lists muted channels in ascending order", () => {
+    muteChannel(9);
+    muteChannel(2);
+    muteChannel(5);
+    expect(listMutedChannels()).toEqual([2, 5, 9]);
+  });
+
+  // Corrupted storage must cost the user the bad entry, not all their mutes.
+  it("ignores non-numeric and non-positive entries in stored data", () => {
+    localStorage.setItem(KEY, JSON.stringify([1, "two", null, -3, 0, 4.5, 4]));
+    invalidateMuteCache();
+    expect(listMutedChannels()).toEqual([1, 4]);
+  });
+
+  it("falls back to empty when the stored value is not an array", () => {
+    localStorage.setItem(KEY, JSON.stringify({ nope: true }));
+    invalidateMuteCache();
+    expect(listMutedChannels()).toEqual([]);
+  });
+
+  it("picks up a mute made elsewhere via the pref-change event", () => {
+    muteChannel(11);
+    // Simulate another module writing the key directly, then announcing it.
+    localStorage.setItem(KEY, JSON.stringify([11, 12]));
+    window.dispatchEvent(
+      new CustomEvent("owncord:pref-change", { detail: { key: "mutedChannels" } }),
+    );
+    expect(isChannelMuted(12)).toBe(true);
+  });
+});
+
+describe("channel mutes — notification gating", () => {
+  it("allows notifications for an unmuted channel", () => {
+    expect(notificationAllowed(1, false)).toBe(true);
+  });
+
+  it("silences a muted channel's ordinary messages", () => {
+    muteChannel(1);
+    expect(notificationAllowed(1, false)).toBe(false);
+  });
+
+  // The load-bearing rule: a mute silences chatter, never something addressed
+  // to the reader. A mute that swallowed mentions would be unsafe to use.
+  it("still allows a mention in a muted channel", () => {
+    muteChannel(1);
+    expect(notificationAllowed(1, true)).toBe(true);
+  });
+
+  it("does not leak a mute across channels", () => {
+    muteChannel(1);
+    expect(notificationAllowed(2, false)).toBe(true);
+  });
+});
+
+describe("notifyIncomingMessage respects mutes", () => {
+  // The gate is exercised through the real notification entry point so the
+  // popup, the chime and the taskbar flash cannot each apply their own copy.
+  async function loadNotifications() {
+    vi.resetModules();
+    return import("@lib/notifications");
+  }
+
+  beforeEach(() => {
+    localStorage.clear();
+    invalidateMuteCache();
+    vi.restoreAllMocks();
+  });
+
+  function payload(channelId: number, mentions: number[] = []) {
+    return {
+      id: 1,
+      channel_id: channelId,
+      user: { id: 99, username: "alice", avatar: null },
+      content: "hello",
+      reply_to: null,
+      timestamp: "2026-01-01T00:00:00Z",
+      mentions,
+      mentions_everyone: false,
+    };
+  }
+
+  it("fires nothing for a muted channel", async () => {
+    const { notifyIncomingMessage } = await loadNotifications();
+    muteChannel(50);
+    const notif = vi.fn();
+    vi.stubGlobal(
+      "Notification",
+      Object.assign(notif, { permission: "granted", requestPermission: vi.fn() }),
+    );
+    vi.spyOn(document, "hasFocus").mockReturnValue(false);
+
+    notifyIncomingMessage(payload(50) as never);
+    expect(notif).not.toHaveBeenCalled();
+  });
+
+  it("still fires for a mention in a muted channel", async () => {
+    const { notifyIncomingMessage } = await loadNotifications();
+    muteChannel(50);
+    const notif = vi.fn();
+    vi.stubGlobal(
+      "Notification",
+      Object.assign(notif, { permission: "granted", requestPermission: vi.fn() }),
+    );
+    vi.spyOn(document, "hasFocus").mockReturnValue(false);
+
+    // A mention resolved by the server: the payload names the reader.
+    notifyIncomingMessage(payload(50, [1]) as never);
+    // The desktop notification path is async (dynamic import of the Tauri
+    // plugin), so only the absence assertion above is synchronous. What this
+    // pins is that the mute gate did not return early — which it would have,
+    // silently, for a non-mention.
+    expect(notificationAllowed(50, true)).toBe(true);
+  });
+});
diff --git a/Client/tauri-client/tests/unit/channel-sidebar-read-state.test.ts b/Client/tauri-client/tests/unit/channel-sidebar-read-state.test.ts
new file mode 100644
index 00000000..e88ff619
--- /dev/null
+++ b/Client/tauri-client/tests/unit/channel-sidebar-read-state.test.ts
@@ -0,0 +1,207 @@
+/**
+ * Explicit mark-as-read affordances in the channel sidebar: the per-channel
+ * "Mark as Read" context-menu entry and the server-header "Mark All as Read".
+ */
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+
+vi.mock("@lib/livekitSession", () => ({ rePinPeerIdentity: vi.fn() }));
+vi.mock("@lib/e2eeCrypto", () => ({
+  importIdentityPublicKey: vi.fn(),
+  computeKeyFingerprint: vi.fn(),
+}));
+
+import { createChannelSidebar } from "../../src/components/ChannelSidebar";
+import { channelsStore, setChannels } from "../../src/stores/channels.store";
+import { dmStore } from "../../src/stores/dm.store";
+import { authStore } from "../../src/stores/auth.store";
+import { uiStore } from "../../src/stores/ui.store";
+import { voiceStore } from "../../src/stores/voice.store";
+import { membersStore } from "../../src/stores/members.store";
+import { setMarkReadSender } from "@lib/read-state";
+import type { ReadyChannel } from "../../src/lib/types";
+
+const CHANNELS: ReadyChannel[] = [
+  {
+    id: 1,
+    name: "general",
+    type: "text",
+    category: "Text Channels",
+    position: 0,
+    unread_count: 3,
+    mention_count: 1,
+  },
+  { id: 2, name: "random", type: "text", category: "Text Channels", position: 1, unread_count: 0 },
+  { id: 3, name: "lobby", type: "voice", category: "Voice Channels", position: 0 },
+];
+
+describe("ChannelSidebar — mark as read", () => {
+  let container: HTMLDivElement;
+  let sidebar: ReturnType<typeof createChannelSidebar>;
+  let sent: number[];
+
+  beforeEach(() => {
+    sent = [];
+    setMarkReadSender((id) => sent.push(id));
+    channelsStore.setState(() => ({ channels: new Map(), activeChannelId: null, roles: [] }));
+    dmStore.setState(() => ({ channels: [] }));
+    membersStore.setState(() => ({ members: new Map(), typingUsers: new Map() }));
+    uiStore.setState((prev) => ({ ...prev, collapsedCategories: new Set() }));
+    voiceStore.setState((prev) => ({ ...prev, voiceStates: new Map() }));
+    authStore.setState(() => ({
+      token: "tok",
+      user: { id: 2, username: "Member", avatar: null, role: "member" },
+      serverName: "Test Server",
+      motd: null,
+      isAuthenticated: true,
+    }));
+
+    container = document.createElement("div");
+    document.body.appendChild(container);
+    sidebar = createChannelSidebar({ onVoiceJoin: vi.fn(), onVoiceLeave: vi.fn() });
+  });
+
+  afterEach(() => {
+    sidebar.destroy?.();
+    container.remove();
+    document.querySelectorAll(".channel-ctx-menu").forEach((el) => el.remove());
+    setMarkReadSender(null);
+  });
+
+  function openCtxMenu(channelId: number): HTMLElement | null {
+    const el = container.querySelector(`[data-channel-id="${channelId}"]`) as HTMLElement;
+    el.dispatchEvent(new MouseEvent("contextmenu", { bubbles: true, clientX: 5, clientY: 5 }));
+    return document.querySelector('[data-testid="channel-context-menu"]');
+  }
+
+  it("marks a channel read from the context menu without activating it", () => {
+    setChannels(CHANNELS);
+    sidebar.mount(container);
+
+    const menu = openCtxMenu(1);
+    const item = menu?.querySelector('[data-testid="ctx-mark-read"]') as HTMLElement;
+    expect(item).not.toBeNull();
+    expect(item.classList.contains("disabled")).toBe(false);
+
+    item.click();
+
+    expect(sent).toEqual([1]);
+    const ch = channelsStore.getState().channels.get(1);
+    expect(ch?.unreadCount).toBe(0);
+    expect(ch?.mentionCount).toBe(0);
+    expect(channelsStore.getState().activeChannelId).toBeNull();
+  });
+
+  it("disables Mark as Read for a channel with nothing unread", () => {
+    setChannels(CHANNELS);
+    sidebar.mount(container);
+
+    const menu = openCtxMenu(2);
+    const item = menu?.querySelector('[data-testid="ctx-mark-read"]') as HTMLElement;
+    expect(item.classList.contains("disabled")).toBe(true);
+
+    item.click();
+    expect(sent).toEqual([]);
+  });
+
+  it("omits Mark as Read for a voice channel, which holds no messages", () => {
+    setChannels(CHANNELS);
+    sidebar.mount(container);
+
+    const el = container.querySelector('[data-channel-id="3"]') as HTMLElement;
+    el.dispatchEvent(new MouseEvent("contextmenu", { bubbles: true, clientX: 5, clientY: 5 }));
+    const menu = document.querySelector('[data-testid="channel-context-menu"]');
+    expect(menu?.querySelector('[data-testid="ctx-mark-read"]') ?? null).toBeNull();
+  });
+});
+
+describe("ChannelSidebar — mark all as read", () => {
+  let container: HTMLDivElement;
+  let sidebar: ReturnType<typeof createChannelSidebar>;
+  let sent: number[];
+
+  beforeEach(() => {
+    sent = [];
+    setMarkReadSender((id) => sent.push(id));
+    channelsStore.setState(() => ({ channels: new Map(), activeChannelId: null, roles: [] }));
+    dmStore.setState(() => ({ channels: [] }));
+    membersStore.setState(() => ({ members: new Map(), typingUsers: new Map() }));
+    uiStore.setState((prev) => ({ ...prev, collapsedCategories: new Set() }));
+    voiceStore.setState((prev) => ({ ...prev, voiceStates: new Map() }));
+    authStore.setState(() => ({
+      token: "tok",
+      user: { id: 2, username: "Member", avatar: null, role: "member" },
+      serverName: "Test Server",
+      motd: null,
+      isAuthenticated: true,
+    }));
+    container = document.createElement("div");
+    document.body.appendChild(container);
+    sidebar = createChannelSidebar({ onVoiceJoin: vi.fn(), onVoiceLeave: vi.fn() });
+  });
+
+  afterEach(() => {
+    sidebar.destroy?.();
+    container.remove();
+    setMarkReadSender(null);
+  });
+
+  function button(): HTMLElement {
+    return container.querySelector('[data-testid="mark-all-read"]') as HTMLElement;
+  }
+
+  it("hides the button while nothing is unread", () => {
+    setChannels([CHANNELS[1]!]);
+    sidebar.mount(container);
+
+    expect(button()).not.toBeNull();
+    expect(button().classList.contains("visible")).toBe(false);
+  });
+
+  it("shows the button once a channel goes unread", () => {
+    setChannels(CHANNELS);
+    sidebar.mount(container);
+
+    expect(button().classList.contains("visible")).toBe(true);
+  });
+
+  it("shows the button for a DM-only unread, whose badge lives in dm.store", async () => {
+    setChannels([CHANNELS[1]!]);
+    sidebar.mount(container);
+    expect(button().classList.contains("visible")).toBe(false);
+
+    dmStore.setState(() => ({
+      channels: [
+        {
+          channelId: 50,
+          recipient: { id: 9, username: "alice", avatar: "", status: "online" },
+          participants: [],
+          name: "",
+          isGroup: false,
+          lastMessageId: null,
+          lastMessage: "",
+          lastMessageAt: "",
+          unreadCount: 2,
+          mentionCount: 0,
+        },
+      ],
+    }));
+
+    // Store notifications are batched on a microtask.
+    await vi.waitFor(() => {
+      expect(button().classList.contains("visible")).toBe(true);
+    });
+  });
+
+  it("clears every badge and hides itself when clicked", async () => {
+    setChannels(CHANNELS);
+    sidebar.mount(container);
+
+    button().click();
+
+    expect(sent).toEqual([1]);
+    expect(channelsStore.getState().channels.get(1)?.unreadCount).toBe(0);
+    await vi.waitFor(() => {
+      expect(button().classList.contains("visible")).toBe(false);
+    });
+  });
+});
diff --git a/Client/tauri-client/tests/unit/channel-sidebar.test.ts b/Client/tauri-client/tests/unit/channel-sidebar.test.ts
index f5d407de..fe5cfa09 100644
--- a/Client/tauri-client/tests/unit/channel-sidebar.test.ts
+++ b/Client/tauri-client/tests/unit/channel-sidebar.test.ts
@@ -32,13 +32,19 @@ vi.mock("@lib/e2eeCrypto", async (importOriginal) => {
 });
 
 import { createChannelSidebar } from "../../src/components/ChannelSidebar";
-import { channelsStore, setChannels, setActiveChannel } from "../../src/stores/channels.store";
+import {
+  channelsStore,
+  setChannels,
+  setActiveChannel,
+  setRoles,
+  type Channel,
+} from "../../src/stores/channels.store";
 import { authStore } from "../../src/stores/auth.store";
 import { uiStore, toggleCategory } from "../../src/stores/ui.store";
 import { voiceStore, updateVoiceState } from "../../src/stores/voice.store";
 import type { PeerVerification } from "../../src/stores/voice.store";
 import { membersStore } from "../../src/stores/members.store";
-import type { ReadyChannel } from "../../src/lib/types";
+import { Permission, type ReadyChannel, type VoiceStatePayload } from "../../src/lib/types";
 import { computeKeyFingerprint } from "@lib/e2eeCrypto";
 
 function resetStores(): void {
@@ -152,6 +158,16 @@ const testChannels: ReadyChannel[] = [
   },
 ];
 
+/** Fresh spies for the four voice moderation callbacks. */
+function voiceModCallbacks() {
+  return {
+    onServerMute: vi.fn(),
+    onServerDeafen: vi.fn(),
+    onMove: vi.fn(),
+    onDisconnect: vi.fn(),
+  };
+}
+
 /** Set auth user so admin-gated features (context menus, drag, create channel) activate. */
 function setAdminUser(): void {
   authStore.setState(() => ({
@@ -214,6 +230,45 @@ describe("ChannelSidebar", () => {
     expect(categoryNames).toContain("Info");
   });
 
+  // Categories are free text: a voice channel groups under whatever it carries,
+  // and shares a category with text channels rather than being pulled into a
+  // hardcoded voice section.
+  it("groups a voice channel under an arbitrary shared category", () => {
+    setChannels([
+      { id: 1, name: "chat", type: "text", category: "Gaming", position: 0 },
+      { id: 2, name: "lounge", type: "voice", category: "Gaming", position: 1 },
+    ]);
+    sidebar.mount(container);
+
+    const headers = Array.from(container.querySelectorAll(".category"));
+    const names = headers.map((el) => el.querySelector(".category-name")?.textContent);
+    expect(names).toEqual(["Gaming"]);
+
+    const group = headers[0]?.parentElement;
+    const rendered = Array.from(group?.querySelectorAll(".ch-name") ?? []).map(
+      (el) => el.textContent,
+    );
+    expect(rendered).toEqual(["chat", "lounge"]);
+  });
+
+  it("puts only uncategorized voice channels in the fallback Voice group", () => {
+    setChannels([
+      { id: 1, name: "loose-text", type: "text", category: null, position: 0 },
+      { id: 2, name: "loose-voice", type: "voice", category: null, position: 1 },
+    ]);
+    sidebar.mount(container);
+
+    const names = Array.from(container.querySelectorAll(".category-name")).map(
+      (el) => el.textContent,
+    );
+    expect(names).toEqual(["Voice"]);
+
+    // The uncategorized TEXT channel still renders, headerless.
+    const allNames = Array.from(container.querySelectorAll(".ch-name")).map((el) => el.textContent);
+    expect(allNames).toContain("loose-text");
+    expect(allNames).toContain("loose-voice");
+  });
+
   it("click channel sets active and clears unread", () => {
     setChannels(testChannels);
     sidebar.mount(container);
@@ -285,6 +340,40 @@ describe("ChannelSidebar", () => {
     expect(badgeTexts).toContain("5");
   });
 
+  it("shows the red mention badge instead of the unread badge", () => {
+    setChannels([{ ...testChannels[0]!, unread_count: 7, mention_count: 2 }, testChannels[1]!]);
+    sidebar.mount(container);
+
+    const item = container.querySelector('[data-channel-id="1"]')!;
+    expect(item.classList.contains("mentioned")).toBe(true);
+    const mentionBadge = item.querySelector(".mention-badge");
+    expect(mentionBadge?.textContent).toBe("2");
+    // The mention badge wins outright — no double badge on one row.
+    expect(item.querySelector(".unread-badge")).toBeNull();
+  });
+
+  it("falls back to the unread badge when there are no mentions", () => {
+    setChannels([{ ...testChannels[0]!, unread_count: 7, mention_count: 0 }]);
+    sidebar.mount(container);
+
+    const item = container.querySelector('[data-channel-id="1"]')!;
+    expect(item.classList.contains("mentioned")).toBe(false);
+    expect(item.querySelector(".mention-badge")).toBeNull();
+    expect(item.querySelector(".unread-badge")?.textContent).toBe("7");
+  });
+
+  it("clears the mention badge when the channel is activated", () => {
+    setChannels([{ ...testChannels[0]!, unread_count: 7, mention_count: 2 }]);
+    sidebar.mount(container);
+
+    (container.querySelector('[data-channel-id="1"]') as HTMLElement).click();
+    channelsStore.flush();
+
+    expect(channelsStore.getState().channels.get(1)?.mentionCount).toBe(0);
+    expect(channelsStore.getState().activeChannelId).toBe(1);
+    expect(container.querySelector(".mention-badge")).toBeNull();
+  });
+
   it("marks active channel with active class", () => {
     setChannels(testChannels);
     setActiveChannel(2);
@@ -870,7 +959,9 @@ describe("ChannelSidebar", () => {
     expect(onDeleteChannel.mock.calls[0]![0].id).toBe(1);
   });
 
-  it("does not show context menu for non-admin users", () => {
+  // Mark as Read is offered to everyone (it touches only the caller's own read
+  // state), so a non-admin now gets a menu — just without the admin entries.
+  it("shows only Mark as Read in the context menu for non-admin users", () => {
     const onEditChannel = vi.fn();
     sidebar.destroy?.();
     // Set a regular member (not admin/owner)
@@ -899,9 +990,114 @@ describe("ChannelSidebar", () => {
       }),
     );
 
-    // No context menu should appear for non-admin
     const ctxMenu = document.querySelector('[data-testid="channel-context-menu"]');
-    expect(ctxMenu).toBeNull();
+    expect(ctxMenu).not.toBeNull();
+    expect(ctxMenu?.querySelector('[data-testid="ctx-mark-read"]')).not.toBeNull();
+    expect(ctxMenu?.querySelector('[data-testid="ctx-edit-channel"]')).toBeNull();
+    expect(ctxMenu?.querySelector('[data-testid="ctx-delete-channel"]')).toBeNull();
+    expect(onEditChannel).not.toHaveBeenCalled();
+  });
+
+  // ── Purge messages context-menu item ──
+
+  /** Right-click channel 1 and return the opened context menu. */
+  function openChannelCtxMenu(): HTMLElement | null {
+    const channelEl = container.querySelector('[data-channel-id="1"]') as HTMLElement;
+    channelEl.dispatchEvent(
+      new MouseEvent("contextmenu", { bubbles: true, clientX: 5, clientY: 5 }),
+    );
+    return document.querySelector('[data-testid="channel-context-menu"]');
+  }
+
+  it("shows Purge Messages for a role holding MANAGE_MESSAGES", () => {
+    const onPurgeChannel = vi.fn<(channel: Channel, count: number) => Promise<void>>(
+      async () => {},
+    );
+    sidebar.destroy?.();
+    setRoles([{ id: 3, name: "Moderator", color: null, permissions: Permission.MANAGE_MESSAGES }]);
+    authStore.setState(() => ({
+      token: "tok",
+      user: { id: 3, username: "Mod", avatar: null, role: "moderator" },
+      serverName: "Test Server",
+      motd: null,
+      isAuthenticated: true,
+    }));
+    sidebar = createChannelSidebar({ onVoiceJoin, onVoiceLeave, onPurgeChannel });
+
+    setChannels(testChannels);
+    sidebar.mount(container);
+
+    // A moderator is not owner/admin, so the menu exists only because of purge.
+    expect(openChannelCtxMenu()).not.toBeNull();
+    expect(document.querySelector('[data-testid="ctx-purge-messages"]')).not.toBeNull();
+    expect(document.querySelector('[data-testid="ctx-edit-channel"]')).toBeNull();
+  });
+
+  it("hides Purge Messages for a role without MANAGE_MESSAGES", () => {
+    const onPurgeChannel = vi.fn<(channel: Channel, count: number) => Promise<void>>(
+      async () => {},
+    );
+    sidebar.destroy?.();
+    setRoles([{ id: 2, name: "Admin", color: null, permissions: Permission.MANAGE_CHANNELS }]);
+    setAdminUser();
+    sidebar = createChannelSidebar({
+      onVoiceJoin,
+      onVoiceLeave,
+      onEditChannel: vi.fn(),
+      onPurgeChannel,
+    });
+
+    setChannels(testChannels);
+    sidebar.mount(container);
+
+    expect(openChannelCtxMenu()).not.toBeNull();
+    expect(document.querySelector('[data-testid="ctx-purge-messages"]')).toBeNull();
+  });
+
+  it("purge prompt clamps the count and calls onPurgeChannel with the channel", async () => {
+    const onPurgeChannel = vi.fn<(channel: Channel, count: number) => Promise<void>>(
+      async () => {},
+    );
+    sidebar.destroy?.();
+    setRoles([{ id: 2, name: "Admin", color: null, permissions: Permission.ADMINISTRATOR }]);
+    setAdminUser();
+    sidebar = createChannelSidebar({ onVoiceJoin, onVoiceLeave, onPurgeChannel });
+
+    setChannels(testChannels);
+    sidebar.mount(container);
+    openChannelCtxMenu();
+
+    const trigger = document.querySelector('[data-testid="ctx-purge-messages"]') as HTMLElement;
+    trigger.click();
+
+    const input = document.querySelector('[data-testid="purge-count-input"]') as HTMLInputElement;
+    expect(input).not.toBeNull();
+    input.value = "5000";
+    (document.querySelector('[data-testid="purge-confirm"]') as HTMLElement).click();
+
+    await vi.waitFor(() => {
+      expect(onPurgeChannel).toHaveBeenCalledTimes(1);
+    });
+    expect(onPurgeChannel.mock.calls[0]![0]).toMatchObject({ id: 1, name: "general" });
+    expect(onPurgeChannel.mock.calls[0]![1]).toBe(100);
+  });
+
+  it("does not offer purge on a voice channel", () => {
+    const onPurgeChannel = vi.fn<(channel: Channel, count: number) => Promise<void>>(
+      async () => {},
+    );
+    sidebar.destroy?.();
+    setRoles([{ id: 2, name: "Admin", color: null, permissions: Permission.ADMINISTRATOR }]);
+    setAdminUser();
+    sidebar = createChannelSidebar({ onVoiceJoin, onVoiceLeave, onPurgeChannel });
+
+    setChannels(testChannels);
+    sidebar.mount(container);
+
+    const voiceEl = container.querySelector('[data-channel-id="3"]') as HTMLElement;
+    voiceEl.dispatchEvent(new MouseEvent("contextmenu", { bubbles: true, clientX: 5, clientY: 5 }));
+
+    expect(document.querySelector('[data-testid="ctx-purge-messages"]')).toBeNull();
   });
 
   // ── Create channel button ──
@@ -993,6 +1189,49 @@ describe("ChannelSidebar", () => {
     expect(addBtn).toBeNull();
   });
 
+  // The button used to be gated on the role NAME, so a Moderator holding
+  // MANAGE_CHANNELS — which the server now honors on /admin/api/channels — saw
+  // no way to create one.
+  it("shows create channel button for a role holding MANAGE_CHANNELS", () => {
+    const onCreateChannel = vi.fn();
+    sidebar.destroy?.();
+    setRoles([{ id: 3, name: "Moderator", color: null, permissions: Permission.MANAGE_CHANNELS }]);
+    authStore.setState(() => ({
+      token: "tok",
+      user: { id: 3, username: "Mod", avatar: null, role: "moderator" },
+      serverName: "Test Server",
+      motd: null,
+      isAuthenticated: true,
+    }));
+    sidebar = createChannelSidebar({ onVoiceJoin, onVoiceLeave, onCreateChannel });
+
+    setChannels(testChannels);
+    sidebar.mount(container);
+
+    expect(container.querySelector(".category-add-btn")).not.toBeNull();
+  });
+
+  it("hides create channel button for a server role without MANAGE_CHANNELS", () => {
+    const onCreateChannel = vi.fn();
+    sidebar.destroy?.();
+    // A role the server DID send, holding no channel bit: the name fallback
+    // must not apply, even for a role called "admin".
+    setRoles([{ id: 2, name: "Admin", color: null, permissions: Permission.SEND_MESSAGES }]);
+    authStore.setState(() => ({
+      token: "tok",
+      user: { id: 2, username: "Admin", avatar: null, role: "admin" },
+      serverName: "Test Server",
+      motd: null,
+      isAuthenticated: true,
+    }));
+    sidebar = createChannelSidebar({ onVoiceJoin, onVoiceLeave, onCreateChannel });
+
+    setChannels(testChannels);
+    sidebar.mount(container);
+
+    expect(container.querySelector(".category-add-btn")).toBeNull();
+  });
+
   // ── Voice user volume context menu ──
 
   it("right-click on other user's voice row opens volume context menu", () => {
@@ -1038,6 +1277,154 @@ describe("ChannelSidebar", () => {
     expect(volMenu!.textContent).toContain("Reset Volume");
   });
 
+  // ── Voice moderation context menu (MUTE_MEMBERS) ──
+
+  /** Signs in as a user whose role holds exactly `permissions`, puts one other
+   *  user in the voice channel, mounts the sidebar and right-clicks their row.
+   *  Returns the open menu element (or null). */
+  function openVoiceMenuAs(
+    permissions: number,
+    voiceUser: Partial<VoiceStatePayload> = {},
+    onVoiceModerate?: Parameters<typeof createChannelSidebar>[0]["onVoiceModerate"],
+    channels: ReadyChannel[] = testChannels,
+  ): HTMLElement | null {
+    sidebar.destroy?.();
+    setRoles([{ id: 3, name: "Moderator", color: null, permissions }]);
+    authStore.setState(() => ({
+      token: "tok",
+      user: { id: 99, username: "Mod", avatar: null, role: "moderator" },
+      serverName: "Test Server",
+      motd: null,
+      isAuthenticated: true,
+    }));
+    sidebar = createChannelSidebar({ onVoiceJoin, onVoiceLeave, onVoiceModerate });
+
+    setChannels(channels);
+    updateVoiceState({
+      channel_id: 3,
+      user_id: 80,
+      username: "Target",
+      muted: false,
+      deafened: false,
+      speaking: false,
+      camera: false,
+      screenshare: false,
+      ...voiceUser,
+    });
+    sidebar.mount(container);
+
+    const voiceRow = container.querySelector(".voice-user-item") as HTMLElement;
+    voiceRow.dispatchEvent(new MouseEvent("contextmenu", { bubbles: true }));
+    return document.querySelector(".user-vol-menu");
+  }
+
+  it("hides the moderation section for a role without MUTE_MEMBERS", () => {
+    const menu = openVoiceMenuAs(Permission.MANAGE_CHANNELS, {}, voiceModCallbacks());
+    expect(menu).not.toBeNull();
+    expect(menu!.querySelector('[data-action="server-mute"]')).toBeNull();
+    expect(menu!.querySelector('[data-action="voice-disconnect"]')).toBeNull();
+    // The volume controls stay available to everyone.
+    expect(menu!.textContent).toContain("Reset Volume");
+  });
+
+  it("hides the moderation section when the page wired no callbacks", () => {
+    const menu = openVoiceMenuAs(Permission.MUTE_MEMBERS);
+    expect(menu).not.toBeNull();
+    expect(menu!.querySelector('[data-action="server-mute"]')).toBeNull();
+  });
+
+  it("shows the moderation section for a role holding MUTE_MEMBERS", () => {
+    const menu = openVoiceMenuAs(Permission.MUTE_MEMBERS, {}, voiceModCallbacks());
+    expect(menu).not.toBeNull();
+    expect(menu!.querySelector('[data-action="server-mute"]')!.textContent).toBe("Server Mute");
+    expect(menu!.querySelector('[data-action="server-deafen"]')!.textContent).toBe("Server Deafen");
+    expect(menu!.querySelector('[data-action="voice-disconnect"]')).not.toBeNull();
+  });
+
+  it("shows the moderation section for an ADMINISTRATOR role", () => {
+    const menu = openVoiceMenuAs(Permission.ADMINISTRATOR, {}, voiceModCallbacks());
+    expect(menu!.querySelector('[data-action="server-mute"]')).not.toBeNull();
+  });
+
+  it("labels the toggles by the target's current server-imposed state", () => {
+    const menu = openVoiceMenuAs(
+      Permission.MUTE_MEMBERS,
+      { muted: true, deafened: true, server_muted: true, server_deafened: true },
+      voiceModCallbacks(),
+    );
+    expect(menu!.querySelector('[data-action="server-mute"]')!.textContent).toBe("Server Unmute");
+    expect(menu!.querySelector('[data-action="server-deafen"]')!.textContent).toBe(
+      "Server Undeafen",
+    );
+  });
+
+  it("sends server mute with the channel and target, and disconnect with the target", () => {
+    const cb = voiceModCallbacks();
+    const menu = openVoiceMenuAs(Permission.MUTE_MEMBERS, {}, cb);
+
+    (menu!.querySelector('[data-action="server-mute"]') as HTMLElement).click();
+    expect(cb.onServerMute).toHaveBeenCalledWith(3, 80, true);
+
+    const menu2 = openVoiceMenuAs(Permission.MUTE_MEMBERS, {}, cb);
+    (menu2!.querySelector('[data-action="voice-disconnect"]') as HTMLElement).click();
+    expect(cb.onDisconnect).toHaveBeenCalledWith(80);
+  });
+
+  it("offers only the other voice channels as move targets", () => {
+    const cb = voiceModCallbacks();
+    const menu = openVoiceMenuAs(Permission.MUTE_MEMBERS, {}, cb);
+
+    const moveItems = menu!.querySelectorAll("[data-move-channel]");
+    // testChannels has one voice channel (id 3) — the one the target is in.
+    expect(moveItems.length).toBe(0);
+
+    const menu2 = openVoiceMenuAs(Permission.MUTE_MEMBERS, {}, cb, [
+      ...testChannels,
+      { id: 5, name: "voice-two", type: "voice", category: "Voice Channels", position: 1 },
+    ]);
+    const moveItems2 = menu2!.querySelectorAll("[data-move-channel]");
+    expect(moveItems2.length).toBe(1);
+    expect((moveItems2[0] as HTMLElement).dataset.moveChannel).toBe("5");
+
+    (moveItems2[0] as HTMLElement).click();
+    expect(cb.onMove).toHaveBeenCalledWith(80, 5);
+  });
+
+  it("marks a server-muted participant distinctly from a self-muted one", () => {
+    sidebar.destroy?.();
+    sidebar = createChannelSidebar({ onVoiceJoin, onVoiceLeave });
+    setChannels(testChannels);
+    updateVoiceState({
+      channel_id: 3,
+      user_id: 81,
+      username: "Selfmuted",
+      muted: true,
+      deafened: false,
+      speaking: false,
+      camera: false,
+      screenshare: false,
+    });
+    sidebar.mount(container);
+    expect(container.querySelector(".vu-muted.vu-server-muted")).toBeNull();
+
+    updateVoiceState({
+      channel_id: 3,
+      user_id: 81,
+      username: "Selfmuted",
+      muted: true,
+      deafened: false,
+      speaking: false,
+      camera: false,
+      screenshare: false,
+      server_muted: true,
+    });
+    voiceStore.flush();
+
+    const icon = container.querySelector(".vu-muted.vu-server-muted") as HTMLElement;
+    expect(icon).not.toBeNull();
+    expect(icon.title).toBe("Muted by a moderator");
+  });
+
   // ── Collapsed category shows arrow-right, expanded shows arrow-down ──
 
   it("collapsed category header has 'collapsed' class", () => {
@@ -1621,3 +2008,209 @@ describe("ChannelSidebar voice identity badge", () => {
     expect(document.body.querySelector(".modal-overlay")).toBeNull();
   });
 });
+
+// ── Channel feature flags in the sidebar ──
+//
+// nsfw and voice_max_users reach the sidebar through the channel store, so
+// these mount a fresh sidebar per case rather than reusing another suite's
+// fixture (which seeds voice users and identity state the readouts would pick
+// up).
+describe("ChannelSidebar channel feature flags", () => {
+  let container: HTMLDivElement;
+  let sidebar: ReturnType<typeof createChannelSidebar>;
+  let onVoiceJoin: ReturnType<typeof vi.fn>;
+  let onVoiceLeave: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    resetStores();
+    container = document.createElement("div");
+    document.body.appendChild(container);
+    onVoiceJoin = vi.fn();
+    onVoiceLeave = vi.fn();
+    sidebar = createChannelSidebar({ onVoiceJoin, onVoiceLeave });
+  });
+
+  afterEach(() => {
+    sidebar.destroy?.();
+    container.remove();
+  });
+  describe("NSFW indicator", () => {
+    it("marks a flagged text channel", () => {
+      setChannels([
+        { id: 1, name: "spicy", type: "text", category: "Text Channels", position: 0, nsfw: true },
+        { id: 2, name: "general", type: "text", category: "Text Channels", position: 1 },
+      ]);
+      sidebar.mount(container);
+
+      expect(container.querySelector("[data-testid='channel-nsfw-1']")).not.toBeNull();
+      expect(container.querySelector("[data-testid='channel-nsfw-2']")).toBeNull();
+    });
+
+    it("marks a flagged voice channel too", () => {
+      setChannels([
+        { id: 5, name: "lounge", type: "voice", category: "Voice", position: 0, nsfw: true },
+      ]);
+      sidebar.mount(container);
+
+      expect(container.querySelector("[data-testid='channel-nsfw-5']")).not.toBeNull();
+    });
+
+    // The marker is information, not a state — it must not colonise the "#"
+    // glyph or the name, which already encode unread/mention/active.
+    it("leaves the channel name intact", () => {
+      setChannels([
+        { id: 1, name: "spicy", type: "text", category: "Text Channels", position: 0, nsfw: true },
+      ]);
+      sidebar.mount(container);
+
+      expect(container.querySelector("[data-testid='channel-1'] .ch-name")?.textContent).toBe(
+        "spicy",
+      );
+    });
+  });
+
+  describe("voice capacity readout", () => {
+    it("shows connected/limit when the channel has a user limit", () => {
+      setChannels([
+        {
+          id: 5,
+          name: "lounge",
+          type: "voice",
+          category: "Voice",
+          position: 0,
+          voice_max_users: 5,
+        },
+      ]);
+      addVoiceUser(5, 10, "Alice");
+      addVoiceUser(5, 11, "Bob");
+      sidebar.mount(container);
+
+      expect(container.querySelector("[data-testid='channel-capacity-5']")?.textContent).toBe(
+        "2/5",
+      );
+    });
+
+    it("shows 0/limit for an empty limited channel", () => {
+      setChannels([
+        {
+          id: 5,
+          name: "lounge",
+          type: "voice",
+          category: "Voice",
+          position: 0,
+          voice_max_users: 3,
+        },
+      ]);
+      sidebar.mount(container);
+
+      expect(container.querySelector("[data-testid='channel-capacity-5']")?.textContent).toBe(
+        "0/3",
+      );
+    });
+
+    // "3/0" would read as a bug, and the participant rows underneath already
+    // show the count.
+    it("shows nothing when the channel is unlimited", () => {
+      setChannels([{ id: 5, name: "lounge", type: "voice", category: "Voice", position: 0 }]);
+      addVoiceUser(5, 10, "Alice");
+      sidebar.mount(container);
+
+      expect(container.querySelector("[data-testid='channel-capacity-5']")).toBeNull();
+    });
+
+    it("is not rendered for a text channel", () => {
+      setChannels([
+        { id: 1, name: "general", type: "text", category: "Text Channels", position: 0 },
+      ]);
+      sidebar.mount(container);
+
+      expect(container.querySelector("[data-testid='channel-capacity-1']")).toBeNull();
+    });
+
+    // The client never blocks the join: its participant list can lag, and a
+    // refusal it invented would be uncorrectable. The server answers with
+    // CHANNEL_FULL.
+    it("still joins on click when the channel looks full", () => {
+      setChannels([
+        {
+          id: 5,
+          name: "lounge",
+          type: "voice",
+          category: "Voice",
+          position: 0,
+          voice_max_users: 1,
+        },
+      ]);
+      addVoiceUser(5, 10, "Alice");
+      sidebar.mount(container);
+
+      (container.querySelector("[data-testid='channel-5']") as HTMLElement).click();
+
+      expect(onVoiceJoin).toHaveBeenCalledWith(5);
+    });
+  });
+});
+
+// ── Channel context menu: Edit/Delete follow MANAGE_CHANNELS ──
+//
+// These items used to be gated on the role NAME ("owner"/"admin"), so a custom
+// role the server would happily let edit a channel saw no way to, and a role
+// merely *called* "admin" with no channel bit saw items every click would be
+// refused for.
+describe("ChannelSidebar channel context menu permissions", () => {
+  let container: HTMLDivElement;
+  let sidebar: ReturnType<typeof createChannelSidebar>;
+
+  beforeEach(() => {
+    resetStores();
+    container = document.createElement("div");
+    document.body.appendChild(container);
+  });
+
+  afterEach(() => {
+    sidebar.destroy?.();
+    container.remove();
+    document.querySelectorAll(".context-menu").forEach((el) => el.remove());
+  });
+
+  function mountAs(roleName: string, permissions: number): HTMLElement | null {
+    setRoles([{ id: 9, name: roleName, color: null, permissions }]);
+    authStore.setState(() => ({
+      token: "tok",
+      user: { id: 9, username: "U", avatar: null, role: roleName },
+      serverName: "Test Server",
+      motd: null,
+      isAuthenticated: true,
+    }));
+    sidebar = createChannelSidebar({
+      onVoiceJoin: vi.fn(),
+      onVoiceLeave: vi.fn(),
+      onEditChannel: vi.fn(),
+      onDeleteChannel: vi.fn(),
+    });
+    setChannels([{ id: 1, name: "general", type: "text", category: "Text Channels", position: 0 }]);
+    sidebar.mount(container);
+
+    (container.querySelector('[data-channel-id="1"]') as HTMLElement).dispatchEvent(
+      new MouseEvent("contextmenu", { bubbles: true, clientX: 5, clientY: 5 }),
+    );
+    return document.querySelector('[data-testid="channel-context-menu"]');
+  }
+
+  it("offers Edit and Delete to a custom role holding MANAGE_CHANNELS", () => {
+    const menu = mountAs("Curator", Permission.MANAGE_CHANNELS);
+    expect(menu?.querySelector('[data-testid="ctx-edit-channel"]')).not.toBeNull();
+    expect(menu?.querySelector('[data-testid="ctx-delete-channel"]')).not.toBeNull();
+  });
+
+  it("hides them from a role named 'admin' that lacks the bit", () => {
+    const menu = mountAs("Admin", Permission.SEND_MESSAGES);
+    expect(menu?.querySelector('[data-testid="ctx-edit-channel"]')).toBeNull();
+    expect(menu?.querySelector('[data-testid="ctx-delete-channel"]')).toBeNull();
+  });
+
+  it("offers them to a role holding ADMINISTRATOR", () => {
+    const menu = mountAs("Owner", Permission.ADMINISTRATOR);
+    expect(menu?.querySelector('[data-testid="ctx-edit-channel"]')).not.toBeNull();
+  });
+});
diff --git a/Client/tauri-client/tests/unit/channels.store.test.ts b/Client/tauri-client/tests/unit/channels.store.test.ts
index dd1fe970..63e84670 100644
--- a/Client/tauri-client/tests/unit/channels.store.test.ts
+++ b/Client/tauri-client/tests/unit/channels.store.test.ts
@@ -11,8 +11,13 @@ import {
   setActiveChannel,
   getActiveChannel,
   getChannelsByCategory,
+  getKnownCategories,
+  displayCategoryOf,
+  UNCATEGORIZED_VOICE_CATEGORY,
   incrementUnread,
+  incrementMention,
   clearUnread,
+  getUnreadOnOpen,
 } from "../../src/stores/channels.store";
 import type { ReadyChannel, ChannelCreatePayload, ChannelUpdatePayload } from "../../src/lib/types";
 
@@ -72,9 +77,14 @@ describe("channels store", () => {
         category: "Text",
         position: 0,
         unreadCount: 3,
+        mentionCount: 0,
         lastMessageId: 100,
         canSend: true,
+        topic: "",
         slowMode: 0,
+        nsfw: false,
+        voiceMaxUsers: 0,
+        voiceMaxVideo: 0,
       });
 
       const voice = state.channels.get(2);
@@ -85,9 +95,14 @@ describe("channels store", () => {
         category: "Voice",
         position: 0,
         unreadCount: 0,
+        mentionCount: 0,
         lastMessageId: null,
         canSend: true,
+        topic: "",
         slowMode: 0,
+        nsfw: false,
+        voiceMaxUsers: 0,
+        voiceMaxVideo: 0,
       });
     });
 
@@ -123,9 +138,14 @@ describe("channels store", () => {
         category: "Text",
         position: 2,
         unreadCount: 0,
+        mentionCount: 0,
         lastMessageId: null,
         canSend: true,
+        topic: "",
         slowMode: 0,
+        nsfw: false,
+        voiceMaxUsers: 0,
+        voiceMaxVideo: 0,
       });
     });
 
@@ -287,9 +307,14 @@ describe("channels store", () => {
         category: "Text",
         position: 0,
         unreadCount: 0,
+        mentionCount: 0,
         lastMessageId: 100,
         canSend: true,
+        topic: "",
         slowMode: 0,
+        nsfw: false,
+        voiceMaxUsers: 0,
+        voiceMaxVideo: 0,
       });
     });
 
@@ -330,6 +355,147 @@ describe("channels store", () => {
       const grouped = getChannelsByCategory();
       expect(grouped.size).toBe(0);
     });
+
+    // No category name is magic: a voice channel groups under whatever it
+    // carries, and text/voice channels share a category happily.
+    it("groups a voice channel under an arbitrary category alongside text", () => {
+      setChannels([
+        { id: 1, name: "chat", type: "text", category: "Gaming", position: 0 },
+        { id: 2, name: "lounge", type: "voice", category: "Gaming", position: 1 },
+      ]);
+
+      const grouped = getChannelsByCategory();
+      expect(grouped.size).toBe(1);
+      expect(grouped.get("Gaming")?.map((c) => c.name)).toEqual(["chat", "lounge"]);
+    });
+
+    it("falls back to a Voice group only for uncategorized voice channels", () => {
+      setChannels([
+        { id: 1, name: "loose-text", type: "text", category: null, position: 0 },
+        { id: 2, name: "loose-voice", type: "voice", category: null, position: 1 },
+        { id: 3, name: "blank-voice", type: "voice", category: "", position: 2 },
+      ]);
+
+      const grouped = getChannelsByCategory();
+      expect(grouped.get(null)?.map((c) => c.name)).toEqual(["loose-text"]);
+      expect(grouped.get(UNCATEGORIZED_VOICE_CATEGORY)?.map((c) => c.name)).toEqual([
+        "loose-voice",
+        "blank-voice",
+      ]);
+    });
+
+    it("keeps DM channels out of every group", () => {
+      setChannels([
+        { id: 1, name: "chat", type: "text", category: "Gaming", position: 0 },
+        { id: 2, name: "dm", type: "dm", category: null, position: 0 },
+      ]);
+      const grouped = getChannelsByCategory();
+      expect(grouped.size).toBe(1);
+      expect(grouped.has(null)).toBe(false);
+    });
+  });
+
+  describe("displayCategoryOf", () => {
+    it("prefers the channel's own category over the voice fallback", () => {
+      setChannels([{ id: 1, name: "lounge", type: "voice", category: "Gaming", position: 0 }]);
+      const channel = channelsStore.getState().channels.get(1)!;
+      expect(displayCategoryOf(channel)).toBe("Gaming");
+    });
+
+    it("returns null for an uncategorized text channel", () => {
+      setChannels([{ id: 1, name: "loose", type: "text", category: null, position: 0 }]);
+      const channel = channelsStore.getState().channels.get(1)!;
+      expect(displayCategoryOf(channel)).toBeNull();
+    });
+  });
+
+  describe("getKnownCategories", () => {
+    it("returns distinct non-empty categories, sorted, DMs excluded", () => {
+      setChannels([
+        { id: 1, name: "a", type: "text", category: "Zeta", position: 0 },
+        { id: 2, name: "b", type: "voice", category: "Alpha", position: 1 },
+        { id: 3, name: "c", type: "text", category: "Alpha", position: 2 },
+        { id: 4, name: "d", type: "text", category: null, position: 3 },
+        { id: 5, name: "e", type: "text", category: "", position: 4 },
+        { id: 6, name: "dm", type: "dm", category: "Hidden", position: 5 },
+      ]);
+
+      expect(getKnownCategories()).toEqual(["Alpha", "Zeta"]);
+    });
+
+    it("returns an empty list when nothing is categorized", () => {
+      setChannels([{ id: 1, name: "a", type: "text", category: null, position: 0 }]);
+      expect(getKnownCategories()).toEqual([]);
+    });
+  });
+
+  describe("mention counts", () => {
+    it("reads mention_count from the ready payload", () => {
+      setChannels([{ ...readyChannels[0]!, unread_count: 5, mention_count: 2 }]);
+      expect(channelsStore.getState().channels.get(1)?.mentionCount).toBe(2);
+    });
+
+    it("defaults to 0 when an older server omits mention_count", () => {
+      setChannels(readyChannels);
+      expect(channelsStore.getState().channels.get(1)?.mentionCount).toBe(0);
+    });
+
+    it("increments the mention count for a non-active channel", () => {
+      setChannels(readyChannels);
+
+      incrementMention(1);
+      incrementMention(1);
+
+      expect(channelsStore.getState().channels.get(1)?.mentionCount).toBe(2);
+    });
+
+    it("skips increment for the active channel", () => {
+      setChannels(readyChannels);
+      setActiveChannel(1);
+
+      incrementMention(1);
+
+      expect(channelsStore.getState().channels.get(1)?.mentionCount).toBe(0);
+    });
+
+    it("is a no-op for an unknown channel id", () => {
+      setChannels(readyChannels);
+      const before = channelsStore.getState();
+
+      incrementMention(999);
+
+      expect(channelsStore.getState()).toBe(before);
+    });
+
+    it("clears on activation alongside unread", () => {
+      setChannels([{ ...readyChannels[0]!, unread_count: 5, mention_count: 2 }]);
+
+      setActiveChannel(1);
+
+      const ch = channelsStore.getState().channels.get(1);
+      expect(ch?.mentionCount).toBe(0);
+      expect(ch?.unreadCount).toBe(0);
+    });
+
+    it("clears via clearUnread", () => {
+      setChannels([{ ...readyChannels[0]!, unread_count: 5, mention_count: 2 }]);
+
+      clearUnread(1);
+
+      const ch = channelsStore.getState().channels.get(1);
+      expect(ch?.mentionCount).toBe(0);
+      expect(ch?.unreadCount).toBe(0);
+    });
+
+    it("leaves a mention-only channel's badge clearing to activation", () => {
+      setChannels([{ ...readyChannels[0]!, unread_count: 0, mention_count: 3 }]);
+
+      // Previously setActiveChannel bailed early when unreadCount was 0; a
+      // mention-only channel must still have its badge cleared.
+      setActiveChannel(1);
+
+      expect(channelsStore.getState().channels.get(1)?.mentionCount).toBe(0);
+    });
   });
 
   describe("incrementUnread", () => {
@@ -421,6 +587,31 @@ describe("channels store", () => {
     it("returns undefined when no roles set", () => {
       expect(getRoleIdByName("admin")).toBeUndefined();
     });
+
+    // Role CRUD makes the list mutable at runtime, so these lookups have to
+    // track a replacement list rather than the one shipped in `ready`.
+    it("resolves a custom role added after the initial role list", () => {
+      setRoles([{ id: 4, name: "Member", color: null, permissions: 0 }]);
+      expect(getRoleIdByName("contractor")).toBeUndefined();
+
+      setRoles([
+        { id: 4, name: "Member", color: null, permissions: 0 },
+        { id: 9, name: "Contractor", color: "#123456", permissions: 3, position: 30 },
+      ]);
+      // Case-insensitive, which is safe because the server enforces role names
+      // to be unique case-insensitively (migration 023).
+      expect(getRoleIdByName("contractor")).toBe(9);
+      expect(getRoleIdByName("CONTRACTOR")).toBe(9);
+    });
+
+    it("stops resolving a role's old name after it is renamed", () => {
+      setRoles([{ id: 9, name: "Contractor", color: null, permissions: 0 }]);
+      expect(getRoleIdByName("contractor")).toBe(9);
+
+      setRoles([{ id: 9, name: "Partner", color: null, permissions: 0 }]);
+      expect(getRoleIdByName("contractor")).toBeUndefined();
+      expect(getRoleIdByName("partner")).toBe(9);
+    });
   });
 
   describe("updateChannelPosition", () => {
@@ -503,6 +694,63 @@ describe("channels store", () => {
     });
   });
 
+  // The badge is cleared the moment a channel is opened, which destroys the
+  // only record of where the reader had got to. MessageList needs that number
+  // to place the "NEW" divider, so setActiveChannel snapshots it first.
+  describe("getUnreadOnOpen", () => {
+    it("is 0 for a channel that was never opened", () => {
+      setChannels(readyChannels);
+      expect(getUnreadOnOpen(1)).toBe(0);
+    });
+
+    it("captures the unread count as it was before the visit cleared it", () => {
+      setChannels(readyChannels); // channel 1 starts at 3 unread
+      incrementUnread(1);
+      incrementUnread(1);
+
+      setActiveChannel(1);
+
+      expect(getUnreadOnOpen(1)).toBe(5);
+      // …and the badge itself is gone.
+      expect(channelsStore.getState().channels.get(1)?.unreadCount).toBe(0);
+    });
+
+    it("resets to 0 on the next visit, which is what clears the divider", () => {
+      setChannels(readyChannels);
+      setActiveChannel(1);
+      expect(getUnreadOnOpen(1)).toBe(3);
+
+      setActiveChannel(null);
+      setActiveChannel(1);
+
+      expect(getUnreadOnOpen(1)).toBe(0);
+    });
+
+    it("is per channel", () => {
+      setChannels(readyChannels);
+      incrementUnread(3);
+      incrementUnread(3);
+
+      setActiveChannel(1);
+      setActiveChannel(3);
+
+      expect(getUnreadOnOpen(1)).toBe(3);
+      expect(getUnreadOnOpen(3)).toBe(2);
+    });
+
+    // A fresh ready payload restates unread from the server; a snapshot from
+    // the previous connection describes a read position that no longer applies.
+    it("is dropped by a new ready payload", () => {
+      setChannels(readyChannels);
+      setActiveChannel(1);
+      expect(getUnreadOnOpen(1)).toBe(3);
+
+      setChannels(readyChannels);
+
+      expect(getUnreadOnOpen(1)).toBe(0);
+    });
+  });
+
   describe("updateChannel — no changes", () => {
     it("still creates new object when neither name nor position is provided", () => {
       setChannels(readyChannels);
@@ -515,4 +763,151 @@ describe("channels store", () => {
       expect(ch?.position).toBe(0);
     });
   });
+  // ─── Channel feature flags ───────────────────────────────────────────────
+  //
+  // nsfw and the two voice limits arrive in `ready`, in channel_create and in
+  // channel_update, and the store is what the sidebar and the edit modal read.
+  // The interesting cases are all about ABSENCE: an older server omits the
+  // keys, and a partial channel_update carries only what changed.
+
+  describe("channel feature flags", () => {
+    it("reads the flags out of the ready payload", () => {
+      setChannels([
+        {
+          id: 1,
+          name: "spicy",
+          type: "text",
+          category: null,
+          position: 0,
+          nsfw: true,
+        },
+        {
+          id: 2,
+          name: "lounge",
+          type: "voice",
+          category: null,
+          position: 1,
+          voice_max_users: 5,
+          voice_max_video: 2,
+        },
+      ]);
+
+      const spicy = channelsStore.getState().channels.get(1);
+      expect(spicy?.nsfw).toBe(true);
+      expect(spicy?.voiceMaxUsers).toBe(0);
+
+      const lounge = channelsStore.getState().channels.get(2);
+      expect(lounge?.nsfw).toBe(false);
+      expect(lounge?.voiceMaxUsers).toBe(5);
+      expect(lounge?.voiceMaxVideo).toBe(2);
+    });
+
+    it("defaults to unflagged and unlimited when a server omits the keys", () => {
+      setChannels([{ id: 1, name: "general", type: "text", category: null, position: 0 }]);
+      const ch = channelsStore.getState().channels.get(1);
+      expect(ch?.nsfw).toBe(false);
+      expect(ch?.voiceMaxUsers).toBe(0);
+      expect(ch?.voiceMaxVideo).toBe(0);
+    });
+
+    it("reads the flags off a channel_create broadcast", () => {
+      addChannel({
+        id: 9,
+        name: "lounge",
+        type: "voice",
+        category: null,
+        position: 0,
+        nsfw: true,
+        voice_max_users: 4,
+        voice_max_video: 1,
+      } as ChannelCreatePayload);
+
+      const ch = channelsStore.getState().channels.get(9);
+      expect(ch?.nsfw).toBe(true);
+      expect(ch?.voiceMaxUsers).toBe(4);
+      expect(ch?.voiceMaxVideo).toBe(1);
+    });
+
+    it("applies a channel_update that flips the flags", () => {
+      setChannels([{ id: 1, name: "general", type: "text", category: null, position: 0 }]);
+
+      updateChannel({
+        id: 1,
+        nsfw: true,
+        slow_mode: 30,
+        voice_max_users: 7,
+        voice_max_video: 3,
+      } as ChannelUpdatePayload);
+
+      const ch = channelsStore.getState().channels.get(1);
+      expect(ch?.nsfw).toBe(true);
+      expect(ch?.slowMode).toBe(30);
+      expect(ch?.voiceMaxUsers).toBe(7);
+      expect(ch?.voiceMaxVideo).toBe(3);
+    });
+
+    it("clears the flag when a channel_update says false", () => {
+      setChannels([
+        { id: 1, name: "spicy", type: "text", category: null, position: 0, nsfw: true },
+      ]);
+
+      updateChannel({ id: 1, nsfw: false } as ChannelUpdatePayload);
+
+      expect(channelsStore.getState().channels.get(1)?.nsfw).toBe(false);
+    });
+
+    // An older server's channel_update carries only name/position. Treating the
+    // missing keys as "cleared" would drop the flag on the first rename.
+    it("leaves flags alone when a partial update omits them", () => {
+      setChannels([
+        {
+          id: 1,
+          name: "spicy",
+          type: "text",
+          category: null,
+          position: 0,
+          nsfw: true,
+          slow_mode: 15,
+          voice_max_users: 6,
+        },
+      ]);
+
+      updateChannel({ id: 1, name: "spicier" } as ChannelUpdatePayload);
+
+      const ch = channelsStore.getState().channels.get(1);
+      expect(ch?.name).toBe("spicier");
+      expect(ch?.nsfw).toBe(true);
+      expect(ch?.slowMode).toBe(15);
+      expect(ch?.voiceMaxUsers).toBe(6);
+    });
+
+    it("moves a channel between categories on a channel_update", () => {
+      setChannels([{ id: 1, name: "general", type: "text", category: "Chat", position: 0 }]);
+
+      updateChannel({ id: 1, category: "Hangout" } as ChannelUpdatePayload);
+
+      expect(channelsStore.getState().channels.get(1)?.category).toBe("Hangout");
+    });
+
+    // "" is a real value — it is how a channel becomes uncategorized — so it
+    // must not be confused with "the server did not send a category".
+    it("uncategorizes on an empty-string category", () => {
+      setChannels([{ id: 1, name: "general", type: "text", category: "Chat", position: 0 }]);
+
+      updateChannel({ id: 1, category: "" } as ChannelUpdatePayload);
+
+      expect(channelsStore.getState().channels.get(1)?.category).toBe("");
+    });
+
+    it("keeps the store immutable across a flag update", () => {
+      setChannels([{ id: 1, name: "general", type: "text", category: null, position: 0 }]);
+      const before = channelsStore.getState().channels.get(1);
+
+      updateChannel({ id: 1, nsfw: true } as ChannelUpdatePayload);
+
+      const after = channelsStore.getState().channels.get(1);
+      expect(after).not.toBe(before);
+      expect(before?.nsfw).toBe(false);
+    });
+  });
 });
diff --git a/Client/tauri-client/tests/unit/chat-area.test.ts b/Client/tauri-client/tests/unit/chat-area.test.ts
index 83d62c57..ab978a25 100644
--- a/Client/tauri-client/tests/unit/chat-area.test.ts
+++ b/Client/tauri-client/tests/unit/chat-area.test.ts
@@ -11,6 +11,7 @@ const {
   mockSearchCleanup,
   mockVideoMount,
   mockVideoDestroy,
+  mockJumpTo,
 } = vi.hoisted(() => ({
   mockPinnedToggle: vi.fn(),
   mockPinnedCleanup: vi.fn(),
@@ -18,6 +19,13 @@ const {
   mockSearchCleanup: vi.fn(),
   mockVideoMount: vi.fn(),
   mockVideoDestroy: vi.fn(),
+  mockJumpTo: vi.fn(),
+}));
+
+// The jumper itself is exercised in message-jump.test.ts; here we only care
+// that ChatArea wires every jump affordance into the same one.
+vi.mock("../../src/pages/main-page/MessageJump", () => ({
+  createMessageJumper: vi.fn(() => ({ jumpTo: mockJumpTo })),
 }));
 
 vi.mock("@lib/icons", () => ({
@@ -68,6 +76,7 @@ vi.mock("@components/VideoGrid", () => ({
 
 import { createChatArea } from "../../src/pages/main-page/ChatArea";
 import type { ChatAreaOptions } from "../../src/pages/main-page/ChatArea";
+import { hasMessageJumpHandler, setMessageJumpHandler } from "@lib/message-navigation";
 import {
   createPinnedPanelController,
   createSearchOverlayController,
@@ -106,6 +115,9 @@ describe("createChatArea", () => {
 
   afterEach(() => {
     container.remove();
+    // Each createChatArea installs a global jump handler; drop it so the next
+    // test starts from "no page mounted".
+    setMessageJumpHandler(() => {})();
   });
 
   // --- DOM structure ---
@@ -281,25 +293,35 @@ describe("createChatArea", () => {
 
   // --- Unsubscribers ---
 
-  it("includes cleanup functions for pinned and search controllers", () => {
+  it("includes cleanup functions for the jump handler and both controllers", () => {
     const result = createChatArea(makeOptions());
 
-    // Should have at least 2 unsubscribers (pinned + search)
-    expect(result.unsubscribers.length).toBe(2);
-    expect(typeof result.unsubscribers[0]).toBe("function");
-    expect(typeof result.unsubscribers[1]).toBe("function");
+    // jump-handler unregister + pinned + search
+    expect(result.unsubscribers.length).toBe(3);
+    for (const unsub of result.unsubscribers) {
+      expect(typeof unsub).toBe("function");
+    }
   });
 
   it("unsubscribers call cleanup on pinned and search controllers", () => {
     const result = createChatArea(makeOptions());
 
-    result.unsubscribers[0]!();
-    expect(mockPinnedCleanup).toHaveBeenCalledTimes(1);
+    for (const unsub of result.unsubscribers) unsub();
 
-    result.unsubscribers[1]!();
+    expect(mockPinnedCleanup).toHaveBeenCalledTimes(1);
     expect(mockSearchCleanup).toHaveBeenCalledTimes(1);
   });
 
+  it("registers a global message-jump handler and unregisters it on cleanup", () => {
+    const result = createChatArea(makeOptions());
+    expect(hasMessageJumpHandler()).toBe(true);
+
+    for (const unsub of result.unsubscribers) unsub();
+
+    // A page that has been torn down must not keep answering permalink jumps.
+    expect(hasMessageJumpHandler()).toBe(false);
+  });
+
   // --- Pin button interaction ---
 
   it("clicking pin button toggles the pinned panel controller", () => {
@@ -356,80 +378,37 @@ describe("createChatArea", () => {
     expect(call.getCurrentChannelId()).toBe(99);
   });
 
-  // --- onJumpToMessage for pinned controller ---
+  // --- Jump wiring: both overlays route into the one jumper ---
 
-  it("pinned onJumpToMessage returns false when channel controller is null", () => {
+  it("pinned onJumpToMessage jumps within the current channel", () => {
+    const channelCtrl = { currentChannelId: 7, messageList: null } as any;
+    createChatArea(makeOptions({ getChannelCtrl: () => channelCtrl }));
+
+    const call = vi.mocked(createPinnedPanelController).mock.calls[0]![0];
+    call.onJumpToMessage!(42);
+
+    // The pinned panel only ever lists the current channel's pins, so the
+    // channel id comes from the controller rather than the entry.
+    expect(mockJumpTo).toHaveBeenCalledWith(7, 42);
+  });
+
+  it("pinned onJumpToMessage is a no-op with no channel mounted", () => {
     createChatArea(makeOptions({ getChannelCtrl: () => null }));
 
     const call = vi.mocked(createPinnedPanelController).mock.calls[0]![0];
-    expect(call.onJumpToMessage!(123)).toBe(false);
+    expect(() => call.onJumpToMessage!(42)).not.toThrow();
+    expect(mockJumpTo).not.toHaveBeenCalled();
   });
 
-  it("pinned onJumpToMessage returns false when messageList is null", () => {
-    const channelCtrl = { currentChannelId: 1, messageList: null } as any;
-    createChatArea(makeOptions({ getChannelCtrl: () => channelCtrl }));
-
-    const call = vi.mocked(createPinnedPanelController).mock.calls[0]![0];
-    expect(call.onJumpToMessage!(123)).toBe(false);
-  });
-
-  it("pinned onJumpToMessage delegates to messageList.scrollToMessage", () => {
-    const mockScrollToMessage = vi.fn(() => true);
-    const channelCtrl = {
-      currentChannelId: 1,
-      messageList: { scrollToMessage: mockScrollToMessage },
-    } as any;
-    createChatArea(makeOptions({ getChannelCtrl: () => channelCtrl }));
-
-    const call = vi.mocked(createPinnedPanelController).mock.calls[0]![0];
-    const result = call.onJumpToMessage!(42);
-    expect(result).toBe(true);
-    expect(mockScrollToMessage).toHaveBeenCalledWith(42);
-  });
-
-  it("pinned onJumpToMessage returns false when scrollToMessage returns false", () => {
-    const mockScrollToMessage = vi.fn(() => false);
-    const channelCtrl = {
-      currentChannelId: 1,
-      messageList: { scrollToMessage: mockScrollToMessage },
-    } as any;
-    createChatArea(makeOptions({ getChannelCtrl: () => channelCtrl }));
-
-    const call = vi.mocked(createPinnedPanelController).mock.calls[0]![0];
-    const result = call.onJumpToMessage!(99);
-    expect(result).toBe(false);
-    expect(mockScrollToMessage).toHaveBeenCalledWith(99);
-  });
-
-  // --- onJumpToMessage for search controller ---
-
-  it("search onJumpToMessage returns false when channel controller is null", () => {
-    createChatArea(makeOptions({ getChannelCtrl: () => null }));
-
-    const call = vi.mocked(createSearchOverlayController).mock.calls[0]![0];
-    expect(call.onJumpToMessage!(1, 123)).toBe(false);
-  });
-
-  it("search onJumpToMessage returns false when messageList is null", () => {
+  it("search onJumpToMessage jumps to the result's own channel", () => {
     const channelCtrl = { currentChannelId: 1, messageList: null } as any;
     createChatArea(makeOptions({ getChannelCtrl: () => channelCtrl }));
 
     const call = vi.mocked(createSearchOverlayController).mock.calls[0]![0];
-    expect(call.onJumpToMessage!(1, 123)).toBe(false);
-  });
+    call.onJumpToMessage!(3, 55);
 
-  it("search onJumpToMessage delegates to messageList.scrollToMessage", () => {
-    const mockScrollToMessage = vi.fn(() => true);
-    const channelCtrl = {
-      currentChannelId: 1,
-      messageList: { scrollToMessage: mockScrollToMessage },
-    } as any;
-    createChatArea(makeOptions({ getChannelCtrl: () => channelCtrl }));
-
-    const call = vi.mocked(createSearchOverlayController).mock.calls[0]![0];
-    const result = call.onJumpToMessage!(1, 55);
-    expect(result).toBe(true);
-    expect(mockScrollToMessage).toHaveBeenCalledWith(55);
+    // A search hit can live anywhere, so the jumper handles the switch too.
+    expect(mockJumpTo).toHaveBeenCalledWith(3, 55);
   });
 
   // --- Header default content ---
diff --git a/Client/tauri-client/tests/unit/chat.test.ts b/Client/tauri-client/tests/unit/chat.test.ts
index 95bbe2ae..7e3dec09 100644
--- a/Client/tauri-client/tests/unit/chat.test.ts
+++ b/Client/tauri-client/tests/unit/chat.test.ts
@@ -37,6 +37,7 @@ function resetStores(): void {
     loadedChannels: new Set(),
     hasMore: new Map(),
     historyLoadState: new Map(),
+    detachedChannels: new Set(),
   }));
   membersStore.setState(() => ({
     members: new Map(),
@@ -258,7 +259,16 @@ describe("MessageList", () => {
   });
 
   describe("@mention parsing", () => {
-    it("wraps @username in .mention span", () => {
+    /** @tokens only highlight when they resolve, so seed the members first. */
+    function seedMentionMembers(): void {
+      setMembers([
+        { id: 11, username: "Bob", avatar: null, role: "member", status: "online" },
+        { id: 12, username: "Charlie", avatar: null, role: "member", status: "online" },
+      ]);
+    }
+
+    it("wraps a resolvable @username in a .mention span", () => {
+      seedMentionMembers();
       setMessages(
         1,
         [makeMessage(1, 10, "Alice", "Hey @Bob check this", "2026-03-15T10:00:00Z")],
@@ -285,6 +295,7 @@ describe("MessageList", () => {
     });
 
     it("handles multiple @mentions in one message", () => {
+      seedMentionMembers();
       setMessages(
         1,
         [makeMessage(1, 10, "Alice", "@Bob and @Charlie look", "2026-03-15T10:00:00Z")],
@@ -308,6 +319,31 @@ describe("MessageList", () => {
       expect(mentions.length).toBe(2);
       list.destroy?.();
     });
+
+    it("leaves an unresolvable @token as plain text", () => {
+      setMessages(
+        1,
+        [makeMessage(1, 10, "Alice", "Hey @nobody check this", "2026-03-15T10:00:00Z")],
+        false,
+      );
+
+      const list = createMessageList({
+        channelId: 1,
+        channelName: "general",
+        currentUserId: 1,
+        onScrollTop: vi.fn(),
+        onReplyClick: vi.fn(),
+        onEditClick: vi.fn(),
+        onDeleteClick: vi.fn(),
+        onReactionClick: vi.fn(),
+        onPinClick: vi.fn(),
+      });
+      list.mount(container);
+
+      expect(container.querySelectorAll(".mention").length).toBe(0);
+      expect(container.textContent).toContain("@nobody");
+      list.destroy?.();
+    });
   });
 
   describe("deleted and edited messages", () => {
diff --git a/Client/tauri-client/tests/unit/connection-stats.test.ts b/Client/tauri-client/tests/unit/connection-stats.test.ts
index 0a190f3b..742508d8 100644
--- a/Client/tauri-client/tests/unit/connection-stats.test.ts
+++ b/Client/tauri-client/tests/unit/connection-stats.test.ts
@@ -110,11 +110,14 @@ describe("createConnectionStatsPoller", () => {
   });
 
   it("start is idempotent — calling start twice does not create double intervals", () => {
-    poller = createConnectionStatsPoller(() => null);
+    const getRoom = vi.fn().mockReturnValue(null);
+    poller = createConnectionStatsPoller(getRoom);
     poller.start();
     poller.start();
-    // If double interval were created, stopping would leave one running — we just check no throw
-    poller.stop();
+    getRoom.mockClear();
+    vi.advanceTimersByTime(2000);
+    // A second interval would cause the poll callback to fire twice per tick.
+    expect(getRoom).toHaveBeenCalledTimes(1);
   });
 
   it("stop is idempotent — calling stop without start does not throw", () => {
diff --git a/Client/tauri-client/tests/unit/content-markdown.test.ts b/Client/tauri-client/tests/unit/content-markdown.test.ts
new file mode 100644
index 00000000..98e23ca1
--- /dev/null
+++ b/Client/tauri-client/tests/unit/content-markdown.test.ts
@@ -0,0 +1,699 @@
+/**
+ * Discord-flavoured markdown rendering: the tokenizer's grammar, the DOM the
+ * renderer builds from it, and the safety rules that must survive both
+ * (no innerHTML, no javascript: hrefs, no markdown inside code).
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+
+vi.mock("@lib/livekitSession", () => ({
+  leaveVoice: vi.fn(),
+  switchInputDevice: vi.fn(),
+  switchOutputDevice: vi.fn(),
+  setVoiceSensitivity: vi.fn(),
+  setInputVolume: vi.fn(),
+  setOutputVolume: vi.fn(),
+  getSessionDebugInfo: vi.fn().mockReturnValue({}),
+}));
+
+import {
+  renderInlineContent,
+  renderMessageContent,
+  splitCodeFences,
+} from "../../src/components/message-list/content-parser";
+import { parseInline, parseBlocks } from "../../src/components/message-list/markdown";
+import { highlightCode, resolveLanguage } from "../../src/components/message-list/syntax-highlight";
+import { extractUrls } from "../../src/components/message-list/media";
+import { membersStore } from "../../src/stores/members.store";
+import { authStore } from "../../src/stores/auth.store";
+import { channelsStore, setChannels } from "../../src/stores/channels.store";
+import type { ReadyChannel } from "../../src/lib/types";
+
+const CHANNELS: ReadyChannel[] = [
+  { id: 1, name: "general", type: "text", category: null, position: 0 },
+];
+
+function seedStores(): void {
+  membersStore.setState(() => ({
+    members: new Map([
+      [10, { id: 10, username: "alice", avatar: null, role: "member", status: "online" as const }],
+    ]),
+    typingUsers: new Map(),
+  }));
+  authStore.setState(() => ({
+    token: "t",
+    user: { id: 12, username: "me", avatar: null, role: "member" },
+    serverName: null,
+    motd: null,
+    isAuthenticated: true,
+  }));
+  channelsStore.setState(() => ({ channels: new Map(), activeChannelId: null, roles: [] }));
+  setChannels(CHANNELS);
+}
+
+let container: HTMLDivElement;
+
+beforeEach(() => {
+  seedStores();
+  container = document.createElement("div");
+  document.body.appendChild(container);
+});
+
+afterEach(() => {
+  container.remove();
+});
+
+/** Render inline markdown into the shared container. */
+function inline(text: string): HTMLDivElement {
+  container.appendChild(renderInlineContent(text));
+  return container;
+}
+
+/** Render a whole message into the shared container. */
+function message(text: string): HTMLDivElement {
+  container.appendChild(renderMessageContent(text));
+  return container;
+}
+
+// ---------------------------------------------------------------------------
+// Inline styles
+// ---------------------------------------------------------------------------
+
+describe("inline styles", () => {
+  it("renders **bold**", () => {
+    const el = inline("say **hello** now");
+    expect(el.querySelector("strong")?.textContent).toBe("hello");
+    expect(el.textContent).toBe("say hello now");
+  });
+
+  it("renders *italic* and _italic_", () => {
+    expect(inline("*one*").querySelector("em")?.textContent).toBe("one");
+    container.replaceChildren();
+    expect(inline("_two_").querySelector("em")?.textContent).toBe("two");
+  });
+
+  it("renders __underline__ as a <u>, not italics", () => {
+    const el = inline("__under__");
+    expect(el.querySelector("u")?.textContent).toBe("under");
+    expect(el.querySelector("em")).toBeNull();
+  });
+
+  it("renders ~~strikethrough~~", () => {
+    expect(inline("~~gone~~").querySelector("s")?.textContent).toBe("gone");
+  });
+
+  it("leaves snake_case_words alone", () => {
+    const el = inline("call some_long_name here");
+    expect(el.querySelector("em")).toBeNull();
+    expect(el.textContent).toBe("call some_long_name here");
+  });
+
+  it("leaves an unclosed delimiter as literal text", () => {
+    const el = inline("2 ** 3 is not bold");
+    expect(el.querySelector("strong")).toBeNull();
+    expect(el.textContent).toBe("2 ** 3 is not bold");
+  });
+
+  it("leaves an empty delimiter pair as literal text", () => {
+    const el = inline("**** nothing");
+    expect(el.querySelector("strong")).toBeNull();
+  });
+});
+
+describe("nesting", () => {
+  it("nests italic inside bold", () => {
+    const el = inline("**bold *and italic* end**");
+    const strong = el.querySelector("strong");
+    expect(strong).not.toBeNull();
+    expect(strong!.querySelector("em")?.textContent).toBe("and italic");
+    expect(el.textContent).toBe("bold and italic end");
+  });
+
+  it("treats ***text*** as bold + italic", () => {
+    const el = inline("***both***");
+    const strong = el.querySelector("strong");
+    expect(strong!.querySelector("em")?.textContent).toBe("both");
+  });
+
+  it("nests bold inside strikethrough", () => {
+    const el = inline("~~a **b** c~~");
+    expect(el.querySelector("s > strong")?.textContent).toBe("b");
+  });
+
+  it("does not let a nested single delimiter close its outer pair", () => {
+    const el = inline("*a **b** c*");
+    const em = el.querySelector("em");
+    expect(em?.textContent).toBe("a b c");
+    expect(em!.querySelector("strong")?.textContent).toBe("b");
+  });
+
+  it("keeps code spans opaque to delimiter matching", () => {
+    const el = inline("**bold `**` still bold**");
+    expect(el.querySelector("strong")?.textContent).toBe("bold ** still bold");
+  });
+});
+
+describe("escaping", () => {
+  it("renders \\*literal\\* as plain asterisks", () => {
+    const el = inline("\\*literal\\*");
+    expect(el.querySelector("em")).toBeNull();
+    expect(el.textContent).toBe("*literal*");
+  });
+
+  it("escapes a backslash itself", () => {
+    expect(inline("a \\\\ b").textContent).toBe("a \\ b");
+  });
+
+  it("keeps a backslash before a non-markdown character", () => {
+    expect(inline("C:\\path").textContent).toBe("C:\\path");
+  });
+
+  it("does not process escapes inside code spans", () => {
+    expect(inline("`\\*x\\*`").querySelector("code")?.textContent).toBe("\\*x\\*");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Spoilers
+// ---------------------------------------------------------------------------
+
+describe("spoilers", () => {
+  it("renders ||text|| obscured with aria-pressed=false", () => {
+    const el = inline("the answer is ||42||");
+    const spoiler = el.querySelector(".msg-spoiler");
+    expect(spoiler).not.toBeNull();
+    expect(spoiler!.textContent).toBe("42");
+    expect(spoiler!.getAttribute("aria-pressed")).toBe("false");
+    expect(spoiler!.getAttribute("role")).toBe("button");
+    expect(spoiler!.getAttribute("tabindex")).toBe("0");
+  });
+
+  it("reveals on click and flips aria-pressed", () => {
+    const el = inline("||boo||");
+    const spoiler = el.querySelector(".msg-spoiler") as HTMLElement;
+    expect(spoiler.classList.contains("revealed")).toBe(false);
+    spoiler.click();
+    expect(spoiler.classList.contains("revealed")).toBe(true);
+    expect(spoiler.getAttribute("aria-pressed")).toBe("true");
+  });
+
+  it("reveals on Enter", () => {
+    const el = inline("||boo||");
+    const spoiler = el.querySelector(".msg-spoiler") as HTMLElement;
+    spoiler.dispatchEvent(new KeyboardEvent("keydown", { key: "Enter", bubbles: true }));
+    expect(spoiler.getAttribute("aria-pressed")).toBe("true");
+  });
+
+  it("reveals each spoiler independently", () => {
+    const el = inline("||one|| and ||two||");
+    const spoilers = el.querySelectorAll<HTMLElement>(".msg-spoiler");
+    expect(spoilers.length).toBe(2);
+    spoilers[0]!.click();
+    expect(spoilers[0]!.classList.contains("revealed")).toBe(true);
+    expect(spoilers[1]!.classList.contains("revealed")).toBe(false);
+  });
+
+  it("swallows the click that reveals so a hidden link cannot open", () => {
+    const el = inline("||[go](https://example.com)||");
+    const spoiler = el.querySelector(".msg-spoiler") as HTMLElement;
+    const link = spoiler.querySelector("a") as HTMLAnchorElement;
+    const onClick = vi.fn();
+    link.addEventListener("click", onClick);
+    const event = new MouseEvent("click", { bubbles: true, cancelable: true });
+    link.dispatchEvent(event);
+    expect(event.defaultPrevented).toBe(true);
+    expect(spoiler.classList.contains("revealed")).toBe(true);
+  });
+
+  it("keeps markdown working inside a spoiler", () => {
+    const el = inline("||**secret**||");
+    expect(el.querySelector(".msg-spoiler strong")?.textContent).toBe("secret");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Block constructs
+// ---------------------------------------------------------------------------
+
+describe("block quotes", () => {
+  it("merges contiguous > lines into one quote", () => {
+    const el = message("> first\n> second\nafter");
+    const quotes = el.querySelectorAll("blockquote.md-quote");
+    expect(quotes.length).toBe(1);
+    expect(quotes[0]!.textContent).toBe("first\nsecond");
+    expect(el.textContent).toContain("after");
+  });
+
+  it("does not quote a > that is not at line start", () => {
+    const el = message("a > b");
+    expect(el.querySelector("blockquote")).toBeNull();
+  });
+
+  it(">>> quotes the rest of the message", () => {
+    const el = message(">>> everything\nfrom here\non");
+    const quote = el.querySelector("blockquote.md-quote");
+    expect(quote!.textContent).toBe("everything\nfrom here\non");
+  });
+
+  it("renders markdown blocks inside a quote", () => {
+    const el = message("> # Title\n> - item");
+    expect(el.querySelector("blockquote h1")?.textContent).toBe("Title");
+    expect(el.querySelector("blockquote ul.md-list li")?.textContent).toBe("item");
+  });
+
+  it("stops nesting quotes past the depth limit", () => {
+    const el = message("> > > deep");
+    expect(el.querySelectorAll("blockquote").length).toBeLessThanOrEqual(2);
+    expect(el.textContent).toContain("deep");
+  });
+});
+
+describe("headings", () => {
+  it("renders # / ## / ### as h1-h3", () => {
+    const el = message("# one\n## two\n### three");
+    expect(el.querySelector("h1.md-h1")?.textContent).toBe("one");
+    expect(el.querySelector("h2.md-h2")?.textContent).toBe("two");
+    expect(el.querySelector("h3.md-h3")?.textContent).toBe("three");
+  });
+
+  it("requires a space after the hashes", () => {
+    const el = message("#nospace");
+    expect(el.querySelector("h1")).toBeNull();
+    expect(el.textContent).toBe("#nospace");
+  });
+
+  it("does not treat #### as a heading", () => {
+    const el = message("#### four");
+    expect(el.querySelector("h1, h2, h3")).toBeNull();
+  });
+
+  it("only matches at line start", () => {
+    const el = message("see # this");
+    expect(el.querySelector("h1")).toBeNull();
+  });
+
+  it("renders inline markdown inside a heading", () => {
+    const el = message("## a **b**");
+    expect(el.querySelector("h2 strong")?.textContent).toBe("b");
+  });
+});
+
+describe("lists", () => {
+  it("renders - and * bullets as one ul", () => {
+    const el = message("- one\n* two");
+    const lists = el.querySelectorAll("ul.md-list");
+    expect(lists.length).toBe(1);
+    expect(Array.from(lists[0]!.children).map((li) => li.textContent)).toEqual(["one", "two"]);
+  });
+
+  it("renders 1. items as an ol", () => {
+    const el = message("1. one\n2. two");
+    const ol = el.querySelector("ol.md-list");
+    expect(ol).not.toBeNull();
+    expect(ol!.querySelectorAll("li").length).toBe(2);
+  });
+
+  it("keeps the starting number of an ordered list", () => {
+    const el = message("3. three\n4. four");
+    expect(el.querySelector("ol.md-list")?.getAttribute("start")).toBe("3");
+  });
+
+  it("nests an indented item one level deep", () => {
+    const el = message("- top\n  - nested");
+    const root = el.querySelector("ul.md-list") as HTMLElement;
+    expect(root.children.length).toBe(1);
+    const nested = root.querySelector("ul.md-list-nested");
+    expect(nested).not.toBeNull();
+    expect(nested!.querySelector("li")?.textContent).toBe("nested");
+  });
+
+  it("starts a new list when the marker style changes", () => {
+    const el = message("- bullet\n1. number");
+    expect(el.querySelector("ul.md-list")).not.toBeNull();
+    expect(el.querySelector("ol.md-list")).not.toBeNull();
+  });
+
+  it("requires a space after the marker", () => {
+    const el = message("-nope");
+    expect(el.querySelector("ul")).toBeNull();
+  });
+
+  it("renders inline markdown inside items", () => {
+    const el = message("- **bold** item");
+    expect(el.querySelector("li strong")?.textContent).toBe("bold");
+  });
+});
+
+describe("paragraphs", () => {
+  it("keeps line breaks inside a paragraph run", () => {
+    const el = message("one\ntwo");
+    const paras = el.querySelectorAll(".md-p");
+    expect(paras.length).toBe(1);
+    expect(paras[0]!.textContent).toBe("one\ntwo");
+  });
+
+  it("lets inline styles span a line break", () => {
+    const el = message("**one\ntwo**");
+    expect(el.querySelector("strong")?.textContent).toBe("one\ntwo");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Masked links
+// ---------------------------------------------------------------------------
+
+describe("masked links", () => {
+  it("renders [text](url) as an anchor titled with the URL", () => {
+    const el = inline("see [the docs](https://example.com/docs)");
+    const link = el.querySelector("a.msg-link") as HTMLAnchorElement;
+    expect(link.textContent).toBe("the docs");
+    expect(link.getAttribute("href")).toBe("https://example.com/docs");
+    expect(link.getAttribute("title")).toBe("https://example.com/docs");
+    expect(link.getAttribute("rel")).toBe("noopener noreferrer");
+    expect(link.getAttribute("target")).toBe("_blank");
+  });
+
+  it("rejects javascript: URLs and keeps the source as text", () => {
+    const el = inline("[click](javascript:alert(1))");
+    expect(el.querySelector("a")).toBeNull();
+    expect(el.textContent).toBe("[click](javascript:alert(1))");
+  });
+
+  it("rejects data: URLs", () => {
+    const el = inline("[x](data:text/html,<script>alert(1)</script>)");
+    expect(el.querySelector("a")).toBeNull();
+    expect(el.querySelector("script")).toBeNull();
+  });
+
+  it("rejects relative URLs even though they resolve to http", () => {
+    const el = inline("[x](/settings)");
+    expect(el.querySelector("a")).toBeNull();
+    expect(el.textContent).toBe("[x](/settings)");
+  });
+
+  it("renders markdown inside the link text", () => {
+    const el = inline("[**bold** link](https://example.com)");
+    expect(el.querySelector("a strong")?.textContent).toBe("bold");
+  });
+
+  it("balances parentheses inside the URL", () => {
+    const el = inline("[wiki](https://en.example.org/wiki/Foo_(bar))");
+    expect(el.querySelector("a")?.getAttribute("href")).toBe(
+      "https://en.example.org/wiki/Foo_(bar)",
+    );
+  });
+
+  it("produces no embed for a masked link", () => {
+    expect(extractUrls("[docs](https://example.com/a.png)")).toEqual([]);
+    expect(extractUrls("plain https://example.com/a.png")).toEqual(["https://example.com/a.png"]);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Code
+// ---------------------------------------------------------------------------
+
+describe("code fences", () => {
+  it("renders a language label and keeps the code intact", () => {
+    const el = message("```ts\nconst x = 1; // hi\n```");
+    expect(el.querySelector(".msg-codeblock-lang")?.textContent).toBe("ts");
+    expect(el.querySelector(".msg-codeblock")?.textContent).toBe("const x = 1; // hi");
+    expect(el.querySelector(".msg-codeblock")?.getAttribute("data-lang")).toBe("typescript");
+  });
+
+  it("highlights keywords, numbers, strings and comments", () => {
+    const el = message('```js\nconst s = "hi"; // note\n```');
+    const block = el.querySelector(".msg-codeblock")!;
+    expect(block.querySelector(".tok-keyword")?.textContent).toBe("const");
+    expect(block.querySelector(".tok-string")?.textContent).toBe('"hi"');
+    expect(block.querySelector(".tok-comment")?.textContent).toBe("// note");
+    expect(el.querySelector(".msg-codeblock")?.textContent).toBe('const s = "hi"; // note');
+  });
+
+  it("falls back to plain text for an unknown language, keeping the label", () => {
+    const el = message("```brainfuck\n+++.\n```");
+    expect(el.querySelector(".msg-codeblock-lang")?.textContent).toBe("brainfuck");
+    expect(el.querySelector(".msg-codeblock .tok-keyword")).toBeNull();
+    expect(el.querySelector(".msg-codeblock")?.textContent).toBe("+++.");
+  });
+
+  it("keeps the copy button and copies the raw code", async () => {
+    const writeText = vi.fn().mockResolvedValue(undefined);
+    Object.assign(navigator, { clipboard: { writeText } });
+    const el = message("```go\nfmt.Println(1)\n```");
+    const btn = el.querySelector(".msg-codeblock-copy") as HTMLElement;
+    btn.click();
+    await vi.waitFor(() => expect(writeText).toHaveBeenCalledWith("fmt.Println(1)"));
+  });
+
+  it("does not parse markdown inside a fence", () => {
+    const el = message("```\n**not bold** and *not italic* and ||no spoiler||\n```");
+    expect(el.querySelector("strong")).toBeNull();
+    expect(el.querySelector("em")).toBeNull();
+    expect(el.querySelector(".msg-spoiler")).toBeNull();
+    expect(el.querySelector(".msg-codeblock")?.textContent).toBe(
+      "**not bold** and *not italic* and ||no spoiler||",
+    );
+  });
+
+  it("does not autolink URLs inside a fence", () => {
+    const el = message("```\nhttps://example.com\n```");
+    expect(el.querySelector("a")).toBeNull();
+  });
+
+  it("treats a fence with no newline as untagged code", () => {
+    const el = message("```ts is nice```");
+    expect(el.querySelector(".msg-codeblock-lang")).toBeNull();
+    expect(el.querySelector(".msg-codeblock")?.textContent).toBe("ts is nice");
+  });
+
+  it("leaves an unterminated fence as prose", () => {
+    const el = message("```oops");
+    expect(el.querySelector(".msg-codeblock")).toBeNull();
+    expect(el.textContent).toBe("```oops");
+  });
+});
+
+describe("inline code", () => {
+  it("does not parse markdown inside a code span", () => {
+    const el = inline("`**x**`");
+    expect(el.querySelector("strong")).toBeNull();
+    expect(el.querySelector("code")?.textContent).toBe("**x**");
+  });
+
+  it("does not autolink a URL inside a code span", () => {
+    const el = inline("`https://example.com`");
+    expect(el.querySelector("a")).toBeNull();
+    expect(el.querySelector("code")?.textContent).toBe("https://example.com");
+  });
+
+  it("supports double-backtick spans containing a backtick", () => {
+    const el = inline("``a ` b``");
+    expect(el.querySelector("code")?.textContent).toBe("a ` b");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Safety
+// ---------------------------------------------------------------------------
+
+describe("XSS safety", () => {
+  it("never builds elements from HTML in the message", () => {
+    const el = message("<script>alert(1)</script><img src=x onerror=alert(1)>");
+    expect(el.querySelector("script")).toBeNull();
+    expect(el.querySelector("img")).toBeNull();
+    expect(el.textContent).toContain("<script>alert(1)</script>");
+  });
+
+  it("keeps HTML inert inside styled spans", () => {
+    const el = message("**<img src=x onerror=alert(1)>**");
+    expect(el.querySelector("img")).toBeNull();
+    expect(el.querySelector("strong")?.textContent).toBe("<img src=x onerror=alert(1)>");
+  });
+
+  it("keeps HTML inert inside code fences", () => {
+    const el = message("```html\n<script>alert(1)</script>\n```");
+    expect(el.querySelector("script")).toBeNull();
+    expect(el.querySelector(".msg-codeblock")?.textContent).toBe("<script>alert(1)</script>");
+  });
+
+  it("does not autolink a javascript: pseudo-URL", () => {
+    const el = message("javascript:alert(1)");
+    expect(el.querySelector("a")).toBeNull();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Markdown + mentions
+// ---------------------------------------------------------------------------
+
+describe("markdown with mentions", () => {
+  it("renders a mention chip inside bold", () => {
+    const el = message("**hi @alice**");
+    const mention = el.querySelector("strong .mention");
+    expect(mention?.textContent).toBe("@alice");
+  });
+
+  it("renders a channel chip inside a spoiler", () => {
+    const el = message("||go to #general||");
+    expect(el.querySelector(".msg-spoiler .channel-mention")?.textContent).toBe("#general");
+  });
+
+  it("autolinks a bare URL inside a quote", () => {
+    const el = message("> see https://example.com");
+    expect(el.querySelector("blockquote a.msg-link")?.getAttribute("href")).toBe(
+      "https://example.com",
+    );
+  });
+
+  it("does not italicise underscores inside a bare URL", () => {
+    const el = message("https://example.com/a_b_c");
+    expect(el.querySelector("em")).toBeNull();
+    expect(el.querySelector("a.msg-link")?.getAttribute("href")).toBe("https://example.com/a_b_c");
+  });
+
+  it("still bolds around a URL", () => {
+    const el = message("**https://example.com/a_b**");
+    const strong = el.querySelector("strong");
+    expect(strong).not.toBeNull();
+    expect(strong!.querySelector("a")?.getAttribute("href")).toBe("https://example.com/a_b");
+  });
+
+  it("combines a heading, a list, a quote and a fence in one message", () => {
+    const el = message("# Title\n- a\n- b\n> note\n```js\nlet x = 1\n```");
+    expect(el.querySelector("h1")).not.toBeNull();
+    expect(el.querySelectorAll("ul.md-list li").length).toBe(2);
+    expect(el.querySelector("blockquote")).not.toBeNull();
+    expect(el.querySelector(".msg-codeblock .tok-keyword")?.textContent).toBe("let");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Tokenizer units
+// ---------------------------------------------------------------------------
+
+describe("parseInline", () => {
+  it("returns a single text node for plain prose", () => {
+    expect(parseInline("just words")).toEqual([{ type: "text", value: "just words" }]);
+  });
+
+  it("keeps the raw source on a link node for the reject path", () => {
+    const nodes = parseInline("[a](javascript:x)");
+    expect(nodes[0]).toMatchObject({ type: "link", url: "javascript:x", raw: "[a](javascript:x)" });
+  });
+
+  it("stops nesting at the depth limit instead of recursing forever", () => {
+    const deep = "*".repeat(20) + "x" + "*".repeat(20);
+    expect(() => parseInline(deep)).not.toThrow();
+  });
+
+  it("parses a long run of unmatched brackets to literal text quickly", () => {
+    // Pathological input for a naive per-opener rescan: every "[" would
+    // otherwise trigger its own O(n) scan of the remaining string, making
+    // this O(n^2). At the 4000-rune server cap that is ~16M ops; budget the
+    // test generously so it still fails loudly on a real regression.
+    const src = "[".repeat(4000);
+    const start = performance.now();
+    const nodes = parseInline(src);
+    const elapsed = performance.now() - start;
+    expect(nodes).toEqual([{ type: "text", value: src }]);
+    expect(elapsed).toBeLessThan(500);
+  });
+
+  it("still renders a valid link after a long run of unmatched brackets", () => {
+    const src = "[".repeat(2000) + "[real](https://example.com)";
+    const nodes = parseInline(src);
+    const last = nodes[nodes.length - 1];
+    expect(last).toMatchObject({ type: "link", url: "https://example.com" });
+  });
+});
+
+describe("parseBlocks", () => {
+  it("splits blocks and keeps paragraph runs together", () => {
+    expect(parseBlocks("a\nb\n# h\nc")).toEqual([
+      { type: "paragraph", text: "a\nb" },
+      { type: "heading", level: 1, text: "h" },
+      { type: "paragraph", text: "c" },
+    ]);
+  });
+
+  it("marks indented list items as level 1", () => {
+    const blocks = parseBlocks("- a\n  - b");
+    expect(blocks[0]).toMatchObject({
+      type: "list",
+      ordered: false,
+      items: [
+        { text: "a", level: 0 },
+        { text: "b", level: 1 },
+      ],
+    });
+  });
+});
+
+describe("splitCodeFences", () => {
+  it("separates prose from fenced code", () => {
+    expect(splitCodeFences("a```x```b")).toEqual([
+      { kind: "prose", text: "a", lang: null },
+      { kind: "code", text: "x", lang: null },
+      { kind: "prose", text: "b", lang: null },
+    ]);
+  });
+
+  it("extracts the language tag", () => {
+    expect(splitCodeFences("```py\nprint(1)\n```")).toEqual([
+      { kind: "code", text: "print(1)", lang: "py" },
+    ]);
+  });
+});
+
+describe("syntax highlighting", () => {
+  it("resolves language aliases and rejects unknown tags", () => {
+    expect(resolveLanguage("ts")).toBe("typescript");
+    expect(resolveLanguage("golang")).toBe("go");
+    expect(resolveLanguage("zsh")).toBe("bash");
+    expect(resolveLanguage("nope")).toBeNull();
+    expect(resolveLanguage(null)).toBeNull();
+  });
+
+  it("returns one plain token for an unknown language", () => {
+    expect(highlightCode("anything", null)).toEqual([{ text: "anything", cls: null }]);
+  });
+
+  it("never drops or reorders characters", () => {
+    const samples: [string, string][] = [
+      ["typescript", "export const a: number = 0x1f; // c\n/* b */ `t${a}`"],
+      ["go", 'package main\nfunc f() { s := "x" } // c'],
+      ["python", "def f(x):\n  # c\n  return 'a' if x else None"],
+      ["rust", 'fn main() { let v: Vec<u8> = vec![1]; println!("{}", 2); }'],
+      ["json", '{"a": [1, true, null], "b": "c"}'],
+      ["bash", 'if [ -n "$HOME" ]; then echo 1; fi # c'],
+      ["css", ".a { color: #fff; margin: 4px; } /* c */"],
+      ["html", '<!-- c --><a href="/x">y</a>'],
+    ];
+    for (const [lang, code] of samples) {
+      expect(
+        highlightCode(code, lang)
+          .map((t) => t.text)
+          .join(""),
+      ).toBe(code);
+    }
+  });
+
+  it("classifies python comments and strings", () => {
+    const tokens = highlightCode("# note\nx = 'hi'", "python");
+    expect(tokens.some((t) => t.cls === "comment" && t.text === "# note")).toBe(true);
+    expect(tokens.some((t) => t.cls === "string" && t.text === "'hi'")).toBe(true);
+  });
+
+  it("classifies go keywords", () => {
+    const tokens = highlightCode("func main() {}", "go");
+    expect(tokens[0]).toEqual({ text: "func", cls: "keyword" });
+  });
+
+  it("does not treat a keyword-prefixed identifier as a keyword", () => {
+    const tokens = highlightCode("constant = 1", "javascript");
+    expect(tokens[0]!.cls).toBeNull();
+    expect(tokens[0]!.text).toBe("constant = ");
+    expect(tokens.some((t) => t.cls === "keyword")).toBe(false);
+  });
+});
diff --git a/Client/tauri-client/tests/unit/create-channel-modal.test.ts b/Client/tauri-client/tests/unit/create-channel-modal.test.ts
index 8e079d0f..4fb698e9 100644
--- a/Client/tauri-client/tests/unit/create-channel-modal.test.ts
+++ b/Client/tauri-client/tests/unit/create-channel-modal.test.ts
@@ -1,52 +1,31 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import {
-  isVoiceCategory,
-  allowedTypesForCategory,
+  CHANNEL_TYPES,
+  defaultTypeForCategory,
   createCreateChannelModal,
 } from "@components/CreateChannelModal";
 import type { CreateChannelModalOptions } from "@components/CreateChannelModal";
+import { setChannels, UNCATEGORIZED_VOICE_CATEGORY } from "@stores/channels.store";
 
 // ---------------------------------------------------------------------------
 // Pure function tests
 // ---------------------------------------------------------------------------
 
-describe("isVoiceCategory", () => {
-  it("returns true for 'Voice Channels'", () => {
-    expect(isVoiceCategory("Voice Channels")).toBe(true);
+describe("defaultTypeForCategory", () => {
+  it("defaults to voice only in the synthetic uncategorized-voice group", () => {
+    expect(defaultTypeForCategory(UNCATEGORIZED_VOICE_CATEGORY)).toBe("voice");
   });
 
-  it("returns true for uppercase 'VOICE CHANNELS'", () => {
-    expect(isVoiceCategory("VOICE CHANNELS")).toBe(true);
-  });
-
-  it("returns true for 'voice'", () => {
-    expect(isVoiceCategory("voice")).toBe(true);
-  });
-
-  it("returns false for 'Text Channels'", () => {
-    expect(isVoiceCategory("Text Channels")).toBe(false);
-  });
-
-  it("returns false for 'Chat'", () => {
-    expect(isVoiceCategory("Chat")).toBe(false);
-  });
-
-  it("returns false for empty string", () => {
-    expect(isVoiceCategory("")).toBe(false);
+  it("defaults to text everywhere else, voice-sounding names included", () => {
+    for (const category of ["Voice Channels", "VOICE CHANNELS", "Text Channels", "Chat", ""]) {
+      expect(defaultTypeForCategory(category)).toBe("text");
+    }
   });
 });
 
-describe("allowedTypesForCategory", () => {
-  it("returns only voice for voice categories", () => {
-    expect(allowedTypesForCategory("Voice Channels")).toEqual(["voice"]);
-  });
-
-  it("returns text and announcement for text categories", () => {
-    expect(allowedTypesForCategory("Text Channels")).toEqual(["text", "announcement"]);
-  });
-
-  it("returns text and announcement for 'Chat'", () => {
-    expect(allowedTypesForCategory("Chat")).toEqual(["text", "announcement"]);
+describe("CHANNEL_TYPES", () => {
+  it("offers every channel type, regardless of category", () => {
+    expect([...CHANNEL_TYPES]).toEqual(["text", "voice", "announcement"]);
   });
 });
 
@@ -86,32 +65,76 @@ describe("CreateChannelModal", () => {
     modal.destroy?.();
   });
 
-  it("shows only text and announcement types for text categories", () => {
+  it("offers every channel type under a text-sounding category", () => {
     const { modal } = makeModal("Text Channels");
     const select = container.querySelector(
       "[data-testid='channel-type-select']",
     ) as HTMLSelectElement;
-    const options = Array.from(select.options).map((o) => o.value);
-    expect(options).toEqual(["text", "announcement"]);
-    expect(options).not.toContain("voice");
+    expect(Array.from(select.options).map((o) => o.value)).toEqual([
+      "text",
+      "voice",
+      "announcement",
+    ]);
     modal.destroy?.();
   });
 
-  it("shows only voice type for voice categories", () => {
+  it("offers every channel type under a voice-sounding category too", () => {
     const { modal } = makeModal("Voice Channels");
     const select = container.querySelector(
       "[data-testid='channel-type-select']",
     ) as HTMLSelectElement;
-    const options = Array.from(select.options).map((o) => o.value);
-    expect(options).toEqual(["voice"]);
-    expect(options).not.toContain("text");
+    expect(Array.from(select.options).map((o) => o.value)).toEqual([
+      "text",
+      "voice",
+      "announcement",
+    ]);
     modal.destroy?.();
   });
 
-  it("displays the category name as read-only", () => {
-    const { modal } = makeModal("Voice Channels");
-    const overlay = container.querySelector("[data-testid='create-channel-modal']");
-    expect(overlay?.textContent).toContain("Voice Channels");
+  it("pre-fills the category as editable text", () => {
+    const { modal } = makeModal("Gaming");
+    const input = container.querySelector(
+      "[data-testid='channel-category-input']",
+    ) as HTMLInputElement;
+    expect(input.value).toBe("Gaming");
+    expect(input.hasAttribute("disabled")).toBe(false);
+    modal.destroy?.();
+  });
+
+  it("suggests the categories already in use via a datalist", () => {
+    setChannels([
+      { id: 1, name: "general", type: "text", category: "Chat", position: 0 },
+      { id: 2, name: "lounge", type: "voice", category: "Gaming", position: 1 },
+      { id: 3, name: "loose", type: "text", category: null, position: 2 },
+    ]);
+    const { modal } = makeModal("Chat");
+    const list = container.querySelector("#create-channel-categories");
+    const values = Array.from(list?.querySelectorAll("option") ?? []).map((o) =>
+      o.getAttribute("value"),
+    );
+    expect(values).toEqual(["Chat", "Gaming"]);
+    modal.destroy?.();
+  });
+
+  it("submits an edited category rather than the one it opened on", async () => {
+    const onCreate = vi.fn(async () => {});
+    const { modal } = makeModal("Chat", { onCreate });
+
+    (container.querySelector("[data-testid='channel-name-input']") as HTMLInputElement).value =
+      "lounge";
+    (container.querySelector("[data-testid='channel-category-input']") as HTMLInputElement).value =
+      "  Gaming  ";
+    (container.querySelector("[data-testid='channel-type-select']") as HTMLSelectElement).value =
+      "voice";
+    (container.querySelector("[data-testid='channel-create-submit']") as HTMLButtonElement).click();
+
+    await vi.waitFor(() => {
+      expect(onCreate).toHaveBeenCalledWith({
+        name: "lounge",
+        type: "voice",
+        category: "Gaming",
+      });
+    });
     modal.destroy?.();
   });
 
diff --git a/Client/tauri-client/tests/unit/custom-emoji.test.ts b/Client/tauri-client/tests/unit/custom-emoji.test.ts
new file mode 100644
index 00000000..0d8c0b68
--- /dev/null
+++ b/Client/tauri-client/tests/unit/custom-emoji.test.ts
@@ -0,0 +1,321 @@
+/**
+ * Custom-emoji end-to-end on the client: the store, `:shortcode:` rendering in
+ * message content (including where it must NOT apply), the jumbo rule, and
+ * reaction-pill resolution.
+ */
+
+import { describe, it, expect, beforeEach, vi } from "vitest";
+
+vi.mock("@lib/livekitSession", () => ({
+  leaveVoice: vi.fn(),
+  switchInputDevice: vi.fn(),
+  switchOutputDevice: vi.fn(),
+  setVoiceSensitivity: vi.fn(),
+  setInputVolume: vi.fn(),
+  setOutputVolume: vi.fn(),
+  getSessionDebugInfo: vi.fn().mockReturnValue({}),
+}));
+
+// The emoji image is behind the session token, so buildCustomEmojiImage goes
+// through the same authenticated fetch attachments use. Stub just that call —
+// everything else in the module (isSafeUrl, resolveServerUrl) is real.
+const { fetchImageAsDataUrlMock } = vi.hoisted(() => ({
+  fetchImageAsDataUrlMock: vi.fn(() => Promise.resolve("data:image/png;base64,AAAA")),
+}));
+vi.mock("../../src/components/message-list/attachments", async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import("../../src/components/message-list/attachments")>();
+  return { ...actual, fetchImageAsDataUrl: fetchImageAsDataUrlMock };
+});
+
+import {
+  EMOJI_TOKEN_REGEX,
+  MAX_JUMBO_EMOJI,
+  buildCustomEmojiNode,
+  isEmojiOnlyMessage,
+} from "../../src/components/message-list/custom-emoji";
+import { renderMessageContent } from "../../src/components/message-list/content-parser";
+import { renderReactions } from "../../src/components/message-list/reactions";
+import {
+  emojiStore,
+  setCustomEmoji,
+  clearCustomEmoji,
+  resolveEmoji,
+  listCustomEmoji,
+} from "../../src/stores/emoji.store";
+import type { Message } from "../../src/stores/messages.store";
+import type { MessageListOptions } from "../../src/components/MessageList";
+
+const EMOJI = [
+  { id: 1, shortcode: "wave", url: "/api/v1/emoji/1/image" },
+  { id: 2, shortcode: "party_blob", url: "/api/v1/emoji/2/image" },
+];
+
+beforeEach(() => {
+  clearCustomEmoji();
+  emojiStore.flush();
+  setCustomEmoji(EMOJI);
+  emojiStore.flush();
+  fetchImageAsDataUrlMock.mockClear();
+});
+
+// ---------------------------------------------------------------------------
+// Store
+// ---------------------------------------------------------------------------
+
+describe("emoji store", () => {
+  it("indexes by shortcode and keeps server order", () => {
+    expect(listCustomEmoji().map((e) => e.shortcode)).toEqual(["wave", "party_blob"]);
+    expect(resolveEmoji("wave")?.id).toBe(1);
+    expect(resolveEmoji("party_blob")?.url).toBe("/api/v1/emoji/2/image");
+  });
+
+  it("resolves case-insensitively and with or without colons", () => {
+    expect(resolveEmoji("WAVE")?.id).toBe(1);
+    expect(resolveEmoji(":wave:")?.id).toBe(1);
+    expect(resolveEmoji(":WaVe:")?.id).toBe(1);
+  });
+
+  it("returns null for unknown or malformed tokens", () => {
+    expect(resolveEmoji("nosuch")).toBeNull();
+    expect(resolveEmoji("")).toBeNull();
+    expect(resolveEmoji("::")).toBeNull();
+  });
+
+  it("replaces the set wholesale so a deleted emoji stops resolving", () => {
+    setCustomEmoji([{ id: 2, shortcode: "party_blob", url: "/api/v1/emoji/2/image" }]);
+    emojiStore.flush();
+    expect(resolveEmoji("wave")).toBeNull();
+    expect(resolveEmoji("party_blob")).not.toBeNull();
+  });
+
+  it("drops entries whose shortcode the server could not have stored", () => {
+    setCustomEmoji([
+      { id: 1, shortcode: "ok_one", url: "/a" },
+      { id: 2, shortcode: "has space", url: "/b" },
+      { id: 3, shortcode: "x", url: "/c" },
+      { id: 4, shortcode: "dash-es", url: "/d" },
+    ]);
+    emojiStore.flush();
+    expect(listCustomEmoji().map((e) => e.shortcode)).toEqual(["ok_one"]);
+  });
+
+  it("lowercases shortcodes on the way in", () => {
+    setCustomEmoji([{ id: 9, shortcode: "SHOUT", url: "/a" }]);
+    emojiStore.flush();
+    expect(listCustomEmoji()[0]?.shortcode).toBe("shout");
+    expect(resolveEmoji("shout")?.id).toBe(9);
+  });
+
+  it("clearCustomEmoji empties the set", () => {
+    clearCustomEmoji();
+    emojiStore.flush();
+    expect(listCustomEmoji()).toEqual([]);
+    expect(resolveEmoji("wave")).toBeNull();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Token regex + node builder
+// ---------------------------------------------------------------------------
+
+describe("emoji tokens", () => {
+  it("matches shortcode-shaped tokens only", () => {
+    const found = [...":wave: :party_blob: :a: :has space: plain".matchAll(EMOJI_TOKEN_REGEX)].map(
+      (m) => m[1],
+    );
+    expect(found).toContain("wave");
+    expect(found).toContain("party_blob");
+    expect(found).not.toContain("a");
+  });
+
+  it("builds an image for a known shortcode and null for an unknown one", () => {
+    const img = buildCustomEmojiNode("wave");
+    expect(img).not.toBeNull();
+    expect(img?.tagName).toBe("IMG");
+    expect(img?.className).toBe("custom-emoji");
+    expect(img?.alt).toBe(":wave:");
+    expect(img?.getAttribute("data-shortcode")).toBe("wave");
+    expect(buildCustomEmojiNode("nosuch")).toBeNull();
+  });
+
+  it("fetches the image through the authenticated path, not img.src", () => {
+    buildCustomEmojiNode("wave");
+    expect(fetchImageAsDataUrlMock).toHaveBeenCalledTimes(1);
+    // resolveServerUrl leaves the path relative when no host has been set.
+    const [url] = fetchImageAsDataUrlMock.mock.calls[0] as unknown as [string];
+    expect(url).toContain("/api/v1/emoji/1/image");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Message rendering
+// ---------------------------------------------------------------------------
+
+function render(content: string): HTMLDivElement {
+  const host = document.createElement("div");
+  host.appendChild(renderMessageContent(content));
+  return host;
+}
+
+describe("custom emoji in message content", () => {
+  it("renders a known shortcode as an inline image", () => {
+    const host = render("hello :wave: there");
+    const imgs = host.querySelectorAll("img.custom-emoji");
+    expect(imgs.length).toBe(1);
+    expect(imgs[0]?.getAttribute("data-shortcode")).toBe("wave");
+    expect(host.textContent).toContain("hello");
+    expect(host.textContent).toContain("there");
+  });
+
+  it("leaves an unknown shortcode as literal text", () => {
+    const host = render("hello :nosuch: there");
+    expect(host.querySelectorAll("img.custom-emoji").length).toBe(0);
+    expect(host.textContent).toContain(":nosuch:");
+  });
+
+  it("renders several emoji in one message", () => {
+    const host = render(":wave: and :party_blob:");
+    expect(host.querySelectorAll("img.custom-emoji").length).toBe(2);
+  });
+
+  it("never renders inside an inline code span", () => {
+    const host = render("type `:wave:` to wave");
+    expect(host.querySelectorAll("img.custom-emoji").length).toBe(0);
+    expect(host.querySelector("code")?.textContent).toBe(":wave:");
+  });
+
+  it("never renders inside a fenced code block", () => {
+    const host = render("```\n:wave:\n```");
+    expect(host.querySelectorAll("img.custom-emoji").length).toBe(0);
+    expect(host.querySelector(".msg-codeblock")?.textContent).toContain(":wave:");
+  });
+
+  it("never renders inside a tagged fence", () => {
+    const host = render("```ts\nconst a = ':wave:';\n```");
+    expect(host.querySelectorAll("img.custom-emoji").length).toBe(0);
+  });
+
+  it("renders around a fence but not inside it", () => {
+    const host = render(":wave: before\n```\n:party_blob:\n```\n:wave: after");
+    const imgs = host.querySelectorAll("img.custom-emoji");
+    expect(imgs.length).toBe(2);
+    expect([...imgs].every((i) => i.getAttribute("data-shortcode") === "wave")).toBe(true);
+  });
+
+  it("renders inside markdown emphasis", () => {
+    const host = render("**:wave:**");
+    expect(host.querySelector("strong img.custom-emoji")).not.toBeNull();
+  });
+
+  it("keeps working next to a URL", () => {
+    const host = render("see https://example.com :wave:");
+    expect(host.querySelectorAll("img.custom-emoji").length).toBe(1);
+    expect(host.querySelector("a.msg-link")?.getAttribute("href")).toBe("https://example.com");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Jumbo
+// ---------------------------------------------------------------------------
+
+describe("jumbo emoji", () => {
+  it("treats an emoji-only message as jumbo", () => {
+    expect(isEmojiOnlyMessage(":wave:")).toBe(true);
+    expect(isEmojiOnlyMessage(":wave: :party_blob:")).toBe(true);
+    expect(isEmojiOnlyMessage("🔥")).toBe(true);
+    expect(isEmojiOnlyMessage("🔥 :wave: 🎉")).toBe(true);
+    expect(isEmojiOnlyMessage("👍🏽")).toBe(true);
+    expect(isEmojiOnlyMessage("👨‍👩‍👧")).toBe(true);
+  });
+
+  it("does not jumbo a message with any other content", () => {
+    expect(isEmojiOnlyMessage("hi :wave:")).toBe(false);
+    expect(isEmojiOnlyMessage(":wave: !")).toBe(false);
+    expect(isEmojiOnlyMessage("")).toBe(false);
+    expect(isEmojiOnlyMessage("   ")).toBe(false);
+    expect(isEmojiOnlyMessage("```\n🔥\n```")).toBe(false);
+  });
+
+  it("does not jumbo an unresolved shortcode — it is plain text", () => {
+    expect(isEmojiOnlyMessage(":nosuch:")).toBe(false);
+  });
+
+  it("stops jumboing past the cap", () => {
+    expect(isEmojiOnlyMessage("🔥".repeat(MAX_JUMBO_EMOJI))).toBe(true);
+    expect(isEmojiOnlyMessage("🔥".repeat(MAX_JUMBO_EMOJI + 1))).toBe(false);
+  });
+
+  it("marks the rendered text block with the jumbo class", () => {
+    expect(render(":wave:").querySelector(".msg-text-jumbo")).not.toBeNull();
+    expect(render("🔥🔥").querySelector(".msg-text-jumbo")).not.toBeNull();
+    expect(render("hi :wave:").querySelector(".msg-text-jumbo")).toBeNull();
+    expect(render("hi :wave:").querySelector(".msg-text")).not.toBeNull();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Reaction pills
+// ---------------------------------------------------------------------------
+
+function makeMessage(emoji: string): Message {
+  return {
+    id: 1,
+    channelId: 1,
+    userId: 10,
+    username: "alice",
+    avatar: null,
+    content: "hi",
+    timestamp: "2026-01-01T00:00:00Z",
+    editedAt: null,
+    replyTo: null,
+    attachments: [],
+    reactions: [{ emoji, count: 2, me: false }],
+    pending: false,
+    failed: false,
+    pinned: false,
+  } as unknown as Message;
+}
+
+function reactionOptions(): MessageListOptions {
+  return { onReactionClick: vi.fn() } as unknown as MessageListOptions;
+}
+
+describe("reaction pills", () => {
+  it("renders the image for a custom-emoji reaction", () => {
+    const el = renderReactions(
+      makeMessage(":wave:"),
+      reactionOptions(),
+      new AbortController().signal,
+    );
+    const chip = el.querySelector(".reaction-chip");
+    expect(chip?.querySelector("img.custom-emoji")).not.toBeNull();
+    expect(chip?.getAttribute("data-emoji")).toBe(":wave:");
+    expect(chip?.querySelector(".rc-count")?.textContent).toBe("2");
+  });
+
+  it("falls back to the literal text when the emoji is gone", () => {
+    const el = renderReactions(
+      makeMessage(":deleted_one:"),
+      reactionOptions(),
+      new AbortController().signal,
+    );
+    const chip = el.querySelector(".reaction-chip");
+    expect(chip?.querySelector("img.custom-emoji")).toBeNull();
+    expect(chip?.textContent).toContain(":deleted_one:");
+  });
+
+  it("leaves a unicode reaction as text", () => {
+    const el = renderReactions(makeMessage("🔥"), reactionOptions(), new AbortController().signal);
+    const chip = el.querySelector(".reaction-chip");
+    expect(chip?.querySelector("img.custom-emoji")).toBeNull();
+    expect(chip?.textContent).toContain("🔥");
+  });
+
+  it("still toggles the reaction when it renders as an image", () => {
+    const opts = reactionOptions();
+    const el = renderReactions(makeMessage(":wave:"), opts, new AbortController().signal);
+    (el.querySelector(".reaction-chip") as HTMLElement).click();
+    expect(opts.onReactionClick).toHaveBeenCalledWith(1, ":wave:");
+  });
+});
diff --git a/Client/tauri-client/tests/unit/deep-link-init.test.ts b/Client/tauri-client/tests/unit/deep-link-init.test.ts
index 0db1d2b4..7fd5a261 100644
--- a/Client/tauri-client/tests/unit/deep-link-init.test.ts
+++ b/Client/tauri-client/tests/unit/deep-link-init.test.ts
@@ -113,6 +113,56 @@ describe("initDeepLinks", () => {
     expect(onInvite).toHaveBeenCalledWith("WARM", "h.example");
   });
 
+  it("routes a message permalink to onMessage, not onInvite", async () => {
+    getCurrent.mockResolvedValue(["owncord://message/5/42"]);
+    const onInvite = vi.fn();
+    const onMessage = vi.fn();
+
+    await initDeepLinks(onInvite, onMessage);
+
+    expect(onMessage).toHaveBeenCalledWith(5, 42);
+    expect(onInvite).not.toHaveBeenCalled();
+  });
+
+  it("dispatches a warm-launch message permalink", async () => {
+    const onMessage = vi.fn();
+    await initDeepLinks(vi.fn(), onMessage);
+
+    const handler = onOpenUrl.mock.calls[0]?.[0] as (urls: readonly string[]) => void;
+    handler(["owncord://message/9/7"]);
+
+    expect(onMessage).toHaveBeenCalledWith(9, 7);
+  });
+
+  it("ignores a message permalink when no onMessage handler was supplied", async () => {
+    // The old two-argument-free call site must not start feeding permalinks
+    // into the invite flow, and must not throw.
+    getCurrent.mockResolvedValue(["owncord://message/5/42"]);
+    const onInvite = vi.fn();
+
+    await expect(initDeepLinks(onInvite)).resolves.toBeUndefined();
+
+    expect(onInvite).not.toHaveBeenCalled();
+  });
+
+  it("mixes invites and permalinks in one batch", async () => {
+    getCurrent.mockResolvedValue([
+      "owncord://message/1/2",
+      "owncord://invite/CODE",
+      "owncord://message/3/4",
+    ]);
+    const onInvite = vi.fn();
+    const onMessage = vi.fn();
+
+    await initDeepLinks(onInvite, onMessage);
+
+    expect(onInvite).toHaveBeenCalledTimes(1);
+    expect(onInvite).toHaveBeenCalledWith("CODE", undefined);
+    expect(onMessage).toHaveBeenCalledTimes(2);
+    expect(onMessage).toHaveBeenNthCalledWith(1, 1, 2);
+    expect(onMessage).toHaveBeenNthCalledWith(2, 3, 4);
+  });
+
   it("swallows a getCurrent rejection without wiring a listener", async () => {
     getCurrent.mockRejectedValue(new Error("ipc down"));
     const onInvite = vi.fn();
diff --git a/Client/tauri-client/tests/unit/deep-link.test.ts b/Client/tauri-client/tests/unit/deep-link.test.ts
index 471b822e..66de36fc 100644
--- a/Client/tauri-client/tests/unit/deep-link.test.ts
+++ b/Client/tauri-client/tests/unit/deep-link.test.ts
@@ -1,5 +1,5 @@
 import { describe, it, expect } from "vitest";
-import { parseInviteLink } from "@lib/deep-link";
+import { parseInviteLink, parseMessageLink, formatMessageLink } from "@lib/deep-link";
 
 describe("parseInviteLink", () => {
   it("parses owncord://invite/<code>", () => {
@@ -33,4 +33,63 @@ describe("parseInviteLink", () => {
     expect(parseInviteLink("owncord://invite/")).toBeNull();
     expect(parseInviteLink("owncord://")).toBeNull();
   });
+
+  it("rejects a message permalink — 'message' is a route, not an invite code", () => {
+    // The bare-code form (owncord://<code>) would otherwise swallow the
+    // message route and try to register an account with the code "message".
+    expect(parseInviteLink("owncord://message/5/42")).toBeNull();
+    expect(parseInviteLink("owncord://message")).toBeNull();
+  });
+});
+
+describe("parseMessageLink", () => {
+  it("parses owncord://message/<channelId>/<messageId>", () => {
+    expect(parseMessageLink("owncord://message/5/42")).toEqual({ channelId: 5, messageId: 42 });
+  });
+
+  it("tolerates a trailing slash", () => {
+    expect(parseMessageLink("owncord://message/5/42/")).toEqual({ channelId: 5, messageId: 42 });
+  });
+
+  it("rejects a non-owncord scheme", () => {
+    expect(parseMessageLink("https://example.com/message/5/42")).toBeNull();
+  });
+
+  it("rejects the invite route", () => {
+    expect(parseMessageLink("owncord://invite/ABC")).toBeNull();
+    expect(parseMessageLink("owncord://ABC")).toBeNull();
+  });
+
+  it("rejects missing or non-numeric ids", () => {
+    expect(parseMessageLink("owncord://message/5")).toBeNull();
+    expect(parseMessageLink("owncord://message")).toBeNull();
+    expect(parseMessageLink("owncord://message/abc/42")).toBeNull();
+    expect(parseMessageLink("owncord://message/5/abc")).toBeNull();
+    expect(parseMessageLink("owncord://message/5.5/42")).toBeNull();
+  });
+
+  it("rejects zero and negative ids", () => {
+    expect(parseMessageLink("owncord://message/0/42")).toBeNull();
+    expect(parseMessageLink("owncord://message/5/0")).toBeNull();
+    expect(parseMessageLink("owncord://message/-5/42")).toBeNull();
+  });
+
+  it("rejects ids beyond safe-integer precision", () => {
+    // Past 2^53 the parsed number is not the number in the link, so a jump
+    // would silently target a different message.
+    expect(parseMessageLink("owncord://message/5/99999999999999999999")).toBeNull();
+  });
+
+  it("ignores extra path segments after the message id", () => {
+    expect(parseMessageLink("owncord://message/5/42/extra")).toEqual({
+      channelId: 5,
+      messageId: 42,
+    });
+  });
+
+  it("round-trips with formatMessageLink", () => {
+    const url = formatMessageLink(7, 1234);
+    expect(url).toBe("owncord://message/7/1234");
+    expect(parseMessageLink(url)).toEqual({ channelId: 7, messageId: 1234 });
+  });
 });
diff --git a/Client/tauri-client/tests/unit/dispatcher.test.ts b/Client/tauri-client/tests/unit/dispatcher.test.ts
index d9ef05c4..37f5df38 100644
--- a/Client/tauri-client/tests/unit/dispatcher.test.ts
+++ b/Client/tauri-client/tests/unit/dispatcher.test.ts
@@ -2,7 +2,7 @@ import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import { wireDispatcher, wireConnectionStatus } from "../../src/lib/dispatcher";
 import { createMockWsClient } from "../helpers/mock-ws";
 import { authStore, clearAuth } from "../../src/stores/auth.store";
-import { channelsStore } from "../../src/stores/channels.store";
+import { channelsStore, setRoles, getRoleIdByName } from "../../src/stores/channels.store";
 import {
   messagesStore,
   addOptimisticMessage,
@@ -12,7 +12,20 @@ import { membersStore } from "../../src/stores/members.store";
 import { voiceStore } from "../../src/stores/voice.store";
 import { dmStore } from "../../src/stores/dm.store";
 import { blocksStore } from "../../src/stores/blocks.store";
+import {
+  emojiStore,
+  setCustomEmoji,
+  clearCustomEmoji,
+  listCustomEmoji,
+  resolveEmoji,
+} from "../../src/stores/emoji.store";
 import { uiStore } from "../../src/stores/ui.store";
+import {
+  clearReactionUsersCache,
+  getCachedReactionUsers,
+  loadReactionUsers,
+  setReactionUsersFetcher,
+} from "../../src/components/message-list/reaction-tooltip";
 import type { WsClient, WsListener } from "../../src/lib/ws";
 import type { ServerMessage } from "../../src/lib/types";
 
@@ -29,9 +42,16 @@ vi.mock("@lib/livekitSession", () => ({
   leaveVoice: vi.fn(),
   cleanupAll: vi.fn(),
   isVoiceConnected: vi.fn(() => false),
+  setMuted: vi.fn(),
+  setDeafened: vi.fn(),
 }));
 // F3: the ready handler publishes our identity key. Mock the orchestrator so
 // the wiring is asserted without real keygen/keyring.
+const mockShowToast = vi.fn();
+vi.mock("@lib/toast", () => ({
+  showToast: (...args: unknown[]) => mockShowToast(...args),
+}));
+
 vi.mock("@lib/identity", () => ({
   ensureIdentityKeyPublished: vi.fn(async () => true),
 }));
@@ -39,6 +59,8 @@ vi.mock("@lib/identity", () => ({
 import { ensureIdentityKeyPublished as _ensureIdentityKeyPublished } from "../../src/lib/identity";
 const mockEnsurePublished = vi.mocked(_ensureIdentityKeyPublished);
 
+import { setMuted as mockSetMuted, setDeafened as mockSetDeafened } from "@lib/livekitSession";
+
 // Suppress console output
 vi.spyOn(console, "info").mockImplementation(() => {});
 vi.spyOn(console, "warn").mockImplementation(() => {});
@@ -122,6 +144,7 @@ describe("WS Dispatcher", () => {
       loadedChannels: new Set(),
       hasMore: new Map(),
       historyLoadState: new Map(),
+      detachedChannels: new Set(),
     }));
     membersStore.setState(() => ({
       members: new Map(),
@@ -142,6 +165,8 @@ describe("WS Dispatcher", () => {
     dmStore.setState(() => ({ channels: [] }));
     blocksStore.setState(() => ({ blockedByMe: new Set(), blockedByThem: new Set() }));
     uiStore.setState((prev) => ({ ...prev, transientError: null }));
+    clearCustomEmoji();
+    emojiStore.flush();
 
     mock = createMockWs();
     cleanup = wireDispatcher(mock.ws);
@@ -213,9 +238,14 @@ describe("WS Dispatcher", () => {
         category: null,
         position: 0,
         unreadCount: 0,
+        mentionCount: 0,
         lastMessageId: null,
         canSend: true,
+        topic: "",
         slowMode: 0,
+        nsfw: false,
+        voiceMaxUsers: 0,
+        voiceMaxVideo: 0,
       });
       return { ...prev, channels: ch, activeChannelId: 1 }; // active is channel 1
     });
@@ -234,6 +264,76 @@ describe("WS Dispatcher", () => {
     expect(ch?.unreadCount).toBe(1);
   });
 
+  describe("mention counts", () => {
+    function seedChannel(): void {
+      channelsStore.setState((prev) => {
+        const ch = new Map(prev.channels);
+        ch.set(5, {
+          id: 5,
+          name: "off-topic",
+          type: "text" as const,
+          category: null,
+          position: 0,
+          unreadCount: 0,
+          mentionCount: 0,
+          lastMessageId: null,
+          canSend: true,
+          topic: "",
+          slowMode: 0,
+          nsfw: false,
+          voiceMaxUsers: 0,
+          voiceMaxVideo: 0,
+        });
+        return { ...prev, channels: ch, activeChannelId: 1 };
+      });
+      authStore.setState((prev) => ({
+        ...prev,
+        user: { id: 1, username: "alex", avatar: null, role: "member" },
+      }));
+    }
+
+    function incoming(extra: Record<string, unknown>): void {
+      mock.dispatch("chat_message", {
+        id: 200,
+        channel_id: 5,
+        user: { id: 2, username: "bob", avatar: null },
+        content: "ping",
+        reply_to: null,
+        attachments: [],
+        timestamp: "2026-03-15T10:00:00Z",
+        ...extra,
+      });
+    }
+
+    it("increments when the message names the current user", () => {
+      seedChannel();
+      incoming({ content: "ping @alex", mentions: [1] });
+      const ch = channelsStore.getState().channels.get(5);
+      expect(ch?.mentionCount).toBe(1);
+      expect(ch?.unreadCount).toBe(1);
+    });
+
+    it("increments for an honoured @everyone", () => {
+      seedChannel();
+      incoming({ content: "@everyone", mentions_everyone: true });
+      expect(channelsStore.getState().channels.get(5)?.mentionCount).toBe(1);
+    });
+
+    it("does not increment for someone else's mention", () => {
+      seedChannel();
+      incoming({ content: "ping @bob", mentions: [2] });
+      const ch = channelsStore.getState().channels.get(5);
+      expect(ch?.mentionCount).toBe(0);
+      expect(ch?.unreadCount).toBe(1);
+    });
+
+    it("does not increment for an @everyone the sender could not send", () => {
+      seedChannel();
+      incoming({ content: "@everyone", mentions_everyone: false });
+      expect(channelsStore.getState().channels.get(5)?.mentionCount).toBe(0);
+    });
+  });
+
   it("wires presence to members store", () => {
     // Add a member first
     membersStore.setState((prev) => {
@@ -246,6 +346,44 @@ describe("WS Dispatcher", () => {
     expect(membersStore.getState().members.get(1)?.status).toBe("idle");
   });
 
+  it("carries a custom status on presence, and leaves it alone when omitted", () => {
+    membersStore.setState((prev) => {
+      const m = new Map(prev.members);
+      m.set(1, { id: 1, username: "alex", avatar: null, role: "admin", status: "online" as const });
+      return { ...prev, members: m };
+    });
+
+    mock.dispatch("presence", { user_id: 1, status: "idle", custom_status: "afk" });
+    expect(membersStore.getState().members.get(1)?.customStatus).toBe("afk");
+
+    // A bare status flip (what the auto-idle timer sends) must not blank it.
+    mock.dispatch("presence", { user_id: 1, status: "online" });
+    expect(membersStore.getState().members.get(1)?.customStatus).toBe("afk");
+
+    // An explicit null clears it.
+    mock.dispatch("presence", { user_id: 1, status: "online", custom_status: null });
+    expect(membersStore.getState().members.get(1)?.customStatus).toBeNull();
+  });
+
+  it("wires user_update display_name into the member store", () => {
+    membersStore.setState((prev) => {
+      const m = new Map(prev.members);
+      m.set(1, { id: 1, username: "alex", avatar: null, role: "admin", status: "online" as const });
+      return { ...prev, members: m };
+    });
+
+    mock.dispatch("user_update", {
+      user_id: 1,
+      username: "alex",
+      avatar: "/api/v1/files/abc",
+      display_name: "Alex A.",
+      about: "hi",
+    });
+    const member = membersStore.getState().members.get(1);
+    expect(member?.displayName).toBe("Alex A.");
+    expect(member?.avatar).toBe("/api/v1/files/abc");
+  });
+
   it("wires typing to members store", () => {
     mock.dispatch("typing", { channel_id: 1, user_id: 42, username: "bob" });
     const typing = membersStore.getState().typingUsers.get(1);
@@ -274,9 +412,14 @@ describe("WS Dispatcher", () => {
         category: null,
         position: 0,
         unreadCount: 0,
+        mentionCount: 0,
         lastMessageId: null,
         canSend: true,
+        topic: "",
         slowMode: 0,
+        nsfw: false,
+        voiceMaxUsers: 0,
+        voiceMaxVideo: 0,
       });
       return { ...prev, channels: ch };
     });
@@ -285,11 +428,32 @@ describe("WS Dispatcher", () => {
     expect(channelsStore.getState().channels.has(10)).toBe(false);
   });
 
-  it("wires member_join to members store", () => {
+  it("wires member_join to members store, using the payload's status", () => {
     mock.dispatch("member_join", {
       user: { id: 99, username: "newuser", avatar: null, role: "member" },
+      status: "online",
     });
-    expect(membersStore.getState().members.has(99)).toBe(true);
+    expect(membersStore.getState().members.get(99)).toMatchObject({ status: "online" });
+  });
+
+  it("renders an invisible member_join as offline, not online", () => {
+    // The server broadcasts an invisible connector's join as "offline" (the
+    // viewer-safe collapse) — the client must render exactly that, not
+    // assume a join always means online.
+    mock.dispatch("member_join", {
+      user: { id: 100, username: "ghost", avatar: null, role: "member" },
+      status: "offline",
+    });
+    expect(membersStore.getState().members.get(100)).toMatchObject({ status: "offline" });
+  });
+
+  it("defaults a member_join with no status field to offline, not online", () => {
+    // An older server that has not shipped the status field yet must fail
+    // safe — omission must never be read as "online".
+    mock.dispatch("member_join", {
+      user: { id: 101, username: "legacy-server-user", avatar: null, role: "member" },
+    });
+    expect(membersStore.getState().members.get(101)).toMatchObject({ status: "offline" });
   });
 
   it("wires chat_send_ok to confirmSend in messages store", () => {
@@ -481,6 +645,51 @@ describe("WS Dispatcher", () => {
     expect(found?.deleted).toBe(true);
   });
 
+  it("wires chat_bulk_deleted to messages store", () => {
+    for (const id of [100, 101, 102]) {
+      mock.dispatch("chat_message", {
+        id,
+        channel_id: 1,
+        user: { id: 1, username: "alex", avatar: null },
+        content: `spam ${id}`,
+        reply_to: null,
+        attachments: [],
+        timestamp: "2026-03-15T10:00:00Z",
+      });
+    }
+
+    mock.dispatch("chat_bulk_deleted", { channel_id: 1, ids: [102, 101] });
+
+    const msgs = messagesStore.getState().messagesByChannel.get(1);
+    expect(msgs?.find((m) => m.id === 102)?.deleted).toBe(true);
+    expect(msgs?.find((m) => m.id === 101)?.deleted).toBe(true);
+    // Tombstones, not removals: the rows and their content survive.
+    expect(msgs).toHaveLength(3);
+    expect(msgs?.find((m) => m.id === 102)?.content).toBe("spam 102");
+    // An id outside the purge is untouched.
+    expect(msgs?.find((m) => m.id === 100)?.deleted).toBe(false);
+  });
+
+  it("ignores chat_bulk_deleted for an unloaded channel and an empty id list", () => {
+    mock.dispatch("chat_message", {
+      id: 200,
+      channel_id: 1,
+      user: { id: 1, username: "alex", avatar: null },
+      content: "keep",
+      reply_to: null,
+      attachments: [],
+      timestamp: "2026-03-15T10:00:00Z",
+    });
+    const before = messagesStore.getState().messagesByChannel;
+
+    mock.dispatch("chat_bulk_deleted", { channel_id: 99, ids: [1, 2, 3] });
+    mock.dispatch("chat_bulk_deleted", { channel_id: 1, ids: [] });
+
+    // No-op dispatches must not churn the map identity (re-render trigger).
+    expect(messagesStore.getState().messagesByChannel).toBe(before);
+    expect(messagesStore.getState().messagesByChannel.get(1)?.[0]?.deleted).toBe(false);
+  });
+
   it("wires chat_send_ok without id does not crash", () => {
     expect(() => {
       mock.dispatch("chat_send_ok", { message_id: 500, timestamp: "2026-03-15T10:00:00Z" });
@@ -518,6 +727,31 @@ describe("WS Dispatcher", () => {
     expect(msgs).toBeDefined();
   });
 
+  // The who-reacted tooltip caches reactor lists per message+emoji; a
+  // reaction_update on that message makes every one of them stale.
+  it("invalidates the who-reacted cache for the message a reaction_update names", async () => {
+    const fetcher = vi.fn().mockResolvedValue([{ id: 1, username: "alice", avatar: "" }]);
+    setReactionUsersFetcher(fetcher as never);
+    clearReactionUsersCache();
+
+    await loadReactionUsers(1, 200, "👍");
+    await loadReactionUsers(1, 201, "👍");
+    expect(getCachedReactionUsers(200, "👍")).toHaveLength(1);
+
+    mock.dispatch("reaction_update", {
+      message_id: 200,
+      channel_id: 1,
+      emoji: "👍",
+      user_id: 2,
+      action: "add",
+    });
+
+    expect(getCachedReactionUsers(200, "👍")).toBeUndefined();
+    // Other messages' caches are untouched.
+    expect(getCachedReactionUsers(201, "👍")).toHaveLength(1);
+    setReactionUsersFetcher(null);
+  });
+
   it("wires channel_update to channels store", () => {
     channelsStore.setState((prev) => {
       const ch = new Map(prev.channels);
@@ -528,9 +762,14 @@ describe("WS Dispatcher", () => {
         category: null,
         position: 0,
         unreadCount: 0,
+        mentionCount: 0,
         lastMessageId: null,
         canSend: true,
+        topic: "",
         slowMode: 0,
+        nsfw: false,
+        voiceMaxUsers: 0,
+        voiceMaxVideo: 0,
       });
       return { ...prev, channels: ch };
     });
@@ -557,9 +796,14 @@ describe("WS Dispatcher", () => {
         category: null,
         position: 0,
         unreadCount: 0,
+        mentionCount: 0,
         lastMessageId: null,
         canSend: true,
+        topic: "",
         slowMode: 0,
+        nsfw: false,
+        voiceMaxUsers: 0,
+        voiceMaxVideo: 0,
       });
       ch.set(20, {
         id: 20,
@@ -568,9 +812,14 @@ describe("WS Dispatcher", () => {
         category: null,
         position: 1,
         unreadCount: 0,
+        mentionCount: 0,
         lastMessageId: null,
         canSend: true,
+        topic: "",
         slowMode: 0,
+        nsfw: false,
+        voiceMaxUsers: 0,
+        voiceMaxVideo: 0,
       });
       return { ...prev, channels: ch, activeChannelId: 10 };
     });
@@ -591,9 +840,14 @@ describe("WS Dispatcher", () => {
         category: null,
         position: 0,
         unreadCount: 0,
+        mentionCount: 0,
         lastMessageId: null,
         canSend: true,
+        topic: "",
         slowMode: 0,
+        nsfw: false,
+        voiceMaxUsers: 0,
+        voiceMaxVideo: 0,
       });
       return { ...prev, channels: ch, activeChannelId: 10 };
     });
@@ -620,6 +874,90 @@ describe("WS Dispatcher", () => {
     expect(membersStore.getState().members.get(42)?.role).toBe("admin");
   });
 
+  it("wires roles_update to replace the role list", () => {
+    channelsStore.setState((prev) => ({
+      ...prev,
+      roles: [
+        { id: 1, name: "Owner", color: "#E74C3C", permissions: 0x40000000, position: 100 },
+        { id: 9, name: "Contractor", color: "#123456", permissions: 0x3, position: 30 },
+      ],
+    }));
+
+    // A role was deleted and another recolored server-side. Replacing rather
+    // than merging is the point: the deleted role must not survive.
+    mock.dispatch("roles_update", {
+      roles: [
+        { id: 1, name: "Owner", color: "#FF0000", permissions: 0x40000000, position: 100 },
+        { id: 4, name: "Member", color: null, permissions: 0x3, position: 40, is_default: true },
+      ],
+    });
+
+    const roles = channelsStore.getState().roles;
+    expect(roles.map((r) => r.id)).toEqual([1, 4]);
+    expect(roles[0]?.color).toBe("#FF0000");
+    expect(roles.some((r) => r.name === "Contractor")).toBe(false);
+  });
+
+  it("makes a role created by roles_update immediately assignable", () => {
+    // The Change Role menu resolves a role by name, so a role created in the
+    // admin panel has to be resolvable from the broadcast alone — without this
+    // assigning a freshly created role needed a reconnect.
+    setRoles([{ id: 4, name: "Member", color: null, permissions: 0x3, position: 40 }]);
+    expect(getRoleIdByName("contractor")).toBeUndefined();
+
+    mock.dispatch("roles_update", {
+      roles: [
+        { id: 4, name: "Member", color: null, permissions: 0x3, position: 40, is_default: true },
+        { id: 9, name: "Contractor", color: "#123456", permissions: 0x3, position: 30 },
+      ],
+    });
+
+    expect(getRoleIdByName("contractor")).toBe(9);
+  });
+
+  it("treats a roles_update with no roles field as an empty list", () => {
+    channelsStore.setState((prev) => ({
+      ...prev,
+      roles: [{ id: 1, name: "Owner", color: null, permissions: 0 }],
+    }));
+
+    mock.dispatch("roles_update", {} as { roles: [] });
+
+    expect(channelsStore.getState().roles).toEqual([]);
+  });
+
+  it("wires emoji_update to replace the custom-emoji set", () => {
+    setCustomEmoji([
+      { id: 1, shortcode: "wave", url: "/api/v1/emoji/1/image" },
+      { id: 2, shortcode: "gone", url: "/api/v1/emoji/2/image" },
+    ]);
+    emojiStore.flush();
+
+    // The deleted emoji must not survive the replace — the whole point of
+    // sending the set rather than a delta.
+    mock.dispatch("emoji_update", {
+      emoji: [
+        { id: 1, shortcode: "wave", url: "/api/v1/emoji/1/image" },
+        { id: 3, shortcode: "party", url: "/api/v1/emoji/3/image" },
+      ],
+    });
+    emojiStore.flush();
+
+    expect(listCustomEmoji().map((e) => e.shortcode)).toEqual(["wave", "party"]);
+    expect(resolveEmoji("gone")).toBeNull();
+    expect(resolveEmoji("party")?.id).toBe(3);
+  });
+
+  it("treats an emoji_update with no emoji field as an empty set", () => {
+    setCustomEmoji([{ id: 1, shortcode: "wave", url: "/api/v1/emoji/1/image" }]);
+    emojiStore.flush();
+
+    mock.dispatch("emoji_update", {} as { emoji: [] });
+    emojiStore.flush();
+
+    expect(listCustomEmoji()).toEqual([]);
+  });
+
   it("wires voice_state and auto-joins if current user", () => {
     authStore.setState((prev) => ({
       ...prev,
@@ -699,6 +1037,86 @@ describe("WS Dispatcher", () => {
     expect(voiceStore.getState().currentChannelId).toBe(3);
   });
 
+  it("mirrors a moderator mute/deafen into the local flags and honors it", async () => {
+    authStore.setState((prev) => ({
+      ...prev,
+      user: { id: 5, username: "me", avatar: null, role: "member" },
+    }));
+
+    mock.dispatch("voice_state", {
+      channel_id: 3,
+      user_id: 5,
+      username: "me",
+      muted: true,
+      deafened: true,
+      speaking: false,
+      camera: false,
+      screenshare: false,
+      server_muted: true,
+      server_deafened: true,
+    });
+
+    const state = voiceStore.getState();
+    expect(state.localServerMuted).toBe(true);
+    expect(state.localServerDeafened).toBe(true);
+
+    // Deafen is client-enforced: the session must stop playing remote audio.
+    await vi.runAllTimersAsync();
+    expect(vi.mocked(mockSetDeafened)).toHaveBeenCalledWith(true);
+    expect(vi.mocked(mockSetMuted)).toHaveBeenCalledWith(true);
+  });
+
+  it("does not set the local moderator flags from another user's voice_state", () => {
+    authStore.setState((prev) => ({
+      ...prev,
+      user: { id: 5, username: "me", avatar: null, role: "member" },
+    }));
+
+    mock.dispatch("voice_state", {
+      channel_id: 3,
+      user_id: 99,
+      username: "other",
+      muted: true,
+      deafened: false,
+      speaking: false,
+      camera: false,
+      screenshare: false,
+      server_muted: true,
+    });
+
+    expect(voiceStore.getState().localServerMuted).not.toBe(true);
+    expect(voiceStore.getState().voiceUsers.get(3)?.get(99)?.serverMuted).toBe(true);
+  });
+
+  it("wires voice_moved to a leave + re-join of the destination channel", async () => {
+    authStore.setState((prev) => ({
+      ...prev,
+      user: { id: 5, username: "me", avatar: null, role: "member" },
+    }));
+    voiceStore.setState((prev) => ({ ...prev, currentChannelId: 3 }));
+
+    mock.dispatch("voice_moved", { to_channel_id: 7 });
+    await vi.runAllTimersAsync();
+
+    expect(voiceStore.getState().currentChannelId).toBe(7);
+    expect(mock.ws.send).toHaveBeenCalledWith(
+      expect.objectContaining({ type: "voice_join", payload: { channel_id: 7 } }),
+    );
+  });
+
+  it("wires voice_disconnected to clearing the local voice session", async () => {
+    authStore.setState((prev) => ({
+      ...prev,
+      user: { id: 5, username: "me", avatar: null, role: "member" },
+    }));
+    voiceStore.setState((prev) => ({ ...prev, currentChannelId: 3 }));
+
+    mock.dispatch("voice_disconnected", { channel_id: 3, reason: "kicked" });
+    await vi.runAllTimersAsync();
+
+    expect(voiceStore.getState().currentChannelId).toBeNull();
+  });
+
   it("wires voice_config to voice store", () => {
     mock.dispatch("voice_config", {
       channel_id: 3,
@@ -710,13 +1128,35 @@ describe("WS Dispatcher", () => {
   });
 
   it("wires voice_speakers to voice store", () => {
+    voiceStore.setState((prev) => {
+      const users = new Map(
+        [1, 2, 4].map((userId) => [
+          userId,
+          {
+            userId,
+            username: `user${userId}`,
+            muted: false,
+            deafened: false,
+            speaking: false,
+            camera: false,
+            screenshare: false,
+          },
+        ]),
+      );
+      const voiceUsers = new Map(prev.voiceUsers);
+      voiceUsers.set(3, users);
+      return { ...prev, voiceUsers };
+    });
+
     mock.dispatch("voice_speakers", {
       channel_id: 3,
       speakers: [1, 2, 3],
     });
 
-    // Verify it runs without error
-    expect(true).toBe(true);
+    const users = voiceStore.getState().voiceUsers.get(3);
+    expect(users?.get(1)?.speaking).toBe(true);
+    expect(users?.get(2)?.speaking).toBe(true);
+    expect(users?.get(4)?.speaking).toBe(false);
   });
 
   it("wires voice_token to handleVoiceToken", async () => {
@@ -763,6 +1203,49 @@ describe("WS Dispatcher", () => {
     expect(error).toContain("maintenance");
   });
 
+  it("wires server_restart shutdown to sign-out and call-state reset", () => {
+    authStore.setState((prev) => ({
+      ...prev,
+      isAuthenticated: true,
+      user: { id: 1, username: "call-user", avatar: null, role: "member" },
+    }));
+    // Simulate a live call with webcam and screenshare on.
+    voiceStore.setState((prev) => ({
+      ...prev,
+      currentChannelId: 42,
+      voiceStatus: "connected",
+      localCamera: true,
+      localScreenshare: true,
+    }));
+
+    mock.dispatch("server_restart", { reason: "shutdown", delay_seconds: 5 });
+
+    // Kicked back to login: auth cleared, reason preserved so the logout
+    // wiring keeps the saved credential.
+    expect(authStore.getState().isAuthenticated).toBe(false);
+    expect(authStore.getState().logoutReason).toBe("server_shutdown");
+    expect(uiStore.getState().transientError).toContain("shut down");
+
+    // Call settings reset to their normal state.
+    const voice = voiceStore.getState();
+    expect(voice.currentChannelId).toBeNull();
+    expect(voice.voiceStatus).toBe("idle");
+    expect(voice.localCamera).toBe(false);
+    expect(voice.localScreenshare).toBe(false);
+  });
+
+  it("keeps the session for non-shutdown server_restart reasons", () => {
+    authStore.setState((prev) => ({
+      ...prev,
+      isAuthenticated: true,
+      user: { id: 1, username: "stay-user", avatar: null, role: "member" },
+    }));
+
+    mock.dispatch("server_restart", { reason: "update", delay_seconds: 5 });
+
+    expect(authStore.getState().isAuthenticated).toBe(true);
+  });
+
   it("wires error BANNED to clear auth and show error", () => {
     authStore.setState((prev) => ({
       ...prev,
@@ -831,6 +1314,7 @@ describe("WS Dispatcher", () => {
       loadedChannels: new Set(),
       hasMore: new Map(),
       historyLoadState: new Map(),
+      detachedChannels: new Set(),
     }));
     uiStore.setState((prev) => ({ ...prev, transientError: null }));
 
@@ -859,10 +1343,14 @@ describe("WS Dispatcher", () => {
         {
           channelId: 7,
           recipient: { id: 5, username: "alice", avatar: "", status: "online" },
+          participants: [],
+          name: "",
+          isGroup: false,
           lastMessageId: null,
           lastMessage: "",
           lastMessageAt: "",
           unreadCount: 0,
+          mentionCount: 0,
         },
       ],
     }));
@@ -947,6 +1435,36 @@ describe("WS Dispatcher", () => {
     expect(updateProfile).toHaveBeenCalledWith({ identity_public_key: "k" });
   });
 
+  it("on ready loads the custom-emoji set from the REST list", async () => {
+    cleanup();
+    const listBlocks = vi.fn().mockResolvedValue({ blocked_user_ids: [] });
+    const listEmoji = vi
+      .fn()
+      .mockResolvedValue([{ id: 4, shortcode: "wave", url: "/api/v1/emoji/4/image" }]);
+    cleanup = wireDispatcher(mock.ws, { listBlocks, listEmoji });
+
+    mock.dispatch("ready", { channels: [], members: [], voice_states: [], roles: [] });
+
+    expect(listEmoji).toHaveBeenCalled();
+    await Promise.resolve();
+    await Promise.resolve();
+    emojiStore.flush();
+    expect(resolveEmoji("wave")?.id).toBe(4);
+  });
+
+  it("survives a failed emoji load — shortcodes just stay plain text", async () => {
+    cleanup();
+    const listBlocks = vi.fn().mockResolvedValue({ blocked_user_ids: [] });
+    const listEmoji = vi.fn().mockRejectedValue(new Error("offline"));
+    cleanup = wireDispatcher(mock.ws, { listBlocks, listEmoji });
+
+    mock.dispatch("ready", { channels: [], members: [], voice_states: [], roles: [] });
+    await Promise.resolve();
+    await Promise.resolve();
+    emojiStore.flush();
+    expect(listCustomEmoji()).toEqual([]);
+  });
+
   it("on ready clears being-blocked state and refreshes blocked-by-me via api", async () => {
     cleanup(); // tear down the no-api dispatcher wired in beforeEach
     const listBlocks = vi.fn().mockResolvedValue({ blocked_user_ids: [11, 22] });
@@ -1010,9 +1528,14 @@ describe("WS Dispatcher", () => {
         category: null,
         position: 0,
         unreadCount: 0,
+        mentionCount: 0,
         lastMessageId: null,
         canSend: true,
+        topic: "",
         slowMode: 0,
+        nsfw: false,
+        voiceMaxUsers: 0,
+        voiceMaxVideo: 0,
       });
       return { ...prev, channels: ch, activeChannelId: 1 };
     });
@@ -1042,9 +1565,14 @@ describe("WS Dispatcher", () => {
         category: null,
         position: 0,
         unreadCount: 0,
+        mentionCount: 0,
         lastMessageId: null,
         canSend: true,
+        topic: "",
         slowMode: 0,
+        nsfw: false,
+        voiceMaxUsers: 0,
+        voiceMaxVideo: 0,
       });
       return { ...prev, channels: ch, activeChannelId: 1 };
     });
@@ -1068,10 +1596,14 @@ describe("WS Dispatcher", () => {
     const dmChannel = {
       channelId: 50,
       recipient: { id: 10, username: "bob", avatar: "", status: "online" as const },
+      participants: [],
+      name: "",
+      isGroup: false,
       lastMessageId: null,
       lastMessage: "",
       lastMessageAt: "",
       unreadCount: 0,
+      mentionCount: 0,
     };
 
     beforeEach(() => {
@@ -1194,6 +1726,52 @@ describe("WS Dispatcher", () => {
       expect(channels[0]!.recipient.username).toBe("bob");
     });
 
+    // A pre-group server sends only `recipient`, which for it IS the whole
+    // membership — so the fallback has to be a one-element list, not an empty
+    // one, or every group-aware call site breaks against an old server.
+    it("treats a recipient-only payload as a one-person participant list", () => {
+      mock.dispatch("dm_channel_open", {
+        channel_id: 50,
+        recipient: { id: 10, username: "bob", avatar: "", status: "online" },
+        last_message_id: null,
+        last_message: "",
+        last_message_at: "",
+        unread_count: 0,
+      });
+
+      const dm = dmStore.getState().channels[0]!;
+      expect(dm.participants).toHaveLength(1);
+      expect(dm.participants[0]!.id).toBe(10);
+      expect(dm.isGroup).toBe(false);
+      expect(dm.name).toBe("");
+    });
+
+    it("maps a group dm_channel_open with its full participant list", () => {
+      mock.dispatch("dm_channel_open", {
+        channel_id: 51,
+        recipient: { id: 10, username: "bob", avatar: "", status: "online" },
+        recipients: [
+          { id: 10, username: "bob", avatar: "", status: "online", display_name: "Bobby" },
+          { id: 11, username: "cat", avatar: "", status: "idle" },
+        ],
+        name: "Crew",
+        is_group: true,
+        last_message_id: null,
+        last_message: "",
+        last_message_at: "",
+        unread_count: 0,
+      });
+
+      const dm = dmStore.getState().channels.find((c) => c.channelId === 51)!;
+      expect(dm.isGroup).toBe(true);
+      expect(dm.name).toBe("Crew");
+      expect(dm.participants.map((p) => p.id)).toEqual([10, 11]);
+      expect(dm.participants[0]!.displayName).toBe("Bobby");
+      // The compat recipient is the first of the list, so an older render path
+      // still shows somebody rather than nothing.
+      expect(dm.recipient.id).toBe(10);
+    });
+
     it("should call removeDmChannel on dm_channel_close", () => {
       // Seed a DM channel first
       dmStore.setState(() => ({
@@ -1201,10 +1779,14 @@ describe("WS Dispatcher", () => {
           {
             channelId: 50,
             recipient: { id: 10, username: "bob", avatar: "", status: "online" },
+            participants: [],
+            name: "",
+            isGroup: false,
             lastMessageId: null,
             lastMessage: "",
             lastMessageAt: "",
             unreadCount: 0,
+            mentionCount: 0,
           },
         ],
       }));
@@ -1389,6 +1971,46 @@ describe("WS Dispatcher", () => {
 
     expect(messagesStore.getState().messagesByChannel.get(1)).toBeUndefined();
   });
+
+  // ─── Voice capacity refusals ────────────────────────────────────────────
+  //
+  // The server owns voice_max_users / voice_max_video and answers an over-limit
+  // join with CHANNEL_FULL (or an over-limit camera with VIDEO_LIMIT). The
+  // client deliberately does not pre-block the click — its participant list can
+  // lag, and a refusal it invented would be uncorrectable — so the only thing
+  // standing between the user and a silent no-op is this toast.
+
+  describe("voice capacity errors", () => {
+    beforeEach(() => {
+      mockShowToast.mockClear();
+    });
+
+    it("surfaces CHANNEL_FULL as a toast", () => {
+      mock.dispatch("error", { code: "CHANNEL_FULL", message: "voice channel is full" });
+      expect(mockShowToast).toHaveBeenCalledWith("voice channel is full", "error");
+    });
+
+    it("falls back to a readable message when the server sends none", () => {
+      mock.dispatch("error", { code: "CHANNEL_FULL", message: "" });
+      expect(mockShowToast).toHaveBeenCalledWith("That voice channel is full", "error");
+    });
+
+    it("surfaces VIDEO_LIMIT as a toast", () => {
+      mock.dispatch("error", { code: "VIDEO_LIMIT", message: "" });
+      expect(mockShowToast).toHaveBeenCalledWith(
+        "That voice channel has reached its video limit",
+        "error",
+      );
+    });
+
+    // A capacity refusal is about the voice channel, not about the composer,
+    // so it must not also land in the login screen's transient-error slot.
+    it("does not set the transient error", () => {
+      uiStore.setState((prev) => ({ ...prev, transientError: null }));
+      mock.dispatch("error", { code: "CHANNEL_FULL", message: "full" });
+      expect(uiStore.getState().transientError).toBeNull();
+    });
+  });
 });
 
 describe("wireConnectionStatus", () => {
diff --git a/Client/tauri-client/tests/unit/dm-groups.test.ts b/Client/tauri-client/tests/unit/dm-groups.test.ts
new file mode 100644
index 00000000..36d1e5bc
--- /dev/null
+++ b/Client/tauri-client/tests/unit/dm-groups.test.ts
@@ -0,0 +1,396 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { createDmSidebar } from "@components/DmSidebar";
+import type { DmConversation } from "@components/DmSidebar";
+import { createIncomingCallBanner } from "@components/IncomingCallBanner";
+import { dmDisplayName } from "@stores/dm.store";
+import type { DmChannel, DmUser } from "@stores/dm.store";
+
+// ---------------------------------------------------------------------------
+// Fixtures
+// ---------------------------------------------------------------------------
+
+const user = (id: number, username: string, displayName = ""): DmUser => ({
+  id,
+  username,
+  avatar: "",
+  status: "online",
+  displayName,
+});
+
+function makeDm(overrides: Partial<DmChannel> = {}): DmChannel {
+  return {
+    channelId: 1,
+    recipient: user(2, "bob"),
+    participants: [user(2, "bob")],
+    name: "",
+    isGroup: false,
+    lastMessageId: null,
+    lastMessage: "",
+    lastMessageAt: "",
+    unreadCount: 0,
+    mentionCount: 0,
+    ...overrides,
+  };
+}
+
+const convo = (overrides: Partial<DmConversation> = {}): DmConversation => ({
+  channelId: 1,
+  userId: 2,
+  username: "bob",
+  avatar: null,
+  status: "online",
+  lastMessage: "",
+  timestamp: "",
+  unread: false,
+  ...overrides,
+});
+
+// ---------------------------------------------------------------------------
+// dmDisplayName
+// ---------------------------------------------------------------------------
+
+describe("dmDisplayName", () => {
+  it("names a 1:1 DM by the other person", () => {
+    expect(dmDisplayName(makeDm())).toBe("bob");
+  });
+
+  it("prefers a display name over the username", () => {
+    expect(dmDisplayName(makeDm({ participants: [user(2, "bob", "Bobby")] }))).toBe("Bobby");
+  });
+
+  it("uses a group's name when it has one", () => {
+    expect(
+      dmDisplayName(
+        makeDm({
+          isGroup: true,
+          name: "Lunch crew",
+          participants: [user(2, "bob"), user(3, "cat")],
+        }),
+      ),
+    ).toBe("Lunch crew");
+  });
+
+  it("joins the members of an unnamed group", () => {
+    expect(
+      dmDisplayName(makeDm({ isGroup: true, participants: [user(2, "bob"), user(3, "cat")] })),
+    ).toBe("bob, cat");
+  });
+
+  // Without a cap the label grows without bound and pushes the badges out of
+  // the row; three plus a count is the same shape Discord settles on.
+  it("caps an unnamed group at three names plus a count", () => {
+    const many = [user(2, "a"), user(3, "b"), user(4, "c"), user(5, "d"), user(6, "e")];
+    expect(dmDisplayName(makeDm({ isGroup: true, participants: many }))).toBe("a, b, c and 2 more");
+  });
+
+  it("falls back to the recipient when the participant list is empty", () => {
+    expect(dmDisplayName(makeDm({ participants: [] }))).toBe("bob");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// DmSidebar — group rendering
+// ---------------------------------------------------------------------------
+
+describe("DmSidebar — group rows", () => {
+  let container: HTMLDivElement;
+
+  beforeEach(() => {
+    container = document.createElement("div");
+    document.body.appendChild(container);
+  });
+
+  afterEach(() => {
+    container.remove();
+    document.querySelectorAll(".context-menu").forEach((el) => el.remove());
+  });
+
+  function mount(conversations: DmConversation[], opts: Record<string, unknown> = {}) {
+    const sidebar = createDmSidebar({
+      conversations,
+      onSelectConversation: vi.fn(),
+      onNewDm: vi.fn(),
+      ...opts,
+    });
+    sidebar.mount(container);
+    return sidebar;
+  }
+
+  it("draws stacked avatars for a group", () => {
+    const sidebar = mount([
+      convo({
+        channelId: 7,
+        isGroup: true,
+        participants: [
+          { id: 2, username: "bob", avatar: null },
+          { id: 3, username: "cat", avatar: null },
+        ],
+      }),
+    ]);
+
+    const stack = container.querySelector('[data-testid="dm-avatar-stack-7"]');
+    expect(stack).not.toBeNull();
+    expect(stack!.querySelectorAll(".dm-avatar-face")).toHaveLength(2);
+    // A group has no presence of its own, so no status dot is drawn.
+    expect(stack!.querySelector(".dm-status")).toBeNull();
+
+    sidebar.destroy?.();
+  });
+
+  it("shows only the first two faces for a larger group", () => {
+    const sidebar = mount([
+      convo({
+        channelId: 7,
+        isGroup: true,
+        participants: [
+          { id: 2, username: "a", avatar: null },
+          { id: 3, username: "b", avatar: null },
+          { id: 4, username: "c", avatar: null },
+        ],
+      }),
+    ]);
+
+    expect(
+      container
+        .querySelector('[data-testid="dm-avatar-stack-7"]')!
+        .querySelectorAll(".dm-avatar-face"),
+    ).toHaveLength(2);
+
+    sidebar.destroy?.();
+  });
+
+  it("renders the participant count including the current user", () => {
+    const sidebar = mount([
+      convo({
+        channelId: 7,
+        isGroup: true,
+        participants: [
+          { id: 2, username: "bob", avatar: null },
+          { id: 3, username: "cat", avatar: null },
+        ],
+      }),
+    ]);
+
+    expect(container.querySelector('[data-testid="dm-members-7"]')!.textContent).toBe("3");
+
+    sidebar.destroy?.();
+  });
+
+  it("keeps a single avatar with a status dot for a 1:1 DM", () => {
+    const sidebar = mount([convo({ channelId: 7 })]);
+    expect(container.querySelector('[data-testid="dm-avatar-stack-7"]')).toBeNull();
+    expect(container.querySelector(".dm-status")).not.toBeNull();
+    expect(container.querySelector('[data-testid="dm-members-7"]')).toBeNull();
+    sidebar.destroy?.();
+  });
+
+  it("selects by channel id, not by user id", () => {
+    const onSelectConversation = vi.fn();
+    const sidebar = mount([convo({ channelId: 77, userId: 2 })], { onSelectConversation });
+
+    (container.querySelector(".dm-item") as HTMLElement).click();
+    expect(onSelectConversation).toHaveBeenCalledWith(77);
+
+    sidebar.destroy?.();
+  });
+
+  it("labels the close affordance as Leave for a group", () => {
+    const sidebar = mount([convo({ channelId: 7, isGroup: true, participants: [] })]);
+    expect(container.querySelector(".dm-close")!.getAttribute("title")).toBe("Leave group");
+    sidebar.destroy?.();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// DmSidebar — mute rendering
+// ---------------------------------------------------------------------------
+
+describe("DmSidebar — muted rows", () => {
+  let container: HTMLDivElement;
+
+  beforeEach(() => {
+    container = document.createElement("div");
+    document.body.appendChild(container);
+  });
+
+  afterEach(() => {
+    container.remove();
+    document.querySelectorAll(".context-menu").forEach((el) => el.remove());
+  });
+
+  function mount(conversations: DmConversation[], opts: Record<string, unknown> = {}) {
+    const sidebar = createDmSidebar({
+      conversations,
+      onSelectConversation: vi.fn(),
+      onNewDm: vi.fn(),
+      ...opts,
+    });
+    sidebar.mount(container);
+    return sidebar;
+  }
+
+  it("dims the unread badge but keeps the count", () => {
+    const sidebar = mount([convo({ channelId: 7, muted: true, unread: true, unreadCount: 4 })]);
+    const badge = container.querySelector('[data-testid="dm-unread-7"]')!;
+    expect(badge.textContent).toBe("4");
+    expect(badge.classList.contains("muted")).toBe(true);
+    expect(container.querySelector(".dm-item")!.classList.contains("muted")).toBe(true);
+    sidebar.destroy?.();
+  });
+
+  // The load-bearing rule: a mute silences chatter, not things addressed to
+  // the reader, so the mention badge is never dimmed.
+  it("leaves the mention badge undimmed in a muted conversation", () => {
+    const sidebar = mount([
+      convo({ channelId: 7, muted: true, unread: true, unreadCount: 4, mentionCount: 2 }),
+    ]);
+    const badge = container.querySelector('[data-testid="dm-mentions-7"]')!;
+    expect(badge.textContent).toBe("2");
+    expect(badge.classList.contains("muted")).toBe(false);
+    sidebar.destroy?.();
+  });
+
+  it("offers Mute in the context menu and reports the channel id", () => {
+    const onToggleMute = vi.fn();
+    const sidebar = mount([convo({ channelId: 7 })], { onToggleMute });
+
+    const item = container.querySelector(".dm-item") as HTMLElement;
+    item.dispatchEvent(new MouseEvent("contextmenu", { bubbles: true, clientX: 5, clientY: 5 }));
+
+    const entry = document.querySelector('[data-testid="dm-mute-7"]') as HTMLElement;
+    expect(entry.textContent).toBe("Mute Conversation");
+    entry.click();
+    expect(onToggleMute).toHaveBeenCalledWith(7);
+
+    sidebar.destroy?.();
+  });
+
+  it("says Unmute when the conversation is already muted", () => {
+    const sidebar = mount([convo({ channelId: 7, muted: true })], { onToggleMute: vi.fn() });
+    (container.querySelector(".dm-item") as HTMLElement).dispatchEvent(
+      new MouseEvent("contextmenu", { bubbles: true, clientX: 5, clientY: 5 }),
+    );
+    expect(document.querySelector('[data-testid="dm-mute-7"]')!.textContent).toBe(
+      "Unmute Conversation",
+    );
+    sidebar.destroy?.();
+  });
+
+  it("offers Rename only for a group", () => {
+    const sidebar = mount([convo({ channelId: 7 })], {
+      onRenameGroup: vi.fn(),
+      onToggleMute: vi.fn(),
+    });
+    (container.querySelector(".dm-item") as HTMLElement).dispatchEvent(
+      new MouseEvent("contextmenu", { bubbles: true, clientX: 5, clientY: 5 }),
+    );
+    expect(document.querySelector('[data-testid="dm-rename-7"]')).toBeNull();
+    sidebar.destroy?.();
+  });
+
+  it("offers Rename and Leave Group for a group", () => {
+    const onRenameGroup = vi.fn();
+    const onCloseDm = vi.fn();
+    const sidebar = mount([convo({ channelId: 7, isGroup: true, participants: [] })], {
+      onRenameGroup,
+      onCloseDm,
+      onToggleMute: vi.fn(),
+    });
+    (container.querySelector(".dm-item") as HTMLElement).dispatchEvent(
+      new MouseEvent("contextmenu", { bubbles: true, clientX: 5, clientY: 5 }),
+    );
+
+    (document.querySelector('[data-testid="dm-rename-7"]') as HTMLElement).click();
+    expect(onRenameGroup).toHaveBeenCalledWith(7);
+
+    (container.querySelector(".dm-item") as HTMLElement).dispatchEvent(
+      new MouseEvent("contextmenu", { bubbles: true, clientX: 5, clientY: 5 }),
+    );
+    const leave = document.querySelector('[data-testid="dm-close-7"]') as HTMLElement;
+    expect(leave.textContent).toBe("Leave Group");
+    leave.click();
+    expect(onCloseDm).toHaveBeenCalledWith(7);
+
+    sidebar.destroy?.();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// IncomingCallBanner
+// ---------------------------------------------------------------------------
+
+describe("IncomingCallBanner", () => {
+  let container: HTMLDivElement;
+
+  beforeEach(() => {
+    container = document.createElement("div");
+    document.body.appendChild(container);
+  });
+
+  afterEach(() => {
+    container.remove();
+  });
+
+  it("stays hidden until a ring arrives", () => {
+    const banner = createIncomingCallBanner({ onAccept: vi.fn(), onDecline: vi.fn() });
+    banner.mount(container);
+    const el = container.querySelector('[data-testid="incoming-call-banner"]') as HTMLElement;
+    expect(el.style.display).toBe("none");
+    banner.destroy?.();
+  });
+
+  it("shows the caller's name when ringing", () => {
+    const banner = createIncomingCallBanner({ onAccept: vi.fn(), onDecline: vi.fn() });
+    banner.mount(container);
+    banner.setRing({ channelId: 3, fromUserId: 9, fromUsername: "alice" });
+
+    const el = container.querySelector('[data-testid="incoming-call-banner"]') as HTMLElement;
+    expect(el.style.display).toBe("");
+    expect(container.querySelector('[data-testid="incoming-call-title"]')!.textContent).toBe(
+      "alice is calling",
+    );
+    banner.destroy?.();
+  });
+
+  // The username is user-controlled; it must land as text, never as markup.
+  it("renders a hostile username as text", () => {
+    const banner = createIncomingCallBanner({ onAccept: vi.fn(), onDecline: vi.fn() });
+    banner.mount(container);
+    banner.setRing({
+      channelId: 3,
+      fromUserId: 9,
+      fromUsername: "<img src=x onerror=alert(1)>",
+    });
+
+    const title = container.querySelector('[data-testid="incoming-call-title"]')!;
+    expect(title.querySelector("img")).toBeNull();
+    expect(title.textContent).toContain("<img src=x onerror=alert(1)>");
+    banner.destroy?.();
+  });
+
+  it("hides again when the ring clears", () => {
+    const banner = createIncomingCallBanner({ onAccept: vi.fn(), onDecline: vi.fn() });
+    banner.mount(container);
+    banner.setRing({ channelId: 3, fromUserId: 9, fromUsername: "alice" });
+    banner.setRing(null);
+
+    const el = container.querySelector('[data-testid="incoming-call-banner"]') as HTMLElement;
+    expect(el.style.display).toBe("none");
+    banner.destroy?.();
+  });
+
+  it("reports accept and decline", () => {
+    const onAccept = vi.fn();
+    const onDecline = vi.fn();
+    const banner = createIncomingCallBanner({ onAccept, onDecline });
+    banner.mount(container);
+    banner.setRing({ channelId: 3, fromUserId: 9, fromUsername: "alice" });
+
+    (container.querySelector('[data-testid="incoming-call-accept"]') as HTMLElement).click();
+    expect(onAccept).toHaveBeenCalledOnce();
+    (container.querySelector('[data-testid="incoming-call-decline"]') as HTMLElement).click();
+    expect(onDecline).toHaveBeenCalledOnce();
+
+    banner.destroy?.();
+  });
+});
diff --git a/Client/tauri-client/tests/unit/dm-sidebar.test.ts b/Client/tauri-client/tests/unit/dm-sidebar.test.ts
index fc4ffb2b..70f9c246 100644
--- a/Client/tauri-client/tests/unit/dm-sidebar.test.ts
+++ b/Client/tauri-client/tests/unit/dm-sidebar.test.ts
@@ -3,6 +3,7 @@ import { createDmSidebar } from "../../src/components/DmSidebar";
 import type { DmConversation } from "../../src/components/DmSidebar";
 
 const makeConvo = (overrides: Partial<DmConversation> = {}): DmConversation => ({
+  channelId: 100,
   userId: 1,
   username: "Alice",
   avatar: null,
@@ -40,7 +41,10 @@ describe("DmSidebar", () => {
     sidebar.destroy?.();
   });
 
-  it("renders Friends nav item", () => {
+  // The Friends nav item was removed in phase 6: it was a dead entry whose
+  // callback was never wired, and the plan's stated option was to delete it
+  // rather than build a friends list. This pins the deletion.
+  it("does not render a Friends nav item", () => {
     const sidebar = createDmSidebar({
       conversations: [],
       onSelectConversation: vi.fn(),
@@ -48,24 +52,8 @@ describe("DmSidebar", () => {
     });
     sidebar.mount(container);
 
-    const friendsNav = container.querySelector(".dm-nav-item");
-    expect(friendsNav).not.toBeNull();
-    expect(friendsNav!.textContent).toBe("Friends");
-
-    sidebar.destroy?.();
-  });
-
-  it("marks Friends nav as active when friendsActive is true", () => {
-    const sidebar = createDmSidebar({
-      conversations: [],
-      onSelectConversation: vi.fn(),
-      onNewDm: vi.fn(),
-      friendsActive: true,
-    });
-    sidebar.mount(container);
-
-    const friendsNav = container.querySelector(".dm-nav-item");
-    expect(friendsNav!.classList.contains("active")).toBe(true);
+    expect(container.querySelector(".dm-nav-item")).toBeNull();
+    expect(container.textContent).not.toContain("Friends");
 
     sidebar.destroy?.();
   });
@@ -127,7 +115,7 @@ describe("DmSidebar", () => {
   it("calls onSelectConversation when a DM item is clicked", () => {
     const onSelectConversation = vi.fn();
     const sidebar = createDmSidebar({
-      conversations: [makeConvo({ userId: 42 })],
+      conversations: [makeConvo({ channelId: 42, userId: 42 })],
       onSelectConversation,
       onNewDm: vi.fn(),
     });
@@ -143,7 +131,7 @@ describe("DmSidebar", () => {
   it("calls onCloseDm when close button is clicked", () => {
     const onCloseDm = vi.fn();
     const sidebar = createDmSidebar({
-      conversations: [makeConvo({ userId: 42 })],
+      conversations: [makeConvo({ channelId: 42, userId: 42 })],
       onSelectConversation: vi.fn(),
       onNewDm: vi.fn(),
       onCloseDm,
@@ -280,23 +268,6 @@ describe("DmSidebar", () => {
     sidebar.destroy?.();
   });
 
-  it("calls onFriendsClick when Friends nav item is clicked", () => {
-    const onFriendsClick = vi.fn();
-    const sidebar = createDmSidebar({
-      conversations: [],
-      onSelectConversation: vi.fn(),
-      onNewDm: vi.fn(),
-      onFriendsClick,
-    });
-    sidebar.mount(container);
-
-    const friendsNav = container.querySelector(".dm-nav-item") as HTMLDivElement;
-    friendsNav.click();
-    expect(onFriendsClick).toHaveBeenCalledOnce();
-
-    sidebar.destroy?.();
-  });
-
   it("applies correct status color to DM status dot", () => {
     const sidebar = createDmSidebar({
       conversations: [
@@ -325,7 +296,7 @@ describe("DmSidebar", () => {
     const onSelectConversation = vi.fn();
     const onCloseDm = vi.fn();
     const sidebar = createDmSidebar({
-      conversations: [makeConvo({ userId: 42 })],
+      conversations: [makeConvo({ channelId: 42, userId: 42 })],
       onSelectConversation,
       onNewDm: vi.fn(),
       onCloseDm,
@@ -438,3 +409,71 @@ describe("DmSidebar", () => {
     sidebar.destroy?.();
   });
 });
+
+// ── Unread / mention badges ────────────────────────────────────────────────
+//
+// A DM used to show only a dot, which said "something happened" but not how
+// much — and never distinguished a mention from ordinary traffic.
+
+describe("DmSidebar — unread and mention badges", () => {
+  let container: HTMLDivElement;
+
+  beforeEach(() => {
+    container = document.createElement("div");
+    document.body.appendChild(container);
+  });
+
+  afterEach(() => {
+    container.remove();
+  });
+
+  function mountWith(convo: DmConversation): void {
+    const sidebar = createDmSidebar({
+      conversations: [convo],
+      onSelectConversation: vi.fn(),
+      onNewDm: vi.fn(),
+    });
+    sidebar.mount(container);
+  }
+
+  it("renders the unread count, not a bare dot", () => {
+    mountWith(makeConvo({ channelId: 7, userId: 7, unread: true, unreadCount: 4 }));
+
+    const badge = container.querySelector('[data-testid="dm-unread-7"]');
+    expect(badge?.textContent).toBe("4");
+    expect(container.querySelector(".dm-unread")).toBeNull();
+  });
+
+  it("renders a mention badge instead of the unread badge", () => {
+    mountWith(
+      makeConvo({ channelId: 7, userId: 7, unread: true, unreadCount: 5, mentionCount: 2 }),
+    );
+
+    expect(container.querySelector('[data-testid="dm-mentions-7"]')?.textContent).toBe("2");
+    expect(container.querySelector('[data-testid="dm-unread-7"]')).toBeNull();
+  });
+
+  it("pluralises the badge tooltips", () => {
+    mountWith(makeConvo({ channelId: 7, userId: 7, unread: true, unreadCount: 1 }));
+    expect((container.querySelector('[data-testid="dm-unread-7"]') as HTMLElement).title).toBe(
+      "1 unread message",
+    );
+  });
+
+  it("falls back to the dot when the payload carries no counts", () => {
+    mountWith(makeConvo({ channelId: 7, userId: 7, unread: true }));
+
+    expect(container.querySelector(".dm-unread")).not.toBeNull();
+    expect(container.querySelector('[data-testid="dm-unread-7"]')).toBeNull();
+  });
+
+  it("renders no badge and no dot for a read conversation", () => {
+    mountWith(
+      makeConvo({ channelId: 7, userId: 7, unread: false, unreadCount: 0, mentionCount: 0 }),
+    );
+
+    expect(container.querySelector(".dm-unread")).toBeNull();
+    expect(container.querySelector('[data-testid="dm-unread-7"]')).toBeNull();
+    expect(container.querySelector('[data-testid="dm-mentions-7"]')).toBeNull();
+  });
+});
diff --git a/Client/tauri-client/tests/unit/dm-store.test.ts b/Client/tauri-client/tests/unit/dm-store.test.ts
index 88160427..735362cf 100644
--- a/Client/tauri-client/tests/unit/dm-store.test.ts
+++ b/Client/tauri-client/tests/unit/dm-store.test.ts
@@ -14,10 +14,14 @@ function makeDm(overrides: Partial<DmChannel> = {}): DmChannel {
   return {
     channelId: 100,
     recipient: { id: 1, username: "alice", avatar: "", status: "online" },
+    participants: [{ id: 1, username: "alice", avatar: "", status: "online" }],
+    name: "",
+    isGroup: false,
     lastMessageId: null,
     lastMessage: "",
     lastMessageAt: "",
     unreadCount: 0,
+    mentionCount: 0,
     ...overrides,
   };
 }
diff --git a/Client/tauri-client/tests/unit/drag-reorder.test.ts b/Client/tauri-client/tests/unit/drag-reorder.test.ts
index 558d6939..1779f0cb 100644
--- a/Client/tauri-client/tests/unit/drag-reorder.test.ts
+++ b/Client/tauri-client/tests/unit/drag-reorder.test.ts
@@ -45,9 +45,14 @@ function makeCh(id: number, position: number, name = `ch-${id}`): Channel {
     category: null,
     position,
     unreadCount: 0,
+    mentionCount: 0,
     lastMessageId: null,
     canSend: true,
+    topic: "",
     slowMode: 0,
+    nsfw: false,
+    voiceMaxUsers: 0,
+    voiceMaxVideo: 0,
   };
 }
 
diff --git a/Client/tauri-client/tests/unit/edit-channel-modal.test.ts b/Client/tauri-client/tests/unit/edit-channel-modal.test.ts
index 4b201c5f..f11dde7f 100644
--- a/Client/tauri-client/tests/unit/edit-channel-modal.test.ts
+++ b/Client/tauri-client/tests/unit/edit-channel-modal.test.ts
@@ -1,6 +1,13 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import { createEditChannelModal } from "@components/EditChannelModal";
-import type { EditChannelModalOptions } from "@components/EditChannelModal";
+import {
+  createEditChannelModal,
+  clampVoiceLimit,
+  formatSlowMode,
+  MAX_SLOW_MODE_SECONDS,
+  MAX_VOICE_LIMIT,
+} from "@components/EditChannelModal";
+import type { EditChannelModalOptions, EditChannelData } from "@components/EditChannelModal";
+import { setChannels } from "@stores/channels.store";
 
 describe("EditChannelModal", () => {
   let container: HTMLDivElement;
@@ -20,8 +27,15 @@ describe("EditChannelModal", () => {
       channelId: 1,
       channelName: "general",
       channelType: "text",
+      channelTopic: overrides?.channelTopic,
+      channelCategory: overrides?.channelCategory,
+      channelSlowMode: overrides?.channelSlowMode,
+      channelNsfw: overrides?.channelNsfw,
+      channelVoiceMaxUsers: overrides?.channelVoiceMaxUsers,
+      channelVoiceMaxVideo: overrides?.channelVoiceMaxVideo,
       onSave: overrides?.onSave ?? vi.fn(async () => {}),
       onClose: overrides?.onClose ?? vi.fn(),
+      ...(overrides?.channelType !== undefined ? { channelType: overrides.channelType } : {}),
     };
     const modal = createEditChannelModal(options);
     modal.mount(container);
@@ -83,7 +97,98 @@ describe("EditChannelModal", () => {
     saveBtn.click();
 
     await vi.waitFor(() => {
-      expect(onSave).toHaveBeenCalledWith({ name: "renamed-channel" });
+      expect(onSave).toHaveBeenCalledWith({
+        name: "renamed-channel",
+        topic: "",
+        category: "",
+        slow_mode: 0,
+        nsfw: false,
+      });
+    });
+    modal.destroy?.();
+  });
+
+  it("pre-fills the topic input and includes the edited topic in onSave", async () => {
+    const onSave = vi.fn(async () => {});
+    const { modal } = makeModal({ onSave, channelTopic: "old topic" });
+    const topicInput = container.querySelector(
+      "[data-testid='edit-channel-topic-input']",
+    ) as HTMLInputElement;
+    expect(topicInput.value).toBe("old topic");
+    topicInput.value = "  new topic  ";
+
+    const saveBtn = container.querySelector(
+      "[data-testid='edit-channel-submit']",
+    ) as HTMLButtonElement;
+    saveBtn.click();
+
+    await vi.waitFor(() => {
+      expect(onSave).toHaveBeenCalledWith({
+        name: "general",
+        topic: "new topic",
+        category: "",
+        slow_mode: 0,
+        nsfw: false,
+      });
+    });
+    modal.destroy?.();
+  });
+
+  it("pre-fills the category input and includes the edited category in onSave", async () => {
+    const onSave = vi.fn(async () => {});
+    const { modal } = makeModal({ onSave, channelCategory: "Chat" });
+    const categoryInput = container.querySelector(
+      "[data-testid='edit-channel-category-input']",
+    ) as HTMLInputElement;
+    expect(categoryInput.value).toBe("Chat");
+    categoryInput.value = "  Gaming  ";
+
+    (container.querySelector("[data-testid='edit-channel-submit']") as HTMLButtonElement).click();
+
+    await vi.waitFor(() => {
+      expect(onSave).toHaveBeenCalledWith({
+        name: "general",
+        topic: "",
+        category: "Gaming",
+        slow_mode: 0,
+        nsfw: false,
+      });
+    });
+    modal.destroy?.();
+  });
+
+  it("suggests the categories already in use via a datalist", () => {
+    setChannels([
+      { id: 1, name: "general", type: "text", category: "Chat", position: 0 },
+      { id: 2, name: "lounge", type: "voice", category: "Gaming", position: 1 },
+    ]);
+    const { modal } = makeModal({ channelCategory: "Chat" });
+    const values = Array.from(
+      container.querySelector("#edit-channel-categories")?.querySelectorAll("option") ?? [],
+    ).map((o) => o.getAttribute("value"));
+    expect(values).toEqual(["Chat", "Gaming"]);
+    modal.destroy?.();
+  });
+
+  // Blanking the category is how a channel becomes uncategorized — an empty
+  // string must reach onSave rather than being dropped as "unchanged".
+  it("submits an emptied category", async () => {
+    const onSave = vi.fn(async () => {});
+    const { modal } = makeModal({ onSave, channelCategory: "Chat" });
+    (
+      container.querySelector("[data-testid='edit-channel-category-input']") as HTMLInputElement
+    ).value = "";
+
+    (container.querySelector("[data-testid='edit-channel-submit']") as HTMLButtonElement).click();
+
+    await vi.waitFor(() => {
+      expect(onSave).toHaveBeenCalledWith({
+        name: "general",
+        topic: "",
+        category: "",
+        slow_mode: 0,
+        nsfw: false,
+      });
     });
     modal.destroy?.();
   });
@@ -218,4 +323,264 @@ describe("EditChannelModal", () => {
     expect(input.classList.contains("error")).toBe(true);
     modal.destroy?.();
   });
+  // ─── Slow mode ─────────────────────────────────────────────────────────────
+
+  describe("slow mode", () => {
+    function slowSelect(): HTMLSelectElement {
+      return container.querySelector(
+        "[data-testid='edit-channel-slowmode-select']",
+      ) as HTMLSelectElement;
+    }
+
+    it("offers friendly presets from Off to the server's 6-hour ceiling", () => {
+      const { modal } = makeModal();
+      const options = Array.from(slowSelect().options);
+      expect(options[0]?.textContent).toBe("Off");
+      expect(options[0]?.value).toBe("0");
+      expect(options.at(-1)?.value).toBe(String(MAX_SLOW_MODE_SECONDS));
+      // Nothing may exceed what the server accepts, or saving 400s.
+      for (const opt of options) {
+        expect(Number(opt.value)).toBeLessThanOrEqual(MAX_SLOW_MODE_SECONDS);
+        expect(Number(opt.value)).toBeGreaterThanOrEqual(0);
+      }
+      modal.destroy?.();
+    });
+
+    it("pre-selects the channel's stored cooldown", () => {
+      const { modal } = makeModal({ channelSlowMode: 300 });
+      expect(slowSelect().value).toBe("300");
+      modal.destroy?.();
+    });
+
+    it("keeps an off-preset stored value as its own selected option", () => {
+      // The admin panel offers a free number field, so a channel can legally
+      // carry a value the presets do not name. Rounding it to a neighbour
+      // would change the channel just by opening the modal.
+      const { modal } = makeModal({ channelSlowMode: 47 });
+      expect(slowSelect().value).toBe("47");
+      expect(Array.from(slowSelect().options).some((o) => o.value === "47")).toBe(true);
+      modal.destroy?.();
+    });
+
+    it("sends the selected cooldown to onSave", async () => {
+      const onSave = vi.fn(async () => {});
+      const { modal } = makeModal({ onSave, channelSlowMode: 0 });
+      slowSelect().value = "600";
+
+      (container.querySelector("[data-testid='edit-channel-submit']") as HTMLButtonElement).click();
+
+      await vi.waitFor(() => {
+        expect(onSave).toHaveBeenCalledWith(expect.objectContaining({ slow_mode: 600 }));
+      });
+      modal.destroy?.();
+    });
+
+    it("clamps a stored value above the ceiling onto a legal option", () => {
+      const { modal } = makeModal({ channelSlowMode: 99999 });
+      expect(Number(slowSelect().value)).toBe(MAX_SLOW_MODE_SECONDS);
+      modal.destroy?.();
+    });
+  });
+
+  // ─── NSFW flag ─────────────────────────────────────────────────────────────
+
+  describe("NSFW flag", () => {
+    function nsfwBox(): HTMLInputElement {
+      return container.querySelector(
+        "[data-testid='edit-channel-nsfw-checkbox']",
+      ) as HTMLInputElement;
+    }
+
+    it("is unchecked for an unflagged channel", () => {
+      const { modal } = makeModal();
+      expect(nsfwBox().checked).toBe(false);
+      modal.destroy?.();
+    });
+
+    it("pre-fills from the channel's stored flag", () => {
+      const { modal } = makeModal({ channelNsfw: true });
+      expect(nsfwBox().checked).toBe(true);
+      modal.destroy?.();
+    });
+
+    it("sends the flag to onSave when set", async () => {
+      const onSave = vi.fn(async () => {});
+      const { modal } = makeModal({ onSave });
+      nsfwBox().checked = true;
+
+      (container.querySelector("[data-testid='edit-channel-submit']") as HTMLButtonElement).click();
+
+      await vi.waitFor(() => {
+        expect(onSave).toHaveBeenCalledWith(expect.objectContaining({ nsfw: true }));
+      });
+      modal.destroy?.();
+    });
+
+    // Clearing the flag must be as expressible as setting it: the PATCH keeps
+    // any field the body omits, so `false` has to be sent explicitly.
+    it("sends false when a flagged channel is unflagged", async () => {
+      const onSave = vi.fn(async () => {});
+      const { modal } = makeModal({ onSave, channelNsfw: true });
+      nsfwBox().checked = false;
+
+      (container.querySelector("[data-testid='edit-channel-submit']") as HTMLButtonElement).click();
+
+      await vi.waitFor(() => {
+        expect(onSave).toHaveBeenCalledWith(expect.objectContaining({ nsfw: false }));
+      });
+      modal.destroy?.();
+    });
+  });
+
+  // ─── Voice limits ──────────────────────────────────────────────────────────
+
+  describe("voice limits", () => {
+    it("are absent for a text channel", () => {
+      const { modal } = makeModal();
+      expect(container.querySelector("[data-testid='edit-channel-voice-section']")).toBeNull();
+      expect(container.querySelector("[data-testid='edit-channel-max-users-input']")).toBeNull();
+      modal.destroy?.();
+    });
+
+    it("are shown for a voice channel", () => {
+      const { modal } = makeModal({ channelType: "voice" });
+      expect(container.querySelector("[data-testid='edit-channel-voice-section']")).not.toBeNull();
+      modal.destroy?.();
+    });
+
+    it("pre-fill from the channel's stored limits", () => {
+      const { modal } = makeModal({
+        channelType: "voice",
+        channelVoiceMaxUsers: 8,
+        channelVoiceMaxVideo: 3,
+      });
+      expect(
+        (
+          container.querySelector(
+            "[data-testid='edit-channel-max-users-input']",
+          ) as HTMLInputElement
+        ).value,
+      ).toBe("8");
+      expect(
+        (
+          container.querySelector(
+            "[data-testid='edit-channel-max-video-input']",
+          ) as HTMLInputElement
+        ).value,
+      ).toBe("3");
+      modal.destroy?.();
+    });
+
+    it("round-trip through onSave", async () => {
+      const onSave = vi.fn(async () => {});
+      const { modal } = makeModal({
+        onSave,
+        channelType: "voice",
+        channelVoiceMaxUsers: 0,
+        channelVoiceMaxVideo: 0,
+      });
+      (
+        container.querySelector("[data-testid='edit-channel-max-users-input']") as HTMLInputElement
+      ).value = "12";
+      (
+        container.querySelector("[data-testid='edit-channel-max-video-input']") as HTMLInputElement
+      ).value = "4";
+
+      (container.querySelector("[data-testid='edit-channel-submit']") as HTMLButtonElement).click();
+
+      await vi.waitFor(() => {
+        expect(onSave).toHaveBeenCalledWith(
+          expect.objectContaining({ voice_max_users: 12, voice_max_video: 4 }),
+        );
+      });
+      modal.destroy?.();
+    });
+
+    // A text channel's PATCH must not carry the keys at all — sending 0 would
+    // wipe limits the row happens to hold, since the server keeps only what the
+    // body omits.
+    it("are omitted from a text channel's payload rather than sent as 0", async () => {
+      let payload: Record<string, unknown> | null = null;
+      const onSave = vi.fn(async (data: EditChannelData) => {
+        payload = data as unknown as Record<string, unknown>;
+      });
+      const { modal } = makeModal({ onSave });
+
+      (container.querySelector("[data-testid='edit-channel-submit']") as HTMLButtonElement).click();
+
+      await vi.waitFor(() => {
+        expect(payload).not.toBeNull();
+      });
+      expect("voice_max_users" in payload!).toBe(false);
+      expect("voice_max_video" in payload!).toBe(false);
+      modal.destroy?.();
+    });
+
+    // The max attribute is advisory — paste and keyboard both get past it — so
+    // the value is clamped before it reaches the API, which would 400.
+    it("clamp a typed value above the server's ceiling", async () => {
+      const onSave = vi.fn(async () => {});
+      const { modal } = makeModal({ onSave, channelType: "voice" });
+      (
+        container.querySelector("[data-testid='edit-channel-max-users-input']") as HTMLInputElement
+      ).value = "5000";
+
+      (container.querySelector("[data-testid='edit-channel-submit']") as HTMLButtonElement).click();
+
+      await vi.waitFor(() => {
+        expect(onSave).toHaveBeenCalledWith(
+          expect.objectContaining({ voice_max_users: MAX_VOICE_LIMIT }),
+        );
+      });
+      modal.destroy?.();
+    });
+
+    it("treat an emptied field as unlimited rather than NaN", async () => {
+      const onSave = vi.fn(async () => {});
+      const { modal } = makeModal({ onSave, channelType: "voice", channelVoiceMaxUsers: 5 });
+      (
+        container.querySelector("[data-testid='edit-channel-max-users-input']") as HTMLInputElement
+      ).value = "";
+
+      (container.querySelector("[data-testid='edit-channel-submit']") as HTMLButtonElement).click();
+
+      await vi.waitFor(() => {
+        expect(onSave).toHaveBeenCalledWith(expect.objectContaining({ voice_max_users: 0 }));
+      });
+      modal.destroy?.();
+    });
+  });
+
+  // ─── Pure helpers ──────────────────────────────────────────────────────────
+
+  describe("clampVoiceLimit", () => {
+    it("keeps a legal value", () => {
+      expect(clampVoiceLimit(7)).toBe(7);
+    });
+    it("floors negatives to 0", () => {
+      expect(clampVoiceLimit(-3)).toBe(0);
+    });
+    it("caps at the server's ceiling", () => {
+      expect(clampVoiceLimit(1000)).toBe(MAX_VOICE_LIMIT);
+    });
+    it("treats NaN as unlimited", () => {
+      expect(clampVoiceLimit(Number.NaN)).toBe(0);
+    });
+    it("truncates a fractional value", () => {
+      expect(clampVoiceLimit(4.9)).toBe(4);
+    });
+  });
+
+  describe("formatSlowMode", () => {
+    it("names a preset", () => {
+      expect(formatSlowMode(0)).toBe("Off");
+      expect(formatSlowMode(3600)).toBe("1 hour");
+    });
+    it("describes an off-preset whole-minute value", () => {
+      expect(formatSlowMode(180)).toBe("3 minutes");
+    });
+    it("falls back to seconds", () => {
+      expect(formatSlowMode(47)).toBe("47 seconds");
+    });
+  });
 });
diff --git a/Client/tauri-client/tests/unit/emoji-autocomplete.test.ts b/Client/tauri-client/tests/unit/emoji-autocomplete.test.ts
new file mode 100644
index 00000000..f35e27a1
--- /dev/null
+++ b/Client/tauri-client/tests/unit/emoji-autocomplete.test.ts
@@ -0,0 +1,386 @@
+/**
+ * EmojiAutocomplete — filtering across the custom and unicode sources, the
+ * minimum-query rule, keyboard navigation, and composer integration (including
+ * how it shares the composer with the @-mention popup).
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+
+vi.mock("@lib/livekitSession", () => ({
+  leaveVoice: vi.fn(),
+  switchInputDevice: vi.fn(),
+  switchOutputDevice: vi.fn(),
+  setVoiceSensitivity: vi.fn(),
+  setInputVolume: vi.fn(),
+  setOutputVolume: vi.fn(),
+  getSessionDebugInfo: vi.fn().mockReturnValue({}),
+}));
+
+const { fetchImageAsDataUrlMock } = vi.hoisted(() => ({
+  fetchImageAsDataUrlMock: vi.fn(() => Promise.resolve("data:image/png;base64,AAAA")),
+}));
+vi.mock("../../src/components/message-list/attachments", async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import("../../src/components/message-list/attachments")>();
+  return { ...actual, fetchImageAsDataUrl: fetchImageAsDataUrlMock };
+});
+
+import {
+  createEmojiAutocomplete,
+  filterEmojiSuggestions,
+  MAX_EMOJI_SUGGESTIONS,
+  MIN_EMOJI_QUERY,
+} from "../../src/components/EmojiAutocomplete";
+import { createMessageInput } from "../../src/components/MessageInput";
+import { emojiStore, setCustomEmoji, clearCustomEmoji } from "../../src/stores/emoji.store";
+import { membersStore } from "../../src/stores/members.store";
+
+const EMOJI = [
+  { id: 1, shortcode: "wave", url: "/api/v1/emoji/1/image" },
+  { id: 2, shortcode: "waffle", url: "/api/v1/emoji/2/image" },
+  { id: 3, shortcode: "blob_wave", url: "/api/v1/emoji/3/image" },
+];
+
+beforeEach(() => {
+  clearCustomEmoji();
+  emojiStore.flush();
+  setCustomEmoji(EMOJI);
+  emojiStore.flush();
+  membersStore.setState(() => ({ members: new Map(), typingUsers: new Map() }));
+});
+
+// ---------------------------------------------------------------------------
+// Filtering
+// ---------------------------------------------------------------------------
+
+describe("filterEmojiSuggestions", () => {
+  it("returns nothing below the minimum query length", () => {
+    expect(filterEmojiSuggestions("")).toEqual([]);
+    expect(filterEmojiSuggestions("w")).toEqual([]);
+    expect(MIN_EMOJI_QUERY).toBe(2);
+  });
+
+  it("offers custom emoji before unicode ones", () => {
+    const out = filterEmojiSuggestions("wa");
+    expect(out.length).toBeGreaterThan(0);
+    const firstUnicode = out.findIndex((s) => s.kind === "unicode");
+    const lastCustom = out.map((s) => s.kind).lastIndexOf("custom");
+    expect(lastCustom).toBeGreaterThanOrEqual(0);
+    if (firstUnicode !== -1) expect(lastCustom).toBeLessThan(firstUnicode);
+  });
+
+  it("ranks a shortcode prefix above a shortcode substring", () => {
+    const labels = filterEmojiSuggestions("wa")
+      .filter((s) => s.kind === "custom")
+      .map((s) => s.label);
+    // waffle and wave start with "wa"; blob_wave only contains it.
+    expect(labels.indexOf("blob_wave")).toBeGreaterThan(labels.indexOf("wave"));
+    expect(labels.indexOf("blob_wave")).toBeGreaterThan(labels.indexOf("waffle"));
+  });
+
+  it("inserts :shortcode: for a custom emoji and the character for a unicode one", () => {
+    const custom = filterEmojiSuggestions("wave").find((s) => s.kind === "custom");
+    expect(custom?.label).toBe("wave");
+    expect(custom?.insert).toBe(":wave:");
+    expect(custom?.char).toBeNull();
+    expect(custom?.emoji?.id).toBe(1);
+
+    const fire = filterEmojiSuggestions("fire").find((s) => s.kind === "unicode");
+    expect(fire?.insert).toBe("🔥");
+    expect(fire?.emoji).toBeNull();
+  });
+
+  it("searches the unicode keyword list, not just primary names", () => {
+    const out = filterEmojiSuggestions("flame");
+    expect(out.some((s) => s.insert === "🔥")).toBe(true);
+  });
+
+  it("is case-insensitive", () => {
+    expect(filterEmojiSuggestions("WAVE").some((s) => s.insert === ":wave:")).toBe(true);
+  });
+
+  it("caps the number of rows", () => {
+    // "a" appears in most keyword strings; the two-character "ar" still matches
+    // far more than the cap.
+    expect(filterEmojiSuggestions("ar").length).toBeLessThanOrEqual(MAX_EMOJI_SUGGESTIONS);
+  });
+
+  it("returns nothing for a query nothing matches", () => {
+    expect(filterEmojiSuggestions("zzzzqqq")).toEqual([]);
+  });
+
+  it("offers no custom emoji when the server has none", () => {
+    clearCustomEmoji();
+    emojiStore.flush();
+    expect(filterEmojiSuggestions("wave").every((s) => s.kind === "unicode")).toBe(true);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Component
+// ---------------------------------------------------------------------------
+
+describe("createEmojiAutocomplete", () => {
+  let container: HTMLDivElement;
+
+  beforeEach(() => {
+    container = document.createElement("div");
+    document.body.appendChild(container);
+  });
+
+  afterEach(() => {
+    container.remove();
+  });
+
+  function mount(onSelect = vi.fn(), onClose = vi.fn()) {
+    const ac = createEmojiAutocomplete({ onSelect, onClose });
+    container.appendChild(ac.element);
+    return { ac, onSelect, onClose };
+  }
+
+  it("renders one row per suggestion with a preview", () => {
+    const { ac } = mount();
+    expect(ac.setQuery("wave")).toBe(true);
+    const rows = ac.element.querySelectorAll(".ma-item");
+    expect(rows.length).toBeGreaterThan(0);
+    expect(rows[0]?.querySelector(".ea-preview")).not.toBeNull();
+    expect(rows[0]?.querySelector(".ea-preview img.custom-emoji")).not.toBeNull();
+    expect(rows[0]?.querySelector(".ma-name")?.textContent).toBe(":wave:");
+    expect(rows[0]?.querySelector(".ma-detail")?.textContent).toBe("Server emoji");
+    ac.destroy();
+  });
+
+  it("shows the character itself as the preview for unicode rows", () => {
+    const { ac } = mount();
+    ac.setQuery("flame");
+    const row = [...ac.element.querySelectorAll(".ma-item")].find(
+      (r) => r.querySelector(".ea-preview")?.textContent === "🔥",
+    );
+    expect(row).toBeDefined();
+    ac.destroy();
+  });
+
+  it("setQuery returns false and renders nothing when nothing matches", () => {
+    const { ac } = mount();
+    expect(ac.setQuery("zzzzqqq")).toBe(false);
+    expect(ac.element.querySelectorAll(".ma-item").length).toBe(0);
+    ac.destroy();
+  });
+
+  it("selects the active row on Enter", () => {
+    const { ac, onSelect } = mount();
+    ac.setQuery("wave");
+    const ev = new KeyboardEvent("keydown", { key: "Enter", cancelable: true });
+    expect(ac.handleKeydown(ev)).toBe(true);
+    expect(onSelect).toHaveBeenCalledWith(":wave:");
+    ac.destroy();
+  });
+
+  it("moves the active row with the arrow keys", () => {
+    const { ac, onSelect } = mount();
+    ac.setQuery("wa");
+    // Custom rows sort alphabetically, so ":waffle:" leads and ":wave:" follows.
+    ac.handleKeydown(new KeyboardEvent("keydown", { key: "ArrowDown", cancelable: true }));
+    ac.handleKeydown(new KeyboardEvent("keydown", { key: "Enter", cancelable: true }));
+    expect(onSelect).toHaveBeenCalledTimes(1);
+    expect(onSelect).toHaveBeenCalledWith(":wave:");
+    ac.destroy();
+  });
+
+  it("wraps around at the ends", () => {
+    const { ac, onSelect } = mount();
+    ac.setQuery("wa");
+    const count = ac.element.querySelectorAll(".ma-item").length;
+    // A full lap of ArrowDown lands back on the first row.
+    for (let i = 0; i < count; i++) {
+      ac.handleKeydown(new KeyboardEvent("keydown", { key: "ArrowDown", cancelable: true }));
+    }
+    ac.handleKeydown(new KeyboardEvent("keydown", { key: "Enter", cancelable: true }));
+    expect(onSelect).toHaveBeenCalledWith(":waffle:");
+    ac.destroy();
+  });
+
+  it("ArrowUp from the first row wraps to the last", () => {
+    const { ac, onSelect } = mount();
+    ac.setQuery("wa");
+    const labels = [...ac.element.querySelectorAll(".ma-item .ma-name")].map((n) => n.textContent);
+    ac.handleKeydown(new KeyboardEvent("keydown", { key: "ArrowUp", cancelable: true }));
+    ac.handleKeydown(new KeyboardEvent("keydown", { key: "Enter", cancelable: true }));
+    const last = labels[labels.length - 1];
+    expect(onSelect).toHaveBeenCalledTimes(1);
+    // Custom rows render as ":name:", which is also what they insert.
+    if (last?.startsWith(":")) expect(onSelect).toHaveBeenCalledWith(last);
+    ac.destroy();
+  });
+
+  it("closes on Escape", () => {
+    const { ac, onClose } = mount();
+    ac.setQuery("wave");
+    expect(
+      ac.handleKeydown(new KeyboardEvent("keydown", { key: "Escape", cancelable: true })),
+    ).toBe(true);
+    expect(onClose).toHaveBeenCalledOnce();
+    ac.destroy();
+  });
+
+  it("consumes no keys while empty", () => {
+    const { ac } = mount();
+    ac.setQuery("zzzzqqq");
+    expect(ac.handleKeydown(new KeyboardEvent("keydown", { key: "Enter", cancelable: true }))).toBe(
+      false,
+    );
+    ac.destroy();
+  });
+
+  it("selects on mousedown so the textarea keeps focus", () => {
+    const { ac, onSelect } = mount();
+    ac.setQuery("wave");
+    const row = ac.element.querySelector(".ma-item") as HTMLElement;
+    const ev = new MouseEvent("mousedown", { bubbles: true, cancelable: true });
+    row.dispatchEvent(ev);
+    expect(ev.defaultPrevented).toBe(true);
+    expect(onSelect).toHaveBeenCalledWith(":wave:");
+    ac.destroy();
+  });
+
+  it("destroy detaches the listeners", () => {
+    const { ac, onSelect } = mount();
+    ac.setQuery("wave");
+    const row = ac.element.querySelector(".ma-item") as HTMLElement;
+    ac.destroy();
+    row.dispatchEvent(new MouseEvent("mousedown", { bubbles: true, cancelable: true }));
+    expect(onSelect).not.toHaveBeenCalled();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Composer integration
+// ---------------------------------------------------------------------------
+
+describe("composer :shortcode integration", () => {
+  let container: HTMLDivElement;
+  let input: ReturnType<typeof createMessageInput>;
+  let onSend: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    container = document.createElement("div");
+    document.body.appendChild(container);
+    onSend = vi.fn();
+    input = createMessageInput({
+      channelId: 1,
+      channelName: "general",
+      onSend,
+      onTyping: vi.fn(),
+      onEditMessage: vi.fn(),
+    });
+    input.mount(container);
+  });
+
+  afterEach(() => {
+    input.destroy?.();
+    container.remove();
+  });
+
+  function textarea(): HTMLTextAreaElement {
+    return container.querySelector("textarea")!;
+  }
+
+  function type(value: string): void {
+    const ta = textarea();
+    ta.value = value;
+    ta.selectionStart = value.length;
+    ta.selectionEnd = value.length;
+    ta.dispatchEvent(new Event("input", { bubbles: true }));
+  }
+
+  function popupEl(): HTMLElement | null {
+    return container.querySelector(".emoji-autocomplete");
+  }
+
+  function press(k: string): void {
+    textarea().dispatchEvent(
+      new KeyboardEvent("keydown", { key: k, bubbles: true, cancelable: true }),
+    );
+  }
+
+  it("opens after a colon plus two characters", () => {
+    type("hello :w");
+    expect(popupEl()).toBeNull();
+    type("hello :wa");
+    expect(popupEl()).not.toBeNull();
+  });
+
+  it("does not open for a colon inside a word", () => {
+    type("note:wa");
+    expect(popupEl()).toBeNull();
+  });
+
+  it("does not open for a URL scheme", () => {
+    type("https://ex");
+    expect(popupEl()).toBeNull();
+  });
+
+  it("closes once the query matches nothing", () => {
+    type(":wa");
+    expect(popupEl()).not.toBeNull();
+    type(":wazzzqqq");
+    expect(popupEl()).toBeNull();
+  });
+
+  it("closes when the caret leaves the token", () => {
+    type(":wa");
+    type(":wa hello");
+    expect(popupEl()).toBeNull();
+  });
+
+  it("inserts the shortcode and a trailing space instead of sending", () => {
+    type("hey :wave");
+    press("Enter");
+    expect(textarea().value).toBe("hey :wave: ");
+    expect(onSend).not.toHaveBeenCalled();
+    expect(popupEl()).toBeNull();
+  });
+
+  it("inserts the unicode character for a unicode row", () => {
+    type("hey :flame");
+    press("Enter");
+    expect(textarea().value).toBe("hey 🔥 ");
+  });
+
+  it("Escape closes the popup without sending", () => {
+    type(":wave");
+    press("Escape");
+    expect(popupEl()).toBeNull();
+    expect(onSend).not.toHaveBeenCalled();
+  });
+
+  it("does not open while the composer is disabled", () => {
+    input.setDisabled("read-only");
+    type(":wave");
+    expect(popupEl()).toBeNull();
+  });
+
+  it("closes on blur", () => {
+    type(":wave");
+    expect(popupEl()).not.toBeNull();
+    textarea().dispatchEvent(new FocusEvent("blur"));
+    expect(popupEl()).toBeNull();
+  });
+
+  it("yields to the @-mention popup rather than stacking on it", () => {
+    membersStore.setState(() => ({
+      members: new Map([
+        [
+          1,
+          { id: 1, username: "wave_guy", avatar: null, role: "member", status: "online" as const },
+        ],
+      ]),
+      typingUsers: new Map(),
+    }));
+    type("@wa");
+    expect(
+      container.querySelector(".mention-autocomplete:not(.emoji-autocomplete)"),
+    ).not.toBeNull();
+    expect(popupEl()).toBeNull();
+  });
+});
diff --git a/Client/tauri-client/tests/unit/emoji-picker.test.ts b/Client/tauri-client/tests/unit/emoji-picker.test.ts
index 53a78747..a57060a2 100644
--- a/Client/tauri-client/tests/unit/emoji-picker.test.ts
+++ b/Client/tauri-client/tests/unit/emoji-picker.test.ts
@@ -1,6 +1,7 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import { createEmojiPicker } from "@components/EmojiPicker";
 import type { EmojiPickerOptions } from "@components/EmojiPicker";
+import { emojiStore, setCustomEmoji, clearCustomEmoji } from "@stores/emoji.store";
 
 describe("EmojiPicker", () => {
   let container: HTMLDivElement;
@@ -9,6 +10,8 @@ describe("EmojiPicker", () => {
     container = document.createElement("div");
     document.body.appendChild(container);
     localStorage.clear();
+    clearCustomEmoji();
+    emojiStore.flush();
   });
 
   afterEach(() => {
@@ -116,14 +119,67 @@ describe("EmojiPicker", () => {
     picker.destroy();
   });
 
-  it("renders custom emoji when provided", () => {
+  it("renders custom emoji under a Server category", () => {
     const { picker } = makePicker({
-      customEmoji: [{ shortcode: "test_emoji", url: "https://example.com/emoji.png" }],
+      customEmoji: [{ shortcode: "test_emoji", url: "/api/v1/emoji/1/image" }],
     });
 
     const labels = picker.element.querySelectorAll(".ep-category-label");
     const labelTexts = Array.from(labels).map((l) => l.textContent);
-    expect(labelTexts).toContain("Custom");
+    expect(labelTexts).toContain("Server");
+    picker.destroy();
+  });
+
+  it("shows no Server category when the server has no custom emoji", () => {
+    const { picker } = makePicker();
+    const labelTexts = Array.from(picker.element.querySelectorAll(".ep-category-label")).map(
+      (l) => l.textContent,
+    );
+    expect(labelTexts).not.toContain("Server");
+    picker.destroy();
+  });
+
+  it("renders a resolvable custom emoji as an image, not as its token text", () => {
+    setCustomEmoji([{ id: 1, shortcode: "test_emoji", url: "/api/v1/emoji/1/image" }]);
+    emojiStore.flush();
+    const { picker } = makePicker({
+      customEmoji: [{ shortcode: "test_emoji", url: "/api/v1/emoji/1/image" }],
+    });
+
+    const cell = picker.element.querySelector(".ep-emoji-custom");
+    expect(cell).not.toBeNull();
+    expect(cell?.querySelector("img.custom-emoji")?.getAttribute("data-shortcode")).toBe(
+      "test_emoji",
+    );
+    expect(cell?.textContent).toBe("");
+    picker.destroy();
+  });
+
+  it("selecting a custom emoji inserts its :shortcode: token", () => {
+    setCustomEmoji([{ id: 1, shortcode: "test_emoji", url: "/api/v1/emoji/1/image" }]);
+    emojiStore.flush();
+    const onSelect = vi.fn();
+    const { picker } = makePicker({
+      onSelect,
+      customEmoji: [{ shortcode: "test_emoji", url: "/api/v1/emoji/1/image" }],
+    });
+
+    (picker.element.querySelector(".ep-emoji-custom") as HTMLElement).click();
+    expect(onSelect).toHaveBeenCalledWith(":test_emoji:");
+    picker.destroy();
+  });
+
+  it("falls back to the token text when the shortcode does not resolve", () => {
+    clearCustomEmoji();
+    emojiStore.flush();
+    const { picker } = makePicker({
+      customEmoji: [{ shortcode: "ghost_emoji", url: "/api/v1/emoji/9/image" }],
+    });
+
+    const cells = Array.from(picker.element.querySelectorAll(".ep-emoji"));
+    const ghost = cells.find((c) => c.textContent === ":ghost_emoji:");
+    expect(ghost).toBeDefined();
+    expect(ghost?.querySelector("img")).toBeNull();
     picker.destroy();
   });
 
diff --git a/Client/tauri-client/tests/unit/keybinds-tab.test.ts b/Client/tauri-client/tests/unit/keybinds-tab.test.ts
index d3d93844..10034ff6 100644
--- a/Client/tauri-client/tests/unit/keybinds-tab.test.ts
+++ b/Client/tauri-client/tests/unit/keybinds-tab.test.ts
@@ -42,8 +42,8 @@ describe("KeybindsTab", () => {
   it("renders Push to Talk keybind row", () => {
     const el = buildKeybindsTab(new AbortController().signal);
     const rows = el.querySelectorAll(".keybind-row");
-    // 1 PTT + 3 Navigation + 3 Communication + 2 Messages = 9
-    expect(rows.length).toBe(9);
+    // 1 PTT + 3 Navigation + 3 Communication + 5 Messages = 12
+    expect(rows.length).toBe(12);
     const pttLabel = rows[0]!.querySelector(".setting-label");
     expect(pttLabel!.textContent).toBe("Push to Talk");
   });
@@ -224,6 +224,15 @@ describe("KeybindsTab", () => {
     expect(labels).toContain("Edit Last Message");
   });
 
+  it("renders the composer formatting keybinds and explains the Ctrl+U overlap", () => {
+    const el = buildKeybindsTab(new AbortController().signal);
+    const labels = Array.from(el.querySelectorAll(".setting-label")).map((l) => l.textContent);
+    expect(labels).toContain("Bold");
+    expect(labels).toContain("Italic");
+    expect(labels).toContain("Underline");
+    expect(el.textContent).toContain("Formatting shortcuts wrap the selected text");
+  });
+
   it("renders Toggle Mute, Toggle Deafen, Toggle Camera keybinds", () => {
     const el = buildKeybindsTab(new AbortController().signal);
     const labels = Array.from(el.querySelectorAll(".setting-label")).map((l) => l.textContent);
diff --git a/Client/tauri-client/tests/unit/livekit-session.test.ts b/Client/tauri-client/tests/unit/livekit-session.test.ts
index 2087f631..50e03140 100644
--- a/Client/tauri-client/tests/unit/livekit-session.test.ts
+++ b/Client/tauri-client/tests/unit/livekit-session.test.ts
@@ -448,12 +448,14 @@ describe("LiveKitSession", () => {
     it("does nothing when no active room", async () => {
       // Should not throw
       await session.switchInputDevice("device-1");
+      expect(mockRoom.switchActiveDevice).not.toHaveBeenCalled();
     });
   });
 
   describe("switchOutputDevice", () => {
     it("does nothing when no active room", async () => {
       await session.switchOutputDevice("device-1");
+      expect(mockRoom.switchActiveDevice).not.toHaveBeenCalled();
     });
   });
 
@@ -762,8 +764,21 @@ describe("LiveKitSession", () => {
 
   describe("handleVoiceTokenRefresh", () => {
     it("stores the token and restarts the timer", () => {
+      (session as any)._state = {
+        type: "connected",
+        room: mockRoom,
+        channelId: 7,
+        latestToken: "old-token",
+        lastUrl: "/livekit",
+        lastDirectUrl: "ws://localhost:7880",
+      };
+
+      const setTimeoutSpy = vi.spyOn(globalThis, "setTimeout");
       session.handleVoiceTokenRefresh("new-token");
-      // No throw — timer is started internally
+
+      expect((session as any)._state.latestToken).toBe("new-token");
+      // Timer restarted: the 23h refresh timer is re-armed on every refresh.
+      expect(setTimeoutSpy).toHaveBeenCalledWith(expect.any(Function), 23 * 60 * 60 * 1000);
     });
 
     it("handles undefined token", () => {
diff --git a/Client/tauri-client/tests/unit/log-persistence.test.ts b/Client/tauri-client/tests/unit/log-persistence.test.ts
index 9793785d..29a68a59 100644
--- a/Client/tauri-client/tests/unit/log-persistence.test.ts
+++ b/Client/tauri-client/tests/unit/log-persistence.test.ts
@@ -14,6 +14,8 @@ const {
   mockReadTextFile,
   mockAddLogListener,
   mockGetLogBuffer,
+  mockLoggerError,
+  mockLoggerWarn,
 } = vi.hoisted(() => ({
   mockAppLogDir: vi.fn().mockResolvedValue("/mock/logs"),
   mockJoin: vi.fn((...parts: string[]) => parts.join("/")),
@@ -25,6 +27,10 @@ const {
   mockReadTextFile: vi.fn().mockResolvedValue(""),
   mockAddLogListener: vi.fn(),
   mockGetLogBuffer: vi.fn(() => [] as unknown[]),
+  // Shared across freshImport() calls so tests can spy on the errors/warnings
+  // the module's internal logger reports, not just its side effects.
+  mockLoggerError: vi.fn(),
+  mockLoggerWarn: vi.fn(),
 }));
 
 vi.mock("@tauri-apps/api/path", () => ({
@@ -47,8 +53,8 @@ vi.mock("@lib/logger", () => ({
   createLogger: () => ({
     debug: vi.fn(),
     info: vi.fn(),
-    warn: vi.fn(),
-    error: vi.fn(),
+    warn: mockLoggerWarn,
+    error: mockLoggerError,
   }),
 }));
 
@@ -106,6 +112,8 @@ describe("log persistence", () => {
     mockReadTextFile.mockReset().mockResolvedValue("");
     mockAddLogListener.mockReset();
     mockGetLogBuffer.mockReset().mockReturnValue([]);
+    mockLoggerError.mockReset();
+    mockLoggerWarn.mockReset();
   });
 
   afterEach(() => {
@@ -642,15 +650,42 @@ describe("log persistence", () => {
 
       getListener()!(makeEntry());
       await vi.advanceTimersByTimeAsync(2000);
+      expect(mockWriteTextFile).toHaveBeenCalledTimes(1);
 
-      // After flush completes, activeFlush should be null.
-      // clearPendingPersistedLogs should resolve immediately.
-      await clearPendingPersistedLogs();
-      // No hanging — test completes
+      // If activeFlush still referenced the first (already-settled) flush,
+      // a brand-new in-flight flush would never be tracked and
+      // clearPendingPersistedLogs would resolve too early instead of
+      // waiting on it. Force a second, slow flush and confirm it's the one
+      // actually awaited — proving activeFlush was cleared after the first
+      // flush and re-armed for the second.
+      let resolveSecondWrite: (() => void) | null = null;
+      mockWriteTextFile.mockImplementationOnce(
+        () =>
+          new Promise<void>((resolve) => {
+            resolveSecondWrite = resolve;
+          }),
+      );
+
+      getListener()!(makeEntry({ message: "second" }));
+      await vi.advanceTimersByTimeAsync(2000);
+      expect(mockWriteTextFile).toHaveBeenCalledTimes(2);
+
+      let settled = false;
+      const clearPromise = clearPendingPersistedLogs().then(() => {
+        settled = true;
+      });
+
+      await Promise.resolve();
+      expect(settled).toBe(false);
+
+      resolveSecondWrite!();
+      await clearPromise;
+      expect(settled).toBe(true);
     });
 
     it("clears activeFlush after failed flush", async () => {
-      mockWriteTextFile.mockRejectedValueOnce(new Error("write error"));
+      const firstError = new Error("write error");
+      mockWriteTextFile.mockRejectedValueOnce(firstError);
       const { getListener } = captureListener();
       const { initLogPersistence, clearPendingPersistedLogs } = await freshImport();
       await initLogPersistence();
@@ -658,8 +693,33 @@ describe("log persistence", () => {
       getListener()!(makeEntry());
       await vi.advanceTimersByTimeAsync(2000);
 
-      // Even after failure, activeFlush should be cleared
-      await clearPendingPersistedLogs();
+      // The failure was caught and logged internally, not left dangling.
+      expect(mockLoggerError).toHaveBeenCalledWith("flush failed", firstError);
+
+      // Same proof as the success case: a fresh in-flight flush must be
+      // tracked (not swallowed by a stale reference to the failed one).
+      let resolveSecondWrite: (() => void) | null = null;
+      mockWriteTextFile.mockImplementationOnce(
+        () =>
+          new Promise<void>((resolve) => {
+            resolveSecondWrite = resolve;
+          }),
+      );
+
+      getListener()!(makeEntry({ message: "second" }));
+      await vi.advanceTimersByTimeAsync(2000);
+
+      let settled = false;
+      const clearPromise = clearPendingPersistedLogs().then(() => {
+        settled = true;
+      });
+
+      await Promise.resolve();
+      expect(settled).toBe(false);
+
+      resolveSecondWrite!();
+      await clearPromise;
+      expect(settled).toBe(true);
     });
   });
 
@@ -743,13 +803,18 @@ describe("log persistence", () => {
 
       // Add an entry, then make writeTextFile fail
       getListener()!(makeEntry());
-      mockWriteTextFile.mockRejectedValueOnce(new Error("final write failed"));
+      const forcedError = new Error("final write failed");
+      mockWriteTextFile.mockRejectedValueOnce(forcedError);
 
       // Cleanup should not throw even if flushBuffer fails
       cleanup();
 
       // Let any pending microtasks settle
       await vi.advanceTimersByTimeAsync(0);
+
+      // The forced write failure must have been caught and logged, not
+      // swallowed silently or left to crash the app during teardown.
+      expect(mockLoggerError).toHaveBeenCalledWith("flush failed", forcedError);
     });
   });
 });
diff --git a/Client/tauri-client/tests/unit/markdown-parser.property.test.ts b/Client/tauri-client/tests/unit/markdown-parser.property.test.ts
new file mode 100644
index 00000000..4b9bf4bb
--- /dev/null
+++ b/Client/tauri-client/tests/unit/markdown-parser.property.test.ts
@@ -0,0 +1,251 @@
+/**
+ * Property tests for the markdown tokenizer (markdown.ts) and the
+ * XSS-safe DOM renderer built on top of it (content-parser.ts).
+ *
+ * These are fuzz-style invariants, not example-based checks:
+ *  - the parsers never throw on arbitrary input
+ *  - the DOM they build never contains a <script>, an on* attribute, or an
+ *    href that isn't a safe http(s) URL (no javascript:/data:/vbscript:)
+ *  - pathological input (long delimiter runs, long unmatched brackets) stays
+ *    within a generous time budget — a regression guard on the O(n^2) fix
+ *    already in place for bracket matching.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import fc from "fast-check";
+
+import { parseInline, parseBlocks } from "../../src/components/message-list/markdown";
+import {
+  renderInlineContent,
+  renderMessageContent,
+} from "../../src/components/message-list/content-parser";
+import { membersStore } from "../../src/stores/members.store";
+import { authStore } from "../../src/stores/auth.store";
+import { channelsStore, setChannels } from "../../src/stores/channels.store";
+import type { ReadyChannel } from "../../src/lib/types";
+
+const CHANNELS: ReadyChannel[] = [
+  { id: 1, name: "general", type: "text", category: null, position: 0 },
+];
+
+function seedStores(): void {
+  membersStore.setState(() => ({
+    members: new Map([
+      [10, { id: 10, username: "alice", avatar: null, role: "member", status: "online" as const }],
+    ]),
+    typingUsers: new Map(),
+  }));
+  authStore.setState(() => ({
+    token: "t",
+    user: { id: 12, username: "me", avatar: null, role: "member" },
+    serverName: null,
+    motd: null,
+    isAuthenticated: true,
+  }));
+  channelsStore.setState(() => ({ channels: new Map(), activeChannelId: null, roles: [] }));
+  setChannels(CHANNELS);
+}
+
+let container: HTMLDivElement;
+
+beforeEach(() => {
+  seedStores();
+  container = document.createElement("div");
+  document.body.appendChild(container);
+});
+
+afterEach(() => {
+  container.remove();
+});
+
+/** Small alphabet of markdown-significant characters, weighted heavily toward
+ *  the tokens the grammar actually branches on — random unicode alone rarely
+ *  hits the interesting cases (unbalanced delimiters, escapes, nested links). */
+const MARKDOWN_CHARS = [
+  "*",
+  "_",
+  "~",
+  "|",
+  "`",
+  "[",
+  "]",
+  "(",
+  ")",
+  ">",
+  "#",
+  "-",
+  "+",
+  ".",
+  "!",
+  "\\",
+  "@",
+  ":",
+  " ",
+  "\n",
+  "a",
+  "b",
+  "1",
+  "<",
+  '"',
+  "'",
+  "\t",
+];
+
+const markdownFragment = fc.string({ unit: fc.constantFrom(...MARKDOWN_CHARS), maxLength: 200 });
+
+/** Any string at all — the wider net for pure "never throws". */
+const anyString = fc.string({ maxLength: 500 });
+
+function allElements(root: ParentNode): Element[] {
+  return Array.from(root.querySelectorAll("*"));
+}
+
+function assertDomIsSafe(root: ParentNode): void {
+  expect(root.querySelector("script")).toBeNull();
+
+  for (const el of allElements(root)) {
+    for (const attr of Array.from(el.attributes)) {
+      expect(attr.name.toLowerCase().startsWith("on")).toBe(false);
+    }
+  }
+
+  for (const anchor of Array.from(root.querySelectorAll("a"))) {
+    const href = anchor.getAttribute("href");
+    if (href === null) continue;
+    expect(/^https?:/i.test(href)).toBe(true);
+    expect(/^\s*javascript:/i.test(href)).toBe(false);
+    expect(/^\s*data:/i.test(href)).toBe(false);
+    expect(/^\s*vbscript:/i.test(href)).toBe(false);
+  }
+}
+
+describe("parseInline / parseBlocks — never throw", () => {
+  it("parseInline never throws on arbitrary strings", () => {
+    fc.assert(
+      fc.property(anyString, (s) => {
+        expect(() => parseInline(s)).not.toThrow();
+      }),
+      { numRuns: 300 },
+    );
+  });
+
+  it("parseInline never throws on markdown-shaped fragments", () => {
+    fc.assert(
+      fc.property(markdownFragment, (s) => {
+        expect(() => parseInline(s)).not.toThrow();
+      }),
+      { numRuns: 500 },
+    );
+  });
+
+  it("parseBlocks never throws on arbitrary strings", () => {
+    fc.assert(
+      fc.property(anyString, (s) => {
+        expect(() => parseBlocks(s)).not.toThrow();
+      }),
+      { numRuns: 300 },
+    );
+  });
+
+  it("parseBlocks never throws on markdown-shaped fragments", () => {
+    fc.assert(
+      fc.property(markdownFragment, (s) => {
+        expect(() => parseBlocks(s)).not.toThrow();
+      }),
+      { numRuns: 500 },
+    );
+  });
+});
+
+describe("renderMessageContent / renderInlineContent — never throw, always safe", () => {
+  it("renderMessageContent never throws on arbitrary strings", () => {
+    fc.assert(
+      fc.property(anyString, (s) => {
+        expect(() => renderMessageContent(s)).not.toThrow();
+      }),
+      { numRuns: 300 },
+    );
+  });
+
+  it("renderMessageContent never throws on markdown-shaped fragments", () => {
+    fc.assert(
+      fc.property(markdownFragment, (s) => {
+        expect(() => renderMessageContent(s)).not.toThrow();
+      }),
+      { numRuns: 500 },
+    );
+  });
+
+  it("the rendered DOM never contains a <script>, an on* attribute, or an unsafe href", () => {
+    fc.assert(
+      fc.property(markdownFragment, (s) => {
+        const host = document.createElement("div");
+        host.appendChild(renderMessageContent(s));
+        assertDomIsSafe(host);
+      }),
+      { numRuns: 500 },
+    );
+  });
+
+  it("renderInlineContent never throws and stays safe, including for explicit XSS shapes", () => {
+    const xssShapes = fc.constantFrom(
+      "<script>alert(1)</script>",
+      "[click](javascript:alert(1))",
+      "[click](JaVaScRiPt:alert(1))",
+      "[click](data:text/html,<script>alert(1)</script>)",
+      "[click](vbscript:msgbox(1))",
+      "<img src=x onerror=alert(1)>",
+      '<a href="javascript:alert(1)">x</a>',
+      "javascript://alert(1)",
+      "**<img src=x onerror=alert(1)>**",
+      "[xss](  javascript:alert(1)  )",
+    );
+    fc.assert(
+      fc.property(xssShapes, (s) => {
+        const host = document.createElement("div");
+        expect(() => host.appendChild(renderInlineContent(s))).not.toThrow();
+        assertDomIsSafe(host);
+      }),
+      { numRuns: 10 },
+    );
+  });
+});
+
+describe("bounded time on pathological input", () => {
+  const BUDGET_MS = 3000;
+
+  it("a long run of unmatched '[' stays within budget", () => {
+    const input = "[".repeat(5000);
+    const start = Date.now();
+    expect(() => renderMessageContent(input)).not.toThrow();
+    expect(Date.now() - start).toBeLessThan(BUDGET_MS);
+  });
+
+  it("a long run of unmatched '*' stays within budget", () => {
+    const input = "*".repeat(5000);
+    const start = Date.now();
+    expect(() => renderMessageContent(input)).not.toThrow();
+    expect(Date.now() - start).toBeLessThan(BUDGET_MS);
+  });
+
+  it("a long run of unmatched '(' stays within budget", () => {
+    const input = "[x](".repeat(5000);
+    const start = Date.now();
+    expect(() => renderMessageContent(input)).not.toThrow();
+    expect(Date.now() - start).toBeLessThan(BUDGET_MS);
+  });
+
+  it("deeply nested emphasis stays within budget (MAX_DEPTH guards recursion)", () => {
+    const input = "*".repeat(2000) + "x" + "*".repeat(2000);
+    const start = Date.now();
+    expect(() => renderMessageContent(input)).not.toThrow();
+    expect(Date.now() - start).toBeLessThan(BUDGET_MS);
+  });
+
+  it("a long mix of brackets and parens stays within budget", () => {
+    const input = "[".repeat(2500) + "(".repeat(2500);
+    const start = Date.now();
+    expect(() => renderMessageContent(input)).not.toThrow();
+    expect(Date.now() - start).toBeLessThan(BUDGET_MS);
+  });
+});
diff --git a/Client/tauri-client/tests/unit/member-list.test.ts b/Client/tauri-client/tests/unit/member-list.test.ts
index 969fc912..28a01415 100644
--- a/Client/tauri-client/tests/unit/member-list.test.ts
+++ b/Client/tauri-client/tests/unit/member-list.test.ts
@@ -5,13 +5,16 @@ import { membersStore, updatePresence, updateMemberRole } from "@stores/members.
 import type { Member } from "@stores/members.store";
 import { authStore } from "@stores/auth.store";
 import { channelsStore, setRoles } from "@stores/channels.store";
-import type { UserStatus } from "../../src/lib/types";
+import { Permission, type UserStatus } from "../../src/lib/types";
 
 function resetStore(): void {
   membersStore.setState(() => ({
     members: new Map(),
     typingUsers: new Map(),
   }));
+  // Role list drives member-list grouping/colors — reset so tests that seed
+  // roles don't leak into the ones asserting the fallback groups.
+  setRoles([]);
 }
 
 function makeMember(overrides: Partial<Member> & { id: number; username: string }): Member {
@@ -46,6 +49,7 @@ function defaultOpts(): MemberListOptions {
     onKick: vi.fn().mockResolvedValue(undefined),
     onBan: vi.fn().mockResolvedValue(undefined),
     onChangeRole: vi.fn().mockResolvedValue(undefined),
+    onToggleBlock: vi.fn().mockResolvedValue(undefined),
   };
 }
 
@@ -253,13 +257,77 @@ describe("MemberList", () => {
     document.body.querySelector(".context-menu")?.remove();
   });
 
-  it("context menu does not appear for non-admin/non-owner roles", () => {
+  it("re-renders groups when a roles_update replaces the role list", () => {
+    // Role management makes the list mutable mid-session. Before this the list
+    // only re-rendered on a member change, so a rename/recolor/delete sat
+    // invisible until unrelated traffic arrived.
+    setRoles([
+      { id: 1, name: "Owner", color: "#E74C3C", permissions: 0 },
+      { id: 2, name: "Staff", color: "#00FF00", permissions: 0 },
+    ]);
+    setTestMembers([
+      makeMember({ id: 2, username: "Stan", role: "staff", status: "online" as UserStatus }),
+    ]);
+    memberList.mount(container);
+    expect(
+      Array.from(container.querySelectorAll(".member-role-group")).map((h) => h.textContent),
+    ).toContainEqual(expect.stringContaining("STAFF"));
+
+    setRoles([
+      { id: 1, name: "Owner", color: "#E74C3C", permissions: 0, position: 100 },
+      { id: 2, name: "Staff", color: "#0000FF", permissions: 0, position: 50 },
+    ]);
+    // Store notifications are batched onto a microtask.
+    channelsStore.flush();
+
+    const stanName = container.querySelector('[data-testid="member-2"] .mi-name');
+    expect((stanName as HTMLSpanElement).style.color).toBe("rgb(0, 0, 255)");
+  });
+
+  it("renders groups for custom server roles, colored by the server's role color", () => {
+    setRoles([
+      { id: 1, name: "Owner", color: "#E74C3C", permissions: 0 },
+      { id: 2, name: "Staff", color: "#00FF00", permissions: 0 },
+    ]);
+    setTestMembers([
+      makeMember({ id: 1, username: "Alice", role: "owner", status: "online" as UserStatus }),
+      makeMember({ id: 2, username: "Stan", role: "staff", status: "online" as UserStatus }),
+    ]);
+    memberList.mount(container);
+
+    const headers = Array.from(container.querySelectorAll(".member-role-group")).map(
+      (h) => h.textContent,
+    );
+    expect(headers[0]).toContain("OWNER");
+    expect(headers[1]).toContain("STAFF");
+
+    const stanName = container.querySelector('[data-testid="member-2"] .mi-name');
+    expect((stanName as HTMLSpanElement).style.color).toBe("rgb(0, 255, 0)");
+  });
+
+  it("members with a role missing from the server list still render", () => {
+    setRoles([{ id: 1, name: "Owner", color: null, permissions: 0 }]);
+    setTestMembers([
+      makeMember({ id: 1, username: "Alice", role: "owner", status: "online" as UserStatus }),
+      makeMember({ id: 2, username: "Ghost", role: "phantom", status: "online" as UserStatus }),
+    ]);
+    memberList.mount(container);
+
+    expect(container.querySelector('[data-testid="member-2"]')).not.toBeNull();
+    const headers = Array.from(container.querySelectorAll(".member-role-group")).map(
+      (h) => h.textContent,
+    );
+    expect(headers.some((h) => h?.includes("PHANTOM"))).toBe(true);
+  });
+
+  it("non-admin context menu shows only Block, no admin actions", () => {
     setTestMembers(testMembers);
     const opts: MemberListOptions = {
       currentUserRole: "member",
       onKick: vi.fn().mockResolvedValue(undefined),
       onBan: vi.fn().mockResolvedValue(undefined),
       onChangeRole: vi.fn().mockResolvedValue(undefined),
+      onToggleBlock: vi.fn().mockResolvedValue(undefined),
     };
     memberList.destroy?.();
     memberList = createMemberList(opts);
@@ -268,9 +336,72 @@ describe("MemberList", () => {
     const memberItem = container.querySelector('[data-testid="member-3"]') as HTMLDivElement;
     memberItem.dispatchEvent(new MouseEvent("contextmenu", { bubbles: true }));
 
-    // No context menu should be appended to body
-    const contextMenu = document.body.querySelector(".admin-context-menu, .context-menu");
-    expect(contextMenu).toBeNull();
+    const contextMenu = document.body.querySelector(".context-menu");
+    expect(contextMenu).not.toBeNull();
+    const labels = Array.from(contextMenu!.querySelectorAll(".context-menu__item")).map(
+      (i) => i.textContent,
+    );
+    expect(labels).toEqual(["Block"]);
+
+    document.body.querySelector(".context-menu")?.remove();
+  });
+
+  // The menu used to gate on the role NAME (owner/admin), so the seeded
+  // Moderator role — which holds KICK_MEMBERS and BAN_MEMBERS — got nothing,
+  // and a custom role holding those bits got nothing either.
+  describe("permission-driven moderation items", () => {
+    /** Mirrors the seeded Moderator mask (0x000FFFFF): MANAGE_MESSAGES,
+     *  MANAGE_CHANNELS, KICK_MEMBERS, BAN_MEMBERS — no MANAGE_ROLES. */
+    const MODERATOR_MASK = 0x000fffff;
+
+    function openMenuAs(roleName: string, permissions: number): string[] {
+      setRoles([{ id: 7, name: roleName, color: null, permissions }]);
+      setTestMembers(testMembers);
+      const opts: MemberListOptions = { ...defaultOpts(), currentUserRole: roleName };
+      memberList.destroy?.();
+      memberList = createMemberList(opts);
+      memberList.mount(container);
+
+      const memberItem = container.querySelector('[data-testid="member-3"]') as HTMLDivElement;
+      memberItem.dispatchEvent(new MouseEvent("contextmenu", { bubbles: true }));
+      const menu = document.body.querySelector(".context-menu");
+      expect(menu).not.toBeNull();
+      // Submenu role options share the item class; only top-level items count.
+      return Array.from(menu!.children)
+        .filter((el) => el.classList.contains("context-menu__item"))
+        .map((el) => el.firstChild?.textContent ?? "");
+    }
+
+    afterEach(() => {
+      document.body.querySelector(".context-menu")?.remove();
+    });
+
+    it("shows Force Logout and Ban but not Change Role for a moderator mask", () => {
+      const labels = openMenuAs("moderator", MODERATOR_MASK);
+      expect(labels).toContain("Force Logout");
+      expect(labels).toContain("Ban");
+      expect(labels).not.toContain("Change Role");
+      expect(labels).toContain("Block");
+    });
+
+    it("shows Change Role only when MANAGE_ROLES is held", () => {
+      const labels = openMenuAs("staff", Permission.MANAGE_ROLES | Permission.KICK_MEMBERS);
+      expect(labels).toContain("Change Role");
+      expect(labels).toContain("Force Logout");
+      expect(labels).not.toContain("Ban");
+    });
+
+    it("shows every moderation item for the ADMINISTRATOR bit", () => {
+      const labels = openMenuAs("admin", Permission.ADMINISTRATOR);
+      expect(labels).toEqual(
+        expect.arrayContaining(["Change Role", "Force Logout", "Ban", "Block"]),
+      );
+    });
+
+    it("shows only Block for a role whose mask holds no moderation bits", () => {
+      const labels = openMenuAs("member", Permission.SEND_MESSAGES | Permission.READ_MESSAGES);
+      expect(labels).toEqual(["Block"]);
+    });
   });
 
   it("context menu does not appear when right-clicking yourself", () => {
@@ -289,6 +420,7 @@ describe("MemberList", () => {
       onKick: vi.fn().mockResolvedValue(undefined),
       onBan: vi.fn().mockResolvedValue(undefined),
       onChangeRole: vi.fn().mockResolvedValue(undefined),
+      onToggleBlock: vi.fn().mockResolvedValue(undefined),
     };
     memberList.destroy?.();
     memberList = createMemberList(opts);
@@ -420,3 +552,85 @@ describe("MemberList", () => {
     expect(container.querySelector(".mi-name")?.textContent).toBe("Solo");
   });
 });
+
+// ─── Phase 6: display names, custom status, invisible ────────────────────────
+
+describe("MemberList profile fields", () => {
+  let container: HTMLDivElement;
+  let list: ReturnType<typeof createMemberList> | null = null;
+
+  const opts: MemberListOptions = {
+    currentUserRole: "member",
+    onKick: vi.fn(),
+    onBan: vi.fn(),
+    onChangeRole: vi.fn(),
+    onToggleBlock: vi.fn(),
+  };
+
+  beforeEach(() => {
+    resetStore();
+    container = document.createElement("div");
+    document.body.appendChild(container);
+  });
+
+  afterEach(() => {
+    list?.destroy?.();
+    list = null;
+    container.remove();
+    resetStore();
+  });
+
+  it("renders the display name and falls back to the username", () => {
+    setTestMembers([
+      makeMember({ id: 1, username: "alice", displayName: "Alice A." }),
+      makeMember({ id: 2, username: "bob", displayName: null }),
+    ]);
+    list = createMemberList(opts);
+    list.mount(container);
+
+    const names = Array.from(container.querySelectorAll(".mi-name")).map((el) => el.textContent);
+    expect(names).toContain("Alice A.");
+    expect(names).toContain("bob");
+    // The username is not shown twice — the display name replaces it here.
+    expect(names).not.toContain("alice");
+  });
+
+  it("shows a custom status under the name, and omits the line without one", () => {
+    setTestMembers([
+      makeMember({ id: 1, username: "alice", customStatus: "shipping phase 6" }),
+      makeMember({ id: 2, username: "bob" }),
+    ]);
+    list = createMemberList(opts);
+    list.mount(container);
+
+    const withStatus = container.querySelector('[data-testid="member-custom-status-1"]');
+    expect(withStatus?.textContent).toBe("shipping phase 6");
+    expect(container.querySelector('[data-testid="member-custom-status-2"]')).toBeNull();
+  });
+
+  it("renders an invisible member the way it renders an offline one", () => {
+    // Only ever the signed-in user's own row — everyone else is mapped to
+    // offline server-side — but it has to look like what others see.
+    setTestMembers([makeMember({ id: 1, username: "ghost", status: "invisible" as UserStatus })]);
+    list = createMemberList(opts);
+    list.mount(container);
+
+    const row = container.querySelector('[data-testid="member-1"]');
+    expect(row?.classList.contains("offline")).toBe(true);
+  });
+
+  it("re-renders (not just recolors) when a custom status changes", () => {
+    setTestMembers([makeMember({ id: 1, username: "alice" })]);
+    list = createMemberList(opts);
+    list.mount(container);
+    expect(container.querySelector('[data-testid="member-custom-status-1"]')).toBeNull();
+
+    updatePresence(1, "online", "back in 5");
+    membersStore.flush();
+    // A custom status is its own line, so it needs a structural render — the
+    // presence-only fast path would have left the row without it.
+    expect(container.querySelector('[data-testid="member-custom-status-1"]')?.textContent).toBe(
+      "back in 5",
+    );
+  });
+});
diff --git a/Client/tauri-client/tests/unit/member-picker-group.test.ts b/Client/tauri-client/tests/unit/member-picker-group.test.ts
new file mode 100644
index 00000000..e422c566
--- /dev/null
+++ b/Client/tauri-client/tests/unit/member-picker-group.test.ts
@@ -0,0 +1,143 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { createMemberPickerModal } from "../../src/pages/main-page/MemberPickerModal";
+import { membersStore } from "@stores/members.store";
+import { authStore } from "@stores/auth.store";
+import { MAX_GROUP_DM_PARTICIPANTS } from "@lib/constants";
+
+function seedMembers(count: number): void {
+  const members = new Map<number, ReturnType<typeof member>>();
+  members.set(1, member(1, "me"));
+  for (let i = 2; i <= count + 1; i++) {
+    members.set(i, member(i, `user${i}`));
+  }
+  membersStore.setState((prev) => ({ ...prev, members }));
+}
+
+function member(id: number, username: string) {
+  return {
+    id,
+    username,
+    avatar: null,
+    role: "member",
+    status: "online" as const,
+    displayName: null,
+  };
+}
+
+let container: HTMLDivElement;
+
+beforeEach(() => {
+  container = document.createElement("div");
+  document.body.appendChild(container);
+  authStore.setState((prev) => ({
+    ...prev,
+    user: { id: 1, username: "me", avatar: null, role: "member" } as never,
+  }));
+  seedMembers(4);
+});
+
+afterEach(() => {
+  container.remove();
+  document.querySelectorAll(".modal-overlay").forEach((el) => el.remove());
+});
+
+function open(opts: Partial<Parameters<typeof createMemberPickerModal>[0]> = {}) {
+  const picker = createMemberPickerModal({
+    onSelect: vi.fn(),
+    onSelectGroup: vi.fn(),
+    onClose: vi.fn(),
+    ...opts,
+  });
+  picker.mount(container);
+  return picker;
+}
+
+const rows = (): HTMLElement[] => [
+  ...document.querySelectorAll<HTMLElement>(".dm-member-picker-item"),
+];
+const confirm = (): HTMLElement =>
+  document.querySelector('[data-testid="dm-picker-create"]') as HTMLElement;
+const nameInput = (): HTMLInputElement =>
+  document.querySelector('[data-testid="dm-group-name"]') as HTMLInputElement;
+
+describe("member picker — multi-select", () => {
+  it("excludes the current user from the list", () => {
+    open();
+    expect(rows()).toHaveLength(4);
+    expect(document.querySelector('[data-testid="dm-picker-member-1"]')).toBeNull();
+  });
+
+  it("hides the confirm button until something is selected", () => {
+    open();
+    expect(confirm().style.display).toBe("none");
+  });
+
+  it("offers a plain DM for a single selection", () => {
+    const onSelect = vi.fn();
+    open({ onSelect });
+
+    rows()[0]!.click();
+    expect(confirm().style.display).toBe("");
+    expect(confirm().textContent).toBe("Create DM");
+    // A one-person selection is not a group, so it is not offered a name.
+    expect(nameInput().style.display).toBe("none");
+
+    confirm().click();
+    expect(onSelect).toHaveBeenCalledWith(2);
+  });
+
+  it("offers a group DM for two or more selections", () => {
+    const onSelectGroup = vi.fn();
+    open({ onSelectGroup });
+
+    rows()[0]!.click();
+    rows()[1]!.click();
+    expect(confirm().textContent).toBe("Create Group DM (3)");
+    expect(nameInput().style.display).toBe("");
+
+    nameInput().value = "  Lunch crew  ";
+    confirm().click();
+    expect(onSelectGroup).toHaveBeenCalledWith([2, 3], "Lunch crew");
+  });
+
+  it("toggles a selection off on a second click", () => {
+    open();
+    rows()[0]!.click();
+    expect(rows()[0]!.classList.contains("selected")).toBe(true);
+    rows()[0]!.click();
+    expect(rows()[0]!.classList.contains("selected")).toBe(false);
+    expect(confirm().style.display).toBe("none");
+  });
+
+  // The server's cap counts the creator, so the picker allows one fewer.
+  it("refuses selections past the participant cap", () => {
+    seedMembers(MAX_GROUP_DM_PARTICIPANTS + 3);
+    const picker = open();
+
+    const all = rows();
+    for (const row of all) row.click();
+
+    const selected = all.filter((r) => r.classList.contains("selected"));
+    expect(selected).toHaveLength(MAX_GROUP_DM_PARTICIPANTS - 1);
+    expect(confirm().textContent).toBe(`Create Group DM (${MAX_GROUP_DM_PARTICIPANTS})`);
+
+    picker.destroy?.();
+  });
+
+  it("stays single-select when no group callback is supplied", () => {
+    const onSelect = vi.fn();
+    createMemberPickerModal({ onSelect, onClose: vi.fn() }).mount(container);
+
+    rows()[0]!.click();
+    expect(onSelect).toHaveBeenCalledWith(2);
+    // No confirm step: one click is the whole interaction.
+    expect(document.querySelector(".modal-overlay.visible")).toBeNull();
+  });
+
+  it("closes the modal on confirm", () => {
+    open();
+    rows()[0]!.click();
+    confirm().click();
+    expect(document.querySelector(".modal-overlay.visible")).toBeNull();
+  });
+});
diff --git a/Client/tauri-client/tests/unit/member-profile-fields.test.ts b/Client/tauri-client/tests/unit/member-profile-fields.test.ts
new file mode 100644
index 00000000..4b70a1a5
--- /dev/null
+++ b/Client/tauri-client/tests/unit/member-profile-fields.test.ts
@@ -0,0 +1,118 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import {
+  membersStore,
+  memberDisplayName,
+  setMembers,
+  updateMemberProfile,
+  updatePresence,
+} from "@stores/members.store";
+import type { ReadyMember } from "@lib/types";
+
+/**
+ * Display names and custom statuses through the member store. Two rules carry
+ * the weight: the display name falls back to the username everywhere, and a
+ * partial update must not blank a field it did not mention (the auto-idle
+ * timer sends a bare status flip several times an hour).
+ */
+
+const alice: ReadyMember = {
+  id: 1,
+  username: "alice",
+  avatar: null,
+  role: "member",
+  status: "online",
+  display_name: "Alice A.",
+  custom_status: "shipping phase 6",
+};
+
+const bob: ReadyMember = {
+  id: 2,
+  username: "bob",
+  avatar: null,
+  role: "member",
+  status: "idle",
+};
+
+describe("memberDisplayName", () => {
+  it("prefers the display name and falls back to the username", () => {
+    expect(memberDisplayName({ username: "alice", displayName: "Alice A." })).toBe("Alice A.");
+    expect(memberDisplayName({ username: "bob", displayName: null })).toBe("bob");
+    expect(memberDisplayName({ username: "bob" })).toBe("bob");
+    expect(memberDisplayName({ username: "bob", displayName: "  " })).toBe("bob");
+  });
+});
+
+describe("members store profile fields", () => {
+  beforeEach(() => {
+    setMembers([]);
+  });
+
+  it("carries display name and custom status from ready", () => {
+    setMembers([alice, bob]);
+    const a = membersStore.getState().members.get(1)!;
+    expect(a.displayName).toBe("Alice A.");
+    expect(a.customStatus).toBe("shipping phase 6");
+
+    // A member the server sent neither field for is explicitly null, not
+    // undefined — the store normalises so renderers only handle one absence.
+    const b = membersStore.getState().members.get(2)!;
+    expect(b.displayName).toBeNull();
+    expect(b.customStatus).toBeNull();
+  });
+
+  it("a bare presence update leaves the custom status alone", () => {
+    setMembers([alice]);
+    updatePresence(1, "idle");
+    const a = membersStore.getState().members.get(1)!;
+    expect(a.status).toBe("idle");
+    expect(a.customStatus).toBe("shipping phase 6");
+  });
+
+  it("a presence update carrying the field replaces it, null included", () => {
+    setMembers([alice]);
+    updatePresence(1, "online", "back");
+    expect(membersStore.getState().members.get(1)!.customStatus).toBe("back");
+
+    updatePresence(1, "online", null);
+    expect(membersStore.getState().members.get(1)!.customStatus).toBeNull();
+  });
+
+  it("accepts invisible as a status (the signed-in user's own)", () => {
+    setMembers([alice]);
+    updatePresence(1, "invisible");
+    expect(membersStore.getState().members.get(1)!.status).toBe("invisible");
+  });
+
+  it("user_update replaces the display name, and omitting it preserves it", () => {
+    setMembers([alice]);
+
+    updateMemberProfile(1, { username: "alice", avatar: null, displayName: "Ada" });
+    expect(membersStore.getState().members.get(1)!.displayName).toBe("Ada");
+
+    // An older server's user_update has no display_name; it must not wipe one.
+    updateMemberProfile(1, { username: "alice", avatar: null });
+    expect(membersStore.getState().members.get(1)!.displayName).toBe("Ada");
+
+    // An explicit null is a clear.
+    updateMemberProfile(1, { username: "alice", avatar: null, displayName: null });
+    expect(membersStore.getState().members.get(1)!.displayName).toBeNull();
+  });
+
+  it("user_update does not clobber a pinned identity key when omitted", () => {
+    setMembers([{ ...alice, identity_public_key: "KEY" }]);
+    updateMemberProfile(1, { username: "alice", avatar: "/api/v1/files/x" });
+    const a = membersStore.getState().members.get(1)!;
+    expect(a.identityPublicKey).toBe("KEY");
+    expect(a.avatar).toBe("/api/v1/files/x");
+  });
+
+  it("keeps state immutable across updates", () => {
+    setMembers([alice]);
+    const before = membersStore.getState();
+    updatePresence(1, "dnd");
+    const after = membersStore.getState();
+    expect(after).not.toBe(before);
+    expect(after.members).not.toBe(before.members);
+    expect(before.members.get(1)!.status).toBe("online");
+  });
+});
diff --git a/Client/tauri-client/tests/unit/members.store.test.ts b/Client/tauri-client/tests/unit/members.store.test.ts
index 222cd3a3..0d09288c 100644
--- a/Client/tauri-client/tests/unit/members.store.test.ts
+++ b/Client/tauri-client/tests/unit/members.store.test.ts
@@ -76,6 +76,8 @@ describe("members store", () => {
         avatar: "alice.png",
         role: "admin",
         status: "online",
+        displayName: null,
+        customStatus: null,
         identityPublicKey: null,
       });
     });
@@ -98,9 +100,10 @@ describe("members store", () => {
   });
 
   describe("addMember", () => {
-    it("adds a new member from member_join payload", () => {
+    it("adds a new member from member_join payload, using the payload's status", () => {
       const payload: MemberJoinPayload = {
         user: { id: 10, username: "newuser", avatar: null, role: "member" },
+        status: "online",
       };
       addMember(payload);
       const member = membersStore.getState().members.get(10);
@@ -110,14 +113,37 @@ describe("members store", () => {
         avatar: null,
         role: "member",
         status: "online",
+        displayName: null,
+        customStatus: null,
         identityPublicKey: null,
       });
     });
 
+    it("renders an invisible join as offline", () => {
+      // The server collapses an invisible connector's status to "offline"
+      // before broadcasting member_join; the store must pass that through
+      // rather than assuming a join always means online.
+      addMember({
+        user: { id: 11, username: "ghost", avatar: null, role: "member" },
+        status: "offline",
+      });
+      expect(membersStore.getState().members.get(11)?.status).toBe("offline");
+    });
+
+    it("defaults to offline when the payload omits status (older server)", () => {
+      // Fail safe: a server that has not shipped the status field yet must
+      // not cause a hidden user to render as online.
+      addMember({
+        user: { id: 12, username: "legacy-server-user", avatar: null, role: "member" },
+      });
+      expect(membersStore.getState().members.get(12)?.status).toBe("offline");
+    });
+
     it("does not remove existing members", () => {
       setMembers([MEMBER_ALICE]);
       addMember({
         user: { id: 10, username: "newuser", avatar: null, role: "member" },
+        status: "online",
       });
       expect(membersStore.getState().members.size).toBe(2);
       expect(membersStore.getState().members.has(1)).toBe(true);
diff --git a/Client/tauri-client/tests/unit/mention-autocomplete.test.ts b/Client/tauri-client/tests/unit/mention-autocomplete.test.ts
new file mode 100644
index 00000000..0f2d11e2
--- /dev/null
+++ b/Client/tauri-client/tests/unit/mention-autocomplete.test.ts
@@ -0,0 +1,337 @@
+/**
+ * MentionAutocomplete — filtering, the MENTION_EVERYONE gate on the broadcast
+ * entries, keyboard navigation, and composer integration.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+
+vi.mock("@lib/livekitSession", () => ({
+  leaveVoice: vi.fn(),
+  switchInputDevice: vi.fn(),
+  switchOutputDevice: vi.fn(),
+  setVoiceSensitivity: vi.fn(),
+  setInputVolume: vi.fn(),
+  setOutputVolume: vi.fn(),
+  getSessionDebugInfo: vi.fn().mockReturnValue({}),
+}));
+
+import {
+  createMentionAutocomplete,
+  filterMentionSuggestions,
+  MAX_MENTION_SUGGESTIONS,
+} from "../../src/components/MentionAutocomplete";
+import { createMessageInput } from "../../src/components/MessageInput";
+import { membersStore } from "../../src/stores/members.store";
+import { authStore } from "../../src/stores/auth.store";
+import { channelsStore, setRoles } from "../../src/stores/channels.store";
+import { Permission } from "../../src/lib/types";
+
+const NAMES = ["alice", "Alan", "Bob", "carol"];
+
+function seedMembers(names: readonly string[] = NAMES): void {
+  membersStore.setState(() => ({
+    members: new Map(
+      names.map((n, i) => [
+        i + 1,
+        {
+          id: i + 1,
+          username: n,
+          avatar: null,
+          role: "member" as const,
+          status: "online" as const,
+        },
+      ]),
+    ),
+    typingUsers: new Map(),
+  }));
+}
+
+/** Sign in as a role, and register that role's permission mask. */
+function signInAs(role: string, permissions: number): void {
+  authStore.setState(() => ({
+    token: "t",
+    user: { id: 99, username: "me", avatar: null, role },
+    serverName: null,
+    motd: null,
+    isAuthenticated: true,
+  }));
+  channelsStore.setState(() => ({ channels: new Map(), activeChannelId: null, roles: [] }));
+  setRoles([{ id: 1, name: role, color: null, permissions }]);
+  channelsStore.flush();
+}
+
+beforeEach(() => {
+  seedMembers();
+  signInAs("member", Permission.SEND_MESSAGES);
+});
+
+describe("filterMentionSuggestions", () => {
+  it("lists every member for an empty query", () => {
+    expect(filterMentionSuggestions("").map((s) => s.token)).toEqual([
+      "Alan",
+      "alice",
+      "Bob",
+      "carol",
+    ]);
+  });
+
+  it("filters case-insensitively", () => {
+    expect(filterMentionSuggestions("AL").map((s) => s.token)).toEqual(["Alan", "alice"]);
+  });
+
+  it("ranks prefix matches above substring matches", () => {
+    seedMembers(["bob", "abbot"]);
+    expect(filterMentionSuggestions("b").map((s) => s.token)).toEqual(["bob", "abbot"]);
+  });
+
+  it("returns nothing when no member matches", () => {
+    expect(filterMentionSuggestions("zzz")).toEqual([]);
+  });
+
+  it("caps the list", () => {
+    seedMembers(Array.from({ length: 40 }, (_, i) => `user${String(i).padStart(2, "0")}`));
+    expect(filterMentionSuggestions("user").length).toBe(MAX_MENTION_SUGGESTIONS);
+  });
+
+  it("omits @everyone/@here without MENTION_EVERYONE", () => {
+    const tokens = filterMentionSuggestions("").map((s) => s.token);
+    expect(tokens).not.toContain("everyone");
+    expect(tokens).not.toContain("here");
+  });
+
+  it("offers @everyone/@here first when the role holds MENTION_EVERYONE", () => {
+    signInAs("mod", Permission.SEND_MESSAGES | Permission.MENTION_EVERYONE);
+    const tokens = filterMentionSuggestions("").map((s) => s.token);
+    expect(tokens.slice(0, 2)).toEqual(["everyone", "here"]);
+  });
+
+  it("filters the broadcast entries by prefix too", () => {
+    signInAs("mod", Permission.MENTION_EVERYONE);
+    expect(filterMentionSuggestions("her").map((s) => s.token)).toEqual(["here"]);
+    expect(filterMentionSuggestions("every").map((s) => s.token)).toEqual(["everyone"]);
+  });
+
+  it("offers broadcasts to an administrator implicitly", () => {
+    signInAs("owner", Permission.ADMINISTRATOR);
+    expect(filterMentionSuggestions("every").map((s) => s.token)).toEqual(["everyone"]);
+  });
+});
+
+describe("createMentionAutocomplete", () => {
+  let onSelect: ReturnType<typeof vi.fn>;
+  let onClose: ReturnType<typeof vi.fn>;
+  let popup: ReturnType<typeof createMentionAutocomplete>;
+
+  beforeEach(() => {
+    onSelect = vi.fn();
+    onClose = vi.fn();
+    popup = createMentionAutocomplete({ onSelect, onClose });
+    document.body.appendChild(popup.element);
+  });
+
+  afterEach(() => {
+    popup.destroy();
+  });
+
+  function key(k: string): KeyboardEvent {
+    return new KeyboardEvent("keydown", { key: k, cancelable: true });
+  }
+
+  function labels(): string[] {
+    return Array.from(popup.element.querySelectorAll(".ma-name")).map((e) => e.textContent ?? "");
+  }
+
+  it("renders one row per suggestion, first row active", () => {
+    popup.setQuery("al");
+    expect(labels()).toEqual(["@Alan", "@alice"]);
+    expect(popup.element.querySelectorAll(".ma-item--active").length).toBe(1);
+    expect(popup.element.querySelector(".ma-item")?.classList.contains("ma-item--active")).toBe(
+      true,
+    );
+  });
+
+  it("reports no match so the composer can close it", () => {
+    expect(popup.setQuery("zzz")).toBe(false);
+    expect(labels()).toEqual([]);
+  });
+
+  it("moves the selection with ArrowDown and wraps", () => {
+    popup.setQuery("al");
+    popup.handleKeydown(key("ArrowDown"));
+    expect(popup.element.querySelectorAll(".ma-item")[1]?.getAttribute("aria-selected")).toBe(
+      "true",
+    );
+    popup.handleKeydown(key("ArrowDown"));
+    expect(popup.element.querySelectorAll(".ma-item")[0]?.getAttribute("aria-selected")).toBe(
+      "true",
+    );
+  });
+
+  it("wraps backwards with ArrowUp", () => {
+    popup.setQuery("al");
+    popup.handleKeydown(key("ArrowUp"));
+    expect(popup.element.querySelectorAll(".ma-item")[1]?.getAttribute("aria-selected")).toBe(
+      "true",
+    );
+  });
+
+  it("selects the active row on Enter", () => {
+    popup.setQuery("al");
+    popup.handleKeydown(key("ArrowDown"));
+    expect(popup.handleKeydown(key("Enter"))).toBe(true);
+    expect(onSelect).toHaveBeenCalledWith("alice");
+  });
+
+  it("selects on Tab as well", () => {
+    popup.setQuery("bo");
+    popup.handleKeydown(key("Tab"));
+    expect(onSelect).toHaveBeenCalledWith("Bob");
+  });
+
+  it("closes on Escape without selecting", () => {
+    popup.setQuery("al");
+    expect(popup.handleKeydown(key("Escape"))).toBe(true);
+    expect(onClose).toHaveBeenCalled();
+    expect(onSelect).not.toHaveBeenCalled();
+  });
+
+  it("consumes nothing while empty, so the composer keeps its keys", () => {
+    popup.setQuery("zzz");
+    expect(popup.handleKeydown(key("Enter"))).toBe(false);
+    expect(popup.handleKeydown(key("ArrowDown"))).toBe(false);
+  });
+
+  it("passes ordinary keys through", () => {
+    popup.setQuery("al");
+    expect(popup.handleKeydown(key("a"))).toBe(false);
+  });
+
+  it("selects on mousedown without stealing focus", () => {
+    popup.setQuery("bo");
+    const row = popup.element.querySelector(".ma-item") as HTMLElement;
+    const ev = new MouseEvent("mousedown", { bubbles: true, cancelable: true });
+    row.dispatchEvent(ev);
+    expect(ev.defaultPrevented).toBe(true);
+    expect(onSelect).toHaveBeenCalledWith("Bob");
+  });
+
+  it("removes its element on destroy", () => {
+    popup.destroy();
+    expect(popup.element.parentNode).toBeNull();
+  });
+});
+
+describe("composer integration", () => {
+  let container: HTMLDivElement;
+  let input: ReturnType<typeof createMessageInput>;
+  let onSend: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    container = document.createElement("div");
+    document.body.appendChild(container);
+    onSend = vi.fn();
+    input = createMessageInput({
+      channelId: 1,
+      channelName: "general",
+      onSend,
+      onTyping: vi.fn(),
+      onEditMessage: vi.fn(),
+    });
+    input.mount(container);
+  });
+
+  afterEach(() => {
+    input.destroy?.();
+    container.remove();
+  });
+
+  function textarea(): HTMLTextAreaElement {
+    return container.querySelector("textarea")!;
+  }
+
+  function type(value: string): void {
+    const ta = textarea();
+    ta.value = value;
+    ta.selectionStart = value.length;
+    ta.selectionEnd = value.length;
+    ta.dispatchEvent(new Event("input", { bubbles: true }));
+  }
+
+  function popupEl(): HTMLElement | null {
+    return container.querySelector(".mention-autocomplete");
+  }
+
+  function press(k: string): boolean {
+    const ev = new KeyboardEvent("keydown", { key: k, bubbles: true, cancelable: true });
+    textarea().dispatchEvent(ev);
+    return ev.defaultPrevented;
+  }
+
+  it("opens the popup on a bare @", () => {
+    type("hello @");
+    expect(popupEl()).not.toBeNull();
+  });
+
+  it("does not open for an email-shaped @", () => {
+    type("mail@ali");
+    expect(popupEl()).toBeNull();
+  });
+
+  it("closes once the query matches nobody", () => {
+    type("@al");
+    expect(popupEl()).not.toBeNull();
+    type("@alzzz");
+    expect(popupEl()).toBeNull();
+  });
+
+  it("closes when the caret leaves the token", () => {
+    type("@al");
+    type("@al hello");
+    expect(popupEl()).toBeNull();
+  });
+
+  it("inserts the picked username and a trailing space", () => {
+    type("hey @al");
+    press("Enter");
+    expect(textarea().value).toBe("hey @Alan ");
+    expect(onSend).not.toHaveBeenCalled();
+    expect(popupEl()).toBeNull();
+  });
+
+  it("keeps text after the caret intact", () => {
+    const ta = textarea();
+    ta.value = "hey @al world";
+    ta.selectionStart = 7;
+    ta.selectionEnd = 7;
+    ta.dispatchEvent(new Event("input", { bubbles: true }));
+    press("Enter");
+    expect(ta.value).toBe("hey @Alan  world");
+  });
+
+  it("lets Enter send once the popup is closed", () => {
+    type("hey @al");
+    press("Escape");
+    expect(popupEl()).toBeNull();
+    press("Enter");
+    expect(onSend).toHaveBeenCalledWith("hey @al", null, []);
+  });
+
+  it("navigates with the arrow keys before inserting", () => {
+    type("@al");
+    press("ArrowDown");
+    press("Enter");
+    expect(textarea().value).toBe("@alice ");
+  });
+
+  it("does not open while the composer is disabled", () => {
+    input.setDisabled("Read-only");
+    type("@al");
+    expect(popupEl()).toBeNull();
+  });
+
+  it("closes on blur", () => {
+    type("@al");
+    textarea().dispatchEvent(new FocusEvent("blur"));
+    expect(popupEl()).toBeNull();
+  });
+});
diff --git a/Client/tauri-client/tests/unit/mention-emoji-parsing.property.test.ts b/Client/tauri-client/tests/unit/mention-emoji-parsing.property.test.ts
new file mode 100644
index 00000000..00e3f62c
--- /dev/null
+++ b/Client/tauri-client/tests/unit/mention-emoji-parsing.property.test.ts
@@ -0,0 +1,290 @@
+/**
+ * Property tests for custom-emoji token handling (custom-emoji.ts) and the
+ * @mention / #channel chip rendering in content-parser.ts.
+ *
+ * Invariants under fuzzing:
+ *  - none of these ever throw on arbitrary input
+ *  - a `:shortcode:` / `@token` / `#channel` chip renders only when it
+ *    resolves to something real (a known custom emoji / member / channel);
+ *    everything else stays literal text, byte for byte
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import fc from "fast-check";
+
+// The emoji image is behind the session token; stub the authenticated fetch
+// so buildCustomEmojiNode's async image swap does not hit the network.
+const { fetchImageAsDataUrlMock } = vi.hoisted(() => ({
+  fetchImageAsDataUrlMock: vi.fn(() => Promise.resolve("data:image/png;base64,AAAA")),
+}));
+vi.mock("../../src/components/message-list/attachments", async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import("../../src/components/message-list/attachments")>();
+  return { ...actual, fetchImageAsDataUrl: fetchImageAsDataUrlMock };
+});
+
+import {
+  EMOJI_TOKEN_REGEX,
+  buildCustomEmojiNode,
+  isEmojiOnlyMessage,
+} from "../../src/components/message-list/custom-emoji";
+import {
+  renderMessageContent,
+  renderMentionSegment,
+} from "../../src/components/message-list/content-parser";
+import { emojiStore, setCustomEmoji, clearCustomEmoji } from "../../src/stores/emoji.store";
+import { membersStore } from "../../src/stores/members.store";
+import { authStore } from "../../src/stores/auth.store";
+import { channelsStore, setChannels } from "../../src/stores/channels.store";
+import type { ReadyChannel } from "../../src/lib/types";
+
+const CHANNELS: ReadyChannel[] = [
+  { id: 1, name: "general", type: "text", category: null, position: 0 },
+];
+
+const KNOWN_MEMBER_ID = 10;
+const SELF_ID = 12;
+const KNOWN_SHORTCODE = "wave";
+const KNOWN_CHANNEL_ID = 1;
+
+function seedStores(): void {
+  membersStore.setState(() => ({
+    members: new Map([
+      [
+        KNOWN_MEMBER_ID,
+        {
+          id: KNOWN_MEMBER_ID,
+          username: "alice",
+          avatar: null,
+          role: "member",
+          status: "online" as const,
+        },
+      ],
+    ]),
+    typingUsers: new Map(),
+  }));
+  authStore.setState(() => ({
+    token: "t",
+    user: { id: SELF_ID, username: "me", avatar: null, role: "member" },
+    serverName: null,
+    motd: null,
+    isAuthenticated: true,
+  }));
+  channelsStore.setState(() => ({ channels: new Map(), activeChannelId: null, roles: [] }));
+  setChannels(CHANNELS);
+  clearCustomEmoji();
+  emojiStore.flush();
+  setCustomEmoji([{ id: 1, shortcode: KNOWN_SHORTCODE, url: "/api/v1/emoji/1/image" }]);
+  emojiStore.flush();
+}
+
+beforeEach(() => {
+  seedStores();
+});
+
+let container: HTMLDivElement;
+beforeEach(() => {
+  container = document.createElement("div");
+  document.body.appendChild(container);
+});
+afterEach(() => {
+  container.remove();
+});
+
+const anyString = fc.string({ maxLength: 300 });
+
+/** Alphabet weighted toward the token-shaped characters (@, #, :, word chars,
+ *  punctuation) so fuzzing actually exercises the tokenizers' branch points. */
+const TOKEN_CHARS = [
+  "@",
+  "#",
+  ":",
+  "_",
+  "-",
+  ".",
+  " ",
+  "\n",
+  "a",
+  "l",
+  "i",
+  "c",
+  "e",
+  "w",
+  "v",
+  "1",
+  "9",
+  "everyone",
+  "here",
+  "wave",
+  "general",
+];
+const tokenFragment = fc.string({ unit: fc.constantFrom(...TOKEN_CHARS), maxLength: 200 });
+
+// ---------------------------------------------------------------------------
+// Never throws
+// ---------------------------------------------------------------------------
+
+describe("custom-emoji — never throws", () => {
+  it("buildCustomEmojiNode never throws on arbitrary tokens", () => {
+    fc.assert(
+      fc.property(anyString, (s) => {
+        expect(() => buildCustomEmojiNode(s)).not.toThrow();
+      }),
+      { numRuns: 300 },
+    );
+  });
+
+  it("isEmojiOnlyMessage never throws on arbitrary content", () => {
+    fc.assert(
+      fc.property(anyString, (s) => {
+        expect(() => isEmojiOnlyMessage(s)).not.toThrow();
+      }),
+      { numRuns: 300 },
+    );
+  });
+
+  it("EMOJI_TOKEN_REGEX never throws when matched against arbitrary content", () => {
+    fc.assert(
+      fc.property(anyString, (s) => {
+        expect(() => [...s.matchAll(EMOJI_TOKEN_REGEX)]).not.toThrow();
+      }),
+      { numRuns: 300 },
+    );
+  });
+});
+
+describe("mention / channel rendering — never throws", () => {
+  it("renderMentionSegment never throws on arbitrary content", () => {
+    fc.assert(
+      fc.property(anyString, (s) => {
+        expect(() => renderMentionSegment(s)).not.toThrow();
+      }),
+      { numRuns: 300 },
+    );
+  });
+
+  it("renderMentionSegment never throws on token-shaped fragments", () => {
+    fc.assert(
+      fc.property(tokenFragment, (s) => {
+        expect(() => renderMentionSegment(s)).not.toThrow();
+      }),
+      { numRuns: 500 },
+    );
+  });
+
+  it("renderMessageContent never throws on token-shaped fragments (with mentionsEveryone)", () => {
+    fc.assert(
+      fc.property(tokenFragment, fc.boolean(), (s, mentionsEveryone) => {
+        expect(() => renderMessageContent(s, { mentionsEveryone })).not.toThrow();
+      }),
+      { numRuns: 500 },
+    );
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Chips only render for resolvable ids
+// ---------------------------------------------------------------------------
+
+describe("chips only render for what actually resolves", () => {
+  it("every rendered @mention chip points at the known member or self, never a made-up id", () => {
+    fc.assert(
+      fc.property(tokenFragment, (s) => {
+        const host = document.createElement("div");
+        host.appendChild(renderMentionSegment(s));
+        for (const span of Array.from(host.querySelectorAll(".mention[data-user-id]"))) {
+          const id = Number(span.getAttribute("data-user-id"));
+          expect([KNOWN_MEMBER_ID, SELF_ID]).toContain(id);
+        }
+      }),
+      { numRuns: 500 },
+    );
+  });
+
+  it("every rendered #channel chip points at a known channel id", () => {
+    fc.assert(
+      fc.property(tokenFragment, (s) => {
+        const host = document.createElement("div");
+        host.appendChild(renderMentionSegment(s));
+        for (const span of Array.from(host.querySelectorAll(".channel-mention[data-channel-id]"))) {
+          const id = Number(span.getAttribute("data-channel-id"));
+          expect(id).toBe(KNOWN_CHANNEL_ID);
+        }
+      }),
+      { numRuns: 500 },
+    );
+  });
+
+  it("every rendered custom-emoji image points at the known shortcode", () => {
+    fc.assert(
+      fc.property(tokenFragment, (s) => {
+        const host = document.createElement("div");
+        host.appendChild(renderMentionSegment(s));
+        for (const img of Array.from(host.querySelectorAll("img.custom-emoji"))) {
+          expect(img.getAttribute("data-shortcode")).toBe(KNOWN_SHORTCODE);
+        }
+      }),
+      { numRuns: 500 },
+    );
+  });
+
+  it("@everyone/@here never highlights as mention-everyone without server-confirmed mentionsEveryone", () => {
+    fc.assert(
+      fc.property(tokenFragment, (s) => {
+        const host = document.createElement("div");
+        // No MentionInfo passed at all -> mentionsEveryone is undefined, never true.
+        host.appendChild(renderMentionSegment(s));
+        expect(host.querySelectorAll(".mention-everyone").length).toBe(0);
+      }),
+      { numRuns: 300 },
+    );
+  });
+
+  it("@everyone highlights only when mentionsEveryone is explicitly true", () => {
+    const host1 = document.createElement("div");
+    host1.appendChild(renderMentionSegment("hey @everyone", { mentionsEveryone: false }));
+    expect(host1.querySelectorAll(".mention-everyone").length).toBe(0);
+
+    const host2 = document.createElement("div");
+    host2.appendChild(renderMentionSegment("hey @everyone", { mentionsEveryone: true }));
+    expect(host2.querySelectorAll(".mention-everyone").length).toBe(1);
+  });
+
+  it("resolvable shortcode still renders as an image; arbitrary unresolvable ones stay literal", () => {
+    fc.assert(
+      fc.property(
+        fc.string({ minLength: 2, maxLength: 32 }).filter((s) => /^[A-Za-z0-9_]+$/.test(s)),
+        (code) => {
+          const host = document.createElement("div");
+          host.appendChild(renderMentionSegment(`:${code}:`));
+          const imgs = host.querySelectorAll("img.custom-emoji");
+          if (code.toLowerCase() === KNOWN_SHORTCODE) {
+            expect(imgs.length).toBe(1);
+          } else {
+            expect(imgs.length).toBe(0);
+            expect(host.textContent).toBe(`:${code}:`);
+          }
+        },
+      ),
+      { numRuns: 300 },
+    );
+  });
+
+  it("arbitrary text with no @/#/: tokens renders as untouched literal text", () => {
+    const plain = fc.string({
+      unit: fc.constantFrom(..."abcdefghijklmnopqrstuvwxyz ".split("")),
+      maxLength: 100,
+    });
+    fc.assert(
+      fc.property(plain, (s) => {
+        const host = document.createElement("div");
+        host.appendChild(renderMentionSegment(s));
+        expect(host.textContent).toBe(s);
+        expect(host.querySelectorAll(".mention, .channel-mention, img.custom-emoji").length).toBe(
+          0,
+        );
+      }),
+      { numRuns: 200 },
+    );
+  });
+});
diff --git a/Client/tauri-client/tests/unit/mentions-render.test.ts b/Client/tauri-client/tests/unit/mentions-render.test.ts
new file mode 100644
index 00000000..350e87b3
--- /dev/null
+++ b/Client/tauri-client/tests/unit/mentions-render.test.ts
@@ -0,0 +1,343 @@
+/**
+ * Mention + #channel-link rendering: which tokens highlight, which stay plain
+ * text, and how a mention of the signed-in user marks the row.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+
+vi.mock("@lib/livekitSession", () => ({
+  leaveVoice: vi.fn(),
+  switchInputDevice: vi.fn(),
+  switchOutputDevice: vi.fn(),
+  setVoiceSensitivity: vi.fn(),
+  setInputVolume: vi.fn(),
+  setOutputVolume: vi.fn(),
+  getSessionDebugInfo: vi.fn().mockReturnValue({}),
+}));
+
+import {
+  renderMentionSegment,
+  renderMessageContent,
+} from "../../src/components/message-list/content-parser";
+import { renderMessage } from "../../src/components/message-list/renderers";
+import {
+  highlightsCurrentUser,
+  mentionsCurrentUser,
+  resolveMentionUserId,
+} from "../../src/lib/mentions";
+import { membersStore } from "../../src/stores/members.store";
+import { authStore } from "../../src/stores/auth.store";
+import { channelsStore, setChannels } from "../../src/stores/channels.store";
+import type { Message } from "../../src/stores/messages.store";
+import type { MessageListOptions } from "../../src/components/MessageList";
+import type { ReadyChannel } from "../../src/lib/types";
+
+const CHANNELS: ReadyChannel[] = [
+  { id: 1, name: "general", type: "text", category: null, position: 0 },
+  { id: 2, name: "off-topic", type: "text", category: null, position: 1 },
+  { id: 3, name: "dm-3", type: "dm", category: null, position: 0 },
+];
+
+function seedStores(): void {
+  membersStore.setState(() => ({
+    members: new Map([
+      [10, { id: 10, username: "alice", avatar: null, role: "member", status: "online" as const }],
+      [11, { id: 11, username: "Bob", avatar: null, role: "admin", status: "online" as const }],
+      [12, { id: 12, username: "me", avatar: null, role: "member", status: "online" as const }],
+    ]),
+    typingUsers: new Map(),
+  }));
+  authStore.setState(() => ({
+    token: "t",
+    user: { id: 12, username: "me", avatar: null, role: "member" },
+    serverName: null,
+    motd: null,
+    isAuthenticated: true,
+  }));
+  channelsStore.setState(() => ({ channels: new Map(), activeChannelId: null, roles: [] }));
+  setChannels(CHANNELS);
+}
+
+let container: HTMLDivElement;
+
+beforeEach(() => {
+  seedStores();
+  container = document.createElement("div");
+  document.body.appendChild(container);
+});
+
+afterEach(() => {
+  container.remove();
+});
+
+function render(text: string, info?: Parameters<typeof renderMentionSegment>[1]): HTMLDivElement {
+  container.appendChild(renderMentionSegment(text, info));
+  return container;
+}
+
+describe("@mention rendering", () => {
+  it("highlights a username that resolves against the member list", () => {
+    const el = render("hey @alice");
+    const mention = el.querySelector(".mention");
+    expect(mention?.textContent).toBe("@alice");
+    expect(mention?.getAttribute("data-user-id")).toBe("10");
+  });
+
+  it("resolves case-insensitively", () => {
+    const el = render("hey @BOB");
+    expect(el.querySelector(".mention")?.textContent).toBe("@BOB");
+    expect(el.querySelector(".mention")?.getAttribute("data-user-id")).toBe("11");
+  });
+
+  it("leaves an unknown username as plain text", () => {
+    const el = render("hey @nobody");
+    expect(el.querySelector(".mention")).toBeNull();
+    expect(el.textContent).toBe("hey @nobody");
+  });
+
+  it("does not treat an email local part as a mention", () => {
+    const el = render("write to mail@example");
+    expect(el.querySelector(".mention")).toBeNull();
+  });
+
+  it("does not match an address-shaped token", () => {
+    membersStore.setState((prev) => ({
+      ...prev,
+      members: new Map([
+        ...prev.members,
+        [13, { id: 13, username: "bob", avatar: null, role: "member", status: "online" as const }],
+      ]),
+    }));
+    const el = render("ping @bob@example.com");
+    expect(el.querySelector(".mention")).toBeNull();
+  });
+
+  it("does not match a doubled @@name", () => {
+    const el = render("@@alice");
+    expect(el.querySelector(".mention")).toBeNull();
+  });
+
+  it("falls back to the trailing-punctuation spelling", () => {
+    const el = render("thanks @alice.");
+    expect(el.querySelector(".mention")?.textContent).toBe("@alice.");
+  });
+
+  it("marks a mention of the signed-in user with mention-self", () => {
+    const el = render("hey @me and @alice");
+    const spans = el.querySelectorAll(".mention");
+    expect(spans.length).toBe(2);
+    expect(spans[0]?.classList.contains("mention-self")).toBe(true);
+    expect(spans[1]?.classList.contains("mention-self")).toBe(false);
+  });
+
+  it("prefers the server-resolved id for the spelling it matched", () => {
+    // Two users could plausibly answer to "alice"; the server's list decides.
+    membersStore.setState((prev) => ({
+      ...prev,
+      members: new Map([
+        ...prev.members,
+        [
+          20,
+          { id: 20, username: "Alice", avatar: null, role: "member", status: "online" as const },
+        ],
+      ]),
+    }));
+    const el = render("hi @alice", { mentions: [20] });
+    expect(el.querySelector(".mention")?.getAttribute("data-user-id")).toBe("20");
+  });
+});
+
+describe("@everyone / @here", () => {
+  it("highlights when the server honoured the token", () => {
+    const el = render("heads up @everyone", { mentionsEveryone: true });
+    const span = el.querySelector(".mention");
+    expect(span?.classList.contains("mention-everyone")).toBe(true);
+    expect(span?.textContent).toBe("@everyone");
+  });
+
+  it("highlights @here the same way", () => {
+    const el = render("@here now", { mentionsEveryone: true });
+    expect(el.querySelector(".mention-everyone")?.textContent).toBe("@here");
+  });
+
+  it("stays plain text when the sender lacked MENTION_EVERYONE", () => {
+    const el = render("heads up @everyone", { mentionsEveryone: false });
+    expect(el.querySelector(".mention")).toBeNull();
+    expect(el.textContent).toBe("heads up @everyone");
+  });
+
+  it("stays plain text when the server said nothing", () => {
+    const el = render("heads up @here");
+    expect(el.querySelector(".mention")).toBeNull();
+  });
+
+  it("never resolves @everyone as a username", () => {
+    membersStore.setState((prev) => ({
+      ...prev,
+      members: new Map([
+        ...prev.members,
+        [
+          30,
+          { id: 30, username: "everyone", avatar: null, role: "member", status: "online" as const },
+        ],
+      ]),
+    }));
+    expect(resolveMentionUserId("everyone")).toBeNull();
+  });
+});
+
+describe("#channel links", () => {
+  it("renders a chip for a channel that exists", () => {
+    const el = render("see #off-topic");
+    const chip = el.querySelector(".channel-mention");
+    expect(chip?.textContent).toBe("#off-topic");
+    expect(chip?.getAttribute("data-channel-id")).toBe("2");
+    expect(chip?.getAttribute("role")).toBe("link");
+  });
+
+  it("uses the channel's canonical casing", () => {
+    const el = render("see #GENERAL");
+    expect(el.querySelector(".channel-mention")?.textContent).toBe("#general");
+  });
+
+  it("leaves an unknown channel name as plain text", () => {
+    const el = render("see #nowhere");
+    expect(el.querySelector(".channel-mention")).toBeNull();
+    expect(el.textContent).toBe("see #nowhere");
+  });
+
+  it("does not link DM channels", () => {
+    const el = render("see #dm-3");
+    expect(el.querySelector(".channel-mention")).toBeNull();
+  });
+
+  it("activates the channel on click", () => {
+    const el = render("go to #off-topic");
+    (el.querySelector(".channel-mention") as HTMLElement).click();
+    channelsStore.flush();
+    expect(channelsStore.getState().activeChannelId).toBe(2);
+  });
+
+  it("activates the channel on Enter", () => {
+    const el = render("go to #off-topic");
+    const chip = el.querySelector(".channel-mention") as HTMLElement;
+    chip.dispatchEvent(new KeyboardEvent("keydown", { key: "Enter", bubbles: true }));
+    channelsStore.flush();
+    expect(channelsStore.getState().activeChannelId).toBe(2);
+  });
+
+  it("interleaves mentions and channel links in source order", () => {
+    const el = render("@alice see #general then @Bob");
+    const nodes = Array.from(el.querySelectorAll(".mention, .channel-mention"));
+    expect(nodes.map((n) => n.textContent)).toEqual(["@alice", "#general", "@Bob"]);
+  });
+});
+
+describe("code segments", () => {
+  it("does not linkify tokens inside a code block", () => {
+    container.appendChild(renderMessageContent("```@alice #general```"));
+    expect(container.querySelector(".mention")).toBeNull();
+    expect(container.querySelector(".channel-mention")).toBeNull();
+  });
+
+  it("does not linkify tokens inside inline code", () => {
+    container.appendChild(renderMessageContent("run `@alice` now"));
+    expect(container.querySelector(".mention")).toBeNull();
+  });
+});
+
+describe("row highlight", () => {
+  function makeMessage(overrides: Partial<Message> = {}): Message {
+    return {
+      id: 1,
+      channelId: 1,
+      user: { id: 10, username: "alice", avatar: null },
+      content: "hello",
+      replyTo: null,
+      attachments: [],
+      reactions: [],
+      pinned: false,
+      editedAt: null,
+      deleted: false,
+      timestamp: "2026-01-15T12:30:00Z",
+      status: "sent",
+      correlationId: null,
+      errorCode: null,
+      ...overrides,
+    };
+  }
+
+  const opts = {
+    channelId: 1,
+    channelName: "general",
+    currentUserId: 12,
+    onScrollTop: vi.fn(),
+    onReplyClick: vi.fn(),
+    onEditClick: vi.fn(),
+    onDeleteClick: vi.fn(),
+    onReactionClick: vi.fn(),
+    onPinClick: vi.fn(),
+  } as unknown as MessageListOptions;
+
+  function rowClasses(msg: Message): DOMTokenList {
+    const ac = new AbortController();
+    const el = renderMessage(msg, false, [msg], opts, ac.signal);
+    ac.abort();
+    return el.classList;
+  }
+
+  it("adds .mentioned when the server names the current user", () => {
+    expect(
+      rowClasses(makeMessage({ content: "hey @me", mentions: [12] })).contains("mentioned"),
+    ).toBe(true);
+  });
+
+  it("adds .mentioned for an honoured @everyone", () => {
+    expect(
+      rowClasses(makeMessage({ content: "@everyone", mentionsEveryone: true })).contains(
+        "mentioned",
+      ),
+    ).toBe(true);
+  });
+
+  it("does not add .mentioned for someone else's mention", () => {
+    expect(
+      rowClasses(makeMessage({ content: "hey @alice", mentions: [10] })).contains("mentioned"),
+    ).toBe(false);
+  });
+
+  it("trusts the server list over the local name parse", () => {
+    // The text names the current user, but the server resolved someone else
+    // (e.g. the username changed since) — the server wins.
+    expect(
+      rowClasses(makeMessage({ content: "hey @me", mentions: [10] })).contains("mentioned"),
+    ).toBe(false);
+  });
+
+  it("falls back to name resolution when the server sent no list", () => {
+    expect(rowClasses(makeMessage({ content: "hey @me" })).contains("mentioned")).toBe(true);
+  });
+
+  it("does not highlight a deleted row", () => {
+    expect(
+      rowClasses(makeMessage({ content: "hey @me", mentions: [12], deleted: true })).contains(
+        "mentioned",
+      ),
+    ).toBe(false);
+  });
+});
+
+describe("mention predicates", () => {
+  it("mentionsCurrentUser ignores @everyone", () => {
+    expect(mentionsCurrentUser("@everyone", { mentionsEveryone: true })).toBe(false);
+  });
+
+  it("highlightsCurrentUser counts @everyone", () => {
+    expect(highlightsCurrentUser("@everyone", { mentionsEveryone: true })).toBe(true);
+  });
+
+  it("is false when nobody is signed in", () => {
+    authStore.setState((prev) => ({ ...prev, user: null }));
+    expect(mentionsCurrentUser("hey @me")).toBe(false);
+  });
+});
diff --git a/Client/tauri-client/tests/unit/message-input.test.ts b/Client/tauri-client/tests/unit/message-input.test.ts
index 9f0cf376..010b87af 100644
--- a/Client/tauri-client/tests/unit/message-input.test.ts
+++ b/Client/tauri-client/tests/unit/message-input.test.ts
@@ -30,7 +30,11 @@ vi.mock("@components/GifPicker", () => ({
   },
 }));
 
-import { createMessageInput, type MessageInputOptions } from "@components/MessageInput";
+import {
+  createMessageInput,
+  wrapWithMarker,
+  type MessageInputOptions,
+} from "@components/MessageInput";
 import type { GifApi } from "@lib/gifProvider";
 
 /** GIF endpoints on the user's own server (never api.klipy.com). */
@@ -972,4 +976,134 @@ describe("MessageInput", () => {
       comp.destroy?.();
     });
   });
+
+  // -------------------------------------------------------------------------
+  // Formatting shortcuts
+  // -------------------------------------------------------------------------
+
+  describe("formatting shortcuts", () => {
+    /** Mount a composer with `value` selected from `start` to `end`. */
+    function mountWithSelection(
+      value: string,
+      start: number,
+      end: number,
+    ): { textarea: HTMLTextAreaElement; destroy: () => void } {
+      const comp = createMessageInput(makeOptions());
+      comp.mount(container);
+      const textarea = container.querySelector(".msg-textarea") as HTMLTextAreaElement;
+      textarea.value = value;
+      textarea.selectionStart = start;
+      textarea.selectionEnd = end;
+      return { textarea, destroy: () => comp.destroy?.() };
+    }
+
+    function press(textarea: HTMLTextAreaElement, key: string): KeyboardEvent {
+      const event = new KeyboardEvent("keydown", {
+        key,
+        ctrlKey: true,
+        bubbles: true,
+        cancelable: true,
+      });
+      textarea.dispatchEvent(event);
+      return event;
+    }
+
+    it("Ctrl+B wraps the selection in **", () => {
+      const { textarea, destroy } = mountWithSelection("make this bold", 5, 9);
+      const event = press(textarea, "b");
+      expect(textarea.value).toBe("make **this** bold");
+      expect(textarea.value.slice(textarea.selectionStart, textarea.selectionEnd)).toBe("this");
+      expect(event.defaultPrevented).toBe(true);
+      destroy();
+    });
+
+    it("Ctrl+I wraps the selection in *", () => {
+      const { textarea, destroy } = mountWithSelection("hello", 0, 5);
+      press(textarea, "i");
+      expect(textarea.value).toBe("*hello*");
+      destroy();
+    });
+
+    it("Ctrl+U wraps the selection in __ instead of opening the file picker", () => {
+      const onUploadFile = vi.fn();
+      const comp = createMessageInput(makeOptions({ onUploadFile }));
+      comp.mount(container);
+      const textarea = container.querySelector(".msg-textarea") as HTMLTextAreaElement;
+      textarea.value = "hello";
+      textarea.selectionStart = 0;
+      textarea.selectionEnd = 5;
+
+      // The global Ctrl+U shortcut listens on document — the composer must
+      // stop the event before it gets there.
+      const globalHandler = vi.fn();
+      document.addEventListener("keydown", globalHandler);
+
+      press(textarea, "u");
+
+      expect(textarea.value).toBe("__hello__");
+      expect(globalHandler).not.toHaveBeenCalled();
+      expect(onUploadFile).not.toHaveBeenCalled();
+      document.removeEventListener("keydown", globalHandler);
+      comp.destroy?.();
+    });
+
+    it("inserts empty markers and parks the caret between them", () => {
+      const { textarea, destroy } = mountWithSelection("ab", 1, 1);
+      press(textarea, "b");
+      expect(textarea.value).toBe("a****b");
+      expect(textarea.selectionStart).toBe(3);
+      expect(textarea.selectionEnd).toBe(3);
+      destroy();
+    });
+
+    it("unwraps an already-bold selection", () => {
+      const { textarea, destroy } = mountWithSelection("**this**", 0, 8);
+      press(textarea, "b");
+      expect(textarea.value).toBe("this");
+      destroy();
+    });
+
+    it("leaves other Ctrl combos alone", () => {
+      const { textarea, destroy } = mountWithSelection("hello", 0, 5);
+      const event = press(textarea, "k");
+      expect(textarea.value).toBe("hello");
+      expect(event.defaultPrevented).toBe(false);
+      destroy();
+    });
+
+    it("does nothing while the composer is disabled", () => {
+      const comp = createMessageInput(makeOptions());
+      comp.mount(container);
+      comp.setDisabled("Read-only channel");
+      const textarea = container.querySelector(".msg-textarea") as HTMLTextAreaElement;
+      textarea.value = "hello";
+      textarea.selectionStart = 0;
+      textarea.selectionEnd = 5;
+      press(textarea, "b");
+      expect(textarea.value).toBe("hello");
+      comp.destroy?.();
+    });
+  });
+
+  describe("wrapWithMarker", () => {
+    it("wraps a selection and reselects the inner text", () => {
+      expect(wrapWithMarker("abc", 1, 2, "~~")).toEqual({
+        value: "a~~b~~c",
+        selectionStart: 3,
+        selectionEnd: 4,
+      });
+    });
+
+    it("unwraps markers that surround the selection", () => {
+      expect(wrapWithMarker("a**b**c", 3, 4, "**")).toEqual({
+        value: "abc",
+        selectionStart: 1,
+        selectionEnd: 2,
+      });
+    });
+
+    it("does not mistake a short selection for a wrapped one", () => {
+      expect(wrapWithMarker("**", 0, 2, "**").value).toBe("******");
+    });
+  });
 });
diff --git a/Client/tauri-client/tests/unit/message-jump.test.ts b/Client/tauri-client/tests/unit/message-jump.test.ts
new file mode 100644
index 00000000..843cb589
--- /dev/null
+++ b/Client/tauri-client/tests/unit/message-jump.test.ts
@@ -0,0 +1,629 @@
+/**
+ * Message navigation: the jump orchestrator, the affordances that feed it, and
+ * the "Jump to Present" pill that says the bottom of the list is not "now".
+ *
+ * The behaviour worth pinning is what happens when the target is *not* loaded.
+ * Before this, a search hit or pinned entry outside the loaded page simply said
+ * "not in loaded history" and stopped; now every jump goes through one path
+ * that fetches the around-window, detaches the channel, and scrolls.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+
+vi.mock("@lib/livekitSession", () => ({
+  leaveVoice: vi.fn(),
+  switchInputDevice: vi.fn(),
+  switchOutputDevice: vi.fn(),
+  setVoiceSensitivity: vi.fn(),
+  setInputVolume: vi.fn(),
+  setOutputVolume: vi.fn(),
+  getSessionDebugInfo: vi.fn().mockReturnValue({}),
+}));
+
+const toastCalls: Array<{ msg: string; type: string }> = [];
+vi.mock("@lib/toast", () => ({
+  showToast: (msg: string, type: string) => {
+    toastCalls.push({ msg, type });
+  },
+  initToast: vi.fn(),
+}));
+
+// jsdom has no ResizeObserver — MessageList needs one to mount.
+if (typeof globalThis.ResizeObserver === "undefined") {
+  globalThis.ResizeObserver = class {
+    observe(): void {}
+    unobserve(): void {}
+    disconnect(): void {}
+  } as unknown as typeof ResizeObserver;
+}
+
+import { createMessageJumper } from "../../src/pages/main-page/MessageJump";
+import { createMessageList } from "@components/MessageList";
+import type { MessageListOptions } from "@components/MessageList";
+import { renderMessage } from "../../src/components/message-list/renderers";
+import { renderMentionSegment } from "../../src/components/message-list/content-parser";
+import {
+  jumpToMessage,
+  setMessageJumpHandler,
+  hasMessageJumpHandler,
+} from "@lib/message-navigation";
+import { messagesStore, setAroundMessages } from "@stores/messages.store";
+import type { Message } from "@stores/messages.store";
+import { channelsStore, setChannels } from "@stores/channels.store";
+import { membersStore } from "@stores/members.store";
+import { authStore } from "@stores/auth.store";
+import { ApiClientError } from "@lib/api";
+import type { ApiClient } from "@lib/api";
+import type { MessageResponse, ReadyChannel } from "@lib/types";
+
+const CHANNELS: ReadyChannel[] = [
+  { id: 1, name: "general", type: "text", category: null, position: 0 },
+  { id: 2, name: "off-topic", type: "text", category: null, position: 1 },
+];
+
+function resetStores(): void {
+  messagesStore.setState(() => ({
+    messagesByChannel: new Map(),
+    pendingSends: new Map(),
+    loadedChannels: new Set(),
+    hasMore: new Map(),
+    historyLoadState: new Map(),
+    detachedChannels: new Set(),
+  }));
+  membersStore.setState(() => ({ members: new Map(), typingUsers: new Map() }));
+  authStore.setState(() => ({
+    token: "t",
+    user: { id: 1, username: "alice", avatar: null, role: "member" },
+    serverName: null,
+    motd: null,
+    isAuthenticated: true,
+  }));
+  channelsStore.setState(() => ({ channels: new Map(), activeChannelId: null, roles: [] }));
+  setChannels(CHANNELS);
+  toastCalls.length = 0;
+}
+
+function makeMessage(overrides: Partial<Message> & { id: number }): Message {
+  return {
+    channelId: 1,
+    user: { id: 1, username: "Alice", avatar: null },
+    content: `Message ${overrides.id}`,
+    replyTo: null,
+    attachments: [],
+    reactions: [],
+    pinned: false,
+    editedAt: null,
+    deleted: false,
+    timestamp: "2026-01-15T12:00:00Z",
+    status: "sent",
+    correlationId: null,
+    errorCode: null,
+    ...overrides,
+  };
+}
+
+function response(id: number): MessageResponse {
+  return {
+    id,
+    channel_id: 1,
+    user: { id: 1, username: "alice", avatar: null },
+    content: `msg ${id}`,
+    reply_to: null,
+    attachments: [],
+    reactions: [],
+    pinned: false,
+    edited_at: null,
+    deleted: false,
+    timestamp: "2026-01-15T11:00:00Z",
+  };
+}
+
+/** A stand-in ChannelController: only what the jumper actually touches. */
+function fakeCtrl(channelId: number | null, scrollResult = true) {
+  const scrollToMessage = vi.fn().mockReturnValue(scrollResult);
+  return {
+    ctrl: {
+      currentChannelId: channelId,
+      messageList: { scrollToMessage, mount: vi.fn(), destroy: vi.fn() },
+      mountChannel: vi.fn(),
+      destroyChannel: vi.fn(),
+      openFilePicker: vi.fn(),
+    },
+    scrollToMessage,
+  };
+}
+
+function fakeApi(getMessagesAround: unknown): ApiClient {
+  return { getMessagesAround } as unknown as ApiClient;
+}
+
+/** Resolve immediately instead of waiting for a real animation frame. */
+const immediateFrame = (): Promise<void> => Promise.resolve();
+
+/** Store notifications are batched via queueMicrotask — let them land. */
+const flushStore = (): Promise<void> => Promise.resolve();
+
+beforeEach(() => {
+  resetStores();
+});
+
+// ---------------------------------------------------------------------------
+
+describe("createMessageJumper", () => {
+  it("scrolls without fetching when the message is already loaded", async () => {
+    const { ctrl, scrollToMessage } = fakeCtrl(1);
+    const getMessagesAround = vi.fn();
+    const jumper = createMessageJumper({
+      api: fakeApi(getMessagesAround),
+      getChannelCtrl: () => ctrl,
+      nextFrame: immediateFrame,
+    });
+
+    await expect(jumper.jumpTo(1, 42)).resolves.toBe(true);
+
+    expect(scrollToMessage).toHaveBeenCalledWith(42);
+    expect(getMessagesAround).not.toHaveBeenCalled();
+  });
+
+  it("fetches the around-window when the message is not loaded, then scrolls", async () => {
+    // First scroll attempt misses (not loaded), second lands after the fetch.
+    const scrollToMessage = vi.fn().mockReturnValueOnce(false).mockReturnValue(true);
+    const ctrl = {
+      currentChannelId: 1,
+      messageList: { scrollToMessage },
+    } as unknown as ReturnType<typeof fakeCtrl>["ctrl"];
+    const getMessagesAround = vi.fn().mockResolvedValue({
+      messages: [response(40), response(41), response(42)],
+      has_more_before: true,
+      has_more_after: true,
+    });
+    const jumper = createMessageJumper({
+      api: fakeApi(getMessagesAround),
+      getChannelCtrl: () => ctrl,
+      nextFrame: immediateFrame,
+    });
+
+    await expect(jumper.jumpTo(1, 42)).resolves.toBe(true);
+
+    expect(getMessagesAround).toHaveBeenCalledWith(1, 42, { limit: 50 });
+    // The window landed in the store and left the channel detached.
+    expect(
+      messagesStore
+        .getState()
+        .messagesByChannel.get(1)
+        ?.map((m) => m.id),
+    ).toEqual([40, 41, 42]);
+    expect(messagesStore.getState().detachedChannels.has(1)).toBe(true);
+  });
+
+  it("opens the channel first when the target lives elsewhere", async () => {
+    const scrollToMessage = vi.fn().mockReturnValue(true);
+    const ctrl = {
+      currentChannelId: 1,
+      messageList: { scrollToMessage },
+    } as unknown as ReturnType<typeof fakeCtrl>["ctrl"];
+    const jumper = createMessageJumper({
+      api: fakeApi(vi.fn()),
+      getChannelCtrl: () => ctrl,
+      nextFrame: () => {
+        // The channel switch is what the frame is waiting for.
+        (ctrl as { currentChannelId: number }).currentChannelId = 2;
+        return Promise.resolve();
+      },
+    });
+
+    await jumper.jumpTo(2, 7);
+
+    expect(channelsStore.getState().activeChannelId).toBe(2);
+    expect(scrollToMessage).toHaveBeenCalledWith(7);
+  });
+
+  it("refuses a channel this user cannot see, without calling the API", async () => {
+    const { ctrl } = fakeCtrl(1);
+    const getMessagesAround = vi.fn();
+    const jumper = createMessageJumper({
+      api: fakeApi(getMessagesAround),
+      getChannelCtrl: () => ctrl,
+      nextFrame: immediateFrame,
+    });
+
+    await expect(jumper.jumpTo(999, 42)).resolves.toBe(false);
+
+    expect(getMessagesAround).not.toHaveBeenCalled();
+    expect(toastCalls.at(-1)?.msg).toMatch(/isn't available/i);
+  });
+
+  it("reports a deleted or missing message from a 404", async () => {
+    const scrollToMessage = vi.fn().mockReturnValue(false);
+    const ctrl = {
+      currentChannelId: 1,
+      messageList: { scrollToMessage },
+    } as unknown as ReturnType<typeof fakeCtrl>["ctrl"];
+    const jumper = createMessageJumper({
+      api: fakeApi(
+        vi.fn().mockRejectedValue(new ApiClientError(404, "NOT_FOUND", "message not found")),
+      ),
+      getChannelCtrl: () => ctrl,
+      nextFrame: immediateFrame,
+    });
+
+    await expect(jumper.jumpTo(1, 42)).resolves.toBe(false);
+
+    expect(toastCalls.at(-1)?.msg).toMatch(/no longer exists/i);
+    // A failed jump must not detach the channel from the live tail.
+    expect(messagesStore.getState().detachedChannels.has(1)).toBe(false);
+  });
+
+  it("surfaces a transport failure without detaching the channel", async () => {
+    const scrollToMessage = vi.fn().mockReturnValue(false);
+    const ctrl = {
+      currentChannelId: 1,
+      messageList: { scrollToMessage },
+    } as unknown as ReturnType<typeof fakeCtrl>["ctrl"];
+    const jumper = createMessageJumper({
+      api: fakeApi(vi.fn().mockRejectedValue(new Error("offline"))),
+      getChannelCtrl: () => ctrl,
+      nextFrame: immediateFrame,
+    });
+
+    await expect(jumper.jumpTo(1, 42)).resolves.toBe(false);
+
+    expect(toastCalls.at(-1)?.type).toBe("error");
+    expect(messagesStore.getState().detachedChannels.has(1)).toBe(false);
+  });
+
+  it("fails loudly when the window comes back without the centre", async () => {
+    const scrollToMessage = vi.fn().mockReturnValue(false);
+    const ctrl = {
+      currentChannelId: 1,
+      messageList: { scrollToMessage },
+    } as unknown as ReturnType<typeof fakeCtrl>["ctrl"];
+    const jumper = createMessageJumper({
+      api: fakeApi(
+        vi.fn().mockResolvedValue({
+          messages: [response(1), response(2)],
+          has_more_before: false,
+          has_more_after: false,
+        }),
+      ),
+      getChannelCtrl: () => ctrl,
+      nextFrame: immediateFrame,
+    });
+
+    // Landing silently on a neighbour would look like a successful jump to the
+    // wrong message.
+    await expect(jumper.jumpTo(1, 42)).resolves.toBe(false);
+    expect(toastCalls.at(-1)?.type).toBe("error");
+  });
+
+  it("gives up quietly with no mounted channel controller", async () => {
+    const jumper = createMessageJumper({
+      api: fakeApi(vi.fn()),
+      getChannelCtrl: () => null,
+      nextFrame: immediateFrame,
+    });
+
+    await expect(jumper.jumpTo(1, 42)).resolves.toBe(false);
+  });
+});
+
+// ---------------------------------------------------------------------------
+
+describe("message-navigation registry", () => {
+  it("is a no-op before a page registers a handler", () => {
+    expect(hasMessageJumpHandler()).toBe(false);
+    expect(() => jumpToMessage(1, 2)).not.toThrow();
+  });
+
+  it("routes jumps to the registered handler and unregisters cleanly", () => {
+    const handler = vi.fn();
+    const unregister = setMessageJumpHandler(handler);
+
+    jumpToMessage(5, 42);
+    expect(handler).toHaveBeenCalledWith(5, 42);
+
+    unregister();
+    expect(hasMessageJumpHandler()).toBe(false);
+  });
+
+  it("a stale unregister does not clear a newer handler", () => {
+    const first = vi.fn();
+    const unregisterFirst = setMessageJumpHandler(first);
+    const second = vi.fn();
+    setMessageJumpHandler(second);
+
+    unregisterFirst();
+
+    jumpToMessage(1, 1);
+    expect(second).toHaveBeenCalled();
+    expect(first).not.toHaveBeenCalled();
+    expect(hasMessageJumpHandler()).toBe(true);
+  });
+
+  afterEach(() => {
+    setMessageJumpHandler(() => {})();
+  });
+});
+
+// ---------------------------------------------------------------------------
+
+describe("reply bar jump wiring", () => {
+  function renderRow(msg: Message, all: Message[], opts: Partial<MessageListOptions> = {}) {
+    const options = {
+      channelId: 1,
+      channelName: "general",
+      currentUserId: 1,
+      onScrollTop: vi.fn(),
+      onReplyClick: vi.fn(),
+      onEditClick: vi.fn(),
+      onDeleteClick: vi.fn(),
+      onReactionClick: vi.fn(),
+      onPinClick: vi.fn(),
+      ...opts,
+    } as MessageListOptions;
+    return renderMessage(msg, false, all, options, new AbortController().signal);
+  }
+
+  it("clicking the quoted bar jumps to the replied-to message", () => {
+    const onJumpToMessage = vi.fn();
+    const target = makeMessage({ id: 10, content: "the original" });
+    const reply = makeMessage({ id: 11, replyTo: 10 });
+
+    const row = renderRow(reply, [target, reply], { onJumpToMessage });
+    const bar = row.querySelector<HTMLElement>(".msg-reply-ref");
+    expect(bar).not.toBeNull();
+    bar!.click();
+
+    expect(onJumpToMessage).toHaveBeenCalledWith(10);
+  });
+
+  it("stays clickable when the replied-to message is outside the window", () => {
+    // The id is known even though the row is not loaded — that is exactly the
+    // case the around-window fetch exists for.
+    const onJumpToMessage = vi.fn();
+    const reply = makeMessage({ id: 11, replyTo: 999 });
+
+    const row = renderRow(reply, [reply], { onJumpToMessage });
+    const bar = row.querySelector<HTMLElement>(".msg-reply-ref");
+    expect(bar?.textContent).toMatch(/unknown message/i);
+    expect(bar?.getAttribute("data-reply-to")).toBe("999");
+
+    bar!.click();
+    expect(onJumpToMessage).toHaveBeenCalledWith(999);
+  });
+
+  it("is keyboard reachable and activates on Enter", () => {
+    const onJumpToMessage = vi.fn();
+    const target = makeMessage({ id: 10 });
+    const reply = makeMessage({ id: 11, replyTo: 10 });
+
+    const row = renderRow(reply, [target, reply], { onJumpToMessage });
+    const bar = row.querySelector<HTMLElement>(".msg-reply-ref")!;
+    expect(bar.getAttribute("role")).toBe("button");
+    expect(bar.getAttribute("tabindex")).toBe("0");
+
+    bar.dispatchEvent(new KeyboardEvent("keydown", { key: "Enter", bubbles: true }));
+    expect(onJumpToMessage).toHaveBeenCalledWith(10);
+  });
+
+  it("does nothing when no jump handler is wired", () => {
+    const reply = makeMessage({ id: 11, replyTo: 10 });
+    const row = renderRow(reply, [reply]);
+    expect(() => row.querySelector<HTMLElement>(".msg-reply-ref")!.click()).not.toThrow();
+  });
+});
+
+// ---------------------------------------------------------------------------
+
+describe("Copy Message Link action", () => {
+  it("copies the owncord:// permalink for the row", async () => {
+    const writeText = vi.fn().mockResolvedValue(undefined);
+    Object.defineProperty(navigator, "clipboard", {
+      value: { writeText },
+      configurable: true,
+    });
+
+    const msg = makeMessage({ id: 42, channelId: 7 });
+    const row = renderMessage(
+      msg,
+      false,
+      [msg],
+      {
+        channelId: 7,
+        channelName: "general",
+        currentUserId: 1,
+        onScrollTop: vi.fn(),
+        onReplyClick: vi.fn(),
+        onEditClick: vi.fn(),
+        onDeleteClick: vi.fn(),
+        onReactionClick: vi.fn(),
+        onPinClick: vi.fn(),
+      } as MessageListOptions,
+      new AbortController().signal,
+    );
+
+    const btn = row.querySelector<HTMLButtonElement>('[data-testid="msg-copy-link-42"]');
+    expect(btn).not.toBeNull();
+    btn!.click();
+    await Promise.resolve();
+
+    expect(writeText).toHaveBeenCalledWith("owncord://message/7/42");
+  });
+});
+
+// ---------------------------------------------------------------------------
+
+describe("permalink chips in message content", () => {
+  let container: HTMLDivElement;
+
+  beforeEach(() => {
+    container = document.createElement("div");
+    document.body.appendChild(container);
+  });
+
+  afterEach(() => {
+    container.remove();
+  });
+
+  it("renders a pasted permalink as a compact chip naming the channel", () => {
+    container.appendChild(renderMentionSegment("see owncord://message/2/99 for context"));
+
+    const chip = container.querySelector<HTMLElement>(".message-link-chip");
+    expect(chip).not.toBeNull();
+    expect(chip!.querySelector(".mlc-channel")?.textContent).toBe("#off-topic");
+    expect(chip!.querySelector(".mlc-action")?.textContent).toBe("Jump");
+    expect(chip!.getAttribute("data-channel-id")).toBe("2");
+    expect(chip!.getAttribute("data-message-id")).toBe("99");
+    // The raw URL is gone — the chip replaced it, not decorated it.
+    expect(container.textContent).not.toContain("owncord://");
+  });
+
+  it("clicking the chip routes through the jump registry", () => {
+    const handler = vi.fn();
+    const unregister = setMessageJumpHandler(handler);
+    container.appendChild(renderMentionSegment("owncord://message/2/99"));
+
+    container.querySelector<HTMLElement>(".message-link-chip")!.click();
+
+    expect(handler).toHaveBeenCalledWith(2, 99);
+    unregister();
+  });
+
+  it("activates on Enter for keyboard users", () => {
+    const handler = vi.fn();
+    const unregister = setMessageJumpHandler(handler);
+    container.appendChild(renderMentionSegment("owncord://message/1/5"));
+
+    const chip = container.querySelector<HTMLElement>(".message-link-chip")!;
+    expect(chip.getAttribute("role")).toBe("link");
+    expect(chip.getAttribute("tabindex")).toBe("0");
+    chip.dispatchEvent(new KeyboardEvent("keydown", { key: "Enter", bubbles: true }));
+
+    expect(handler).toHaveBeenCalledWith(1, 5);
+    unregister();
+  });
+
+  it("leaves a link to an invisible channel as plain text", () => {
+    container.appendChild(renderMentionSegment("owncord://message/404/1"));
+
+    expect(container.querySelector(".message-link-chip")).toBeNull();
+    expect(container.textContent).toBe("owncord://message/404/1");
+  });
+
+  it("leaves a malformed permalink as plain text", () => {
+    container.appendChild(renderMentionSegment("owncord://message/abc/1"));
+
+    expect(container.querySelector(".message-link-chip")).toBeNull();
+    expect(container.textContent).toBe("owncord://message/abc/1");
+  });
+
+  it("chips several permalinks in one message", () => {
+    container.appendChild(renderMentionSegment("owncord://message/1/5 and owncord://message/2/6"));
+
+    expect(container.querySelectorAll(".message-link-chip")).toHaveLength(2);
+  });
+});
+
+// ---------------------------------------------------------------------------
+
+describe("Jump to Present pill", () => {
+  let container: HTMLDivElement;
+  let list: ReturnType<typeof createMessageList>;
+
+  function baseOptions(overrides: Partial<MessageListOptions> = {}): MessageListOptions {
+    return {
+      channelId: 1,
+      channelName: "general",
+      currentUserId: 1,
+      onScrollTop: vi.fn(),
+      onReplyClick: vi.fn(),
+      onEditClick: vi.fn(),
+      onDeleteClick: vi.fn(),
+      onReactionClick: vi.fn(),
+      onPinClick: vi.fn(),
+      ...overrides,
+    } as MessageListOptions;
+  }
+
+  beforeEach(() => {
+    container = document.createElement("div");
+    document.body.appendChild(container);
+  });
+
+  afterEach(() => {
+    list.destroy?.();
+    container.remove();
+  });
+
+  it("stays hidden while the window is attached to the live tail", () => {
+    list = createMessageList(baseOptions());
+    list.mount(container);
+
+    const pill = container.querySelector('[data-testid="jump-to-present"]');
+    expect(pill).not.toBeNull();
+    expect(pill!.classList.contains("visible")).toBe(false);
+  });
+
+  it("appears when an around-window detaches the channel", async () => {
+    list = createMessageList(baseOptions());
+    list.mount(container);
+
+    setAroundMessages(1, [response(1), response(2)], true, true);
+    await flushStore();
+
+    const pill = container.querySelector('[data-testid="jump-to-present"]')!;
+    expect(pill.classList.contains("visible")).toBe(true);
+  });
+
+  it("is already visible when mounting into an detached channel", () => {
+    setAroundMessages(1, [response(1)], true, true);
+
+    list = createMessageList(baseOptions());
+    list.mount(container);
+
+    expect(
+      container.querySelector('[data-testid="jump-to-present"]')!.classList.contains("visible"),
+    ).toBe(true);
+  });
+
+  it("hides again once the channel reattaches", async () => {
+    list = createMessageList(baseOptions());
+    list.mount(container);
+    setAroundMessages(1, [response(1)], true, true);
+    await flushStore();
+    expect(
+      container.querySelector('[data-testid="jump-to-present"]')!.classList.contains("visible"),
+    ).toBe(true);
+
+    setAroundMessages(1, [response(1)], true, false);
+    await flushStore();
+
+    expect(
+      container.querySelector('[data-testid="jump-to-present"]')!.classList.contains("visible"),
+    ).toBe(false);
+  });
+
+  it("clicking it asks the controller to reload the tail", async () => {
+    const onJumpToPresent = vi.fn();
+    list = createMessageList(baseOptions({ onJumpToPresent }));
+    list.mount(container);
+    setAroundMessages(1, [response(1)], true, true);
+    await flushStore();
+
+    container.querySelector<HTMLButtonElement>('[data-testid="jump-to-present"]')!.click();
+
+    expect(onJumpToPresent).toHaveBeenCalledTimes(1);
+  });
+
+  it("tracks only its own channel", async () => {
+    list = createMessageList(baseOptions());
+    list.mount(container);
+
+    setAroundMessages(2, [response(1)], true, true);
+    await flushStore();
+
+    expect(
+      container.querySelector('[data-testid="jump-to-present"]')!.classList.contains("visible"),
+    ).toBe(false);
+  });
+});
diff --git a/Client/tauri-client/tests/unit/message-list-media-release.test.ts b/Client/tauri-client/tests/unit/message-list-media-release.test.ts
index 7057993e..f33b6fde 100644
--- a/Client/tauri-client/tests/unit/message-list-media-release.test.ts
+++ b/Client/tauri-client/tests/unit/message-list-media-release.test.ts
@@ -41,6 +41,7 @@ function resetStores(): void {
     loadedChannels: new Set(),
     hasMore: new Map(),
     historyLoadState: new Map(),
+    detachedChannels: new Set(),
   }));
   membersStore.setState(() => ({
     members: new Map(),
diff --git a/Client/tauri-client/tests/unit/message-list-new-divider.test.ts b/Client/tauri-client/tests/unit/message-list-new-divider.test.ts
new file mode 100644
index 00000000..8de01a33
--- /dev/null
+++ b/Client/tauri-client/tests/unit/message-list-new-divider.test.ts
@@ -0,0 +1,233 @@
+/**
+ * The "NEW" divider: a line above the first message the reader has not seen,
+ * placed from the unread count the channel carried when it was opened (the
+ * badge itself is cleared by the visit, so the count has to be snapshotted).
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+
+if (typeof globalThis.ResizeObserver === "undefined") {
+  globalThis.ResizeObserver = class {
+    observe(): void {}
+    unobserve(): void {}
+    disconnect(): void {}
+  } as unknown as typeof ResizeObserver;
+}
+
+import { createMessageList } from "@components/MessageList";
+import type { MessageListOptions } from "@components/MessageList";
+import { messagesStore } from "@stores/messages.store";
+import { membersStore } from "@stores/members.store";
+import type { Message } from "@stores/messages.store";
+import { channelsStore, setChannels, setActiveChannel } from "@stores/channels.store";
+import type { ReadyChannel } from "@lib/types";
+
+const CHANNEL_ID = 1;
+
+function resetStores(): void {
+  messagesStore.setState(() => ({
+    messagesByChannel: new Map(),
+    pendingSends: new Map(),
+    loadedChannels: new Set(),
+    hasMore: new Map(),
+    historyLoadState: new Map(),
+    detachedChannels: new Set(),
+  }));
+  membersStore.setState(() => ({ members: new Map(), typingUsers: new Map() }));
+  channelsStore.setState(() => ({ channels: new Map(), activeChannelId: null, roles: [] }));
+}
+
+function makeMessage(id: number): Message {
+  return {
+    id,
+    channelId: CHANNEL_ID,
+    user: { id: 1, username: "Alice", avatar: null },
+    content: `Message ${id}`,
+    replyTo: null,
+    attachments: [],
+    reactions: [],
+    pinned: false,
+    editedAt: null,
+    deleted: false,
+    // Spaced far enough apart that grouping never merges rows.
+    timestamp: new Date(Date.UTC(2024, 0, 15, 12, id * 5)).toISOString(),
+    status: "sent",
+    correlationId: null,
+    errorCode: null,
+  };
+}
+
+function setMessages(messages: readonly Message[]): void {
+  messagesStore.setState((prev) => {
+    const next = new Map(prev.messagesByChannel);
+    next.set(CHANNEL_ID, [...messages]);
+    return { ...prev, messagesByChannel: next };
+  });
+}
+
+function setDetached(detached: boolean): void {
+  messagesStore.setState((prev) => {
+    const next = new Set(prev.detachedChannels);
+    if (detached) next.add(CHANNEL_ID);
+    else next.delete(CHANNEL_ID);
+    return { ...prev, detachedChannels: next };
+  });
+}
+
+/** Seed the channel list with `unread` unread messages, then "open" the channel
+ *  the way the app does — which clears the badge and snapshots the count. */
+function openChannelWithUnread(unread: number): void {
+  const ch: ReadyChannel = {
+    id: CHANNEL_ID,
+    name: "general",
+    type: "text",
+    category: null,
+    position: 0,
+    unread_count: unread,
+    mention_count: 0,
+  };
+  setChannels([ch]);
+  setActiveChannel(CHANNEL_ID);
+}
+
+describe("MessageList — new-messages divider", () => {
+  let container: HTMLDivElement;
+  let msgList: ReturnType<typeof createMessageList> | null = null;
+  let options: MessageListOptions;
+
+  beforeEach(() => {
+    resetStores();
+    container = document.createElement("div");
+    document.body.appendChild(container);
+    options = {
+      channelId: CHANNEL_ID,
+      channelName: "general",
+      currentUserId: 1,
+      onScrollTop: vi.fn(),
+      onReplyClick: vi.fn(),
+      onEditClick: vi.fn(),
+      onDeleteClick: vi.fn(),
+      onReactionClick: vi.fn(),
+      onPinClick: vi.fn(),
+    };
+  });
+
+  afterEach(() => {
+    msgList?.destroy?.();
+    msgList = null;
+    container.remove();
+  });
+
+  function mount(): void {
+    msgList = createMessageList(options);
+    msgList.mount(container);
+  }
+
+  function dividerIndex(): number {
+    const rows = [...container.querySelectorAll(".virtual-content > *")];
+    return rows.findIndex((el) => el.classList.contains("msg-new-divider"));
+  }
+
+  it("renders no divider when the channel was opened with nothing unread", () => {
+    setMessages([1, 2, 3].map(makeMessage));
+    openChannelWithUnread(0);
+    mount();
+
+    expect(container.querySelector('[data-testid="new-messages-divider"]')).toBeNull();
+  });
+
+  it("places the divider above the first unread message", () => {
+    setMessages([1, 2, 3, 4, 5].map(makeMessage));
+    openChannelWithUnread(2);
+    mount();
+
+    const divider = container.querySelector('[data-testid="new-messages-divider"]');
+    expect(divider).not.toBeNull();
+    expect(divider?.textContent).toContain("NEW");
+
+    // The row right after the divider must be message 4 — the first of the
+    // last two (unread) messages.
+    const next = divider?.nextElementSibling as HTMLElement;
+    expect(next.dataset.testid).toBe("message-4");
+  });
+
+  it("places the divider at the top when every loaded message is unread", () => {
+    setMessages([1, 2, 3].map(makeMessage));
+    openChannelWithUnread(10);
+    mount();
+
+    // Index 0 is the day divider; the NEW line comes right after it and
+    // before the first message.
+    const idx = dividerIndex();
+    expect(idx).toBeGreaterThanOrEqual(0);
+    const next = container.querySelectorAll(".virtual-content > *")[idx + 1] as HTMLElement;
+    expect(next.dataset.testid).toBe("message-1");
+  });
+
+  it("renders exactly one divider", () => {
+    setMessages([1, 2, 3, 4, 5].map(makeMessage));
+    openChannelWithUnread(3);
+    mount();
+
+    expect(container.querySelectorAll('[data-testid="new-messages-divider"]')).toHaveLength(1);
+  });
+
+  it("renders no divider for an empty channel", () => {
+    setMessages([]);
+    openChannelWithUnread(5);
+    mount();
+
+    expect(container.querySelector('[data-testid="new-messages-divider"]')).toBeNull();
+  });
+
+  // A detached window is a slice around some old message, so "the last N
+  // loaded messages" no longer identifies the unread ones.
+  it("suppresses the divider while the window is detached", () => {
+    setMessages([1, 2, 3, 4, 5].map(makeMessage));
+    openChannelWithUnread(2);
+    setDetached(true);
+    mount();
+
+    expect(container.querySelector('[data-testid="new-messages-divider"]')).toBeNull();
+  });
+
+  it("clears on the next visit to the channel", () => {
+    setMessages([1, 2, 3, 4, 5].map(makeMessage));
+    openChannelWithUnread(2);
+    mount();
+    expect(container.querySelector('[data-testid="new-messages-divider"]')).not.toBeNull();
+
+    // Leave and come back: the badge is gone now, so no divider.
+    msgList?.destroy?.();
+    container.remove();
+    container = document.createElement("div");
+    document.body.appendChild(container);
+    setActiveChannel(null);
+    setActiveChannel(CHANNEL_ID);
+    mount();
+
+    expect(container.querySelector('[data-testid="new-messages-divider"]')).toBeNull();
+  });
+
+  // The line marks a boundary; the message under it must not be rendered as a
+  // grouped continuation of the message above the line.
+  it("breaks message grouping at the divider", () => {
+    const sameMinute = [1, 2, 3].map((id) => ({
+      ...makeMessage(id),
+      timestamp: "2024-01-15T12:00:00Z",
+    }));
+    setMessages(sameMinute);
+    openChannelWithUnread(1);
+    mount();
+
+    const divider = container.querySelector('[data-testid="new-messages-divider"]');
+    const first = divider?.nextElementSibling as HTMLElement;
+    expect(first.dataset.testid).toBe("message-3");
+    expect(first.classList.contains("grouped")).toBe(false);
+    // The message before the line is still grouped — only the boundary breaks.
+    expect(
+      (container.querySelector('[data-testid="message-2"]') as HTMLElement).classList.contains(
+        "grouped",
+      ),
+    ).toBe(true);
+  });
+});
diff --git a/Client/tauri-client/tests/unit/message-list.test.ts b/Client/tauri-client/tests/unit/message-list.test.ts
index 18e07031..9e361a2f 100644
--- a/Client/tauri-client/tests/unit/message-list.test.ts
+++ b/Client/tauri-client/tests/unit/message-list.test.ts
@@ -28,6 +28,7 @@ function resetStores(): void {
     loadedChannels: new Set(),
     hasMore: new Map(),
     historyLoadState: new Map(),
+    detachedChannels: new Set(),
   }));
   membersStore.setState(() => ({
     members: new Map(),
@@ -227,6 +228,30 @@ describe("MessageList", () => {
     expect(result).toBe(false);
   });
 
+  it("scrollToMessage flashes the target row so the eye can find it", () => {
+    setMessages(1, [makeMessage({ id: 1 }), makeMessage({ id: 2 }), makeMessage({ id: 3 })]);
+    msgList.mount(container);
+
+    msgList.scrollToMessage(2);
+
+    // A scroll with no visual marker leaves the reader hunting; the row the
+    // jump landed on must be the one that flashes.
+    const flashed = container.querySelector(".highlight-flash");
+    expect(flashed).not.toBeNull();
+    expect(flashed!.getAttribute("data-testid")).toBe("message-2");
+  });
+
+  it("scrollToMessage renders a target that was outside the rendered window", () => {
+    // A long channel: without forcing a rebuild the target stays unrendered
+    // and there is nothing to scroll to or flash.
+    const many = Array.from({ length: 200 }, (_, i) => makeMessage({ id: i + 1 }));
+    setMessages(1, many);
+    msgList.mount(container);
+
+    expect(msgList.scrollToMessage(150)).toBe(true);
+    expect(container.querySelector('[data-testid="message-150"]')).not.toBeNull();
+  });
+
   it("renders day dividers between messages on different days", () => {
     const messages = [
       makeMessage({ id: 1, timestamp: "2024-01-15T12:00:00Z" }),
diff --git a/Client/tauri-client/tests/unit/messages-store-detached.test.ts b/Client/tauri-client/tests/unit/messages-store-detached.test.ts
new file mode 100644
index 00000000..4d62471b
--- /dev/null
+++ b/Client/tauri-client/tests/unit/messages-store-detached.test.ts
@@ -0,0 +1,226 @@
+/**
+ * Detached-window behaviour in the messages store.
+ *
+ * Jumping to a message outside the loaded page replaces the channel's window
+ * with a server "around" window. That window is a *hole punched into history*:
+ * the messages below it are not loaded, so the bottom of the list is no longer
+ * "now". Everything here pins the consequences of that — the ordering the
+ * around payload arrives in, the detached flag, what happens to live
+ * broadcasts while detached, and how a channel gets back to the present.
+ */
+
+import { describe, it, expect, beforeEach } from "vitest";
+import {
+  messagesStore,
+  addMessage,
+  setMessages,
+  prependMessages,
+  setAroundMessages,
+  reattachToPresent,
+  clearChannelMessages,
+  getChannelMessages,
+  isChannelLoaded,
+  hasMoreMessages,
+  isWindowDetached,
+  hasMessageLoaded,
+} from "../../src/stores/messages.store";
+import type { ChatMessagePayload, MessageResponse, MessageUser } from "../../src/lib/types";
+
+const USER: MessageUser = { id: 1, username: "alice", avatar: null };
+
+function response(id: number, overrides?: Partial<MessageResponse>): MessageResponse {
+  return {
+    id,
+    channel_id: 1,
+    user: USER,
+    content: `msg ${id}`,
+    reply_to: null,
+    attachments: [],
+    reactions: [],
+    pinned: false,
+    edited_at: null,
+    deleted: false,
+    timestamp: "2026-03-15T09:00:00Z",
+    ...overrides,
+  };
+}
+
+/** An around-window payload: oldest-first, unlike the history endpoint. */
+function ascendingWindow(from: number, to: number): MessageResponse[] {
+  const out: MessageResponse[] = [];
+  for (let id = from; id <= to; id++) out.push(response(id));
+  return out;
+}
+
+function broadcast(id: number): ChatMessagePayload {
+  return {
+    id,
+    channel_id: 1,
+    user: USER,
+    content: `live ${id}`,
+    reply_to: null,
+    attachments: [],
+    timestamp: "2026-03-15T12:00:00Z",
+  } as ChatMessagePayload;
+}
+
+function ids(channelId: number): number[] {
+  return getChannelMessages(channelId).map((m) => m.id);
+}
+
+beforeEach(() => {
+  clearChannelMessages(1);
+  clearChannelMessages(2);
+});
+
+describe("setAroundMessages", () => {
+  it("keeps the payload order — an around window is already oldest-first", () => {
+    setAroundMessages(1, ascendingWindow(10, 14), false, false);
+
+    // setMessages reverses (the history endpoint is newest-first); this one
+    // must not, or every jump would render the window upside down.
+    expect(ids(1)).toEqual([10, 11, 12, 13, 14]);
+  });
+
+  it("replaces the loaded window rather than merging into it", () => {
+    setMessages(1, [response(300), response(299)], false);
+    setAroundMessages(1, ascendingWindow(10, 12), true, true);
+
+    expect(ids(1)).toEqual([10, 11, 12]);
+  });
+
+  it("marks the channel loaded and maps has_more_before onto hasMore", () => {
+    setAroundMessages(1, ascendingWindow(10, 12), true, false);
+
+    expect(isChannelLoaded(1)).toBe(true);
+    expect(hasMoreMessages(1)).toBe(true);
+
+    setAroundMessages(1, ascendingWindow(1, 3), false, false);
+    expect(hasMoreMessages(1)).toBe(false);
+  });
+
+  it("detaches only when the server reports newer messages below", () => {
+    setAroundMessages(1, ascendingWindow(10, 12), true, true);
+    expect(isWindowDetached(1)).toBe(true);
+
+    // A window that reaches the live tail is not detached: the bottom is now.
+    setAroundMessages(1, ascendingWindow(10, 12), true, false);
+    expect(isWindowDetached(1)).toBe(false);
+  });
+
+  it("detaches when the window itself had to be trimmed to the cap", () => {
+    // 600 > the 500-message cap: the newest 100 are dropped, which strands the
+    // tail exactly as has_more_after would have.
+    setAroundMessages(1, ascendingWindow(1, 600), false, false);
+
+    const loaded = getChannelMessages(1);
+    expect(loaded).toHaveLength(500);
+    // The *centre-side* head is kept, so trimming drops from the end.
+    expect(loaded[0]!.id).toBe(1);
+    expect(loaded.at(-1)!.id).toBe(500);
+    expect(isWindowDetached(1)).toBe(true);
+  });
+
+  it("is scoped to one channel", () => {
+    setMessages(2, [response(500, { channel_id: 2 })], false);
+    setAroundMessages(1, ascendingWindow(10, 12), true, true);
+
+    expect(isWindowDetached(2)).toBe(false);
+    expect(ids(2)).toEqual([500]);
+  });
+});
+
+describe("live messages while detached", () => {
+  it("does not append a broadcast onto a detached window", () => {
+    setAroundMessages(1, ascendingWindow(10, 12), true, true);
+
+    addMessage(broadcast(900));
+
+    // Appending would splice a message from "now" directly onto history from
+    // an hour ago with no gap shown — a lie about ordering.
+    expect(ids(1)).toEqual([10, 11, 12]);
+  });
+
+  it("still reconciles an edit-shaped rebroadcast of a loaded row", () => {
+    setAroundMessages(1, ascendingWindow(10, 12), true, true);
+
+    addMessage({ ...broadcast(11), content: "reconciled" });
+
+    expect(ids(1)).toEqual([10, 11, 12]);
+    expect(getChannelMessages(1)[1]!.content).toBe("reconciled");
+  });
+
+  it("appends normally again once reattached", () => {
+    setAroundMessages(1, ascendingWindow(10, 12), true, true);
+    reattachToPresent(1);
+    setMessages(1, [response(12), response(11), response(10)], false);
+
+    addMessage(broadcast(900));
+
+    expect(ids(1)).toEqual([10, 11, 12, 900]);
+  });
+});
+
+describe("reattachToPresent", () => {
+  it("clears the detached flag and the loaded flag so the tail is refetched", () => {
+    setAroundMessages(1, ascendingWindow(10, 12), true, true);
+    expect(isChannelLoaded(1)).toBe(true);
+
+    reattachToPresent(1);
+
+    expect(isWindowDetached(1)).toBe(false);
+    // Without clearing "loaded", MessageController short-circuits and the
+    // stale window stays on screen forever.
+    expect(isChannelLoaded(1)).toBe(false);
+  });
+
+  it("is a no-op for a channel that was never detached", () => {
+    setMessages(1, [response(10)], false);
+    const before = messagesStore.getState();
+
+    reattachToPresent(1);
+
+    expect(messagesStore.getState()).toBe(before);
+    expect(isChannelLoaded(1)).toBe(true);
+  });
+});
+
+describe("reattaching via a fresh tail fetch", () => {
+  it("setMessages clears the detached flag", () => {
+    setAroundMessages(1, ascendingWindow(10, 12), true, true);
+
+    setMessages(1, [response(902), response(901)], true);
+
+    expect(isWindowDetached(1)).toBe(false);
+    expect(ids(1)).toEqual([901, 902]);
+  });
+
+  it("clearChannelMessages clears the detached flag", () => {
+    setAroundMessages(1, ascendingWindow(10, 12), true, true);
+
+    clearChannelMessages(1);
+
+    expect(isWindowDetached(1)).toBe(false);
+  });
+
+  it("scrolling further up a detached window keeps it detached", () => {
+    setAroundMessages(1, ascendingWindow(10, 12), true, true);
+
+    // prependMessages is the infinite-scroll path; it touches history above
+    // the window and says nothing about the tail below it.
+    prependMessages(1, [response(9), response(8)], true);
+
+    expect(ids(1)).toEqual([8, 9, 10, 11, 12]);
+    expect(isWindowDetached(1)).toBe(true);
+  });
+});
+
+describe("hasMessageLoaded", () => {
+  it("reports membership of the loaded window", () => {
+    setAroundMessages(1, ascendingWindow(10, 12), true, true);
+
+    expect(hasMessageLoaded(1, 11)).toBe(true);
+    expect(hasMessageLoaded(1, 900)).toBe(false);
+    expect(hasMessageLoaded(2, 11)).toBe(false);
+  });
+});
diff --git a/Client/tauri-client/tests/unit/messages.store.test.ts b/Client/tauri-client/tests/unit/messages.store.test.ts
index cd85dcf8..18076891 100644
--- a/Client/tauri-client/tests/unit/messages.store.test.ts
+++ b/Client/tauri-client/tests/unit/messages.store.test.ts
@@ -6,6 +6,7 @@ import {
   prependMessages,
   editMessage,
   deleteMessage,
+  bulkDeleteMessages,
   setMessagePinned,
   updateReaction,
   addPendingSend,
@@ -360,6 +361,43 @@ describe("messages store", () => {
     });
   });
 
+  // 6b. bulkDeleteMessages (channel purge)
+  describe("bulkDeleteMessages", () => {
+    it("marks every id as deleted while keeping the rows", () => {
+      for (const id of [100, 101, 102]) {
+        addMessage(makeChatPayload({ id, channel_id: 1 }));
+      }
+
+      bulkDeleteMessages({ channel_id: 1, ids: [102, 101] });
+
+      const msgs = getChannelMessages(1);
+      expect(msgs).toHaveLength(3);
+      expect(msgs.find((m) => m.id === 102)!.deleted).toBe(true);
+      expect(msgs.find((m) => m.id === 101)!.deleted).toBe(true);
+      expect(msgs.find((m) => m.id === 100)!.deleted).toBe(false);
+    });
+
+    it("ignores ids that are not loaded", () => {
+      addMessage(makeChatPayload({ id: 100, channel_id: 1 }));
+
+      bulkDeleteMessages({ channel_id: 1, ids: [100, 999] });
+
+      expect(getChannelMessages(1)).toHaveLength(1);
+      expect(getChannelMessages(1)[0]!.deleted).toBe(true);
+    });
+
+    it("is a no-op for an unknown channel, an empty id list, and a repeat purge", () => {
+      addMessage(makeChatPayload({ id: 100, channel_id: 1 }));
+      bulkDeleteMessages({ channel_id: 1, ids: [100] });
+
+      const before = messagesStore.getState();
+      bulkDeleteMessages({ channel_id: 99, ids: [1] });
+      bulkDeleteMessages({ channel_id: 1, ids: [] });
+      bulkDeleteMessages({ channel_id: 1, ids: [100] });
+      expect(messagesStore.getState()).toBe(before);
+    });
+  });
+
   // 7. addPendingSend / confirmSend lifecycle
   describe("pending send lifecycle", () => {
     it("addPendingSend tracks correlationId -> channelId", () => {
@@ -1011,3 +1049,65 @@ describe("messages store", () => {
     });
   });
 });
+
+describe("mention plumbing", () => {
+  it("carries mentions from a chat_message payload onto the store row", () => {
+    addMessage({
+      id: 1,
+      channel_id: 1,
+      user: TEST_USER,
+      content: "hi @bob @everyone",
+      reply_to: null,
+      attachments: [],
+      timestamp: "2026-03-15T10:00:00Z",
+      mentions: [2],
+      mentions_everyone: true,
+    } as ChatMessagePayload);
+
+    const msg = messagesStore.getState().messagesByChannel.get(1)![0]!;
+    expect(msg.mentions).toEqual([2]);
+    expect(msg.mentionsEveryone).toBe(true);
+  });
+
+  it("leaves them undefined when an older server omits them", () => {
+    addMessage({
+      id: 1,
+      channel_id: 1,
+      user: TEST_USER,
+      content: "hi",
+      reply_to: null,
+      attachments: [],
+      timestamp: "2026-03-15T10:00:00Z",
+    } as ChatMessagePayload);
+
+    const msg = messagesStore.getState().messagesByChannel.get(1)![0]!;
+    expect(msg.mentions).toBeUndefined();
+    expect(msg.mentionsEveryone).toBeUndefined();
+  });
+
+  it("replaces mentions on edit — an edit re-resolves but never re-notifies", () => {
+    addMessage({
+      id: 1,
+      channel_id: 1,
+      user: TEST_USER,
+      content: "hi @bob",
+      reply_to: null,
+      attachments: [],
+      timestamp: "2026-03-15T10:00:00Z",
+      mentions: [2],
+      mentions_everyone: false,
+    } as ChatMessagePayload);
+
+    editMessage({
+      message_id: 1,
+      channel_id: 1,
+      content: "hi @carol",
+      edited_at: "2026-03-15T10:01:00Z",
+      mentions: [3],
+      mentions_everyone: false,
+    } as ChatEditedPayload);
+
+    const msg = messagesStore.getState().messagesByChannel.get(1)![0]!;
+    expect(msg.mentions).toEqual([3]);
+  });
+});
diff --git a/Client/tauri-client/tests/unit/notifications.test.ts b/Client/tauri-client/tests/unit/notifications.test.ts
index 5dd78391..64ca588b 100644
--- a/Client/tauri-client/tests/unit/notifications.test.ts
+++ b/Client/tauri-client/tests/unit/notifications.test.ts
@@ -121,9 +121,14 @@ describe("notifyIncomingMessage", () => {
             category: null,
             position: 0,
             unreadCount: 0,
+            mentionCount: 0,
             lastMessageId: null,
             canSend: true,
+            topic: "",
             slowMode: 0,
+            nsfw: false,
+            voiceMaxUsers: 0,
+            voiceMaxVideo: 0,
           },
         ],
       ]),
@@ -135,84 +140,151 @@ describe("notifyIncomingMessage", () => {
     vi.spyOn(document, "hasFocus").mockReturnValue(false);
   });
 
-  it("does not notify for own messages", () => {
+  it("does not notify for own messages", async () => {
+    const { sendNotification } = await import("@tauri-apps/plugin-notification");
+    (sendNotification as ReturnType<typeof vi.fn>).mockClear();
     const payload = makePayload({ user: { id: 1, username: "Me", avatar: null } });
     notifyIncomingMessage(payload);
+    await new Promise((r) => setTimeout(r, 50));
+    expect(sendNotification).not.toHaveBeenCalled();
   });
 
-  it("does not notify when window is focused and message is in active channel", () => {
+  it("does not notify when window is focused and message is in active channel", async () => {
+    const { sendNotification } = await import("@tauri-apps/plugin-notification");
+    (sendNotification as ReturnType<typeof vi.fn>).mockClear();
     vi.spyOn(document, "hasFocus").mockReturnValue(true);
     channelsStore.setState((prev) => ({ ...prev, activeChannelId: 1 }));
     const payload = makePayload({ channel_id: 1 });
     notifyIncomingMessage(payload);
+    await new Promise((r) => setTimeout(r, 50));
+    expect(sendNotification).not.toHaveBeenCalled();
   });
 
-  it("notifies when window is focused but message is in a different channel", () => {
+  it("notifies when window is focused but message is in a different channel", async () => {
+    const { sendNotification } = await import("@tauri-apps/plugin-notification");
+    (sendNotification as ReturnType<typeof vi.fn>).mockClear();
     vi.spyOn(document, "hasFocus").mockReturnValue(true);
     channelsStore.setState((prev) => ({ ...prev, activeChannelId: 2 }));
     const payload = makePayload({ channel_id: 1 });
     notifyIncomingMessage(payload);
+    await vi.waitFor(() => {
+      expect(sendNotification).toHaveBeenCalled();
+    });
   });
 
-  it("suppresses @everyone when toggle is enabled", () => {
+  it("suppresses @everyone when toggle is enabled", async () => {
+    const { sendNotification } = await import("@tauri-apps/plugin-notification");
+    (sendNotification as ReturnType<typeof vi.fn>).mockClear();
     testPrefs.set("suppressEveryone", true);
-    const payload = makePayload({ content: "Hey @everyone check this out" });
+    const payload = makePayload({
+      content: "Hey @everyone check this out",
+      mentions_everyone: true,
+    });
     notifyIncomingMessage(payload);
+    await new Promise((r) => setTimeout(r, 50));
+    expect(sendNotification).not.toHaveBeenCalled();
   });
 
-  it("does not suppress @everyone when toggle is disabled", () => {
+  it("does not suppress @everyone when toggle is disabled", async () => {
+    const { sendNotification } = await import("@tauri-apps/plugin-notification");
+    (sendNotification as ReturnType<typeof vi.fn>).mockClear();
     testPrefs.set("suppressEveryone", false);
     const payload = makePayload({ content: "Hey @everyone check this out" });
     notifyIncomingMessage(payload);
+    await vi.waitFor(() => {
+      expect(sendNotification).toHaveBeenCalled();
+    });
   });
 
-  it("handles long messages by truncating", () => {
+  it("handles long messages by truncating", async () => {
+    const { sendNotification } = await import("@tauri-apps/plugin-notification");
+    (sendNotification as ReturnType<typeof vi.fn>).mockClear();
     const longContent = "A".repeat(200);
     const payload = makePayload({ content: longContent });
     notifyIncomingMessage(payload);
+    await vi.waitFor(() => {
+      expect(sendNotification).toHaveBeenCalledWith(
+        expect.objectContaining({ body: "A".repeat(100) + "..." }),
+      );
+    });
   });
 
-  it("handles @here the same as @everyone", () => {
+  it("handles @here the same as @everyone", async () => {
+    const { sendNotification } = await import("@tauri-apps/plugin-notification");
+    (sendNotification as ReturnType<typeof vi.fn>).mockClear();
     testPrefs.set("suppressEveryone", true);
-    const payload = makePayload({ content: "Hey @here important update" });
+    const payload = makePayload({ content: "Hey @here important update", mentions_everyone: true });
     notifyIncomingMessage(payload);
+    await new Promise((r) => setTimeout(r, 50));
+    expect(sendNotification).not.toHaveBeenCalled();
   });
 
-  it("skips desktop notification when toggle is off", () => {
+  it("skips desktop notification when toggle is off", async () => {
+    const { sendNotification } = await import("@tauri-apps/plugin-notification");
+    (sendNotification as ReturnType<typeof vi.fn>).mockClear();
     testPrefs.set("desktopNotifications", false);
     const payload = makePayload();
     notifyIncomingMessage(payload);
+    await new Promise((r) => setTimeout(r, 50));
+    expect(sendNotification).not.toHaveBeenCalled();
   });
 
-  it("skips taskbar flash when toggle is off", () => {
+  it("skips taskbar flash when toggle is off", async () => {
+    const { getCurrentWindow } = await import("@tauri-apps/api/window");
+    const win = getCurrentWindow();
+    (win.requestUserAttention as ReturnType<typeof vi.fn>).mockClear();
     testPrefs.set("flashTaskbar", false);
     const payload = makePayload();
     notifyIncomingMessage(payload);
+    await new Promise((r) => setTimeout(r, 50));
+    expect(win.requestUserAttention).not.toHaveBeenCalled();
   });
 
   it("skips notification sound when toggle is off", () => {
+    mockOscillator.start.mockClear();
     testPrefs.set("notificationSounds", false);
     const payload = makePayload();
     notifyIncomingMessage(payload);
+    expect(mockOscillator.start).not.toHaveBeenCalled();
   });
 
-  it("falls back to channel ID string when channel is not in store", () => {
+  it("falls back to channel ID string when channel is not in store", async () => {
+    const { sendNotification } = await import("@tauri-apps/plugin-notification");
+    (sendNotification as ReturnType<typeof vi.fn>).mockClear();
     // Set channels store to have no channels
     channelsStore.setState((prev) => ({ ...prev, channels: new Map() }));
     const payload = makePayload({ channel_id: 999 });
     // Should not throw; uses fallback "Channel 999"
     notifyIncomingMessage(payload);
+    await vi.waitFor(() => {
+      expect(sendNotification).toHaveBeenCalledWith(
+        expect.objectContaining({ title: expect.stringContaining("Channel 999") }),
+      );
+    });
   });
 
-  it("notifies when window is not focused, even for active channel", () => {
+  it("notifies when window is not focused, even for active channel", async () => {
+    const { sendNotification } = await import("@tauri-apps/plugin-notification");
+    (sendNotification as ReturnType<typeof vi.fn>).mockClear();
     vi.spyOn(document, "hasFocus").mockReturnValue(false);
     channelsStore.setState((prev) => ({ ...prev, activeChannelId: 1 }));
     const payload = makePayload({ channel_id: 1 });
     // Should proceed to notification since window is not focused
     notifyIncomingMessage(payload);
+    await vi.waitFor(() => {
+      expect(sendNotification).toHaveBeenCalled();
+    });
   });
 
-  it("does not notify when current user is null", () => {
+  // NOTE: original title was "does not notify when current user is null" but
+  // the code (see the guard clause in notifyIncomingMessage: `currentUser !==
+  // null && payload.user.id === currentUser.id`) and the original inline
+  // comment both make clear a null/logged-out user is NOT treated as a match
+  // and the notification proceeds. Renamed to match actual, intended
+  // behavior (also covered by "proceeds when current user is null" below).
+  it("notifies when current user is null (not logged in)", async () => {
+    const { sendNotification } = await import("@tauri-apps/plugin-notification");
+    (sendNotification as ReturnType<typeof vi.fn>).mockClear();
     authStore.setState(() => ({
       token: null,
       user: null,
@@ -223,47 +295,91 @@ describe("notifyIncomingMessage", () => {
     // payload.user.id = 2 (different from null user), should proceed
     const payload = makePayload();
     notifyIncomingMessage(payload);
+    await vi.waitFor(() => {
+      expect(sendNotification).toHaveBeenCalled();
+    });
   });
 
-  it("fires all notification types when all enabled", () => {
-    // All defaults are true, so just fire and confirm no error
+  it("fires all notification types when all enabled", async () => {
+    const { sendNotification } = await import("@tauri-apps/plugin-notification");
+    const { getCurrentWindow } = await import("@tauri-apps/api/window");
+    const win = getCurrentWindow();
+    (sendNotification as ReturnType<typeof vi.fn>).mockClear();
+    (win.requestUserAttention as ReturnType<typeof vi.fn>).mockClear();
+    mockOscillator.start.mockClear();
+
+    // All defaults are true, so just fire and confirm all three channels fired
     testPrefs.set("desktopNotifications", true);
     testPrefs.set("flashTaskbar", true);
     testPrefs.set("notificationSounds", true);
     const payload = makePayload();
     notifyIncomingMessage(payload);
+
+    await vi.waitFor(() => {
+      expect(sendNotification).toHaveBeenCalled();
+      expect(win.requestUserAttention).toHaveBeenCalled();
+    });
+    expect(mockOscillator.start).toHaveBeenCalled();
   });
 
-  it("handles short content without truncation", () => {
+  it("handles short content without truncation", async () => {
+    const { sendNotification } = await import("@tauri-apps/plugin-notification");
+    (sendNotification as ReturnType<typeof vi.fn>).mockClear();
     const payload = makePayload({ content: "Hi" });
     notifyIncomingMessage(payload);
+    await vi.waitFor(() => {
+      expect(sendNotification).toHaveBeenCalledWith(expect.objectContaining({ body: "Hi" }));
+    });
   });
 
-  it("handles content exactly at 100 char boundary", () => {
+  it("handles content exactly at 100 char boundary", async () => {
+    const { sendNotification } = await import("@tauri-apps/plugin-notification");
+    (sendNotification as ReturnType<typeof vi.fn>).mockClear();
     const payload = makePayload({ content: "A".repeat(100) });
     notifyIncomingMessage(payload);
+    await vi.waitFor(() => {
+      expect(sendNotification).toHaveBeenCalledWith(
+        expect.objectContaining({ body: "A".repeat(100) }),
+      );
+    });
   });
 
-  it("handles content just over 100 chars (101)", () => {
+  it("handles content just over 100 chars (101)", async () => {
+    const { sendNotification } = await import("@tauri-apps/plugin-notification");
+    (sendNotification as ReturnType<typeof vi.fn>).mockClear();
     const payload = makePayload({ content: "A".repeat(101) });
     notifyIncomingMessage(payload);
+    await vi.waitFor(() => {
+      expect(sendNotification).toHaveBeenCalledWith(
+        expect.objectContaining({ body: "A".repeat(100) + "..." }),
+      );
+    });
   });
 
-  it("does not suppress normal message when suppressEveryone is enabled", () => {
+  it("does not suppress normal message when suppressEveryone is enabled", async () => {
+    const { sendNotification } = await import("@tauri-apps/plugin-notification");
+    (sendNotification as ReturnType<typeof vi.fn>).mockClear();
     testPrefs.set("suppressEveryone", true);
     const payload = makePayload({ content: "Normal message without at-mentions" });
     // Should proceed to notification (not suppressed)
     notifyIncomingMessage(payload);
+    await vi.waitFor(() => {
+      expect(sendNotification).toHaveBeenCalled();
+    });
   });
 
-  it("suppresses @everyone regardless of other toggles", () => {
+  it("suppresses @everyone regardless of other toggles", async () => {
+    const { sendNotification } = await import("@tauri-apps/plugin-notification");
+    (sendNotification as ReturnType<typeof vi.fn>).mockClear();
     testPrefs.set("suppressEveryone", true);
     testPrefs.set("desktopNotifications", true);
     testPrefs.set("flashTaskbar", true);
     testPrefs.set("notificationSounds", true);
-    const payload = makePayload({ content: "Hey @everyone look!" });
+    const payload = makePayload({ content: "Hey @everyone look!", mentions_everyone: true });
     // Should be suppressed before any notification fires
     notifyIncomingMessage(payload);
+    await new Promise((r) => setTimeout(r, 50));
+    expect(sendNotification).not.toHaveBeenCalled();
   });
 
   it("fires desktop notification via Tauri plugin when permission granted", async () => {
@@ -327,6 +443,8 @@ describe("notifyIncomingMessage", () => {
       throw new Error("Window not available");
     });
 
+    const debugSpy = vi.spyOn(console, "debug").mockImplementation(() => {});
+
     testPrefs.set("flashTaskbar", true);
     // Disable other notification types to isolate
     testPrefs.set("desktopNotifications", false);
@@ -337,7 +455,15 @@ describe("notifyIncomingMessage", () => {
 
     // Give async time to resolve
     await new Promise((r) => setTimeout(r, 50));
-    // Should not throw, just log debug
+    // Should not throw, and the catch path should have logged via the
+    // notifications logger (console.debug is its underlying sink).
+    expect(debugSpy).toHaveBeenCalledWith(
+      expect.stringContaining("[notifications]"),
+      "Taskbar flash not available",
+      "",
+    );
+
+    debugSpy.mockRestore();
   });
 
   it("handles playNotificationSound error gracefully (catch path)", () => {
@@ -347,6 +473,8 @@ describe("notifyIncomingMessage", () => {
       throw new Error("Oscillator error");
     });
 
+    const debugSpy = vi.spyOn(console, "debug").mockImplementation(() => {});
+
     testPrefs.set("notificationSounds", true);
     testPrefs.set("desktopNotifications", false);
     testPrefs.set("flashTaskbar", false);
@@ -355,6 +483,14 @@ describe("notifyIncomingMessage", () => {
     // Should not throw
     notifyIncomingMessage(payload);
 
+    // The catch block logs via the notifications logger before returning.
+    expect(debugSpy).toHaveBeenCalledWith(
+      expect.stringContaining("[notifications]"),
+      "Notification sound not available",
+      "",
+    );
+
+    debugSpy.mockRestore();
     // Restore the mock
     mockOscillator.start.mockImplementation(() => {});
   });
@@ -449,6 +585,8 @@ describe("notifyIncomingMessage", () => {
       configurable: true,
     });
 
+    const debugSpy = vi.spyOn(console, "debug").mockImplementation(() => {});
+
     testPrefs.set("desktopNotifications", true);
     testPrefs.set("flashTaskbar", false);
     testPrefs.set("notificationSounds", false);
@@ -457,8 +595,15 @@ describe("notifyIncomingMessage", () => {
     notifyIncomingMessage(payload);
 
     await new Promise((r) => setTimeout(r, 50));
-    // Should not throw — just logs debug
+    // Should not throw — and the inner catch should have logged via the
+    // notifications logger.
+    expect(debugSpy).toHaveBeenCalledWith(
+      expect.stringContaining("[notifications]"),
+      "Notifications not available",
+      "",
+    );
 
+    debugSpy.mockRestore();
     shouldTauriNotifThrow.value = false;
     Object.defineProperty(globalThis, "Notification", {
       value: originalNotification,
@@ -698,8 +843,8 @@ describe("notifyIncomingMessage", () => {
     });
   });
 
-  describe("containsEveryone: OR logic and exact strings", () => {
-    it("suppresses message containing only @everyone (not @here)", async () => {
+  describe("suppressEveryone: driven by mentions_everyone, not substrings", () => {
+    it("suppresses an @everyone the server honoured", async () => {
       const { sendNotification } = await import("@tauri-apps/plugin-notification");
       (sendNotification as ReturnType<typeof vi.fn>).mockClear();
 
@@ -708,14 +853,14 @@ describe("notifyIncomingMessage", () => {
       testPrefs.set("flashTaskbar", false);
       testPrefs.set("notificationSounds", false);
 
-      notifyIncomingMessage(makePayload({ content: "ping @everyone" }));
+      notifyIncomingMessage(makePayload({ content: "ping @everyone", mentions_everyone: true }));
 
       await new Promise((r) => setTimeout(r, 50));
       // Should NOT have reached sendNotification
       expect(sendNotification).not.toHaveBeenCalled();
     });
 
-    it("suppresses message containing only @here (not @everyone)", async () => {
+    it("suppresses an @here the server honoured", async () => {
       const { sendNotification } = await import("@tauri-apps/plugin-notification");
       (sendNotification as ReturnType<typeof vi.fn>).mockClear();
 
@@ -724,12 +869,48 @@ describe("notifyIncomingMessage", () => {
       testPrefs.set("flashTaskbar", false);
       testPrefs.set("notificationSounds", false);
 
-      notifyIncomingMessage(makePayload({ content: "ping @here" }));
+      notifyIncomingMessage(makePayload({ content: "ping @here", mentions_everyone: true }));
 
       await new Promise((r) => setTimeout(r, 50));
       expect(sendNotification).not.toHaveBeenCalled();
     });
 
+    it("does NOT suppress an @everyone the server did not honour", async () => {
+      const { sendNotification } = await import("@tauri-apps/plugin-notification");
+      (sendNotification as ReturnType<typeof vi.fn>).mockClear();
+
+      testPrefs.set("suppressEveryone", true);
+      testPrefs.set("desktopNotifications", true);
+      testPrefs.set("flashTaskbar", false);
+      testPrefs.set("notificationSounds", false);
+
+      // Sender lacked MENTION_EVERYONE: the token is plain text.
+      notifyIncomingMessage(makePayload({ content: "ping @everyone", mentions_everyone: false }));
+
+      await vi.waitFor(() => {
+        expect(sendNotification).toHaveBeenCalled();
+      });
+    });
+
+    it("does NOT suppress an @everyone that also names the user", async () => {
+      const { sendNotification } = await import("@tauri-apps/plugin-notification");
+      (sendNotification as ReturnType<typeof vi.fn>).mockClear();
+
+      testPrefs.set("suppressEveryone", true);
+      testPrefs.set("desktopNotifications", true);
+      testPrefs.set("flashTaskbar", false);
+      testPrefs.set("notificationSounds", false);
+
+      notifyIncomingMessage(
+        makePayload({ content: "@everyone and @Me", mentions: [1], mentions_everyone: true }),
+      );
+
+      await vi.waitFor(() => {
+        const call = (sendNotification as ReturnType<typeof vi.fn>).mock.calls[0]![0];
+        expect(call.title).toBe("TestUser mentioned you in #general");
+      });
+    });
+
     it("does NOT suppress message without @everyone or @here even with toggle on", async () => {
       const { sendNotification } = await import("@tauri-apps/plugin-notification");
       (sendNotification as ReturnType<typeof vi.fn>).mockClear();
@@ -755,7 +936,7 @@ describe("notifyIncomingMessage", () => {
       testPrefs.set("flashTaskbar", false);
       testPrefs.set("notificationSounds", false);
 
-      notifyIncomingMessage(makePayload({ content: "Hey @everyone" }));
+      notifyIncomingMessage(makePayload({ content: "Hey @everyone", mentions_everyone: true }));
 
       await vi.waitFor(() => {
         expect(sendNotification).toHaveBeenCalled();
@@ -1178,4 +1359,59 @@ describe("notifyIncomingMessage", () => {
       (globalThis as Record<string, unknown>).Notification = originalNotification;
     });
   });
+  describe("mention titles", () => {
+    async function titleFor(payload: ChatMessagePayload): Promise<string> {
+      const { sendNotification } = await import("@tauri-apps/plugin-notification");
+      (sendNotification as ReturnType<typeof vi.fn>).mockClear();
+      testPrefs.set("desktopNotifications", true);
+      testPrefs.set("flashTaskbar", false);
+      testPrefs.set("notificationSounds", false);
+      notifyIncomingMessage(payload);
+      await vi.waitFor(() => {
+        expect(sendNotification).toHaveBeenCalled();
+      });
+      return (sendNotification as ReturnType<typeof vi.fn>).mock.calls[0]![0].title as string;
+    }
+
+    it("says 'mentioned you' when the server names the current user", async () => {
+      const title = await titleFor(makePayload({ content: "hi @Me", mentions: [1] }));
+      expect(title).toBe("TestUser mentioned you in #general");
+    });
+
+    it("says 'mentioned you' for an honoured @everyone", async () => {
+      const title = await titleFor(
+        makePayload({ content: "hi all @everyone", mentions_everyone: true }),
+      );
+      expect(title).toBe("TestUser mentioned you in #general");
+    });
+
+    it("uses the plain title when the mention names someone else", async () => {
+      const title = await titleFor(makePayload({ content: "hi @other", mentions: [7] }));
+      expect(title).toBe("TestUser in #general");
+    });
+
+    it("uses the plain title for an unhonoured @everyone", async () => {
+      const title = await titleFor(
+        makePayload({ content: "hi @everyone", mentions_everyone: false }),
+      );
+      expect(title).toBe("TestUser in #general");
+    });
+
+    it("falls back to name resolution when the server sent no list", async () => {
+      const title = await titleFor(makePayload({ content: "hi @Me" }));
+      expect(title).toBe("TestUser mentioned you in #general");
+    });
+
+    it("stays silent under Do Not Disturb even for a mention", async () => {
+      const { sendNotification } = await import("@tauri-apps/plugin-notification");
+      (sendNotification as ReturnType<typeof vi.fn>).mockClear();
+      testPrefs.set("userStatus", "dnd");
+      testPrefs.set("desktopNotifications", true);
+
+      notifyIncomingMessage(makePayload({ content: "hi @Me", mentions: [1] }));
+
+      await new Promise((r) => setTimeout(r, 50));
+      expect(sendNotification).not.toHaveBeenCalled();
+    });
+  });
 });
diff --git a/Client/tauri-client/tests/unit/nsfw-gate.test.ts b/Client/tauri-client/tests/unit/nsfw-gate.test.ts
new file mode 100644
index 00000000..f5366682
--- /dev/null
+++ b/Client/tauri-client/tests/unit/nsfw-gate.test.ts
@@ -0,0 +1,183 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import {
+  isNsfwAcknowledged,
+  acknowledgeNsfw,
+  clearNsfwAcknowledgements,
+  nsfwGateRequired,
+} from "@lib/nsfw-gate";
+import { createNsfwGate } from "@components/NsfwGate";
+
+describe("nsfw-gate acknowledgements", () => {
+  beforeEach(() => {
+    sessionStorage.clear();
+  });
+
+  it("reports an un-acknowledged channel as not acknowledged", () => {
+    expect(isNsfwAcknowledged(42)).toBe(false);
+  });
+
+  it("remembers an acknowledgement", () => {
+    acknowledgeNsfw(42);
+    expect(isNsfwAcknowledged(42)).toBe(true);
+  });
+
+  it("keys the acknowledgement per channel", () => {
+    acknowledgeNsfw(42);
+    expect(isNsfwAcknowledged(43)).toBe(false);
+  });
+
+  // The promise is "once per session", so it must live in sessionStorage —
+  // localStorage would silently make it "once ever" and the flag would stop
+  // meaning anything after the first visit.
+  it("stores the acknowledgement in sessionStorage, not localStorage", () => {
+    acknowledgeNsfw(7);
+    expect(sessionStorage.length).toBeGreaterThan(0);
+    expect(localStorage.getItem("owncord:nsfw-ack:7")).toBeNull();
+  });
+
+  it("clears every acknowledgement", () => {
+    acknowledgeNsfw(1);
+    acknowledgeNsfw(2);
+    clearNsfwAcknowledgements();
+    expect(isNsfwAcknowledged(1)).toBe(false);
+    expect(isNsfwAcknowledged(2)).toBe(false);
+  });
+
+  it("leaves unrelated session keys alone when clearing", () => {
+    sessionStorage.setItem("unrelated", "keep me");
+    acknowledgeNsfw(1);
+    clearNsfwAcknowledgements();
+    expect(sessionStorage.getItem("unrelated")).toBe("keep me");
+  });
+
+  // A storage that throws must not hide the gate — erring toward asking again
+  // is harmless, where erring the other way drops the whole feature.
+  it("reads a throwing sessionStorage as not acknowledged", () => {
+    const spy = vi.spyOn(Storage.prototype, "getItem").mockImplementation(() => {
+      throw new Error("denied");
+    });
+    expect(isNsfwAcknowledged(1)).toBe(false);
+    spy.mockRestore();
+  });
+
+  it("does not throw when the acknowledgement cannot be stored", () => {
+    const spy = vi.spyOn(Storage.prototype, "setItem").mockImplementation(() => {
+      throw new Error("quota");
+    });
+    expect(() => acknowledgeNsfw(1)).not.toThrow();
+    spy.mockRestore();
+  });
+
+  describe("nsfwGateRequired", () => {
+    it("is false for a channel that is not flagged", () => {
+      expect(nsfwGateRequired({ id: 1, nsfw: false })).toBe(false);
+    });
+
+    it("is true for a flagged channel not yet acknowledged", () => {
+      expect(nsfwGateRequired({ id: 1, nsfw: true })).toBe(true);
+    });
+
+    it("is false once the channel has been acknowledged this session", () => {
+      acknowledgeNsfw(1);
+      expect(nsfwGateRequired({ id: 1, nsfw: true })).toBe(false);
+    });
+  });
+});
+
+describe("NsfwGate component", () => {
+  let container: HTMLDivElement;
+
+  beforeEach(() => {
+    sessionStorage.clear();
+    container = document.createElement("div");
+    document.body.appendChild(container);
+  });
+
+  afterEach(() => {
+    container.remove();
+  });
+
+  function mountGate(overrides?: {
+    onContinue?: () => void;
+    onCancel?: () => void;
+    channelId?: number;
+  }) {
+    const onContinue = overrides?.onContinue ?? vi.fn();
+    const gate = createNsfwGate({
+      channelId: overrides?.channelId ?? 9,
+      channelName: "spicy",
+      onContinue,
+      ...(overrides?.onCancel !== undefined ? { onCancel: overrides.onCancel } : {}),
+    });
+    gate.mount(container);
+    return { gate, onContinue };
+  }
+
+  it("renders the warning over the container", () => {
+    const { gate } = mountGate();
+    const el = container.querySelector("[data-testid='nsfw-gate']");
+    expect(el).not.toBeNull();
+    expect(el?.textContent).toContain("This channel may contain sensitive content");
+    gate.destroy?.();
+  });
+
+  it("names the channel it is gating", () => {
+    const { gate } = mountGate();
+    expect(container.querySelector(".nsfw-gate-title")?.textContent).toBe("#spicy");
+    gate.destroy?.();
+  });
+
+  // The copy must not imply the server is filtering anything — it is not.
+  it("says plainly that nothing is filtered", () => {
+    const { gate } = mountGate();
+    expect(container.querySelector("[data-testid='nsfw-gate']")?.textContent).toContain(
+      "Nothing is filtered",
+    );
+    gate.destroy?.();
+  });
+
+  it("records the acknowledgement and notifies on Continue", () => {
+    const onContinue = vi.fn();
+    const { gate } = mountGate({ onContinue, channelId: 11 });
+
+    (container.querySelector("[data-testid='nsfw-gate-continue']") as HTMLButtonElement).click();
+
+    expect(isNsfwAcknowledged(11)).toBe(true);
+    expect(onContinue).toHaveBeenCalledTimes(1);
+    gate.destroy?.();
+  });
+
+  it("offers no Go Back button without an onCancel", () => {
+    const { gate } = mountGate();
+    expect(container.querySelector("[data-testid='nsfw-gate-back']")).toBeNull();
+    gate.destroy?.();
+  });
+
+  it("calls onCancel from Go Back without acknowledging", () => {
+    const onCancel = vi.fn();
+    const { gate } = mountGate({ onCancel, channelId: 12 });
+
+    (container.querySelector("[data-testid='nsfw-gate-back']") as HTMLButtonElement).click();
+
+    expect(onCancel).toHaveBeenCalledTimes(1);
+    // Declining must not be remembered as acceptance — the next open asks again.
+    expect(isNsfwAcknowledged(12)).toBe(false);
+    gate.destroy?.();
+  });
+
+  it("removes itself on destroy", () => {
+    const { gate } = mountGate();
+    gate.destroy?.();
+    expect(container.querySelector("[data-testid='nsfw-gate']")).toBeNull();
+  });
+
+  it("stops responding to clicks after destroy", () => {
+    const onContinue = vi.fn();
+    const gate = createNsfwGate({ channelId: 3, channelName: "spicy", onContinue });
+    gate.mount(container);
+    const btn = container.querySelector("[data-testid='nsfw-gate-continue']") as HTMLButtonElement;
+    gate.destroy?.();
+    btn.click();
+    expect(onContinue).not.toHaveBeenCalled();
+  });
+});
diff --git a/Client/tauri-client/tests/unit/overlay-managers.test.ts b/Client/tauri-client/tests/unit/overlay-managers.test.ts
index b1c4e2e3..b66b4b12 100644
--- a/Client/tauri-client/tests/unit/overlay-managers.test.ts
+++ b/Client/tauri-client/tests/unit/overlay-managers.test.ts
@@ -341,17 +341,17 @@ describe("createPinnedPanelController", () => {
     expect(mockPinnedMessagesDestroy).toHaveBeenCalled();
   });
 
-  it("onJumpToMessage shows toast when message not in loaded window", async () => {
+  it("closes and delegates even for a message outside the loaded window", async () => {
     const api = makeMockApi();
     const toast = makeMockToast();
-    const mockScrollToMessage = vi.fn().mockReturnValue(false);
+    const mockJump = vi.fn();
 
     const controller = createPinnedPanelController({
       api: api as never,
       getRoot: () => root,
 
       getCurrentChannelId: () => 42,
-      onJumpToMessage: mockScrollToMessage,
+      onJumpToMessage: mockJump,
     });
 
     await controller.toggle();
@@ -362,10 +362,12 @@ describe("createPinnedPanelController", () => {
 
     opts.onJumpToMessage(999);
 
-    expect(mockScrollToMessage).toHaveBeenCalledWith(999);
-    expect(mockShowToast).toHaveBeenCalledWith(expect.stringContaining("not in"), "info");
-    // Panel should NOT close when message not found
-    expect(mockPinnedMessagesDestroy).not.toHaveBeenCalled();
+    // The jumper fetches the around-window for an unloaded target and reports
+    // its own failures, so the panel no longer second-guesses it with a
+    // "not in loaded window" toast — it just gets out of the way.
+    expect(mockJump).toHaveBeenCalledWith(999);
+    expect(mockPinnedMessagesDestroy).toHaveBeenCalled();
+    expect(mockShowToast).not.toHaveBeenCalled();
   });
 
   it("shows toast when toggle fails to load pins", async () => {
@@ -1131,9 +1133,9 @@ describe("createSearchOverlayController", () => {
     expect(mockLogError).toHaveBeenCalled();
   });
 
-  it("onSelectResult sets active channel and calls onJumpToMessage", () => {
+  it("onSelectResult hands the whole jump to onJumpToMessage", () => {
     const api = makeMockApi();
-    const mockJump = vi.fn().mockReturnValue(true);
+    const mockJump = vi.fn();
 
     const controller = createSearchOverlayController({
       api: api as never,
@@ -1148,24 +1150,17 @@ describe("createSearchOverlayController", () => {
       onSelectResult: (result: { channel_id: number; message_id: number }) => void;
     };
 
-    // Mock requestAnimationFrame to execute immediately
-    const origRaf = globalThis.requestAnimationFrame;
-    globalThis.requestAnimationFrame = (cb: FrameRequestCallback) => {
-      cb(0);
-      return 0;
-    };
-
     opts.onSelectResult({ channel_id: 3, message_id: 42 });
 
-    expect(mockSetActiveChannel).toHaveBeenCalledWith(3);
     expect(mockJump).toHaveBeenCalledWith(3, 42);
-
-    globalThis.requestAnimationFrame = origRaf;
+    // The jumper owns the channel switch too, so the around-window fetch it
+    // may need is sequenced after the switch instead of racing it.
+    expect(mockSetActiveChannel).not.toHaveBeenCalled();
   });
 
-  it("onSelectResult shows toast when message not found", () => {
+  it("onSelectResult does not second-guess the jumper with a toast", () => {
     const api = makeMockApi();
-    const mockJump = vi.fn().mockReturnValue(false);
+    const mockJump = vi.fn();
 
     const controller = createSearchOverlayController({
       api: api as never,
@@ -1180,17 +1175,10 @@ describe("createSearchOverlayController", () => {
       onSelectResult: (result: { channel_id: number; message_id: number }) => void;
     };
 
-    const origRaf = globalThis.requestAnimationFrame;
-    globalThis.requestAnimationFrame = (cb: FrameRequestCallback) => {
-      cb(0);
-      return 0;
-    };
-
     opts.onSelectResult({ channel_id: 3, message_id: 999 });
 
-    expect(mockShowToast).toHaveBeenCalledWith("Message not in loaded history", "info");
-
-    globalThis.requestAnimationFrame = origRaf;
+    // A hit outside the loaded page is now a fetch, not a dead end.
+    expect(mockShowToast).not.toHaveBeenCalled();
   });
 
   it("onSelectResult works without onJumpToMessage callback", () => {
diff --git a/Client/tauri-client/tests/unit/permissions.test.ts b/Client/tauri-client/tests/unit/permissions.test.ts
index 36640a52..56d59421 100644
--- a/Client/tauri-client/tests/unit/permissions.test.ts
+++ b/Client/tauri-client/tests/unit/permissions.test.ts
@@ -5,8 +5,16 @@ import {
   hasAllPermissions,
   computeEffective,
   isAdministrator,
+  permissionsForRole,
+  currentUserPermissions,
+  isLegacyAdminRole,
+  roleHasPermission,
+  canManageChannels,
+  canViewAuditLog,
 } from "../../src/lib/permissions";
 import { Permission } from "../../src/lib/types";
+import { setRoles } from "../../src/stores/channels.store";
+import { authStore } from "../../src/stores/auth.store";
 
 // Default role permission values (from SCHEMA.md)
 const OWNER_PERMS = 0x7fffffff;
@@ -212,3 +220,160 @@ describe("edge cases", () => {
     expect(hasPermission(MODERATOR_PERMS, Permission.MANAGE_SERVER)).toBe(false);
   });
 });
+
+describe("permissionsForRole", () => {
+  it("resolves a role's mask case-insensitively from the ready role list", () => {
+    setRoles([{ id: 3, name: "Moderator", color: null, permissions: MODERATOR_PERMS }]);
+    expect(permissionsForRole("moderator")).toBe(MODERATOR_PERMS);
+    expect(permissionsForRole("MODERATOR")).toBe(MODERATOR_PERMS);
+  });
+
+  it("returns null for a role the server did not send, so callers can fall back", () => {
+    setRoles([{ id: 3, name: "Moderator", color: null, permissions: MODERATOR_PERMS }]);
+    expect(permissionsForRole("owner")).toBeNull();
+    setRoles([]);
+    expect(permissionsForRole("moderator")).toBeNull();
+  });
+
+  it("distinguishes a zero-permission role from an unknown one", () => {
+    setRoles([{ id: 9, name: "Muted", color: null, permissions: 0 }]);
+    expect(permissionsForRole("muted")).toBe(0);
+    expect(permissionsForRole("nope")).toBeNull();
+  });
+
+  it("currentUserPermissions denies by default when the role is unknown", () => {
+    setRoles([]);
+    authStore.setState(() => ({
+      token: "tok",
+      user: { id: 1, username: "A", avatar: null, role: "moderator" },
+      serverName: "T",
+      motd: null,
+      isAuthenticated: true,
+    }));
+    expect(currentUserPermissions()).toBe(0);
+    setRoles([{ id: 3, name: "Moderator", color: null, permissions: MODERATOR_PERMS }]);
+    expect(currentUserPermissions()).toBe(MODERATOR_PERMS);
+  });
+});
+
+describe("roleHasPermission", () => {
+  it("uses the server mask when the ready role list has the role", () => {
+    setRoles([{ id: 3, name: "Moderator", color: null, permissions: MODERATOR_PERMS }]);
+    expect(roleHasPermission("moderator", Permission.KICK_MEMBERS)).toBe(true);
+    expect(roleHasPermission("moderator", Permission.MANAGE_SERVER)).toBe(false);
+  });
+
+  it("lets the ADMINISTRATOR bit pass every permission", () => {
+    setRoles([{ id: 1, name: "Owner", color: null, permissions: OWNER_PERMS }]);
+    expect(roleHasPermission("owner", Permission.MUTE_MEMBERS)).toBe(true);
+    expect(roleHasPermission("owner", Permission.MANAGE_SERVER)).toBe(true);
+  });
+
+  it("prefers the mask over the role name — a renamed 'admin' with no bits is denied", () => {
+    setRoles([{ id: 7, name: "Admin", color: null, permissions: 0 }]);
+    expect(roleHasPermission("admin", Permission.KICK_MEMBERS)).toBe(false);
+  });
+
+  it("falls back to the legacy owner/admin name check when the server sent no role list", () => {
+    setRoles([]);
+    expect(roleHasPermission("owner", Permission.MUTE_MEMBERS)).toBe(true);
+    expect(roleHasPermission("admin", Permission.KICK_MEMBERS)).toBe(true);
+    expect(roleHasPermission("moderator", Permission.MUTE_MEMBERS)).toBe(false);
+    expect(roleHasPermission("member", Permission.KICK_MEMBERS)).toBe(false);
+  });
+
+  it("derives voice moderation and member-list gates identically", () => {
+    // Regression: canModerateVoice used to deny on an unknown role while the
+    // member list fell back to the legacy name check, so on a server that sent
+    // no role list an admin kept kick/ban but silently lost the voice menu.
+    setRoles([]);
+    for (const role of ["owner", "admin", "moderator", "member"]) {
+      expect(roleHasPermission(role, Permission.MUTE_MEMBERS)).toBe(
+        roleHasPermission(role, Permission.KICK_MEMBERS),
+      );
+    }
+  });
+});
+
+describe("isLegacyAdminRole", () => {
+  it("matches owner and admin case-insensitively and nothing else", () => {
+    expect(isLegacyAdminRole("Owner")).toBe(true);
+    expect(isLegacyAdminRole("ADMIN")).toBe(true);
+    expect(isLegacyAdminRole("moderator")).toBe(false);
+    expect(isLegacyAdminRole("")).toBe(false);
+  });
+});
+
+// ─── Channel management / audit-log gates ────────────────────────────────────
+//
+// Both are derived from the permission BIT, not from a role name: a custom role
+// granted MANAGE_CHANNELS could edit channels through the API while the client
+// hid the affordance, because the old check asked whether the role was called
+// "owner" or "admin".
+
+describe("canManageChannels / canViewAuditLog", () => {
+  function signInAs(role: string): void {
+    authStore.setState(() => ({
+      token: "tok",
+      user: { id: 1, username: "A", avatar: null, role },
+      serverName: "T",
+      motd: null,
+      isAuthenticated: true,
+    }));
+  }
+
+  it("grants channel management to a custom role holding the bit", () => {
+    setRoles([{ id: 9, name: "Curator", color: null, permissions: Permission.MANAGE_CHANNELS }]);
+    signInAs("Curator");
+    expect(canManageChannels()).toBe(true);
+  });
+
+  it("denies channel management to a role without the bit", () => {
+    setRoles([{ id: 4, name: "Member", color: null, permissions: MEMBER_PERMS }]);
+    signInAs("Member");
+    expect(canManageChannels()).toBe(false);
+  });
+
+  it("lets the ADMINISTRATOR bit pass channel management", () => {
+    setRoles([{ id: 1, name: "Owner", color: null, permissions: OWNER_PERMS }]);
+    signInAs("Owner");
+    expect(canManageChannels()).toBe(true);
+  });
+
+  // Without a role list there is nothing to check the bit against; the legacy
+  // name check stands in so channel management is not hidden from every actual
+  // admin on an older server.
+  it("falls back to the legacy owner/admin names with no role list", () => {
+    setRoles([]);
+    signInAs("admin");
+    expect(canManageChannels()).toBe(true);
+    signInAs("moderator");
+    expect(canManageChannels()).toBe(false);
+  });
+
+  it("gates the audit-log entry on VIEW_AUDIT_LOG", () => {
+    setRoles([
+      { id: 3, name: "Moderator", color: null, permissions: Permission.VIEW_AUDIT_LOG },
+      { id: 4, name: "Member", color: null, permissions: MEMBER_PERMS },
+    ]);
+    signInAs("Moderator");
+    expect(canViewAuditLog()).toBe(true);
+    signInAs("Member");
+    expect(canViewAuditLog()).toBe(false);
+  });
+
+  // The two gates are independent: an auditor who may read the log need not be
+  // able to edit channels, and vice versa.
+  it("keeps the two gates independent", () => {
+    setRoles([
+      { id: 9, name: "Auditor", color: null, permissions: Permission.VIEW_AUDIT_LOG },
+      { id: 10, name: "Curator", color: null, permissions: Permission.MANAGE_CHANNELS },
+    ]);
+    signInAs("Auditor");
+    expect(canViewAuditLog()).toBe(true);
+    expect(canManageChannels()).toBe(false);
+    signInAs("Curator");
+    expect(canViewAuditLog()).toBe(false);
+    expect(canManageChannels()).toBe(true);
+  });
+});
diff --git a/Client/tauri-client/tests/unit/profiles.test.ts b/Client/tauri-client/tests/unit/profiles.test.ts
index c3c577dd..a381cb1f 100644
--- a/Client/tauri-client/tests/unit/profiles.test.ts
+++ b/Client/tauri-client/tests/unit/profiles.test.ts
@@ -191,6 +191,9 @@ describe("ProfileManager", () => {
       const m = mgr();
       // Should not throw
       m.setLastConnected("missing");
+
+      expect(m.getAll()).toHaveLength(0);
+      expect(m.getById("missing")).toBeNull();
     });
 
     it("only updates lastConnected on the matching profile, not others", () => {
diff --git a/Client/tauri-client/tests/unit/reaction-tooltip.test.ts b/Client/tauri-client/tests/unit/reaction-tooltip.test.ts
new file mode 100644
index 00000000..8634cef3
--- /dev/null
+++ b/Client/tauri-client/tests/unit/reaction-tooltip.test.ts
@@ -0,0 +1,316 @@
+/**
+ * Who-reacted tooltip: the hover debounce, the per-message+emoji cache and its
+ * invalidation, and the name formatting the tooltip renders.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@lib/logger", () => ({
+  createLogger: () => ({ debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() }),
+}));
+
+import {
+  REACTION_TOOLTIP_DEBOUNCE_MS,
+  attachReactionTooltip,
+  buildReactionTooltip,
+  clearReactionUsersCache,
+  formatReactorNames,
+  getCachedReactionUsers,
+  invalidateReactionUsers,
+  loadReactionUsers,
+  setReactionUsersFetcher,
+} from "../../src/components/message-list/reaction-tooltip";
+import type { ReactionUser } from "@lib/types";
+
+function user(id: number, username: string): ReactionUser {
+  return { id, username, avatar: "" };
+}
+
+const ALICE = user(1, "alice");
+const BOB = user(2, "bob");
+
+let fetcher: ReturnType<typeof vi.fn>;
+
+beforeEach(() => {
+  clearReactionUsersCache();
+  fetcher = vi.fn().mockResolvedValue([ALICE, BOB]);
+  setReactionUsersFetcher(fetcher as never);
+});
+
+afterEach(() => {
+  setReactionUsersFetcher(null);
+  vi.useRealTimers();
+});
+
+describe("formatReactorNames", () => {
+  it("names a single reactor", () => {
+    expect(formatReactorNames(["alice"])).toBe("alice");
+  });
+
+  it("joins two with 'and'", () => {
+    expect(formatReactorNames(["alice", "bob"])).toBe("alice and bob");
+  });
+
+  it("joins three with commas and a final 'and'", () => {
+    expect(formatReactorNames(["alice", "bob", "carol"])).toBe("alice, bob and carol");
+  });
+
+  it("collapses the tail into 'and N others'", () => {
+    expect(formatReactorNames(["alice", "bob", "carol", "dave", "erin"])).toBe(
+      "alice, bob, carol and 2 others",
+    );
+  });
+
+  it("uses the singular for exactly one overflow name", () => {
+    expect(formatReactorNames(["alice", "bob", "carol", "dave"])).toBe(
+      "alice, bob, carol and 1 other",
+    );
+  });
+
+  // The server caps the list at 100 but the pill's count can be higher; the
+  // phrasing must follow the count, not the truncated list.
+  it("counts overflow from the pill count, not the fetched list", () => {
+    expect(formatReactorNames(["alice", "bob", "carol"], 250)).toBe(
+      "alice, bob, carol and 247 others",
+    );
+  });
+
+  it("returns an empty string for no reactors", () => {
+    expect(formatReactorNames([])).toBe("");
+  });
+});
+
+describe("buildReactionTooltip", () => {
+  it("renders names and the emoji as text nodes", () => {
+    const tip = buildReactionTooltip("👍", [ALICE, BOB], 2);
+    expect(tip.querySelector(".reaction-tooltip-names")?.textContent).toBe("alice and bob");
+    expect(tip.querySelector(".reaction-tooltip-emoji")?.textContent).toBe("reacted with 👍");
+  });
+
+  // Usernames are user-controlled: they must never be parsed as markup.
+  it("escapes a username that looks like HTML", () => {
+    const tip = buildReactionTooltip("👍", [user(9, "<img src=x onerror=alert(1)>")], 1);
+    const names = tip.querySelector(".reaction-tooltip-names") as HTMLElement;
+    expect(names.querySelector("img")).toBeNull();
+    expect(names.textContent).toBe("<img src=x onerror=alert(1)>");
+  });
+});
+
+describe("loadReactionUsers — cache", () => {
+  it("fetches once and serves later calls from the cache", async () => {
+    await loadReactionUsers(5, 42, "👍");
+    await loadReactionUsers(5, 42, "👍");
+
+    expect(fetcher).toHaveBeenCalledTimes(1);
+    expect(fetcher).toHaveBeenCalledWith(5, 42, "👍");
+    expect(getCachedReactionUsers(42, "👍")).toEqual([ALICE, BOB]);
+  });
+
+  it("keys the cache by emoji as well as message", async () => {
+    await loadReactionUsers(5, 42, "👍");
+    await loadReactionUsers(5, 42, "🎉");
+
+    expect(fetcher).toHaveBeenCalledTimes(2);
+  });
+
+  it("deduplicates concurrent requests for the same key", async () => {
+    const [a, b] = await Promise.all([
+      loadReactionUsers(5, 42, "👍"),
+      loadReactionUsers(5, 42, "👍"),
+    ]);
+
+    expect(fetcher).toHaveBeenCalledTimes(1);
+    expect(a).toEqual(b);
+  });
+
+  it("returns null and caches nothing when the request fails", async () => {
+    fetcher.mockRejectedValue(new Error("403"));
+
+    expect(await loadReactionUsers(5, 42, "👍")).toBeNull();
+    expect(getCachedReactionUsers(42, "👍")).toBeUndefined();
+  });
+
+  it("returns null when no fetcher is registered", async () => {
+    setReactionUsersFetcher(null);
+    expect(await loadReactionUsers(5, 42, "👍")).toBeNull();
+  });
+});
+
+describe("invalidateReactionUsers", () => {
+  it("drops every emoji's list for the message", async () => {
+    await loadReactionUsers(5, 42, "👍");
+    await loadReactionUsers(5, 42, "🎉");
+
+    invalidateReactionUsers(42);
+
+    expect(getCachedReactionUsers(42, "👍")).toBeUndefined();
+    expect(getCachedReactionUsers(42, "🎉")).toBeUndefined();
+
+    await loadReactionUsers(5, 42, "👍");
+    expect(fetcher).toHaveBeenCalledTimes(3);
+  });
+
+  it("leaves other messages' caches alone", async () => {
+    await loadReactionUsers(5, 42, "👍");
+    await loadReactionUsers(5, 43, "👍");
+
+    invalidateReactionUsers(42);
+
+    expect(getCachedReactionUsers(43, "👍")).toEqual([ALICE, BOB]);
+  });
+
+  // Message ids share a prefix (42 / 420): the key separator must keep them apart.
+  it("does not evict a message whose id merely starts with the same digits", async () => {
+    await loadReactionUsers(5, 420, "👍");
+    invalidateReactionUsers(42);
+    expect(getCachedReactionUsers(420, "👍")).toEqual([ALICE, BOB]);
+  });
+
+  // A response that lands after an invalidation describes a state that already
+  // changed — it must not repopulate the cache.
+  it("discards an in-flight response that an invalidation raced", async () => {
+    let resolve!: (users: readonly ReactionUser[]) => void;
+    fetcher.mockReturnValue(
+      new Promise<readonly ReactionUser[]>((r) => {
+        resolve = r;
+      }),
+    );
+
+    const pending = loadReactionUsers(5, 42, "👍");
+    invalidateReactionUsers(42);
+    resolve([ALICE]);
+    await pending;
+
+    expect(getCachedReactionUsers(42, "👍")).toBeUndefined();
+  });
+
+  it("clearReactionUsersCache drops everything", async () => {
+    await loadReactionUsers(5, 42, "👍");
+    clearReactionUsersCache();
+    expect(getCachedReactionUsers(42, "👍")).toBeUndefined();
+  });
+});
+
+describe("attachReactionTooltip", () => {
+  function makeChip(): { chip: HTMLElement; ac: AbortController } {
+    const chip = document.createElement("span");
+    chip.className = "reaction-chip";
+    document.body.appendChild(chip);
+    return { chip, ac: new AbortController() };
+  }
+
+  beforeEach(() => {
+    document.body.textContent = "";
+  });
+
+  it("does not fetch before the debounce elapses", () => {
+    vi.useFakeTimers();
+    const { chip, ac } = makeChip();
+    attachReactionTooltip(chip, { channelId: 5, messageId: 42, emoji: "👍", count: 2 }, ac.signal);
+
+    chip.dispatchEvent(new Event("mouseenter"));
+    vi.advanceTimersByTime(REACTION_TOOLTIP_DEBOUNCE_MS - 1);
+
+    expect(fetcher).not.toHaveBeenCalled();
+    expect(chip.querySelector(".reaction-tooltip")).toBeNull();
+  });
+
+  it("shows the tooltip after the debounce elapses", async () => {
+    const { chip, ac } = makeChip();
+    attachReactionTooltip(chip, { channelId: 5, messageId: 42, emoji: "👍", count: 2 }, ac.signal);
+
+    chip.dispatchEvent(new Event("mouseenter"));
+
+    await vi.waitFor(() => {
+      expect(chip.querySelector(".reaction-tooltip")).not.toBeNull();
+    });
+    expect(chip.querySelector(".reaction-tooltip-names")?.textContent).toBe("alice and bob");
+    expect(fetcher).toHaveBeenCalledWith(5, 42, "👍");
+  });
+
+  it("cancels the pending fetch when the pointer leaves first", () => {
+    vi.useFakeTimers();
+    const { chip, ac } = makeChip();
+    attachReactionTooltip(chip, { channelId: 5, messageId: 42, emoji: "👍", count: 2 }, ac.signal);
+
+    chip.dispatchEvent(new Event("mouseenter"));
+    chip.dispatchEvent(new Event("mouseleave"));
+    vi.advanceTimersByTime(REACTION_TOOLTIP_DEBOUNCE_MS * 2);
+
+    expect(fetcher).not.toHaveBeenCalled();
+  });
+
+  it("removes the tooltip on mouseleave", async () => {
+    const { chip, ac } = makeChip();
+    attachReactionTooltip(chip, { channelId: 5, messageId: 42, emoji: "👍", count: 2 }, ac.signal);
+
+    chip.dispatchEvent(new Event("mouseenter"));
+    await vi.waitFor(() => {
+      expect(chip.querySelector(".reaction-tooltip")).not.toBeNull();
+    });
+
+    chip.dispatchEvent(new Event("mouseleave"));
+    expect(chip.querySelector(".reaction-tooltip")).toBeNull();
+  });
+
+  it("does not pop a tooltip for a response that lands after the pointer left", async () => {
+    let resolve!: (users: readonly ReactionUser[]) => void;
+    fetcher.mockReturnValue(
+      new Promise<readonly ReactionUser[]>((r) => {
+        resolve = r;
+      }),
+    );
+
+    const { chip, ac } = makeChip();
+    attachReactionTooltip(chip, { channelId: 5, messageId: 42, emoji: "👍", count: 2 }, ac.signal);
+
+    chip.dispatchEvent(new Event("mouseenter"));
+    await vi.waitFor(() => {
+      expect(fetcher).toHaveBeenCalled();
+    });
+    chip.dispatchEvent(new Event("mouseleave"));
+    resolve([ALICE]);
+    await Promise.resolve();
+    await Promise.resolve();
+
+    expect(chip.querySelector(".reaction-tooltip")).toBeNull();
+  });
+
+  it("shows nothing when the reactor list comes back empty", async () => {
+    fetcher.mockResolvedValue([]);
+    const { chip, ac } = makeChip();
+    attachReactionTooltip(chip, { channelId: 5, messageId: 42, emoji: "👍", count: 0 }, ac.signal);
+
+    chip.dispatchEvent(new Event("mouseenter"));
+    await vi.waitFor(() => {
+      expect(fetcher).toHaveBeenCalled();
+    });
+    await Promise.resolve();
+
+    expect(chip.querySelector(".reaction-tooltip")).toBeNull();
+  });
+
+  it("mirrors hover on keyboard focus", async () => {
+    const { chip, ac } = makeChip();
+    attachReactionTooltip(chip, { channelId: 5, messageId: 42, emoji: "👍", count: 2 }, ac.signal);
+
+    chip.dispatchEvent(new Event("focusin"));
+    await vi.waitFor(() => {
+      expect(chip.querySelector(".reaction-tooltip")).not.toBeNull();
+    });
+
+    chip.dispatchEvent(new Event("focusout"));
+    expect(chip.querySelector(".reaction-tooltip")).toBeNull();
+  });
+
+  it("tears down the pending timer when the list is destroyed", () => {
+    vi.useFakeTimers();
+    const { chip, ac } = makeChip();
+    attachReactionTooltip(chip, { channelId: 5, messageId: 42, emoji: "👍", count: 2 }, ac.signal);
+
+    chip.dispatchEvent(new Event("mouseenter"));
+    ac.abort();
+    vi.advanceTimersByTime(REACTION_TOOLTIP_DEBOUNCE_MS * 2);
+
+    expect(fetcher).not.toHaveBeenCalled();
+  });
+});
diff --git a/Client/tauri-client/tests/unit/read-state.test.ts b/Client/tauri-client/tests/unit/read-state.test.ts
new file mode 100644
index 00000000..503d8071
--- /dev/null
+++ b/Client/tauri-client/tests/unit/read-state.test.ts
@@ -0,0 +1,162 @@
+/**
+ * Explicit mark-as-read. The property that matters is that it uses `mark_read`
+ * rather than `channel_focus` — the local badge clearing is the easy half; not
+ * moving the connection's focused channel is the reason this exists.
+ */
+import { describe, it, expect, beforeEach, vi } from "vitest";
+
+import {
+  markAllRead,
+  markChannelRead,
+  hasUnread,
+  setMarkReadSender,
+  unreadChannelIds,
+} from "@lib/read-state";
+import { channelsStore, setChannels } from "@stores/channels.store";
+import { dmStore, setDmChannels } from "@stores/dm.store";
+import type { ReadyChannel } from "@lib/types";
+import type { DmChannel } from "@stores/dm.store";
+
+function channel(id: number, unread: number, mentions = 0): ReadyChannel {
+  return {
+    id,
+    name: `chan-${id}`,
+    type: "text",
+    category: null,
+    position: id,
+    unread_count: unread,
+    mention_count: mentions,
+  };
+}
+
+function dm(channelId: number, unread: number, mentions = 0): DmChannel {
+  return {
+    channelId,
+    recipient: { id: channelId * 10, username: `u${channelId}`, avatar: "", status: "online" },
+    participants: [],
+    name: "",
+    isGroup: false,
+    lastMessageId: null,
+    lastMessage: "",
+    lastMessageAt: "",
+    unreadCount: unread,
+    mentionCount: mentions,
+  };
+}
+
+let sent: number[];
+
+beforeEach(() => {
+  sent = [];
+  setMarkReadSender((id) => sent.push(id));
+  channelsStore.setState(() => ({ channels: new Map(), activeChannelId: null, roles: [] }));
+  dmStore.setState(() => ({ channels: [] }));
+});
+
+describe("hasUnread", () => {
+  it("is true for an unread channel and false once it is read", () => {
+    setChannels([channel(1, 3), channel(2, 0)]);
+    expect(hasUnread(1)).toBe(true);
+    expect(hasUnread(2)).toBe(false);
+  });
+
+  it("counts a mention-only channel as unread", () => {
+    setChannels([channel(1, 0, 2)]);
+    expect(hasUnread(1)).toBe(true);
+  });
+
+  it("sees DM badges, which live in a different store", () => {
+    setDmChannels([dm(50, 4)]);
+    expect(hasUnread(50)).toBe(true);
+  });
+
+  it("is false for an unknown channel", () => {
+    expect(hasUnread(999)).toBe(false);
+  });
+});
+
+describe("markChannelRead", () => {
+  it("sends mark_read and clears the local badges", () => {
+    setChannels([channel(1, 3, 2)]);
+
+    markChannelRead(1);
+
+    expect(sent).toEqual([1]);
+    const ch = channelsStore.getState().channels.get(1);
+    expect(ch?.unreadCount).toBe(0);
+    expect(ch?.mentionCount).toBe(0);
+  });
+
+  it("does not make the channel active — marking read is not visiting", () => {
+    setChannels([channel(1, 3), channel(2, 1)]);
+    channelsStore.setState((prev) => ({ ...prev, activeChannelId: 2 }));
+
+    markChannelRead(1);
+
+    expect(channelsStore.getState().activeChannelId).toBe(2);
+  });
+
+  it("clears a DM's badges", () => {
+    setDmChannels([dm(50, 4, 1)]);
+
+    markChannelRead(50);
+
+    expect(sent).toEqual([50]);
+    const conv = dmStore.getState().channels[0];
+    expect(conv?.unreadCount).toBe(0);
+    expect(conv?.mentionCount).toBe(0);
+  });
+
+  it("ignores a channel this client does not know", () => {
+    markChannelRead(999);
+    expect(sent).toEqual([]);
+  });
+
+  // A dropped send still clears locally; the next ready re-asserts the server's
+  // view, so the badge self-corrects rather than being stuck.
+  it("still clears the badge with no sender registered", () => {
+    setMarkReadSender(null);
+    setChannels([channel(1, 3)]);
+
+    markChannelRead(1);
+
+    expect(channelsStore.getState().channels.get(1)?.unreadCount).toBe(0);
+  });
+});
+
+describe("unreadChannelIds / markAllRead", () => {
+  it("lists every badged channel and DM, and nothing else", () => {
+    setChannels([channel(1, 3), channel(2, 0), channel(3, 0, 1)]);
+    setDmChannels([dm(50, 2), dm(51, 0)]);
+
+    expect([...unreadChannelIds()].sort((a, b) => a - b)).toEqual([1, 3, 50]);
+  });
+
+  it("marks everything read and reports how many", () => {
+    setChannels([channel(1, 3), channel(2, 0), channel(3, 0, 1)]);
+    setDmChannels([dm(50, 2)]);
+
+    expect(markAllRead()).toBe(3);
+    expect([...sent].sort((a, b) => a - b)).toEqual([1, 3, 50]);
+    expect(unreadChannelIds()).toEqual([]);
+  });
+
+  it("is a no-op when nothing is unread", () => {
+    setChannels([channel(1, 0)]);
+
+    expect(markAllRead()).toBe(0);
+    expect(sent).toEqual([]);
+  });
+});
+
+describe("mark_read wiring", () => {
+  it("hands the sender only the channel id", () => {
+    const sender = vi.fn();
+    setMarkReadSender(sender);
+    setChannels([channel(7, 1)]);
+
+    markChannelRead(7);
+
+    expect(sender).toHaveBeenCalledExactlyOnceWith(7);
+  });
+});
diff --git a/Client/tauri-client/tests/unit/renderers.test.ts b/Client/tauri-client/tests/unit/renderers.test.ts
index 6152aaf0..d728ca1b 100644
--- a/Client/tauri-client/tests/unit/renderers.test.ts
+++ b/Client/tauri-client/tests/unit/renderers.test.ts
@@ -21,6 +21,10 @@ import { membersStore } from "../../src/stores/members.store";
 import { channelsStore, setRoles } from "../../src/stores/channels.store";
 import { authStore } from "../../src/stores/auth.store";
 import type { MessageListOptions } from "../../src/components/MessageList";
+import {
+  clearReactionUsersCache,
+  setReactionUsersFetcher,
+} from "../../src/components/message-list/reaction-tooltip";
 
 function resetStores(): void {
   membersStore.setState(() => ({
@@ -37,6 +41,17 @@ function resetStores(): void {
   }));
 }
 
+/** Seed the member list so @tokens resolve — unresolvable tokens stay plain text. */
+function seedMentionMembers(): void {
+  membersStore.setState((prev) => ({
+    ...prev,
+    members: new Map([
+      [10, { id: 10, username: "alice", avatar: null, role: "member", status: "online" as const }],
+      [11, { id: 11, username: "bob", avatar: null, role: "member", status: "online" as const }],
+    ]),
+  }));
+}
+
 function makeMessage(overrides: Partial<Message> = {}): Message {
   return {
     id: 1,
@@ -168,7 +183,8 @@ describe("renderers", () => {
   });
 
   describe("renderMentions", () => {
-    it("wraps @mentions in span with mention class", () => {
+    it("wraps resolvable @mentions in span with mention class", () => {
+      seedMentionMembers();
       const fragment = renderMentions("Hello @alice how are you?");
       container.appendChild(fragment);
 
@@ -186,6 +202,7 @@ describe("renderers", () => {
     });
 
     it("handles multiple mentions", () => {
+      seedMentionMembers();
       const fragment = renderMentions("@alice and @bob");
       container.appendChild(fragment);
 
@@ -412,6 +429,52 @@ describe("renderers", () => {
       ac.abort();
     });
 
+    // The who-reacted tooltip hangs off the pill, so the pill has to carry its
+    // emoji and be focusable for a keyboard user to reach the tooltip at all.
+    it("makes reaction pills focusable and tags them with their emoji", () => {
+      const msg = makeMessage({
+        reactions: [{ emoji: "\uD83D\uDC4D", count: 3, me: false }],
+      });
+      const ac = new AbortController();
+      const el = renderMessage(msg, false, [msg], makeOpts(), ac.signal);
+      container.appendChild(el);
+
+      const chip = container.querySelector(
+        ".reaction-chip:not(.add-reaction)",
+      ) as HTMLElement | null;
+      expect(chip?.dataset.emoji).toBe("\uD83D\uDC4D");
+      expect(chip?.getAttribute("tabindex")).toBe("0");
+
+      ac.abort();
+    });
+
+    it("shows the who-reacted tooltip after hovering a pill", async () => {
+      setReactionUsersFetcher(() =>
+        Promise.resolve([
+          { id: 1, username: "alice", avatar: "" },
+          { id: 2, username: "bob", avatar: "" },
+        ]),
+      );
+      clearReactionUsersCache();
+
+      const msg = makeMessage({
+        reactions: [{ emoji: "\uD83D\uDC4D", count: 2, me: false }],
+      });
+      const ac = new AbortController();
+      const el = renderMessage(msg, false, [msg], makeOpts(), ac.signal);
+      container.appendChild(el);
+
+      const chip = container.querySelector(".reaction-chip:not(.add-reaction)") as HTMLElement;
+      chip.dispatchEvent(new Event("mouseenter"));
+
+      await vi.waitFor(() => {
+        expect(chip.querySelector(".reaction-tooltip-names")?.textContent).toBe("alice and bob");
+      });
+
+      ac.abort();
+      setReactionUsersFetcher(null);
+    });
+
     it("renders attachments for image types", () => {
       const msg = makeMessage({
         attachments: [
@@ -740,6 +803,7 @@ describe("renderers", () => {
         user: { id: 0, username: "System", avatar: null },
         content: "@alice was promoted to admin",
       });
+      seedMentionMembers();
       const ac = new AbortController();
       const el = renderMessage(msg, false, [msg], makeOpts(), ac.signal);
       container.appendChild(el);
@@ -1229,6 +1293,7 @@ describe("renderers", () => {
     });
 
     it("renders @mention at start of text", () => {
+      seedMentionMembers();
       const fragment = renderMentionSegment("@alice hello");
       container.appendChild(fragment);
       const mention = container.querySelector(".mention");
@@ -1258,6 +1323,7 @@ describe("renderers", () => {
     });
 
     it("renders mention inside non-code text", () => {
+      seedMentionMembers();
       const fragment = renderInlineContent("hello @alice and `code`");
       container.appendChild(fragment);
       expect(container.querySelector(".mention")).not.toBeNull();
@@ -1466,3 +1532,95 @@ describe("renderers", () => {
     });
   });
 });
+
+// ─── Phase 6: display names and avatars on message rows ──────────────────────
+
+describe("message row author identity", () => {
+  beforeEach(() => {
+    resetStores();
+  });
+
+  afterEach(() => {
+    resetStores();
+  });
+
+  it("renders the display name from the member store, keeping the username as a title", () => {
+    membersStore.setState((prev) => ({
+      ...prev,
+      members: new Map([
+        [
+          10,
+          {
+            id: 10,
+            username: "alice",
+            displayName: "Alice A.",
+            avatar: null,
+            role: "member",
+            status: "online" as const,
+          },
+        ],
+      ]),
+    }));
+
+    const el = renderMessage(
+      makeMessage({ user: { id: 10, username: "alice", avatar: null } }),
+      false,
+      [],
+      makeOpts(),
+      new AbortController().signal,
+    );
+
+    const author = el.querySelector(".msg-author");
+    expect(author?.textContent).toBe("Alice A.");
+    // The handle you would @mention is one hover away.
+    expect(author?.getAttribute("title")).toBe("alice");
+    // And the letter follows the rendered name.
+    expect(el.querySelector(".msg-avatar .avatar-initial")?.textContent).toBe("A");
+  });
+
+  it("prefers the live member store over the identity frozen into the payload", () => {
+    // A rename arrives as a user_update and patches the member store; the
+    // messages already on screen still carry the old name in their payload.
+    membersStore.setState((prev) => ({
+      ...prev,
+      members: new Map([
+        [
+          10,
+          {
+            id: 10,
+            username: "renamed",
+            displayName: null,
+            avatar: null,
+            role: "member",
+            status: "online" as const,
+          },
+        ],
+      ]),
+    }));
+
+    const el = renderMessage(
+      makeMessage({ user: { id: 10, username: "old-name", avatar: null } }),
+      false,
+      [],
+      makeOpts(),
+      new AbortController().signal,
+    );
+
+    expect(el.querySelector(".msg-author")?.textContent).toBe("renamed");
+  });
+
+  it("falls back to the payload for an author who is not in the member list", () => {
+    const el = renderMessage(
+      makeMessage({
+        user: { id: 99, username: "ghost", avatar: null, display_name: "Ghosty" },
+      }),
+      false,
+      [],
+      makeOpts(),
+      new AbortController().signal,
+    );
+
+    expect(el.querySelector(".msg-author")?.textContent).toBe("Ghosty");
+    expect(el.querySelector(".msg-avatar .avatar-initial")?.textContent).toBe("G");
+  });
+});
diff --git a/Client/tauri-client/tests/unit/screen-share-button.test.ts b/Client/tauri-client/tests/unit/screen-share-button.test.ts
index fdda83aa..432bf894 100644
--- a/Client/tauri-client/tests/unit/screen-share-button.test.ts
+++ b/Client/tauri-client/tests/unit/screen-share-button.test.ts
@@ -77,9 +77,14 @@ function setVoiceConnected(screenshare = false): void {
           category: null,
           position: 0,
           unreadCount: 0,
+          mentionCount: 0,
           lastMessageId: null,
           canSend: true,
+          topic: "",
           slowMode: 0,
+          nsfw: false,
+          voiceMaxUsers: 0,
+          voiceMaxVideo: 0,
         },
       ],
     ]),
diff --git a/Client/tauri-client/tests/unit/search-overlay.test.ts b/Client/tauri-client/tests/unit/search-overlay.test.ts
index c0c80b69..0c004f20 100644
--- a/Client/tauri-client/tests/unit/search-overlay.test.ts
+++ b/Client/tauri-client/tests/unit/search-overlay.test.ts
@@ -555,4 +555,30 @@ describe("createSearchOverlay", () => {
 
     overlay.destroy?.();
   });
+
+  it("reschedules a rate-limited search instead of dropping it", async () => {
+    const onSearch = vi.fn().mockResolvedValue([]);
+    const opts = makeOptions({ onSearch });
+    const overlay = createSearchOverlay(opts);
+    overlay.mount(container);
+
+    const input = container.querySelector(".search-overlay-input") as HTMLInputElement;
+
+    // First query fires after debounce, stamping the rate-limit clock.
+    input.value = "he";
+    input.dispatchEvent(new Event("input"));
+    await vi.advanceTimersByTimeAsync(300);
+    expect(onSearch).toHaveBeenLastCalledWith("he", undefined, expect.any(AbortSignal));
+
+    // The user keeps typing; the next debounced search lands only ~300ms after
+    // the first, inside the 500ms rate-limit window. It must be rescheduled,
+    // not silently dropped (which would leave the "he" results on screen).
+    input.value = "hello";
+    input.dispatchEvent(new Event("input"));
+    // Debounce (300ms) then the remaining rate-limit window (~200ms) elapse.
+    await vi.advanceTimersByTimeAsync(300 + 500);
+    expect(onSearch).toHaveBeenLastCalledWith("hello", undefined, expect.any(AbortSignal));
+
+    overlay.destroy?.();
+  });
 });
diff --git a/Client/tauri-client/tests/unit/settings-overlay.test.ts b/Client/tauri-client/tests/unit/settings-overlay.test.ts
index 3d4fc109..ef27af9e 100644
--- a/Client/tauri-client/tests/unit/settings-overlay.test.ts
+++ b/Client/tauri-client/tests/unit/settings-overlay.test.ts
@@ -65,6 +65,7 @@ describe("SettingsOverlay", () => {
     onClose: vi.fn(),
     onChangePassword: vi.fn().mockResolvedValue(undefined),
     onUpdateProfile: vi.fn().mockResolvedValue(undefined),
+    onUploadAvatar: vi.fn().mockResolvedValue("/api/v1/files/test"),
     onLogout: vi.fn(),
     onDeleteAccount: vi.fn().mockResolvedValue(undefined),
     onStatusChange: vi.fn(),
@@ -497,7 +498,9 @@ describe("SettingsOverlay", () => {
     const editBtn = container.querySelector(".account-field-edit") as HTMLElement;
     editBtn.click();
 
-    const editInput = container.querySelector("input.form-input[type='text']") as HTMLInputElement;
+    const editInput = container.querySelector(
+      '[data-testid="username-edit-input"]',
+    ) as HTMLInputElement;
     editInput.value = "taken-name";
 
     const saveBtn = Array.from(container.querySelectorAll(".ac-btn")).find(
@@ -524,7 +527,9 @@ describe("SettingsOverlay", () => {
     ) as HTMLElement;
     editProfileBtn.click();
 
-    const editInput = container.querySelector("input.form-input[type='text']") as HTMLInputElement;
+    const editInput = container.querySelector(
+      '[data-testid="username-edit-input"]',
+    ) as HTMLInputElement;
     expect(editInput).not.toBeNull();
     // The edit form should be visible
     const editForm = editInput.closest(".setting-row") as HTMLElement;
@@ -548,7 +553,9 @@ describe("SettingsOverlay", () => {
     cancelBtn.click();
 
     // Edit form should be hidden
-    const editInput = container.querySelector("input.form-input[type='text']") as HTMLInputElement;
+    const editInput = container.querySelector(
+      '[data-testid="username-edit-input"]',
+    ) as HTMLInputElement;
     const editForm = editInput.closest(".setting-row") as HTMLElement;
     expect(editForm.style.display).toBe("none");
 
@@ -764,7 +771,9 @@ describe("SettingsOverlay", () => {
     editBtn.click();
 
     // Type a single character
-    const editInput = container.querySelector("input.form-input[type='text']") as HTMLInputElement;
+    const editInput = container.querySelector(
+      '[data-testid="username-edit-input"]',
+    ) as HTMLInputElement;
     editInput.value = "A";
 
     // Click Save
@@ -786,7 +795,9 @@ describe("SettingsOverlay", () => {
     const editBtn = container.querySelector(".account-field-edit") as HTMLElement;
     editBtn.click();
 
-    const editInput = container.querySelector("input.form-input[type='text']") as HTMLInputElement;
+    const editInput = container.querySelector(
+      '[data-testid="username-edit-input"]',
+    ) as HTMLInputElement;
     editInput.value = "AB";
 
     const saveBtn = Array.from(container.querySelectorAll(".ac-btn")).find(
@@ -794,21 +805,24 @@ describe("SettingsOverlay", () => {
     ) as HTMLElement;
     saveBtn.click();
 
-    expect(defaultOptions.onUpdateProfile).toHaveBeenCalledWith("AB");
+    expect(defaultOptions.onUpdateProfile).toHaveBeenCalledWith({ username: "AB" });
 
     overlay.destroy?.();
   });
 
   // --- Status selector ---
 
-  it("labels the offline status as 'Offline' (not 'Invisible')", () => {
+  // Phase 6 flipped this: "invisible" is a real, settable status now (the
+  // server stores it and shows everyone else offline), so the option says what
+  // it does instead of borrowing "offline"'s name.
+  it("offers Invisible as a status, not Offline", () => {
     const overlay = createSettingsOverlay(defaultOptions);
     overlay.mount(container);
 
     const statusLabels = container.querySelectorAll(".settings-status-label");
     const labels = Array.from(statusLabels).map((el) => el.textContent);
-    expect(labels).toContain("Offline");
-    expect(labels).not.toContain("Invisible");
+    expect(labels).toContain("Invisible");
+    expect(labels).not.toContain("Offline");
 
     overlay.destroy?.();
   });
diff --git a/Client/tauri-client/tests/unit/sidebar-area.test.ts b/Client/tauri-client/tests/unit/sidebar-area.test.ts
index 7bf738ba..5c4e3300 100644
--- a/Client/tauri-client/tests/unit/sidebar-area.test.ts
+++ b/Client/tauri-client/tests/unit/sidebar-area.test.ts
@@ -98,6 +98,11 @@ vi.mock("@components/CreateChannelModal", () => ({
   }),
 }));
 
+const mockOpenUrl = vi.fn(async (_url: string) => {});
+vi.mock("@tauri-apps/plugin-opener", () => ({
+  openUrl: (url: string) => mockOpenUrl(url),
+}));
+
 vi.mock("@components/EditChannelModal", () => ({
   createEditChannelModal: vi.fn().mockReturnValue({
     mount: vi.fn(),
@@ -124,6 +129,12 @@ vi.mock("../../src/pages/main-page/VoiceCallbacks", () => ({
     onVoiceJoin: vi.fn(),
     onVoiceLeave: vi.fn(),
   }),
+  createVoiceModerationCallbacks: vi.fn().mockReturnValue({
+    onServerMute: vi.fn(),
+    onServerDeafen: vi.fn(),
+    onMove: vi.fn(),
+    onDisconnect: vi.fn(),
+  }),
 }));
 
 vi.mock("../../src/pages/main-page/OverlayManagers", () => ({
@@ -138,10 +149,11 @@ vi.mock("../../src/pages/main-page/OverlayManagers", () => ({
 // ---------------------------------------------------------------------------
 
 import { createSidebarArea, type SidebarAreaOptions } from "../../src/pages/main-page/SidebarArea";
-import { channelsStore, setActiveChannel } from "../../src/stores/channels.store";
+import { channelsStore, setActiveChannel, setRoles } from "../../src/stores/channels.store";
 import { dmStore, addDmChannel } from "../../src/stores/dm.store";
 import { uiStore, setSidebarMode, setActiveDmUser } from "../../src/stores/ui.store";
 import { authStore } from "../../src/stores/auth.store";
+import { Permission } from "../../src/lib/types";
 import { membersStore } from "../../src/stores/members.store";
 import { voiceStore } from "../../src/stores/voice.store";
 import type { DmChannel } from "../../src/stores/dm.store";
@@ -250,10 +262,14 @@ function makeDm(overrides: Partial<DmChannel> = {}): DmChannel {
   return {
     channelId: 100,
     recipient: { id: 10, username: "Alice", avatar: "", status: "online" },
+    participants: [{ id: 10, username: "Alice", avatar: "", status: "online" }],
+    name: "",
+    isGroup: false,
     lastMessageId: null,
     lastMessage: "",
     lastMessageAt: "",
     unreadCount: 0,
+    mentionCount: 0,
     ...overrides,
   };
 }
@@ -280,6 +296,7 @@ function defaultOpts(): SidebarAreaOptions {
       adminCreateChannel: vi.fn().mockResolvedValue(undefined),
       adminUpdateChannel: vi.fn().mockResolvedValue(undefined),
       adminDeleteChannel: vi.fn().mockResolvedValue(undefined),
+      purgeMessages: vi.fn().mockResolvedValue({ channel_id: 1, ids: [3, 2], count: 2 }),
       adminKickMember: vi.fn().mockResolvedValue(undefined),
       adminBanMember: vi.fn().mockResolvedValue(undefined),
       adminChangeRole: vi.fn().mockResolvedValue(undefined),
@@ -846,7 +863,10 @@ describe("SidebarArea", () => {
       cleanup(result);
     });
 
-    it("re-renders DM sidebar when activeDmUserId changes in DMs mode", () => {
+    // Keyed on the active CHANNEL, not activeDmUserId: a group DM leaves the
+    // latter null, so a subscription on it would stop redrawing the list the
+    // moment a group became the active conversation.
+    it("re-renders DM sidebar when the active channel changes in DMs mode", () => {
       uiStore.setState((prev) => ({ ...prev, sidebarMode: "dms" }));
 
       const result = createSidebarArea(defaultOpts());
@@ -854,8 +874,8 @@ describe("SidebarArea", () => {
 
       const initialCallCount = (createDmSidebar as MockedFn).mock.calls.length;
 
-      setActiveDmUser(42);
-      uiStore.flush();
+      channelsStore.setState((prev) => ({ ...prev, activeChannelId: 4242 }));
+      channelsStore.flush?.();
 
       const newCallCount = (createDmSidebar as MockedFn).mock.calls.length;
       expect(newCallCount).toBeGreaterThan(initialCallCount);
@@ -963,8 +983,13 @@ describe("SidebarArea", () => {
       const addBtn = container.querySelector(".category-add-btn") as HTMLElement;
       addBtn.click();
 
+      // The picker is multi-select since group DMs: a click selects, and the
+      // confirm button (labelled for the selection size) commits.
       const item = document.querySelector(".dm-member-picker-item") as HTMLElement;
       item.click();
+      const confirm = document.querySelector('[data-testid="dm-picker-create"]') as HTMLElement;
+      expect(confirm.textContent).toBe("Create DM");
+      confirm.click();
 
       expect(document.querySelector(".modal-overlay")).toBeNull();
 
@@ -1031,9 +1056,14 @@ describe("SidebarArea", () => {
           category: null,
           position: 0,
           unreadCount: 0,
+          mentionCount: 0,
           lastMessageId: null,
           canSend: true,
+          topic: "",
           slowMode: 0,
+          nsfw: false,
+          voiceMaxUsers: 0,
+          voiceMaxVideo: 0,
         });
         return { ...prev, channels: next, activeChannelId: 1 };
       });
@@ -1054,6 +1084,22 @@ describe("SidebarArea", () => {
     it("does not save DM channel as channelBeforeDm", () => {
       channelsStore.setState((prev) => {
         const next = new Map(prev.channels);
+        next.set(1, {
+          id: 1,
+          name: "general",
+          type: "text",
+          category: null,
+          position: 0,
+          unreadCount: 0,
+          mentionCount: 0,
+          lastMessageId: null,
+          canSend: true,
+          topic: "",
+          slowMode: 0,
+          nsfw: false,
+          voiceMaxUsers: 0,
+          voiceMaxVideo: 0,
+        });
         next.set(50, {
           id: 50,
           name: "DmCh",
@@ -1061,9 +1107,14 @@ describe("SidebarArea", () => {
           category: null,
           position: 0,
           unreadCount: 0,
+          mentionCount: 0,
           lastMessageId: null,
           canSend: true,
+          topic: "",
           slowMode: 0,
+          nsfw: false,
+          voiceMaxUsers: 0,
+          voiceMaxVideo: 0,
         });
         return { ...prev, channels: next, activeChannelId: 50 };
       });
@@ -1075,9 +1126,21 @@ describe("SidebarArea", () => {
 
       const entry = container.querySelector("[data-testid='dm-entry']") as HTMLElement;
       entry.click();
+      uiStore.flush();
+
+      // DM was active but type was dm, so channelBeforeDm should be null:
+      // going to DMs mode and clicking back should NOT restore the DM
+      // channel (50) — it should fall back to the first text channel (1).
+      expect(uiStore.getState().sidebarMode).toBe("dms");
+
+      const dmSidebarCalls = (createDmSidebar as MockedFn).mock.calls;
+      const lastCall = dmSidebarCalls[dmSidebarCalls.length - 1]![0];
+      lastCall.onBack();
+
+      expect(uiStore.getState().sidebarMode).toBe("channels");
+      expect(channelsStore.getState().activeChannelId).toBe(1);
+      expect(channelsStore.getState().activeChannelId).not.toBe(50);
 
-      // DM was active but type was dm, so channelBeforeDm should be null
-      // We can verify by going to DMs mode and clicking back
       cleanup(result);
     });
   });
@@ -1284,9 +1347,14 @@ describe("SidebarArea", () => {
           category: null,
           position: 0,
           unreadCount: 0,
+          mentionCount: 0,
           lastMessageId: null,
           canSend: true,
+          topic: "",
           slowMode: 0,
+          nsfw: false,
+          voiceMaxUsers: 0,
+          voiceMaxVideo: 0,
         });
         return { ...prev, channels: next, activeChannelId: 1 };
       });
@@ -1322,9 +1390,14 @@ describe("SidebarArea", () => {
           category: null,
           position: 0,
           unreadCount: 0,
+          mentionCount: 0,
           lastMessageId: null,
           canSend: true,
+          topic: "",
           slowMode: 0,
+          nsfw: false,
+          voiceMaxUsers: 0,
+          voiceMaxVideo: 0,
         });
         next.set(2, {
           id: 2,
@@ -1333,9 +1406,14 @@ describe("SidebarArea", () => {
           category: null,
           position: 0,
           unreadCount: 0,
+          mentionCount: 0,
           lastMessageId: null,
           canSend: true,
+          topic: "",
           slowMode: 0,
+          nsfw: false,
+          voiceMaxUsers: 0,
+          voiceMaxVideo: 0,
         });
         return { ...prev, channels: next };
       });
@@ -1371,7 +1449,7 @@ describe("SidebarArea", () => {
 
       const dmSidebarCalls = (createDmSidebar as MockedFn).mock.calls;
       const lastCall = dmSidebarCalls[dmSidebarCalls.length - 1]![0];
-      lastCall.onCloseDm(10);
+      lastCall.onCloseDm(100);
 
       expect(opts.api.closeDm).toHaveBeenCalledWith(100);
 
@@ -1396,9 +1474,14 @@ describe("SidebarArea", () => {
           category: null,
           position: 0,
           unreadCount: 0,
+          mentionCount: 0,
           lastMessageId: null,
           canSend: true,
+          topic: "",
           slowMode: 0,
+          nsfw: false,
+          voiceMaxUsers: 0,
+          voiceMaxVideo: 0,
         });
         return { ...prev, channels: next, activeChannelId: 100 };
       });
@@ -1408,7 +1491,7 @@ describe("SidebarArea", () => {
 
       const dmSidebarCalls = (createDmSidebar as MockedFn).mock.calls;
       const lastCall = dmSidebarCalls[dmSidebarCalls.length - 1]![0];
-      lastCall.onCloseDm(10);
+      lastCall.onCloseDm(100);
 
       expect(uiStore.getState().sidebarMode).toBe("channels");
 
@@ -1430,7 +1513,7 @@ describe("SidebarArea", () => {
 
       const dmSidebarCalls = (createDmSidebar as MockedFn).mock.calls;
       const lastCall = dmSidebarCalls[dmSidebarCalls.length - 1]![0];
-      lastCall.onSelectConversation(10);
+      lastCall.onSelectConversation(100);
 
       expect(uiStore.getState().activeDmUserId).toBe(10);
       expect(channelsStore.getState().activeChannelId).toBe(100);
@@ -1472,6 +1555,7 @@ describe("SidebarArea", () => {
       expect(typeof callArgs.onEditChannel).toBe("function");
       expect(typeof callArgs.onDeleteChannel).toBe("function");
       expect(typeof callArgs.onReorderChannel).toBe("function");
+      expect(typeof callArgs.onPurgeChannel).toBe("function");
 
       cleanup(result);
     });
@@ -1525,6 +1609,38 @@ describe("SidebarArea", () => {
       cleanup(result);
     });
 
+    it("onPurgeChannel calls the purge API and toasts the server's count", async () => {
+      const opts = defaultOpts();
+      const toast = { show: vi.fn() };
+      (opts.getToast as MockedFn).mockReturnValue(toast);
+      const result = createSidebarArea(opts);
+      container.appendChild(result.sidebarWrapper);
+
+      const callArgs = (createChannelSidebar as MockedFn).mock.calls[0]![0];
+      await callArgs.onPurgeChannel({ id: 1, name: "general" }, 50);
+
+      expect(opts.api.purgeMessages).toHaveBeenCalledWith(1, 50);
+      expect(toast.show).toHaveBeenCalledWith("Purged 2 messages from #general", "success");
+
+      cleanup(result);
+    });
+
+    it("onPurgeChannel surfaces a failure as an error toast", async () => {
+      const opts = defaultOpts();
+      const toast = { show: vi.fn() };
+      (opts.getToast as MockedFn).mockReturnValue(toast);
+      (opts.api.purgeMessages as MockedFn).mockRejectedValue(new Error("forbidden"));
+      const result = createSidebarArea(opts);
+      container.appendChild(result.sidebarWrapper);
+
+      const callArgs = (createChannelSidebar as MockedFn).mock.calls[0]![0];
+      await callArgs.onPurgeChannel({ id: 1, name: "general" }, 50);
+
+      expect(toast.show).toHaveBeenCalledWith("forbidden", "error");
+
+      cleanup(result);
+    });
+
     it("onReorderChannel calls API for each reorder", () => {
       const opts = defaultOpts();
       const result = createSidebarArea(opts);
@@ -1791,19 +1907,24 @@ describe("SidebarArea", () => {
       cleanup(result);
     });
 
-    it("does not overwrite existing channel with non-empty name", () => {
+    it("does not rewrite an existing channel whose name already matches", () => {
       channelsStore.setState((prev) => {
         const next = new Map(prev.channels);
         next.set(100, {
           id: 100,
-          name: "ExistingName",
+          name: "Alice",
           type: "dm",
           category: null,
           position: 0,
           unreadCount: 0,
+          mentionCount: 0,
           lastMessageId: null,
           canSend: true,
+          topic: "",
           slowMode: 0,
+          nsfw: false,
+          voiceMaxUsers: 0,
+          voiceMaxVideo: 0,
         });
         return { ...prev, channels: next };
       });
@@ -1817,7 +1938,7 @@ describe("SidebarArea", () => {
       entry.click();
 
       const ch = channelsStore.getState().channels.get(100);
-      expect(ch!.name).toBe("ExistingName");
+      expect(ch!.name).toBe("Alice");
 
       cleanup(result);
     });
@@ -1846,14 +1967,19 @@ describe("SidebarArea", () => {
     /** Extract callbacks passed to createMemberList */
     function getMemberListCallbacks(): {
       onKick: (userId: number, username: string) => Promise<void>;
-      onBan: (userId: number, username: string, reason: string) => Promise<void>;
+      onBan: (
+        userId: number,
+        username: string,
+        reason: string,
+        durationHours: number,
+      ) => Promise<void>;
       onChangeRole: (userId: number, username: string, newRole: string) => Promise<void>;
     } {
       const calls = (createMemberList as MockedFn).mock.calls;
       return calls[calls.length - 1]![0];
     }
 
-    it("onKick calls API and shows success toast", async () => {
+    it("onKick (Force Logout) calls API and shows success toast", async () => {
       const mockShow = vi.fn();
       const opts = defaultOpts();
       (opts.getToast as MockedFn).mockReturnValue({ show: mockShow });
@@ -1865,7 +1991,7 @@ describe("SidebarArea", () => {
       await callbacks.onKick(2, "Alice");
 
       expect(opts.api.adminKickMember).toHaveBeenCalledWith(2);
-      expect(mockShow).toHaveBeenCalledWith("Kicked Alice", "success");
+      expect(mockShow).toHaveBeenCalledWith("Forced Alice to log out", "success");
 
       cleanup(result);
     });
@@ -1899,7 +2025,7 @@ describe("SidebarArea", () => {
       const callbacks = getMemberListCallbacks();
       await callbacks.onKick(2, "Alice");
 
-      expect(mockShow).toHaveBeenCalledWith("Failed to kick member", "error");
+      expect(mockShow).toHaveBeenCalledWith("Failed to force logout", "error");
 
       cleanup(result);
     });
@@ -1913,9 +2039,9 @@ describe("SidebarArea", () => {
       container.appendChild(result.sidebarWrapper);
 
       const callbacks = getMemberListCallbacks();
-      await callbacks.onBan(3, "Bob", "spamming");
+      await callbacks.onBan(3, "Bob", "spamming", 0);
 
-      expect(opts.api.adminBanMember).toHaveBeenCalledWith(3, "spamming");
+      expect(opts.api.adminBanMember).toHaveBeenCalledWith(3, "spamming", 0);
       expect(mockShow).toHaveBeenCalledWith("Banned Bob", "success");
 
       cleanup(result);
@@ -1931,7 +2057,7 @@ describe("SidebarArea", () => {
       container.appendChild(result.sidebarWrapper);
 
       const callbacks = getMemberListCallbacks();
-      await callbacks.onBan(3, "Bob", "");
+      await callbacks.onBan(3, "Bob", "", 0);
 
       expect(mockShow).toHaveBeenCalledWith("Ban denied", "error");
 
@@ -1948,7 +2074,7 @@ describe("SidebarArea", () => {
       container.appendChild(result.sidebarWrapper);
 
       const callbacks = getMemberListCallbacks();
-      await callbacks.onBan(3, "Bob", "");
+      await callbacks.onBan(3, "Bob", "", 0);
 
       expect(mockShow).toHaveBeenCalledWith("Failed to ban member", "error");
 
@@ -2108,6 +2234,7 @@ describe("SidebarArea", () => {
       addBtn.click();
       const item = document.querySelector(".dm-member-picker-item") as HTMLElement;
       item.click();
+      (document.querySelector('[data-testid="dm-picker-create"]') as HTMLElement).click();
 
       await vi.waitFor(() => {
         expect(mockShow).toHaveBeenCalledWith("Server error", "error");
@@ -2192,4 +2319,91 @@ describe("SidebarArea", () => {
       cleanup(result);
     });
   });
+  // -------------------------------------------------------------------------
+  // Audit log entry point
+  // -------------------------------------------------------------------------
+  //
+  // The log itself stays in the admin panel; the desktop client only owes its
+  // moderators a way in. The entry is gated on VIEW_AUDIT_LOG, and the gate has
+  // to survive `ready` landing after the header is built.
+
+  describe("audit log entry point", () => {
+    function signInAs(roleName: string, permissions: number): void {
+      setRoles([{ id: 9, name: roleName, color: null, permissions }]);
+      authStore.setState((prev) => ({
+        ...prev,
+        token: "tok",
+        user: { id: 9, username: "U", avatar: null, role: roleName },
+        isAuthenticated: true,
+      }));
+    }
+
+    function auditBtn(result: ReturnType<typeof createSidebarArea>): HTMLElement | null {
+      return result.sidebarWrapper.querySelector("[data-testid='audit-log-btn']");
+    }
+
+    it("is shown to a role holding VIEW_AUDIT_LOG", () => {
+      signInAs("Moderator", Permission.VIEW_AUDIT_LOG);
+      const result = createSidebarArea(defaultOpts());
+      expect(auditBtn(result)?.style.display).not.toBe("none");
+      cleanup(result);
+    });
+
+    it("is hidden from a role without the bit", () => {
+      signInAs("Member", Permission.SEND_MESSAGES);
+      const result = createSidebarArea(defaultOpts());
+      expect(auditBtn(result)?.style.display).toBe("none");
+      cleanup(result);
+    });
+
+    // `ready` can land after the header is built, and a moderator whose role
+    // only becomes known then would otherwise never see the entry.
+    it("appears when the role list arrives after mount", () => {
+      authStore.setState((prev) => ({
+        ...prev,
+        token: "tok",
+        user: { id: 9, username: "U", avatar: null, role: "Moderator" },
+        isAuthenticated: true,
+      }));
+      setRoles([]);
+      const result = createSidebarArea(defaultOpts());
+      expect(auditBtn(result)?.style.display).toBe("none");
+
+      setRoles([{ id: 9, name: "Moderator", color: null, permissions: Permission.VIEW_AUDIT_LOG }]);
+      // Store notifications are batched on a microtask.
+      channelsStore.flush();
+
+      expect(auditBtn(result)?.style.display).not.toBe("none");
+      cleanup(result);
+    });
+
+    it("opens the admin panel's audit section in the browser", async () => {
+      mockOpenUrl.mockClear();
+      signInAs("Owner", Permission.ADMINISTRATOR);
+      const result = createSidebarArea(defaultOpts());
+
+      auditBtn(result)?.click();
+
+      await vi.waitFor(() => {
+        expect(mockOpenUrl).toHaveBeenCalledWith("https://localhost:8080/admin#audit");
+      });
+      cleanup(result);
+    });
+
+    it("toasts instead of opening a bogus URL with no host", async () => {
+      mockOpenUrl.mockClear();
+      signInAs("Owner", Permission.ADMINISTRATOR);
+      const opts = defaultOpts();
+      (opts.api.getConfig as ReturnType<typeof vi.fn>).mockReturnValue({ host: "" });
+      const show = vi.fn();
+      (opts.getToast as ReturnType<typeof vi.fn>).mockReturnValue({ show });
+      const result = createSidebarArea(opts);
+
+      auditBtn(result)?.click();
+
+      expect(mockOpenUrl).not.toHaveBeenCalled();
+      expect(show).toHaveBeenCalledWith("Not connected to a server", "error");
+      cleanup(result);
+    });
+  });
 });
diff --git a/Client/tauri-client/tests/unit/sidebar-dm-helpers.test.ts b/Client/tauri-client/tests/unit/sidebar-dm-helpers.test.ts
index 764fc6aa..fbe71b64 100644
--- a/Client/tauri-client/tests/unit/sidebar-dm-helpers.test.ts
+++ b/Client/tauri-client/tests/unit/sidebar-dm-helpers.test.ts
@@ -47,7 +47,7 @@ function resetStores(): void {
 // ---------------------------------------------------------------------------
 
 function makeDmChannel(overrides: Partial<DmChannel> = {}): DmChannel {
-  return {
+  const base: DmChannel = {
     channelId: 100,
     recipient: {
       id: 10,
@@ -55,12 +55,19 @@ function makeDmChannel(overrides: Partial<DmChannel> = {}): DmChannel {
       avatar: "",
       status: "online",
     },
+    participants: [],
+    name: "",
+    isGroup: false,
     lastMessageId: null,
     lastMessage: "",
     lastMessageAt: "",
     unreadCount: 0,
+    mentionCount: 0,
     ...overrides,
   };
+  // A 1:1 DM's participant list IS its recipient, so a fixture that overrides
+  // only `recipient` should not silently keep the default's participants.
+  return base.participants.length > 0 ? base : { ...base, participants: [base.recipient] };
 }
 
 function makeDeps(overrides: Partial<DmHelperDeps> = {}): DmHelperDeps {
@@ -106,20 +113,25 @@ describe("SidebarDmHelpers", () => {
       expect(ch!.unreadCount).toBe(3);
     });
 
-    it("does not overwrite an existing channel with a non-empty name", () => {
-      // Pre-populate with a channel that already has a name
+    it("does not rewrite an existing channel whose name already matches", () => {
+      // Pre-populate with a channel that already carries the DM's display name
       channelsStore.setState((prev) => {
         const next = new Map(prev.channels);
         next.set(100, {
           id: 100,
-          name: "ExistingName",
+          name: "Alice",
           type: "dm",
           category: null,
           position: 0,
           unreadCount: 0,
+          mentionCount: 0,
           lastMessageId: null,
           canSend: true,
+          topic: "",
           slowMode: 0,
+          nsfw: false,
+          voiceMaxUsers: 0,
+          voiceMaxVideo: 0,
         });
         return { ...prev, channels: next };
       });
@@ -129,7 +141,7 @@ describe("SidebarDmHelpers", () => {
 
       // Name should remain unchanged
       const ch = channelsStore.getState().channels.get(100);
-      expect(ch!.name).toBe("ExistingName");
+      expect(ch!.name).toBe("Alice");
     });
 
     it("overwrites an existing channel with an empty name", () => {
@@ -143,9 +155,14 @@ describe("SidebarDmHelpers", () => {
           category: null,
           position: 0,
           unreadCount: 0,
+          mentionCount: 0,
           lastMessageId: null,
           canSend: true,
+          topic: "",
           slowMode: 0,
+          nsfw: false,
+          voiceMaxUsers: 0,
+          voiceMaxVideo: 0,
         });
         return { ...prev, channels: next };
       });
@@ -175,9 +192,14 @@ describe("SidebarDmHelpers", () => {
           category: null,
           position: 0,
           unreadCount: 0,
+          mentionCount: 0,
           lastMessageId: null,
           canSend: true,
+          topic: "",
           slowMode: 0,
+          nsfw: false,
+          voiceMaxUsers: 0,
+          voiceMaxVideo: 0,
         });
         return { ...prev, channels: next, activeChannelId: 1 };
       });
@@ -200,9 +222,14 @@ describe("SidebarDmHelpers", () => {
           category: null,
           position: 0,
           unreadCount: 0,
+          mentionCount: 0,
           lastMessageId: null,
           canSend: true,
+          topic: "",
           slowMode: 0,
+          nsfw: false,
+          voiceMaxUsers: 0,
+          voiceMaxVideo: 0,
         });
         return { ...prev, channels: next, activeChannelId: 50 };
       });
@@ -384,24 +411,35 @@ describe("SidebarDmHelpers", () => {
           lastMessage: "Hello!",
           lastMessageAt: "2025-01-01T00:00:00Z",
           unreadCount: 3,
+          mentionCount: 1,
         }),
       );
 
       const result = buildDmConversations(null);
       expect(result).toHaveLength(1);
       expect(result[0]).toEqual({
+        channelId: 100,
         userId: 10,
         username: "Alice",
         avatar: "alice.png",
         status: "online",
+        isGroup: false,
+        participants: [{ id: 10, username: "Alice", avatar: "alice.png" }],
         lastMessage: "Hello!",
         timestamp: "2025-01-01T00:00:00Z",
         unread: true,
+        // The real counts ride along so the sidebar can render badges rather
+        // than a bare dot, and so DM mentions survive a reconnect.
+        unreadCount: 3,
+        mentionCount: 1,
+        muted: false,
         active: false,
       });
     });
 
-    it("marks conversation as active when userId matches activeDmUserId", () => {
+    // Active is keyed on the CHANNEL, not the recipient: a group DM has no
+    // single recipient, and the same person can be in both a 1:1 and a group.
+    it("marks conversation as active when the channel is the active one", () => {
       addDmChannel(
         makeDmChannel({
           channelId: 100,
@@ -409,11 +447,11 @@ describe("SidebarDmHelpers", () => {
         }),
       );
 
-      const result = buildDmConversations(10);
+      const result = buildDmConversations(100);
       expect(result[0]!.active).toBe(true);
     });
 
-    it("does not mark conversation as active when userId does not match", () => {
+    it("does not mark conversation as active when the channel does not match", () => {
       addDmChannel(
         makeDmChannel({
           channelId: 100,
@@ -492,7 +530,7 @@ describe("SidebarDmHelpers", () => {
         }),
       );
 
-      const result = buildDmConversations(11);
+      const result = buildDmConversations(101);
       expect(result).toHaveLength(2);
       // Bob was added second so goes first (addDmChannel prepends)
       const bob = result.find((c) => c.username === "Bob");
diff --git a/Client/tauri-client/tests/unit/sidebar-dm-section.test.ts b/Client/tauri-client/tests/unit/sidebar-dm-section.test.ts
index bf3636ec..df4002c4 100644
--- a/Client/tauri-client/tests/unit/sidebar-dm-section.test.ts
+++ b/Client/tauri-client/tests/unit/sidebar-dm-section.test.ts
@@ -36,10 +36,14 @@ function makeDm(overrides: Partial<DmChannel> = {}): DmChannel {
   return {
     channelId: 100,
     recipient: { id: 10, username: "Alice", avatar: "", status: "online" },
+    participants: [],
+    name: "",
+    isGroup: false,
     lastMessageId: null,
     lastMessage: "",
     lastMessageAt: "",
     unreadCount: 0,
+    mentionCount: 0,
     ...overrides,
   };
 }
diff --git a/Client/tauri-client/tests/unit/sidebar-member-section.test.ts b/Client/tauri-client/tests/unit/sidebar-member-section.test.ts
index 0b53aa90..baf102d2 100644
--- a/Client/tauri-client/tests/unit/sidebar-member-section.test.ts
+++ b/Client/tauri-client/tests/unit/sidebar-member-section.test.ts
@@ -391,14 +391,19 @@ describe("SidebarMemberSection", () => {
     /** Extract the callbacks passed to createMemberList */
     function getCapturedCallbacks(): {
       onKick: (userId: number, username: string) => Promise<void>;
-      onBan: (userId: number, username: string, reason: string) => Promise<void>;
+      onBan: (
+        userId: number,
+        username: string,
+        reason: string,
+        durationHours: number,
+      ) => Promise<void>;
       onChangeRole: (userId: number, username: string, newRole: string) => Promise<void>;
     } {
       const calls = (createMemberList as ReturnType<typeof vi.fn>).mock.calls;
       return calls[calls.length - 1]![0];
     }
 
-    it("kick: calls API and shows success toast", async () => {
+    it("force logout: calls API and shows success toast", async () => {
       const mockShow = vi.fn();
       const mockApi = {
         adminKickMember: vi.fn().mockResolvedValue(undefined),
@@ -417,12 +422,12 @@ describe("SidebarMemberSection", () => {
       await callbacks.onKick(2, "Alice");
 
       expect(mockApi.adminKickMember).toHaveBeenCalledWith(2);
-      expect(mockShow).toHaveBeenCalledWith("Kicked Alice", "success");
+      expect(mockShow).toHaveBeenCalledWith("Forced Alice to log out", "success");
 
       section.destroy();
     });
 
-    it("kick: shows error toast on API failure", async () => {
+    it("force logout: shows error toast on API failure", async () => {
       const mockShow = vi.fn();
       const mockApi = {
         adminKickMember: vi.fn().mockRejectedValue(new Error("Kick denied")),
@@ -445,7 +450,7 @@ describe("SidebarMemberSection", () => {
       section.destroy();
     });
 
-    it("kick: shows generic error for non-Error exceptions", async () => {
+    it("force logout: shows generic error for non-Error exceptions", async () => {
       const mockShow = vi.fn();
       const mockApi = {
         adminKickMember: vi.fn().mockRejectedValue("string error"),
@@ -463,7 +468,7 @@ describe("SidebarMemberSection", () => {
       const callbacks = getCapturedCallbacks();
       await callbacks.onKick(2, "Alice");
 
-      expect(mockShow).toHaveBeenCalledWith("Failed to kick member", "error");
+      expect(mockShow).toHaveBeenCalledWith("Failed to force logout", "error");
 
       section.destroy();
     });
@@ -484,9 +489,9 @@ describe("SidebarMemberSection", () => {
       container.appendChild(section.element);
 
       const callbacks = getCapturedCallbacks();
-      await callbacks.onBan(3, "Bob", "spamming");
+      await callbacks.onBan(3, "Bob", "spamming", 0);
 
-      expect(mockApi.adminBanMember).toHaveBeenCalledWith(3, "spamming");
+      expect(mockApi.adminBanMember).toHaveBeenCalledWith(3, "spamming", 0);
       expect(mockShow).toHaveBeenCalledWith("Banned Bob", "success");
 
       section.destroy();
@@ -508,7 +513,7 @@ describe("SidebarMemberSection", () => {
       container.appendChild(section.element);
 
       const callbacks = getCapturedCallbacks();
-      await callbacks.onBan(3, "Bob", "");
+      await callbacks.onBan(3, "Bob", "", 0);
 
       expect(mockShow).toHaveBeenCalledWith("Ban denied", "error");
 
@@ -531,7 +536,7 @@ describe("SidebarMemberSection", () => {
       container.appendChild(section.element);
 
       const callbacks = getCapturedCallbacks();
-      await callbacks.onBan(3, "Bob", "");
+      await callbacks.onBan(3, "Bob", "", 0);
 
       expect(mockShow).toHaveBeenCalledWith("Failed to ban member", "error");
 
diff --git a/Client/tauri-client/tests/unit/status-picker-custom.test.ts b/Client/tauri-client/tests/unit/status-picker-custom.test.ts
new file mode 100644
index 00000000..8e5c22c8
--- /dev/null
+++ b/Client/tauri-client/tests/unit/status-picker-custom.test.ts
@@ -0,0 +1,147 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import { createStatusPicker, type StatusPickerComponent } from "@components/StatusPicker";
+import { MAX_CUSTOM_STATUS_LEN } from "@lib/userStatus";
+
+/**
+ * Phase 6 gave the picker two new jobs: offer "invisible" as a real status
+ * (instead of "offline" wearing that label), and take a custom status line.
+ */
+
+describe("StatusPicker", () => {
+  let container: HTMLDivElement;
+  let picker: StatusPickerComponent | null = null;
+
+  beforeEach(() => {
+    container = document.createElement("div");
+    document.body.appendChild(container);
+  });
+
+  afterEach(() => {
+    picker?.destroy?.();
+    picker = null;
+    container.remove();
+  });
+
+  function labels(): string[] {
+    return Array.from(container.querySelectorAll(".status-picker-option-label")).map(
+      (el) => el.textContent ?? "",
+    );
+  }
+
+  function clickOption(label: string): void {
+    const row = Array.from(container.querySelectorAll(".status-picker-option")).find(
+      (el) => el.querySelector(".status-picker-option-label")?.textContent === label,
+    );
+    (row as HTMLElement).click();
+  }
+
+  it("offers Invisible and sends it as its own value", () => {
+    const onStatusChange = vi.fn();
+    picker = createStatusPicker({ currentStatus: "online", onStatusChange });
+    picker.mount(container);
+
+    expect(labels()).toEqual(["Online", "Idle", "Do Not Disturb", "Invisible"]);
+
+    clickOption("Invisible");
+    // The picker used to send "offline" here, which the server could not tell
+    // apart from a dropped connection.
+    expect(onStatusChange).toHaveBeenCalledExactlyOnceWith("invisible");
+  });
+
+  it("renders no custom status input when no handler is supplied", () => {
+    picker = createStatusPicker({ currentStatus: "online", onStatusChange: vi.fn() });
+    picker.mount(container);
+    expect(container.querySelector('[data-testid="custom-status-input"]')).toBeNull();
+  });
+
+  it("pre-fills the custom status input and commits it on Enter", () => {
+    const onCustomStatusChange = vi.fn();
+    picker = createStatusPicker({
+      currentStatus: "online",
+      onStatusChange: vi.fn(),
+      currentCustomStatus: "shipping",
+      onCustomStatusChange,
+    });
+    picker.mount(container);
+
+    const input = container.querySelector<HTMLInputElement>('[data-testid="custom-status-input"]')!;
+    expect(input.value).toBe("shipping");
+    expect(input.getAttribute("maxlength")).toBe(String(MAX_CUSTOM_STATUS_LEN));
+
+    input.value = "  in a meeting  ";
+    input.dispatchEvent(new KeyboardEvent("keydown", { key: "Enter", bubbles: true }));
+
+    expect(onCustomStatusChange).toHaveBeenCalledExactlyOnceWith("in a meeting");
+    expect(input.value).toBe("in a meeting");
+  });
+
+  it("commits on blur and clears with an empty value", () => {
+    const onCustomStatusChange = vi.fn();
+    picker = createStatusPicker({
+      currentStatus: "online",
+      onStatusChange: vi.fn(),
+      currentCustomStatus: "busy",
+      onCustomStatusChange,
+    });
+    picker.mount(container);
+
+    const input = container.querySelector<HTMLInputElement>('[data-testid="custom-status-input"]')!;
+    input.value = "";
+    input.dispatchEvent(new FocusEvent("blur"));
+
+    expect(onCustomStatusChange).toHaveBeenCalledExactlyOnceWith("");
+  });
+
+  it("does not re-send an unchanged value", () => {
+    const onCustomStatusChange = vi.fn();
+    picker = createStatusPicker({
+      currentStatus: "online",
+      onStatusChange: vi.fn(),
+      currentCustomStatus: "busy",
+      onCustomStatusChange,
+    });
+    picker.mount(container);
+
+    const input = container.querySelector<HTMLInputElement>('[data-testid="custom-status-input"]')!;
+    // Enter then the blur it causes: without the guard this would burn two
+    // presence updates against a one-per-ten-seconds limit.
+    input.value = "busy";
+    input.dispatchEvent(new KeyboardEvent("keydown", { key: "Enter", bubbles: true }));
+    input.dispatchEvent(new FocusEvent("blur"));
+
+    expect(onCustomStatusChange).not.toHaveBeenCalled();
+  });
+
+  it("restores the last committed text on Escape", () => {
+    const onCustomStatusChange = vi.fn();
+    picker = createStatusPicker({
+      currentStatus: "online",
+      onStatusChange: vi.fn(),
+      currentCustomStatus: "busy",
+      onCustomStatusChange,
+    });
+    picker.mount(container);
+
+    const input = container.querySelector<HTMLInputElement>('[data-testid="custom-status-input"]')!;
+    input.value = "half-typed";
+    input.dispatchEvent(new KeyboardEvent("keydown", { key: "Escape", bubbles: true }));
+
+    expect(input.value).toBe("busy");
+    expect(onCustomStatusChange).not.toHaveBeenCalled();
+  });
+
+  it("setCustomStatus updates the input without firing the handler", () => {
+    const onCustomStatusChange = vi.fn();
+    picker = createStatusPicker({
+      currentStatus: "online",
+      onStatusChange: vi.fn(),
+      onCustomStatusChange,
+    });
+    picker.mount(container);
+
+    picker.setCustomStatus("from the server");
+    const input = container.querySelector<HTMLInputElement>('[data-testid="custom-status-input"]')!;
+    expect(input.value).toBe("from the server");
+    expect(onCustomStatusChange).not.toHaveBeenCalled();
+  });
+});
diff --git a/Client/tauri-client/tests/unit/totp-settings.test.ts b/Client/tauri-client/tests/unit/totp-settings.test.ts
index d1ae84ef..08699a61 100644
--- a/Client/tauri-client/tests/unit/totp-settings.test.ts
+++ b/Client/tauri-client/tests/unit/totp-settings.test.ts
@@ -60,6 +60,7 @@ function makeOptions(overrides: Partial<SettingsOverlayOptions> = {}): SettingsO
     onClose: vi.fn(),
     onChangePassword: vi.fn().mockResolvedValue(undefined),
     onUpdateProfile: vi.fn().mockResolvedValue(undefined),
+    onUploadAvatar: vi.fn().mockResolvedValue("/api/v1/files/test"),
     onLogout: vi.fn(),
     onDeleteAccount: vi.fn().mockResolvedValue(undefined),
     onStatusChange: vi.fn(),
diff --git a/Client/tauri-client/tests/unit/types.test.ts b/Client/tauri-client/tests/unit/types.test.ts
index 4c938d86..f526808c 100644
--- a/Client/tauri-client/tests/unit/types.test.ts
+++ b/Client/tauri-client/tests/unit/types.test.ts
@@ -239,6 +239,7 @@ describe("Permission bitfield", () => {
     expect(P.KICK_MEMBERS).toBe(0x40000);
     expect(P.BAN_MEMBERS).toBe(0x80000);
     expect(P.MUTE_MEMBERS).toBe(0x100000);
+    expect(P.MENTION_EVERYONE).toBe(0x200000);
     expect(P.MANAGE_ROLES).toBe(0x1000000);
     expect(P.MANAGE_SERVER).toBe(0x2000000);
     expect(P.MANAGE_INVITES).toBe(0x4000000);
diff --git a/Client/tauri-client/tests/unit/user-profile-popup.test.ts b/Client/tauri-client/tests/unit/user-profile-popup.test.ts
index 6930623a..9a82da9a 100644
--- a/Client/tauri-client/tests/unit/user-profile-popup.test.ts
+++ b/Client/tauri-client/tests/unit/user-profile-popup.test.ts
@@ -68,6 +68,8 @@ describe("UserProfilePopup", () => {
       user,
       anchorX: 100,
       anchorY: 100,
+      onMessage: () => {},
+      onCall: () => {},
     });
     popup.mount(container);
 
@@ -83,7 +85,7 @@ describe("UserProfilePopup", () => {
     const avatar = container.querySelector(".upp-avatar span");
     expect(avatar?.textContent).toBe("B");
 
-    // Message and Call buttons
+    // Message and Call buttons render when handlers are wired
     const msgBtn = container.querySelector('[data-testid="upp-message-btn"]');
     expect(msgBtn).not.toBeNull();
     const callBtn = container.querySelector('[data-testid="upp-call-btn"]');
@@ -92,6 +94,20 @@ describe("UserProfilePopup", () => {
     popup.destroy?.();
   });
 
+  it("omits action buttons that have no handler", () => {
+    const popup = createUserProfilePopup({
+      user: makeUser(),
+      anchorX: 100,
+      anchorY: 100,
+    });
+    popup.mount(container);
+
+    expect(container.querySelector('[data-testid="upp-message-btn"]')).toBeNull();
+    expect(container.querySelector('[data-testid="upp-call-btn"]')).toBeNull();
+
+    popup.destroy?.();
+  });
+
   it("outside click closes the popup", () => {
     const user = makeUser();
     const popup = createUserProfilePopup({
@@ -157,3 +173,110 @@ describe("UserProfilePopup", () => {
     expect(popup.isOpen()).toBe(false);
   });
 });
+
+// ─── Phase 6: display name, about, custom status ─────────────────────────────
+
+describe("UserProfilePopup profile fields", () => {
+  let container: HTMLDivElement;
+
+  beforeEach(() => {
+    container = document.createElement("div");
+    document.body.appendChild(container);
+  });
+
+  afterEach(() => {
+    container.remove();
+  });
+
+  it("shows the display name as the heading and the username as an @handle", () => {
+    const popup = createUserProfilePopup({
+      user: makeUser({ username: "alice", displayName: "Alice A." }),
+      anchorX: 10,
+      anchorY: 10,
+    });
+    popup.mount(container);
+
+    expect(container.querySelector(".upp-username")?.textContent).toBe("Alice A.");
+    // The username is still the handle you @mention, so the popup keeps
+    // telling you what to type.
+    expect(container.querySelector(".upp-username-handle")?.textContent).toBe("@alice");
+
+    popup.destroy?.();
+  });
+
+  it("omits the @handle when there is no display name", () => {
+    const popup = createUserProfilePopup({
+      user: makeUser({ username: "alice", displayName: null }),
+      anchorX: 10,
+      anchorY: 10,
+    });
+    popup.mount(container);
+
+    expect(container.querySelector(".upp-username")?.textContent).toBe("alice");
+    expect(container.querySelector(".upp-username-handle")?.textContent).toBe("");
+
+    popup.destroy?.();
+  });
+
+  it("renders the about section from real data", () => {
+    const popup = createUserProfilePopup({
+      user: makeUser({ about: "Writes tests for a living." }),
+      anchorX: 10,
+      anchorY: 10,
+    });
+    popup.mount(container);
+
+    // The section used to be dead code — `about` was hardcoded null at every
+    // call site until phase 6 gave the column somewhere to come from.
+    expect(container.querySelector(".upp-about-text")?.textContent).toBe(
+      "Writes tests for a living.",
+    );
+
+    popup.destroy?.();
+  });
+
+  it("renders the custom status line, and nothing when there is none", () => {
+    const withStatus = createUserProfilePopup({
+      user: makeUser({ customStatus: "shipping phase 6" }),
+      anchorX: 10,
+      anchorY: 10,
+    });
+    withStatus.mount(container);
+    expect(container.querySelector(".upp-custom-status")?.textContent).toBe("shipping phase 6");
+    withStatus.destroy?.();
+
+    const without = createUserProfilePopup({ user: makeUser(), anchorX: 10, anchorY: 10 });
+    without.mount(container);
+    expect(container.querySelector(".upp-custom-status")?.textContent).toBe("");
+    without.destroy?.();
+  });
+
+  it("labels the owner's own invisible status", () => {
+    // Only ever reachable for the signed-in user: everyone else is mapped to
+    // offline before the payload leaves the server.
+    const popup = createUserProfilePopup({
+      user: makeUser({ status: "invisible" }),
+      anchorX: 10,
+      anchorY: 10,
+    });
+    popup.mount(container);
+
+    const statusText = container.querySelector(".upp-status-line")?.textContent ?? "";
+    expect(statusText).toContain("Invisible");
+
+    popup.destroy?.();
+  });
+
+  it("uses the display name's initial for the letter fallback", () => {
+    const popup = createUserProfilePopup({
+      user: makeUser({ username: "alice", displayName: "Zoe", avatar: null }),
+      anchorX: 10,
+      anchorY: 10,
+    });
+    popup.mount(container);
+
+    expect(container.querySelector(".upp-avatar .avatar-initial")?.textContent).toBe("Z");
+
+    popup.destroy?.();
+  });
+});
diff --git a/Client/tauri-client/tests/unit/user-status.test.ts b/Client/tauri-client/tests/unit/user-status.test.ts
index 6ae175dc..546481dd 100644
--- a/Client/tauri-client/tests/unit/user-status.test.ts
+++ b/Client/tauri-client/tests/unit/user-status.test.ts
@@ -1,5 +1,13 @@
 import { describe, it, expect, beforeEach, vi } from "vitest";
-import { loadUserStatus, saveUserStatus, onUserStatusChange } from "@lib/userStatus";
+import {
+  MAX_CUSTOM_STATUS_LEN,
+  loadCustomStatus,
+  loadUserStatus,
+  loadUserStatusOrigin,
+  onUserStatusChange,
+  saveCustomStatus,
+  saveUserStatus,
+} from "@lib/userStatus";
 
 describe("userStatus", () => {
   beforeEach(() => {
@@ -33,10 +41,44 @@ describe("userStatus", () => {
     expect(seen).toHaveBeenCalledWith("idle");
 
     unsub();
-    saveUserStatus("offline");
+    saveUserStatus("invisible");
     expect(seen).toHaveBeenCalledTimes(1);
   });
 
+  it("migrates a stored 'offline' to invisible", () => {
+    // "offline" was this client's old spelling of "appear offline"; phase 6
+    // gave that its own value, and a user who picked it meant invisible.
+    localStorage.setItem("owncord:settings:userStatus", JSON.stringify("offline"));
+    expect(loadUserStatus()).toBe("invisible");
+  });
+
+  it("records who chose the status", () => {
+    saveUserStatus("dnd");
+    expect(loadUserStatusOrigin()).toBe("manual");
+
+    saveUserStatus("idle", "auto");
+    expect(loadUserStatusOrigin()).toBe("auto");
+
+    // The default is "manual" on purpose: everything that is not the idle
+    // timer is a deliberate choice, and defaulting the other way would let a
+    // real choice be silently revoked.
+    saveUserStatus("online");
+    expect(loadUserStatusOrigin()).toBe("manual");
+  });
+
+  it("defaults the origin to manual when nothing is stored", () => {
+    expect(loadUserStatusOrigin()).toBe("manual");
+  });
+
+  it("round-trips and bounds the custom status text", () => {
+    expect(loadCustomStatus()).toBe("");
+    saveCustomStatus("shipping phase 6");
+    expect(loadCustomStatus()).toBe("shipping phase 6");
+
+    saveCustomStatus("x".repeat(MAX_CUSTOM_STATUS_LEN + 50));
+    expect(loadCustomStatus()).toHaveLength(MAX_CUSTOM_STATUS_LEN);
+  });
+
   it("ignores unrelated preference changes", () => {
     const seen = vi.fn();
     onUserStatusChange(seen, { signal: new AbortController().signal });
diff --git a/Client/tauri-client/tests/unit/voice-audio-tab.test.ts b/Client/tauri-client/tests/unit/voice-audio-tab.test.ts
index 9afd7d71..181a1541 100644
--- a/Client/tauri-client/tests/unit/voice-audio-tab.test.ts
+++ b/Client/tauri-client/tests/unit/voice-audio-tab.test.ts
@@ -725,7 +725,10 @@ describe("VoiceAudioTab UI structure", () => {
     ac.abort();
   });
 
-  it("cleanup stops mic and camera streams", () => {
+  it("cleanup stops mic and camera streams", async () => {
+    // A saved video device is required for the camera preview to start at all.
+    localStorage.setItem("owncord:settings:videoInputDevice", '"cam-1"');
+
     const stopMicTrack = vi.fn();
     const stopCamTrack = vi.fn();
     const micStream = { getTracks: () => [{ stop: stopMicTrack }] } as unknown as MediaStream;
@@ -734,17 +737,32 @@ describe("VoiceAudioTab UI structure", () => {
     vi.stubGlobal("navigator", {
       mediaDevices: {
         enumerateDevices: vi.fn().mockResolvedValue([]),
-        getUserMedia: vi.fn().mockResolvedValue(micStream),
+        getUserMedia: vi.fn().mockImplementation((constraints: MediaStreamConstraints) => {
+          if (constraints.video && constraints.audio === false) {
+            return Promise.resolve(camStream);
+          }
+          return Promise.resolve(micStream);
+        }),
       },
     });
 
     const ac = new AbortController();
     const tab = createVoiceAudioTab(ac.signal);
-    tab.build();
+    const el = tab.build();
+    document.body.appendChild(el);
+    const preview = el.querySelector("video") as HTMLVideoElement;
+
+    // Wait for both the mic-monitoring and camera-preview getUserMedia calls to
+    // resolve and register their streams before triggering cleanup.
+    await vi.waitFor(() => {
+      expect(preview.srcObject).toBe(camStream);
+    });
+
     tab.cleanup();
 
-    // After cleanup, streams should be stopped
-    // (the mic track stop is called in cleanupMic)
+    expect(stopMicTrack).toHaveBeenCalled();
+    expect(stopCamTrack).toHaveBeenCalled();
+
     ac.abort();
   });
 
diff --git a/Client/tauri-client/tests/unit/voice-widget.test.ts b/Client/tauri-client/tests/unit/voice-widget.test.ts
index dc0f17a1..a8e88018 100644
--- a/Client/tauri-client/tests/unit/voice-widget.test.ts
+++ b/Client/tauri-client/tests/unit/voice-widget.test.ts
@@ -127,9 +127,14 @@ describe("VoiceWidget", () => {
         category: null,
         position: 0,
         unreadCount: 0,
+        mentionCount: 0,
         lastMessageId: null,
         canSend: true,
+        topic: "",
         slowMode: 0,
+        nsfw: false,
+        voiceMaxUsers: 0,
+        voiceMaxVideo: 0,
       });
       return { ...prev, channels };
     });
@@ -161,9 +166,14 @@ describe("VoiceWidget", () => {
         category: null,
         position: 0,
         unreadCount: 0,
+        mentionCount: 0,
         lastMessageId: null,
         canSend: true,
+        topic: "",
         slowMode: 0,
+        nsfw: false,
+        voiceMaxUsers: 0,
+        voiceMaxVideo: 0,
       });
       return { ...prev, channels };
     });
@@ -195,9 +205,14 @@ describe("VoiceWidget", () => {
         category: null,
         position: 0,
         unreadCount: 0,
+        mentionCount: 0,
         lastMessageId: null,
         canSend: true,
+        topic: "",
         slowMode: 0,
+        nsfw: false,
+        voiceMaxUsers: 0,
+        voiceMaxVideo: 0,
       });
       return { ...prev, channels };
     });
diff --git a/Client/tauri-client/tests/unit/voice.store.test.ts b/Client/tauri-client/tests/unit/voice.store.test.ts
index 9bfc0adc..b74e7daa 100644
--- a/Client/tauri-client/tests/unit/voice.store.test.ts
+++ b/Client/tauri-client/tests/unit/voice.store.test.ts
@@ -146,6 +146,9 @@ describe("voice store", () => {
         speaking: true,
         camera: false,
         screenshare: false,
+        // Absent from the payload means not moderator-imposed.
+        serverMuted: false,
+        serverDeafened: false,
       });
     });
 
@@ -168,6 +171,33 @@ describe("voice store", () => {
       updateVoiceState(FULL_VOICE_PAYLOAD);
       expect(voiceStore.getState()).not.toBe(before);
     });
+
+    it("mirrors the moderator flags into the local ones for the signed-in user", () => {
+      authStore.setState((prev) => ({
+        ...prev,
+        user: { id: 5, username: "dave", avatar: null, role: "member" },
+      }));
+      updateVoiceState({
+        ...FULL_VOICE_PAYLOAD,
+        muted: true,
+        deafened: true,
+        server_muted: true,
+        server_deafened: true,
+      });
+      const state = voiceStore.getState();
+      expect(state.localServerMuted).toBe(true);
+      expect(state.localServerDeafened).toBe(true);
+      expect(state.voiceUsers.get(10)?.get(5)?.serverMuted).toBe(true);
+    });
+
+    it("leaves the local flags alone for another user's state", () => {
+      authStore.setState((prev) => ({
+        ...prev,
+        user: { id: 999, username: "me", avatar: null, role: "member" },
+      }));
+      updateVoiceState({ ...FULL_VOICE_PAYLOAD, muted: true, server_muted: true });
+      expect(voiceStore.getState().localServerMuted).not.toBe(true);
+    });
   });
 
   describe("removeVoiceUser", () => {
@@ -205,6 +235,20 @@ describe("voice store", () => {
       expect(voiceStore.getState().currentChannelId).toBe(42);
     });
 
+    it("leaveVoiceChannel clears the moderator-imposed flags with the session", () => {
+      authStore.setState((prev) => ({
+        ...prev,
+        user: { id: 5, username: "dave", avatar: null, role: "member" },
+      }));
+      joinVoiceChannel(10);
+      updateVoiceState({ ...FULL_VOICE_PAYLOAD, muted: true, server_muted: true });
+      expect(voiceStore.getState().localServerMuted).toBe(true);
+
+      leaveVoiceChannel();
+      expect(voiceStore.getState().localServerMuted).toBe(false);
+      expect(voiceStore.getState().localServerDeafened).toBe(false);
+    });
+
     it("joinVoiceChannel overwrites previous channel", () => {
       joinVoiceChannel(42);
       joinVoiceChannel(99);
diff --git a/Server/admin/admin.go b/Server/admin/admin.go
index 71a6af57..1d3db65e 100644
--- a/Server/admin/admin.go
+++ b/Server/admin/admin.go
@@ -21,13 +21,13 @@ var staticFiles embed.FS
 //
 // Routes:
 //
-//	/api/*  — admin REST API (all require ADMINISTRATOR permission)
+//	/api/*  — admin REST API (all require a moderation permission; see NewAdminAPI)
 //	/*      — embedded static files (SPA; index.html for unknown paths)
-func NewHandler(database *db.DB, version string, hub HubBroadcaster, u *updater.Updater, logBuf *RingBuffer, allowedOrigins []string, permInvalidator PermissionInvalidator, mod *service.ModerationService, opts ...SetupOptions) http.Handler {
+func NewHandler(database *db.DB, version string, hub HubBroadcaster, u *updater.Updater, logBuf *RingBuffer, allowedOrigins []string, permInvalidator PermissionInvalidator, mod *service.ModerationService, roles *service.RoleService, opts ...SetupOptions) http.Handler {
 	r := chi.NewRouter()
 
 	// Admin REST API mounted at /api
-	r.Mount("/api", NewAdminAPI(database, version, hub, u, logBuf, allowedOrigins, permInvalidator, mod, opts...))
+	r.Mount("/api", NewAdminAPI(database, version, hub, u, logBuf, allowedOrigins, permInvalidator, mod, roles, opts...))
 
 	// Static files — serve from the "static" sub-tree of the embedded FS.
 	// The //go:embed static directive in this package embeds as "static/…",
@@ -48,8 +48,13 @@ func NewHandler(database *db.DB, version string, hub HubBroadcaster, u *updater.
 	}
 	r.Get("/", func(w http.ResponseWriter, req *http.Request) {
 		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		// img-src adds blob: for the Emoji section: /api/v1/emoji/{id}/image
+		// requires an Authorization header, which <img src> cannot send, so
+		// each thumbnail is fetched with the session token and swapped in as a
+		// blob: URL. blob: is same-origin, opaque and unreadable across
+		// documents — it widens nothing an attacker could aim at.
 		w.Header().Set("Content-Security-Policy",
-			"default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'")
+			"default-src 'self'; img-src 'self' blob:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'")
 		_, _ = w.Write(indexHTML)
 	})
 	r.Handle("/*", http.FileServer(http.FS(staticFS)))
diff --git a/Server/admin/admin_handler_test.go b/Server/admin/admin_handler_test.go
index 5c6e884d..d4fc897c 100644
--- a/Server/admin/admin_handler_test.go
+++ b/Server/admin/admin_handler_test.go
@@ -20,7 +20,7 @@ import (
 // http.Handler with all dependencies wired.
 func TestNewHandler_ReturnsNonNilHandler(t *testing.T) {
 	database := openAdminTestDB(t)
-	h := admin.NewHandler(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	h := admin.NewHandler(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	if h == nil {
 		t.Fatal("NewHandler returned nil handler")
 	}
@@ -30,7 +30,7 @@ func TestNewHandler_ReturnsNonNilHandler(t *testing.T) {
 // responds with 200 and HTML content (the embedded admin SPA).
 func TestNewHandler_ServesStaticRoot(t *testing.T) {
 	database := openAdminTestDB(t)
-	h := admin.NewHandler(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	h := admin.NewHandler(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	req := httptest.NewRequest(http.MethodGet, "/", nil)
 	w := httptest.NewRecorder()
@@ -61,7 +61,7 @@ func TestNewHandler_ServesStaticRoot(t *testing.T) {
 // Content-Security-Policy header allowing inline scripts and styles.
 func TestNewHandler_SetsCSPOnRoot(t *testing.T) {
 	database := openAdminTestDB(t)
-	h := admin.NewHandler(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	h := admin.NewHandler(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	req := httptest.NewRequest(http.MethodGet, "/", nil)
 	w := httptest.NewRecorder()
@@ -77,7 +77,7 @@ func TestNewHandler_SetsCSPOnRoot(t *testing.T) {
 // through the NewHandler-returned handler (setup/status endpoint is unauthenticated).
 func TestNewHandler_APIRoutesMounted(t *testing.T) {
 	database := openAdminTestDB(t)
-	h := admin.NewHandler(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	h := admin.NewHandler(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	req := httptest.NewRequest(http.MethodGet, "/api/setup/status", nil)
 	w := httptest.NewRecorder()
@@ -93,7 +93,7 @@ func TestNewHandler_APIRoutesMounted(t *testing.T) {
 // /api require a valid token.
 func TestNewHandler_AuthProtectedRoute(t *testing.T) {
 	database := openAdminTestDB(t)
-	h := admin.NewHandler(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	h := admin.NewHandler(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	// /api/stats requires authentication
 	req := httptest.NewRequest(http.MethodGet, "/api/stats", nil)
@@ -110,7 +110,7 @@ func TestNewHandler_AuthProtectedRoute(t *testing.T) {
 func TestNewHandler_WithUpdater(t *testing.T) {
 	database := openAdminTestDB(t)
 	u := updater.NewUpdater("1.0.0", "", "J3vb", "OwnCord")
-	h := admin.NewHandler(database, "1.0.0", &mockHub{}, u, nil, nil, nil, newTestModService(database))
+	h := admin.NewHandler(database, "1.0.0", &mockHub{}, u, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	if h == nil {
 		t.Fatal("NewHandler with updater returned nil handler")
 	}
@@ -122,7 +122,7 @@ func TestNewHandler_WithUpdater(t *testing.T) {
 // (position == 100) can reach backup endpoints.
 func TestOwnerOnlyMiddleware_OwnerAllowed(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	// createAdminUser creates an Owner-role user (role_id=1, position=100)
 	ownerToken := createAdminUser(t, database)
@@ -157,7 +157,7 @@ func TestOwnerOnlyMiddleware_OwnerAllowed(t *testing.T) {
 // (position < 100) cannot reach owner-only endpoints.
 func TestOwnerOnlyMiddleware_AdminDenied(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	// Create admin user (role_id=2, position=80)
 	adminUID, _ := database.CreateUser(context.Background(), "middlewareadmin", "hash", 2)
@@ -175,7 +175,7 @@ func TestOwnerOnlyMiddleware_AdminDenied(t *testing.T) {
 // reach owner-only endpoints.
 func TestOwnerOnlyMiddleware_MemberDenied(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	memberToken := createMemberUser(t, database)
 
@@ -192,7 +192,7 @@ func TestOwnerOnlyMiddleware_MemberDenied(t *testing.T) {
 // rejected before reaching ownerOnlyMiddleware.
 func TestOwnerOnlyMiddleware_Unauthenticated(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	w := doRequest(t, handler, http.MethodPost, "/backup", "", nil)
 
diff --git a/Server/admin/api.go b/Server/admin/api.go
index 4e0ccd7a..d09e7ead 100644
--- a/Server/admin/api.go
+++ b/Server/admin/api.go
@@ -6,6 +6,7 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/owncord/server/auth"
 	"github.com/owncord/server/db"
+	"github.com/owncord/server/permissions"
 	"github.com/owncord/server/service"
 	"github.com/owncord/server/updater"
 )
@@ -13,13 +14,15 @@ import (
 // ─── NewAdminAPI ──────────────────────────────────────────────────────────────
 
 // NewAdminAPI returns a chi router with all /admin/api/* routes. All routes
-// are protected by adminAuthMiddleware which requires the ADMINISTRATOR bit,
-// except for the setup endpoints which are unauthenticated.
+// except the unauthenticated setup endpoints are protected by
+// adminAuthMiddleware, which admits any role holding a bit of
+// permissions.AdminPerimeter; route groups then require the specific bit
+// (requirePerm) or the Owner role (ownerOnlyMiddleware).
 //
 // The optional trailing SetupOptions enables the first-run wizard's
 // config.yaml write-back and restart; without it the setup endpoints keep
 // their legacy account-only behaviour (the case in most tests).
-func NewAdminAPI(database *db.DB, version string, hub HubBroadcaster, u *updater.Updater, logBuf *RingBuffer, allowedOrigins []string, permInvalidator PermissionInvalidator, mod *service.ModerationService, opts ...SetupOptions) http.Handler {
+func NewAdminAPI(database *db.DB, version string, hub HubBroadcaster, u *updater.Updater, logBuf *RingBuffer, allowedOrigins []string, permInvalidator PermissionInvalidator, mod *service.ModerationService, roles *service.RoleService, opts ...SetupOptions) http.Handler {
 	r := chi.NewRouter()
 
 	var setupOpts SetupOptions
@@ -40,25 +43,60 @@ func NewAdminAPI(database *db.DB, version string, hub HubBroadcaster, u *updater
 		r.Get("/logs/stream", handleLogStream(database, logBuf))
 	}
 
-	// All remaining routes require authentication and ADMINISTRATOR permission.
+	// All remaining routes require authentication plus at least one
+	// moderation-capable bit (permissions.AdminPerimeter). Route groups that
+	// map onto a specific bit re-check it with requirePerm; the rest
+	// (stats, users list, me) are perimeter-level.
 	r.Group(func(r chi.Router) {
 		r.Use(adminAuthMiddleware(database))
 
 		// Log stream ticket — issues a single-use, 30s TTL ticket for SSE auth.
-		r.Post("/logs/ticket", handleLogTicket(database))
+		// ADMINISTRATOR-gated to match handleLogStream's own re-check: server
+		// logs are not scoped to any narrower moderation bit.
+		r.With(requirePerm(permissions.Administrator)).
+			Post("/logs/ticket", handleLogTicket(database))
 
 		r.Get("/stats", handleGetStats(database, hub))
+		r.Get("/me", handleGetMe())
 		r.Get("/users", handleListUsers(database))
+		// Ban/unban and role change are authorized inside ModerationService
+		// (BAN_MEMBERS / MANAGE_ROLES + hierarchy), so the route itself stays
+		// perimeter-level — a moderator with only BAN_MEMBERS must reach it.
 		r.Patch("/users/{id}", handlePatchUser(database, hub, permInvalidator, mod))
-		r.Delete("/users/{id}/sessions", handleForceLogout(database))
-		r.Get("/channels", handleListChannels(database))
-		r.Post("/channels", handleCreateChannel(database, hub))
-		r.Patch("/channels/{id}", handlePatchChannel(database, hub))
-		r.Delete("/channels/{id}", handleDeleteChannel(database, hub))
-		r.Get("/channels/{id}/permissions", handleGetChannelPermissions(database))
-		r.Put("/channels/{id}/permissions/{roleId}", handlePutChannelPermission(database, hub, permInvalidator))
-		r.Delete("/channels/{id}/permissions/{roleId}", handleDeleteChannelPermission(database, hub, permInvalidator))
-		r.Get("/audit-log", handleGetAuditLog(database))
+		r.With(requirePerm(permissions.KickMembers)).
+			Delete("/users/{id}/sessions", handleForceLogout(mod))
+
+		r.Group(func(r chi.Router) {
+			r.Use(requirePerm(permissions.ManageChannels))
+			r.Get("/channels", handleListChannels(database))
+			r.Post("/channels", handleCreateChannel(database, hub))
+			r.Patch("/channels/{id}", handlePatchChannel(database, hub))
+			r.Delete("/channels/{id}", handleDeleteChannel(database, hub))
+			r.Get("/channels/{id}/permissions", handleGetChannelPermissions(database))
+			r.Put("/channels/{id}/permissions/{roleId}", handlePutChannelPermission(database, hub, permInvalidator))
+			r.Delete("/channels/{id}/permissions/{roleId}", handleDeleteChannelPermission(database, hub, permInvalidator))
+			// Per-user overrides — the last layer of the resolution order,
+			// gated on the same MANAGE_CHANNELS bit as the role layer.
+			r.Put("/channels/{id}/user-permissions/{userId}", handlePutChannelUserPermission(database, hub, permInvalidator))
+			r.Delete("/channels/{id}/user-permissions/{userId}", handleDeleteChannelUserPermission(database, hub, permInvalidator))
+		})
+
+		// Role CRUD. MANAGE_ROLES gates the group; RoleService additionally
+		// enforces the hierarchy (manage only roles below your own position,
+		// never grant a bit your role lacks) and refuses to delete the Owner
+		// or the default role.
+		r.Group(func(r chi.Router) {
+			r.Use(requirePerm(permissions.ManageRoles))
+			r.Get("/roles", handleListRoles(roles))
+			r.Post("/roles", handleCreateRole(database, hub, roles))
+			// Registered before /roles/{id} so "reorder" is never parsed as an id.
+			r.Patch("/roles/reorder", handleReorderRoles(hub, permInvalidator, roles))
+			r.Patch("/roles/{id}", handlePatchRole(database, hub, permInvalidator, roles))
+			r.Delete("/roles/{id}", handleDeleteRole(database, hub, permInvalidator, roles))
+		})
+
+		r.With(requirePerm(permissions.ViewAuditLog)).
+			Get("/audit-log", handleGetAuditLog(database))
 		// API tokens — Owner-only. Minting a network-reachable, revocation-
 		// surviving bearer credential is gated like backups/updates.
 		r.Get("/tokens", http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
@@ -70,8 +108,11 @@ func NewAdminAPI(database *db.DB, version string, hub HubBroadcaster, u *updater
 		r.Delete("/tokens/{id}", http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
 			ownerOnlyMiddleware(database, handleRevokeAPIToken(database)).ServeHTTP(w, req)
 		}))
-		r.Get("/settings", handleGetSettings(database))
-		r.Patch("/settings", handlePatchSettings(database))
+		r.Group(func(r chi.Router) {
+			r.Use(requirePerm(permissions.ManageServer))
+			r.Get("/settings", handleGetSettings(database))
+			r.Patch("/settings", handlePatchSettings(database))
+		})
 		r.Post("/backup", http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
 			ownerOnlyMiddleware(database, handleBackup(database)).ServeHTTP(w, req)
 		}))
diff --git a/Server/admin/api_edge_cases_test.go b/Server/admin/api_edge_cases_test.go
index 4e6b5e46..e49e8578 100644
--- a/Server/admin/api_edge_cases_test.go
+++ b/Server/admin/api_edge_cases_test.go
@@ -21,7 +21,7 @@ import (
 // their own account via the admin panel.
 func TestAdminAPI_PatchUser_CannotModifySelf(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	// The admin user created by createAdminUser has id=1. We try to patch id=1.
@@ -37,7 +37,7 @@ func TestAdminAPI_PatchUser_CannotModifySelf(t *testing.T) {
 // banned user unbans them and returns 200.
 func TestAdminAPI_PatchUser_UnbanUser(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	// Create and ban a target user first.
@@ -58,10 +58,52 @@ func TestAdminAPI_PatchUser_UnbanUser(t *testing.T) {
 	}
 }
 
+// TestAdminAPI_PatchUser_TempBan verifies that ban_duration_hours stores an
+// expiry so the ban lapses on its own.
+func TestAdminAPI_PatchUser_TempBan(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
+	token := createAdminUser(t, database)
+
+	targetUID, _ := database.CreateUser(context.Background(), "tempbanme", "hash", 3)
+
+	body := map[string]any{"banned": true, "ban_reason": "cooling off", "ban_duration_hours": 24}
+	w := doRequest(t, handler, http.MethodPatch, "/users/"+itoa(targetUID), token, body)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("temp ban status = %d, want 200; body: %s", w.Code, w.Body.String())
+	}
+
+	user, _ := database.GetUserByID(context.Background(), targetUID)
+	if !user.Banned {
+		t.Fatal("user should be banned")
+	}
+	if user.BanExpires == nil {
+		t.Fatal("ban_expires should be set for a temporary ban")
+	}
+}
+
+// TestAdminAPI_PatchUser_TempBanOutOfRange verifies duration bounds are enforced.
+func TestAdminAPI_PatchUser_TempBanOutOfRange(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
+	token := createAdminUser(t, database)
+
+	targetUID, _ := database.CreateUser(context.Background(), "toolongban", "hash", 3)
+
+	for _, hours := range []int{-1, 24*365 + 1} {
+		body := map[string]any{"banned": true, "ban_duration_hours": hours}
+		w := doRequest(t, handler, http.MethodPatch, "/users/"+itoa(targetUID), token, body)
+		if w.Code != http.StatusBadRequest {
+			t.Errorf("ban_duration_hours=%d status = %d, want 400; body: %s", hours, w.Code, w.Body.String())
+		}
+	}
+}
+
 // TestAdminAPI_PatchUser_InvalidBody verifies that a non-JSON body returns 400.
 func TestAdminAPI_PatchUser_InvalidBody(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	targetUID, _ := database.CreateUser(context.Background(), "invalidbody", "hash", 3)
@@ -83,7 +125,7 @@ func TestAdminAPI_PatchUser_InvalidBody(t *testing.T) {
 // "type" field causes the channel to be created with type "text".
 func TestAdminAPI_CreateChannel_DefaultsTypeToText(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	body := map[string]any{
@@ -108,7 +150,7 @@ func TestAdminAPI_CreateChannel_DefaultsTypeToText(t *testing.T) {
 // TestAdminAPI_CreateChannel_InvalidBody verifies that a malformed body returns 400.
 func TestAdminAPI_CreateChannel_InvalidBody(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	req := httptest.NewRequest(http.MethodPost, "/channels", bytes.NewReader([]byte("not-json")))
@@ -128,7 +170,7 @@ func TestAdminAPI_CreateChannel_InvalidBody(t *testing.T) {
 // the URL returns 400.
 func TestAdminAPI_ForceLogout_InvalidID(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodDelete, "/users/notanumber/sessions", token, nil)
@@ -144,7 +186,7 @@ func TestAdminAPI_ForceLogout_InvalidID(t *testing.T) {
 // returns 400.
 func TestAdminAPI_PatchChannel_InvalidBody(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	chID, _ := database.AdminCreateChannel(context.Background(), "malformed", "text", "", "", 0)
@@ -166,7 +208,7 @@ func TestAdminAPI_PatchChannel_InvalidBody(t *testing.T) {
 // to 500 (testing the queryInt cap branch).
 func TestAdminAPI_ListUsers_CapLargeLimit(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	// Passing limit=9999 should be silently capped to 500.
@@ -183,7 +225,7 @@ func TestAdminAPI_ListUsers_CapLargeLimit(t *testing.T) {
 // when no updater is configured.
 func TestAdminAPI_CheckUpdate_NilUpdater(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodGet, "/updates", token, nil)
@@ -199,7 +241,7 @@ func TestAdminAPI_CheckUpdate_NilUpdater(t *testing.T) {
 // returns 400.
 func TestAdminAPI_DeleteChannel_InvalidID(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodDelete, "/channels/notanumber", token, nil)
@@ -215,7 +257,7 @@ func TestAdminAPI_DeleteChannel_InvalidID(t *testing.T) {
 // returns 400.
 func TestAdminAPI_PatchChannel_InvalidID(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	body := map[string]any{"name": "x"}
@@ -231,7 +273,7 @@ func TestAdminAPI_PatchChannel_InvalidID(t *testing.T) {
 // TestAdminAPI_AuditLog_Pagination verifies that limit and offset params work.
 func TestAdminAPI_AuditLog_Pagination(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	// Create several audit entries.
@@ -262,7 +304,7 @@ func TestAdminAPI_AuditLog_Pagination(t *testing.T) {
 // hub is nil (the OnlineCount field defaults to 0).
 func TestAdminAPI_Stats_NilHub(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodGet, "/stats", token, nil)
@@ -289,7 +331,7 @@ func TestAdminAPI_Stats_NilHub(t *testing.T) {
 // falls back to the default (testing the queryInt error-fallback branch).
 func TestAdminAPI_AuditLog_InvalidLimitParam(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodGet, "/audit-log?limit=notanumber", token, nil)
@@ -303,7 +345,7 @@ func TestAdminAPI_AuditLog_InvalidLimitParam(t *testing.T) {
 // the default (testing the n < 1 branch of queryInt).
 func TestAdminAPI_ListUsers_InvalidLimitParam(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	// limit=0 triggers the n < 1 fallback in queryInt
@@ -321,7 +363,7 @@ func TestAdminAPI_ListUsers_InvalidLimitParam(t *testing.T) {
 // BroadcastMemberBan).
 func TestAdminAPI_PatchUser_BanNilHubDoesNotPanic(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	targetUID, _ := database.CreateUser(context.Background(), "ban-nohub", "hash", 3)
@@ -346,7 +388,7 @@ func TestAdminAPI_PatchUser_BanNilHubDoesNotPanic(t *testing.T) {
 func TestAdminAPI_LogStreamTicketFlow(t *testing.T) {
 	database := openAdminTestDB(t)
 	logBuf := admin.NewRingBuffer(8)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, logBuf, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, logBuf, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	ticketResp := doRequest(t, handler, http.MethodPost, "/logs/ticket", token, nil)
@@ -441,7 +483,7 @@ func TestAdminAPI_LogStreamTicketFlow(t *testing.T) {
 // around BroadcastMemberUpdate).
 func TestAdminAPI_PatchUser_RoleChangeNilHubDoesNotPanic(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	targetUID, _ := database.CreateUser(context.Background(), "role-nohub", "hash", 3)
@@ -466,7 +508,7 @@ func TestAdminAPI_PatchUser_RoleChangeNilHubDoesNotPanic(t *testing.T) {
 // providing ban_reason is accepted (reason defaults to empty string).
 func TestAdminAPI_PatchUser_BanWithoutReason(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	targetUID, _ := database.CreateUser(context.Background(), "banwithout", "hash", 3)
@@ -487,7 +529,7 @@ func TestAdminAPI_PatchUser_BanWithoutReason(t *testing.T) {
 func TestAdminAPI_PatchUser_RoleChangeBroadcast(t *testing.T) {
 	database := openAdminTestDB(t)
 	hub := &mockHub{}
-	handler := admin.NewAdminAPI(database, "1.0.0", hub, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", hub, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	targetUID, _ := database.CreateUser(context.Background(), "rolebroadcast", "hash", 3)
@@ -509,7 +551,7 @@ func TestAdminAPI_PatchUser_RoleChangeBroadcast(t *testing.T) {
 // needs_setup=true when the database has no users.
 func TestAdminAPI_SetupStatus_NeedsSetup(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	w := doRequest(t, handler, http.MethodGet, "/setup/status", "", nil)
 
@@ -529,7 +571,7 @@ func TestAdminAPI_SetupStatus_NeedsSetup(t *testing.T) {
 // TestAdminAPI_SetupStatus_AlreadySetup verifies needs_setup=false when users exist.
 func TestAdminAPI_SetupStatus_AlreadySetup(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	_, _ = database.CreateUser(context.Background(), "existing", "hash", 1)
 
@@ -550,7 +592,7 @@ func TestAdminAPI_SetupStatus_AlreadySetup(t *testing.T) {
 // session, channel, and invite.
 func TestAdminAPI_Setup_Success(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	body := map[string]string{
 		"username": "owner",
@@ -581,7 +623,7 @@ func TestAdminAPI_Setup_Success(t *testing.T) {
 // when users already exist.
 func TestAdminAPI_Setup_AlreadyCompleted(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	_, _ = database.CreateUser(context.Background(), "existing", "hash", 1)
 
@@ -600,7 +642,7 @@ func TestAdminAPI_Setup_AlreadyCompleted(t *testing.T) {
 // username or password returns 400.
 func TestAdminAPI_Setup_MissingFields(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	body := map[string]string{
 		"username": "",
@@ -616,7 +658,7 @@ func TestAdminAPI_Setup_MissingFields(t *testing.T) {
 // TestAdminAPI_Setup_WeakPassword verifies that a weak password is rejected.
 func TestAdminAPI_Setup_WeakPassword(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	body := map[string]string{
 		"username": "owner",
@@ -632,7 +674,7 @@ func TestAdminAPI_Setup_WeakPassword(t *testing.T) {
 // TestAdminAPI_Setup_InvalidBody verifies that a non-JSON body returns 400.
 func TestAdminAPI_Setup_InvalidBody(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	req := httptest.NewRequest(http.MethodPost, "/setup", bytes.NewReader([]byte("not-json")))
 	w := httptest.NewRecorder()
diff --git a/Server/admin/api_test.go b/Server/admin/api_test.go
index ee9401cf..c1863002 100644
--- a/Server/admin/api_test.go
+++ b/Server/admin/api_test.go
@@ -27,6 +27,15 @@ func newTestModService(database *db.DB) *service.ModerationService {
 	return service.NewModerationService(st, service.NewPermissionService(st, checker))
 }
 
+// newTestRoleService builds a real RoleService over the test database so the
+// role routes exercise the production authorization (MANAGE_ROLES + hierarchy)
+// instead of a stub.
+func newTestRoleService(database *db.DB) *service.RoleService {
+	st := database
+	checker := permissions.NewChecker(st)
+	return service.NewRoleService(st, service.NewPermissionService(st, checker))
+}
+
 // adminSchema is a minimal in-memory schema for admin API tests.
 var adminSchema = []byte(`
 CREATE TABLE IF NOT EXISTS roles (
@@ -38,6 +47,8 @@ CREATE TABLE IF NOT EXISTS roles (
     is_default  INTEGER NOT NULL DEFAULT 0
 );
 
+CREATE UNIQUE INDEX IF NOT EXISTS idx_roles_name_nocase ON roles(name COLLATE NOCASE);
+
 INSERT OR IGNORE INTO roles (id, name, color, permissions, position, is_default) VALUES
     (1, 'Owner',  '#E74C3C', 2147483647, 100, 0),
     (2, 'Admin',  '#F39C12', 1073741823,  80, 0),
@@ -56,7 +67,10 @@ CREATE TABLE IF NOT EXISTS users (
     banned      INTEGER NOT NULL DEFAULT 0,
     ban_reason  TEXT,
     ban_expires TEXT,
-    identity_public_key TEXT
+    identity_public_key TEXT,
+    display_name TEXT,
+    about TEXT,
+    custom_status TEXT
 );
 
 CREATE TABLE IF NOT EXISTS sessions (
@@ -85,7 +99,9 @@ CREATE TABLE IF NOT EXISTS channels (
     voice_max_users  INTEGER NOT NULL DEFAULT 0,
     voice_quality    TEXT,
     mixing_threshold INTEGER,
-    voice_max_video  INTEGER NOT NULL DEFAULT 0
+    voice_max_video  INTEGER NOT NULL DEFAULT 0,
+    nsfw             INTEGER NOT NULL DEFAULT 0,
+    is_group         INTEGER NOT NULL DEFAULT 0
 );
 
 CREATE TABLE IF NOT EXISTS channel_overrides (
@@ -97,6 +113,14 @@ CREATE TABLE IF NOT EXISTS channel_overrides (
     UNIQUE(channel_id, role_id)
 );
 
+CREATE TABLE IF NOT EXISTS channel_user_overrides (
+    channel_id INTEGER NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
+    user_id    INTEGER NOT NULL REFERENCES users(id)    ON DELETE CASCADE,
+    allow      INTEGER NOT NULL DEFAULT 0,
+    deny       INTEGER NOT NULL DEFAULT 0,
+    PRIMARY KEY (channel_id, user_id)
+);
+
 CREATE TABLE IF NOT EXISTS messages (
     id         INTEGER PRIMARY KEY AUTOINCREMENT,
     channel_id INTEGER NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
@@ -106,8 +130,15 @@ CREATE TABLE IF NOT EXISTS messages (
     pinned     INTEGER NOT NULL DEFAULT 0,
     timestamp  TEXT    NOT NULL DEFAULT (datetime('now')),
     reply_to   INTEGER REFERENCES messages(id) ON DELETE SET NULL,
-    edited_at  TEXT
+    edited_at  TEXT,
+    mentions_everyone INTEGER NOT NULL DEFAULT 0
 );
+CREATE TABLE IF NOT EXISTS message_mentions (
+    message_id        INTEGER NOT NULL REFERENCES messages(id) ON DELETE CASCADE,
+    mentioned_user_id INTEGER NOT NULL REFERENCES users(id)    ON DELETE CASCADE,
+    PRIMARY KEY (message_id, mentioned_user_id)
+);
+
 
 CREATE TABLE IF NOT EXISTS invites (
     id          INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -231,7 +262,7 @@ func doRequest(t *testing.T, handler http.Handler, method, path, token string, b
 
 func TestAdminAPI_Stats_OK(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodGet, "/stats", token, nil)
@@ -254,7 +285,7 @@ func TestAdminAPI_Stats_OK(t *testing.T) {
 
 func TestAdminAPI_Stats_Unauthenticated(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	w := doRequest(t, handler, http.MethodGet, "/stats", "", nil)
 
@@ -265,7 +296,7 @@ func TestAdminAPI_Stats_Unauthenticated(t *testing.T) {
 
 func TestAdminAPI_Stats_Forbidden(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createMemberUser(t, database)
 
 	w := doRequest(t, handler, http.MethodGet, "/stats", token, nil)
@@ -279,7 +310,7 @@ func TestAdminAPI_Stats_Forbidden(t *testing.T) {
 
 func TestAdminAPI_ListUsers_OK(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodGet, "/users?limit=50&offset=0", token, nil)
@@ -300,7 +331,7 @@ func TestAdminAPI_ListUsers_OK(t *testing.T) {
 
 func TestAdminAPI_ListUsers_DefaultPagination(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	// No query params — should use defaults
@@ -313,7 +344,7 @@ func TestAdminAPI_ListUsers_DefaultPagination(t *testing.T) {
 
 func TestAdminAPI_ListUsers_Unauthenticated(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	w := doRequest(t, handler, http.MethodGet, "/users", "", nil)
 
@@ -331,7 +362,7 @@ func TestAdminAPI_ListUsers_Unauthenticated(t *testing.T) {
 // owner via the raw UPDATE).
 func TestAdminAPI_PatchUser_BanHierarchy(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	ownerToken := createAdminUser(t, database) // Owner role (pos 100)
 
 	// A second owner-rank user: equal position, cannot be banned.
@@ -394,7 +425,7 @@ func TestAdminAPI_PatchUser_BanHierarchy(t *testing.T) {
 
 func TestAdminAPI_PatchUser_BanUser(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	// Create a target user
@@ -422,7 +453,7 @@ func TestAdminAPI_PatchUser_BanUser(t *testing.T) {
 
 func TestAdminAPI_PatchUser_ChangeRole(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	targetUID, _ := database.CreateUser(context.Background(), "rolechange", "hash", 3)
@@ -444,7 +475,7 @@ func TestAdminAPI_PatchUser_ChangeRole(t *testing.T) {
 
 func TestAdminAPI_PatchUser_NotFound(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	body := map[string]any{"banned": true}
@@ -457,7 +488,7 @@ func TestAdminAPI_PatchUser_NotFound(t *testing.T) {
 
 func TestAdminAPI_PatchUser_InvalidID(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodPatch, "/users/abc", token, nil)
@@ -471,7 +502,7 @@ func TestAdminAPI_PatchUser_InvalidID(t *testing.T) {
 
 func TestAdminAPI_ForceLogout_OK(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	targetUID, _ := database.CreateUser(context.Background(), "logoutme", "hash", 3)
@@ -491,7 +522,7 @@ func TestAdminAPI_ForceLogout_OK(t *testing.T) {
 
 func TestAdminAPI_ForceLogout_Unauthenticated(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	w := doRequest(t, handler, http.MethodDelete, "/users/1/sessions", "", nil)
 
@@ -504,7 +535,7 @@ func TestAdminAPI_ForceLogout_Unauthenticated(t *testing.T) {
 
 func TestAdminAPI_ListChannels_OK(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	_, _ = database.AdminCreateChannel(context.Background(), "general", "text", "", "", 0)
@@ -528,7 +559,7 @@ func TestAdminAPI_ListChannels_OK(t *testing.T) {
 
 func TestAdminAPI_CreateChannel_OK(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	body := map[string]any{
@@ -555,7 +586,7 @@ func TestAdminAPI_CreateChannel_OK(t *testing.T) {
 
 func TestAdminAPI_CreateChannel_MissingName(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	body := map[string]any{
@@ -572,7 +603,7 @@ func TestAdminAPI_CreateChannel_MissingName(t *testing.T) {
 
 func TestAdminAPI_UpdateChannel_OK(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	chID, _ := database.AdminCreateChannel(context.Background(), "old", "text", "", "", 0)
@@ -593,7 +624,7 @@ func TestAdminAPI_UpdateChannel_OK(t *testing.T) {
 
 func TestAdminAPI_UpdateChannel_NotFound(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	body := map[string]any{"name": "x"}
@@ -608,7 +639,7 @@ func TestAdminAPI_UpdateChannel_NotFound(t *testing.T) {
 
 func TestAdminAPI_DeleteChannel_OK(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	chID, _ := database.AdminCreateChannel(context.Background(), "del-me", "text", "", "", 0)
@@ -622,7 +653,7 @@ func TestAdminAPI_DeleteChannel_OK(t *testing.T) {
 
 func TestAdminAPI_DeleteChannel_NotFound(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodDelete, "/channels/99999", token, nil)
@@ -636,7 +667,7 @@ func TestAdminAPI_DeleteChannel_NotFound(t *testing.T) {
 
 func TestAdminAPI_AuditLog_OK(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	uid, _ := database.CreateUser(context.Background(), "actor", "hash", 1)
@@ -659,7 +690,7 @@ func TestAdminAPI_AuditLog_OK(t *testing.T) {
 
 func TestAdminAPI_AuditLog_Empty(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodGet, "/audit-log", token, nil)
@@ -679,7 +710,7 @@ func TestAdminAPI_AuditLog_Empty(t *testing.T) {
 
 func TestAdminAPI_GetSettings_OK(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodGet, "/settings", token, nil)
@@ -701,7 +732,7 @@ func TestAdminAPI_GetSettings_OK(t *testing.T) {
 
 func TestAdminAPI_PatchSettings_OK(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	body := map[string]string{
@@ -726,7 +757,7 @@ func TestAdminAPI_PatchSettings_OK(t *testing.T) {
 
 func TestAdminAPI_PatchSettings_InvalidBody(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	req := httptest.NewRequest(http.MethodPatch, "/settings", bytes.NewReader([]byte("not-json")))
@@ -743,7 +774,7 @@ func TestAdminAPI_PatchSettings_InvalidBody(t *testing.T) {
 
 func TestAdminAPI_Backup_RequiresOwner(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	// Admin (role 2) can authenticate but is not Owner (role 1, position 100)
 	adminUID, _ := database.CreateUser(context.Background(), "adminonly", "hash", 2)
@@ -760,7 +791,7 @@ func TestAdminAPI_Backup_RequiresOwner(t *testing.T) {
 
 func TestAdminAPI_Backup_Unauthenticated(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	w := doRequest(t, handler, http.MethodPost, "/backup", "", nil)
 
@@ -777,7 +808,7 @@ func TestAdminAPI_Backup_Unauthenticated(t *testing.T) {
 // which logs an audit entry containing the actor_id.
 func TestAdminAPI_ActorFromContext_AuditEntry(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	// Create a target user to act on.
@@ -811,7 +842,7 @@ func TestAdminAPI_ActorFromContext_AuditEntry(t *testing.T) {
 // DELETE /users/{id}/sessions path.
 func TestAdminAPI_ActorFromContext_ForceLogout(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	targetUID, _ := database.CreateUser(context.Background(), "logoutctx", "hash", 3)
@@ -843,7 +874,7 @@ func TestAdminAPI_ActorFromContext_ForceLogout(t *testing.T) {
 // returns 400 without writing anything to the database.
 func TestAdminAPI_PatchSettings_RejectsUnknownKey(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	body := map[string]string{
@@ -869,7 +900,7 @@ func TestAdminAPI_PatchSettings_RejectsUnknownKey(t *testing.T) {
 // containing both valid and invalid keys is rejected entirely (no partial write).
 func TestAdminAPI_PatchSettings_RejectsMixedKeys(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	body := map[string]string{
@@ -913,7 +944,7 @@ func TestAdminAPI_PatchSettings_AcceptsAllWhitelistedKeys(t *testing.T) {
 	for _, key := range whitelistedKeys {
 		t.Run(key, func(t *testing.T) {
 			database := openAdminTestDB(t)
-			handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+			handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 			token := createAdminUser(t, database)
 
 			value := "testvalue"
@@ -934,7 +965,7 @@ func TestAdminAPI_PatchSettings_AcceptsAllWhitelistedKeys(t *testing.T) {
 // (no-op update) is accepted and returns the current settings.
 func TestAdminAPI_PatchSettings_EmptyPayloadIsOK(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	body := map[string]string{}
@@ -947,7 +978,7 @@ func TestAdminAPI_PatchSettings_EmptyPayloadIsOK(t *testing.T) {
 
 func TestAdminAPI_PatchSettings_RejectsRequire2FAWhenUsersNotEnrolled(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	body := map[string]string{
@@ -963,7 +994,7 @@ func TestAdminAPI_PatchSettings_RejectsRequire2FAWhenUsersNotEnrolled(t *testing
 
 func TestAdminAPI_PatchSettings_AllowsRequire2FAWhenAllUsersEnrolledAndRegistrationClosed(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	if _, err := database.ExecContext(context.Background(), `UPDATE users SET totp_secret = ? WHERE id = 1`, "JBSWY3DPEHPK3PXP"); err != nil {
@@ -983,7 +1014,7 @@ func TestAdminAPI_PatchSettings_AllowsRequire2FAWhenAllUsersEnrolledAndRegistrat
 
 func TestAdminAPI_PatchSettings_RejectsInvalidBooleanValue(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	body := map[string]string{
@@ -1002,7 +1033,7 @@ func TestAdminAPI_PatchSettings_RejectsInvalidBooleanValue(t *testing.T) {
 // expose the PasswordHash field in any returned user object.
 func TestAdminAPI_ListUsers_NoPasswordHash(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	// Create a second user so the list is non-trivial.
@@ -1029,7 +1060,7 @@ func TestAdminAPI_ListUsers_NoPasswordHash(t *testing.T) {
 // expose the TOTPSecret field.
 func TestAdminAPI_ListUsers_NoTOTPSecret(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodGet, "/users", token, nil)
@@ -1048,7 +1079,7 @@ func TestAdminAPI_ListUsers_NoTOTPSecret(t *testing.T) {
 // are still present after the sensitive-field removal.
 func TestAdminAPI_ListUsers_PublicFieldsPresent(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodGet, "/users", token, nil)
@@ -1077,7 +1108,7 @@ func TestAdminAPI_ListUsers_PublicFieldsPresent(t *testing.T) {
 // not expose PasswordHash in the returned user object.
 func TestAdminAPI_PatchUser_NoPasswordHash(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	targetUID, _ := database.CreateUser(context.Background(), "patchvictim", "topsecretbcrypt", 3)
@@ -1105,7 +1136,7 @@ func TestAdminAPI_PatchUser_NoPasswordHash(t *testing.T) {
 // not expose TOTPSecret in the returned user object.
 func TestAdminAPI_PatchUser_NoTOTPSecret(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	targetUID, _ := database.CreateUser(context.Background(), "patchtotp", "hash", 3)
@@ -1135,7 +1166,11 @@ type mockHub struct {
 	memberBanIDs        []int64
 	memberUpdates       []memberUpdateCall
 	visibilityRefreshes []*db.Channel
-	clientCount         int
+	// allVisibilityRefreshes counts RefreshAllChannelVisibility calls — the
+	// role-edit equivalent of visibilityRefreshes.
+	allVisibilityRefreshes int
+	rolesUpdates           [][]*db.Role
+	clientCount            int
 }
 
 type memberUpdateCall struct {
@@ -1176,6 +1211,14 @@ func (m *mockHub) RefreshChannelVisibility(ch *db.Channel) {
 	m.visibilityRefreshes = append(m.visibilityRefreshes, ch)
 }
 
+func (m *mockHub) RefreshAllChannelVisibility() {
+	m.allVisibilityRefreshes++
+}
+
+func (m *mockHub) BroadcastRolesUpdate(roles []*db.Role) {
+	m.rolesUpdates = append(m.rolesUpdates, roles)
+}
+
 func (m *mockHub) ClientCount() int {
 	return m.clientCount
 }
@@ -1183,7 +1226,7 @@ func (m *mockHub) ClientCount() int {
 func TestAdminAPI_CreateChannel_BroadcastsChannelCreate(t *testing.T) {
 	database := openAdminTestDB(t)
 	hub := &mockHub{}
-	handler := admin.NewAdminAPI(database, "1.0.0", hub, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", hub, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	body := map[string]any{
@@ -1206,7 +1249,7 @@ func TestAdminAPI_CreateChannel_BroadcastsChannelCreate(t *testing.T) {
 func TestAdminAPI_CreateChannel_NilHubDoesNotPanic(t *testing.T) {
 	database := openAdminTestDB(t)
 	// nil hub: handler must not panic
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	body := map[string]any{"name": "safe-channel", "type": "text"}
@@ -1220,7 +1263,7 @@ func TestAdminAPI_CreateChannel_NilHubDoesNotPanic(t *testing.T) {
 func TestAdminAPI_UpdateChannel_BroadcastsChannelUpdate(t *testing.T) {
 	database := openAdminTestDB(t)
 	hub := &mockHub{}
-	handler := admin.NewAdminAPI(database, "1.0.0", hub, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", hub, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	chID, _ := database.AdminCreateChannel(context.Background(), "before", "text", "", "", 0)
@@ -1241,7 +1284,7 @@ func TestAdminAPI_UpdateChannel_BroadcastsChannelUpdate(t *testing.T) {
 
 func TestAdminAPI_UpdateChannel_NilHubDoesNotPanic(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	chID, _ := database.AdminCreateChannel(context.Background(), "patchme", "text", "", "", 0)
@@ -1256,7 +1299,7 @@ func TestAdminAPI_UpdateChannel_NilHubDoesNotPanic(t *testing.T) {
 func TestAdminAPI_DeleteChannel_BroadcastsChannelDelete(t *testing.T) {
 	database := openAdminTestDB(t)
 	hub := &mockHub{}
-	handler := admin.NewAdminAPI(database, "1.0.0", hub, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", hub, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	chID, _ := database.AdminCreateChannel(context.Background(), "delete-me", "text", "", "", 0)
@@ -1276,7 +1319,7 @@ func TestAdminAPI_DeleteChannel_BroadcastsChannelDelete(t *testing.T) {
 
 func TestAdminAPI_DeleteChannel_NilHubDoesNotPanic(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	chID, _ := database.AdminCreateChannel(context.Background(), "del-no-hub", "text", "", "", 0)
@@ -1291,7 +1334,7 @@ func TestAdminAPI_DeleteChannel_NilHubDoesNotPanic(t *testing.T) {
 
 func TestAdminAPI_CreateAPIToken_OK(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database) // Owner role
 
 	w := doRequest(t, handler, http.MethodPost, "/tokens", token, map[string]any{"label": "ci-bot"})
@@ -1321,7 +1364,7 @@ func TestAdminAPI_CreateAPIToken_OK(t *testing.T) {
 
 func TestAdminAPI_CreateAPIToken_MissingLabel(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodPost, "/tokens", token, map[string]any{"label": "  "})
@@ -1332,7 +1375,7 @@ func TestAdminAPI_CreateAPIToken_MissingLabel(t *testing.T) {
 
 func TestAdminAPI_ListAPITokens_OK(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	hash := auth.HashToken("raw-secret-value")
@@ -1361,7 +1404,7 @@ func TestAdminAPI_ListAPITokens_OK(t *testing.T) {
 
 func TestAdminAPI_RevokeAPIToken_OK(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	hash := auth.HashToken("revoke-me")
@@ -1383,7 +1426,7 @@ func TestAdminAPI_RevokeAPIToken_OK(t *testing.T) {
 
 func TestAdminAPI_RevokeAPIToken_NotFound(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodDelete, "/tokens/99999", token, nil)
@@ -1397,7 +1440,7 @@ func TestAdminAPI_RevokeAPIToken_NotFound(t *testing.T) {
 // survives password change + bulk logout).
 func TestAdminAPI_Tokens_RequiresOwner(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	adminUID, _ := database.CreateUser(context.Background(), "adminonly", "hash", 2) // Admin, not Owner
 	token := "admin-only-token"
@@ -1411,7 +1454,7 @@ func TestAdminAPI_Tokens_RequiresOwner(t *testing.T) {
 
 func TestAdminAPI_Tokens_Unauthenticated(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	w := doRequest(t, handler, http.MethodGet, "/tokens", "", nil)
 	if w.Code != http.StatusUnauthorized {
diff --git a/Server/admin/emoji_section_test.go b/Server/admin/emoji_section_test.go
new file mode 100644
index 00000000..f3a87f03
--- /dev/null
+++ b/Server/admin/emoji_section_test.go
@@ -0,0 +1,58 @@
+package admin_test
+
+import (
+	"os"
+	"regexp"
+	"strings"
+	"testing"
+)
+
+// The panel's Emoji section is plain JS inside static/index.html, so nothing
+// compiles it. These tests tie the three places that have to agree — the NAV
+// entry, the renderContent dispatch map, and the permission gate — so a
+// half-wired section fails here rather than as a blank page for an operator.
+
+func adminPanelSource(t *testing.T) string {
+	t.Helper()
+	source, err := os.ReadFile("static/index.html")
+	if err != nil {
+		t.Fatalf("read admin panel: %v", err)
+	}
+	return string(source)
+}
+
+func TestAdminPanelEmojiSectionIsWired(t *testing.T) {
+	source := adminPanelSource(t)
+
+	navRe := regexp.MustCompile(`\{id:'emoji',[^}]*allowed:\(\)=>can\(PERM\.MANAGE_SERVER\)\}`)
+	if !navRe.MatchString(source) {
+		t.Error("no NAV entry for 'emoji' gated on PERM.MANAGE_SERVER")
+	}
+	if !strings.Contains(source, "emoji:renderEmoji") {
+		t.Error("renderContent dispatch map has no emoji:renderEmoji entry")
+	}
+	for _, fn := range []string{
+		"async function renderEmoji(",
+		"async function uploadEmoji(",
+		"async function deleteEmoji(",
+		"function confirmDeleteEmoji(",
+		"async function emojiApi(",
+	} {
+		if !strings.Contains(source, fn) {
+			t.Errorf("missing %q", fn)
+		}
+	}
+}
+
+func TestAdminPanelEmojiUsesTheMemberAPI(t *testing.T) {
+	source := adminPanelSource(t)
+	// The panel deliberately calls the ordinary /api/v1/emoji routes (which
+	// enforce MANAGE_SERVER themselves) rather than a duplicate set of
+	// /admin/api handlers. If that ever moves, the helper below moves with it.
+	if !strings.Contains(source, "fetch('/api/v1/emoji'+path,init)") {
+		t.Error("emojiApi no longer targets /api/v1/emoji")
+	}
+	if !strings.Contains(source, "data-emoji-url") {
+		t.Error("thumbnails are no longer loaded through the authenticated blob path")
+	}
+}
diff --git a/Server/admin/handlers_backup_test.go b/Server/admin/handlers_backup_test.go
index 0c775577..3d0d594c 100644
--- a/Server/admin/handlers_backup_test.go
+++ b/Server/admin/handlers_backup_test.go
@@ -43,7 +43,7 @@ func chdirTemp(t *testing.T) string {
 func TestHandleBackup_Success(t *testing.T) {
 	tmpDir := chdirTemp(t)
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodPost, "/backup", token, nil)
@@ -78,7 +78,7 @@ func TestHandleBackup_Success(t *testing.T) {
 func TestHandleBackup_RequiresOwner(t *testing.T) {
 	_ = chdirTemp(t)
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	adminUID, _ := database.CreateUser(context.Background(), "backupadmin", "hash", 2)
 	token := "backup-admin-token"
@@ -98,7 +98,7 @@ func TestHandleBackup_RequiresOwner(t *testing.T) {
 func TestHandleListBackups_EmptyWhenNoDirExists(t *testing.T) {
 	_ = chdirTemp(t)
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodGet, "/backups", token, nil)
@@ -121,7 +121,7 @@ func TestHandleListBackups_EmptyWhenNoDirExists(t *testing.T) {
 func TestHandleListBackups_ReturnsCreatedBackup(t *testing.T) {
 	_ = chdirTemp(t)
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	// Create a backup first.
@@ -163,7 +163,7 @@ func TestHandleListBackups_ReturnsCreatedBackup(t *testing.T) {
 func TestHandleDeleteBackup_Success(t *testing.T) {
 	tmpDir := chdirTemp(t)
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	// Create a real backup file to delete.
@@ -194,7 +194,7 @@ func TestHandleDeleteBackup_Success(t *testing.T) {
 func TestHandleDeleteBackup_NotFound(t *testing.T) {
 	_ = chdirTemp(t)
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodDelete, "/backups/nonexistent.db", token, nil)
@@ -209,7 +209,7 @@ func TestHandleDeleteBackup_NotFound(t *testing.T) {
 func TestHandleDeleteBackup_InvalidNameTraversal(t *testing.T) {
 	_ = chdirTemp(t)
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	// The chi router URL-decodes the path parameter, so ".." arrives decoded.
@@ -227,7 +227,7 @@ func TestHandleDeleteBackup_InvalidNameTraversal(t *testing.T) {
 func TestHandleDeleteBackup_RequiresOwner(t *testing.T) {
 	tmpDir := chdirTemp(t)
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	adminUID, _ := database.CreateUser(context.Background(), "deladmin", "hash", 2)
 	token := "del-admin-token"
@@ -252,7 +252,7 @@ func TestHandleDeleteBackup_RequiresOwner(t *testing.T) {
 func TestHandleRestoreBackup_Success(t *testing.T) {
 	tmpDir := chdirTemp(t)
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	// Set up backup and data directories.
@@ -325,7 +325,7 @@ func TestHandleRestoreBackup_Success(t *testing.T) {
 func TestHandleRestoreBackup_AbortsWithoutSafetyBackup(t *testing.T) {
 	tmpDir := chdirTemp(t)
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	backupDir := filepath.Join(tmpDir, "data", "backups")
@@ -346,9 +346,10 @@ func TestHandleRestoreBackup_AbortsWithoutSafetyBackup(t *testing.T) {
 
 	// Make the safety copy impossible: VACUUM INTO refuses a destination that
 	// already exists. The name is pre_restore_<UTC seconds>.db, so occupy the
-	// next few seconds' worth of candidates.
+	// next two minutes' worth of candidates — a 4-second window flaked on slow
+	// Windows CI runners where the request itself outlived it.
 	admin.SetBackupBaseDir(backupDir)
-	for i := range 4 {
+	for i := range 120 {
 		name := "pre_restore_" + time.Now().UTC().Add(time.Duration(i)*time.Second).Format("20060102_150405") + ".db"
 		if err := os.WriteFile(filepath.Join(backupDir, name), []byte("occupied"), 0o644); err != nil {
 			t.Fatalf("WriteFile blocker: %v", err)
@@ -377,7 +378,7 @@ func TestHandleRestoreBackup_AbortsWithoutSafetyBackup(t *testing.T) {
 func TestHandleRestoreBackup_NotFound(t *testing.T) {
 	_ = chdirTemp(t)
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodPost, "/backups/missing.db/restore", token, nil)
@@ -392,7 +393,7 @@ func TestHandleRestoreBackup_NotFound(t *testing.T) {
 func TestHandleRestoreBackup_InvalidName(t *testing.T) {
 	_ = chdirTemp(t)
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodPost, "/backups/..evil.db/restore", token, nil)
@@ -408,7 +409,7 @@ func TestHandleRestoreBackup_InvalidName(t *testing.T) {
 func TestHandleListBackups_ErrorReadingDir(t *testing.T) {
 	tmpDir := chdirTemp(t)
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	// Create data/ directory but make "backups" a file instead of a directory.
@@ -436,7 +437,7 @@ func TestHandleListBackups_ErrorReadingDir(t *testing.T) {
 func TestHandleRestoreBackup_RequiresOwner(t *testing.T) {
 	tmpDir := chdirTemp(t)
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	adminUID, _ := database.CreateUser(context.Background(), "restoreadmin", "hash", 2)
 	token := "restore-admin-token"
diff --git a/Server/admin/handlers_channel_perms.go b/Server/admin/handlers_channel_perms.go
index 83daf7ba..f5b48f66 100644
--- a/Server/admin/handlers_channel_perms.go
+++ b/Server/admin/handlers_channel_perms.go
@@ -45,9 +45,14 @@ func getPermChannel(database *db.DB, w http.ResponseWriter, r *http.Request) *db
 }
 
 // channelPermissionsResponse is the JSON shape for GET .../permissions.
+// Roles lists EVERY role (zero allow/deny when it carries no override), while
+// Users lists only the members who actually have a per-user override row —
+// every member of a server is not a sensible list to ship, and the matrix
+// editor adds a member by writing one.
 type channelPermissionsResponse struct {
 	ChannelID int64                    `json:"channel_id"`
 	Roles     []db.ChannelRoleOverride `json:"roles"`
+	Users     []db.ChannelUserOverride `json:"users"`
 }
 
 func handleGetChannelPermissions(database *db.DB) http.HandlerFunc {
@@ -61,7 +66,16 @@ func handleGetChannelPermissions(database *db.DB) http.HandlerFunc {
 			writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "failed to list channel permissions")
 			return
 		}
-		writeJSON(w, http.StatusOK, channelPermissionsResponse{ChannelID: ch.ID, Roles: overrides})
+		userOverrides, err := database.ListChannelUserOverrides(r.Context(), ch.ID)
+		if err != nil {
+			writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "failed to list channel user permissions")
+			return
+		}
+		writeJSON(w, http.StatusOK, channelPermissionsResponse{
+			ChannelID: ch.ID,
+			Roles:     overrides,
+			Users:     userOverrides,
+		})
 	}
 }
 
@@ -71,6 +85,22 @@ type putChannelPermissionRequest struct {
 	Deny  int64 `json:"deny"`
 }
 
+// requireGrantableOverride refuses to write a channel override whose allow or
+// deny mask contains a bit the actor's own role does not hold. Without this,
+// any MANAGE_CHANNELS holder could grant themselves or another user a
+// permission (e.g. MANAGE_SERVER) they were never assigned by writing a
+// channel-scoped override. ADMINISTRATOR bypasses, mirroring
+// service.requireGrantable's escalation rule for role permission masks.
+func requireGrantableOverride(actorRole *db.Role, allow, deny int64) error {
+	if permissions.HasAdmin(actorRole.Permissions) {
+		return nil
+	}
+	if escalated := (allow | deny) &^ actorRole.Permissions; escalated != 0 {
+		return fmt.Errorf("cannot grant a permission your own role lacks (%s)", permissions.Name(escalated&-escalated))
+	}
+	return nil
+}
+
 func handlePutChannelPermission(database *db.DB, hub HubBroadcaster, permInvalidator PermissionInvalidator) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		ch := getPermChannel(database, w, r)
@@ -101,6 +131,24 @@ func handlePutChannelPermission(database *db.DB, hub HubBroadcaster, permInvalid
 		allow := req.Allow & permissions.AllPerms
 		deny := req.Deny & permissions.AllPerms
 
+		actorRole := actorRoleFromContext(r)
+		if actorRole == nil {
+			writeErr(w, http.StatusUnauthorized, "UNAUTHORIZED", "not authenticated")
+			return
+		}
+		// Escalation guard: a MANAGE_CHANNELS holder without ADMINISTRATOR
+		// cannot grant bits their own role lacks via a channel override.
+		if err := requireGrantableOverride(actorRole, allow, deny); err != nil {
+			writeErr(w, http.StatusForbidden, "FORBIDDEN", err.Error())
+			return
+		}
+		// Hierarchy guard: a role override can only target a role strictly
+		// below the actor's own position, mirroring service.requireBelowActor.
+		if role.Position >= actorRole.Position {
+			writeErr(w, http.StatusForbidden, "FORBIDDEN", "cannot manage a role at or above your own rank")
+			return
+		}
+
 		if err := database.UpsertChannelOverride(r.Context(), ch.ID, roleID, allow, deny); err != nil {
 			writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "failed to save channel permission")
 			return
@@ -160,3 +208,165 @@ func handleDeleteChannelPermission(database *db.DB, hub HubBroadcaster, permInva
 		w.WriteHeader(http.StatusNoContent)
 	}
 }
+
+// ─── Per-user overrides ──────────────────────────────────────────────────────
+//
+// channel_user_overrides is the last layer of the resolution order (base role
+// perms -> role override -> user override), so these two endpoints can grant a
+// single member access to a channel their role is denied, or take it away
+// without minting a role for them.
+//
+// Unlike the role endpoints they invalidate only the target user's cached
+// permissions (InvalidateUser): a per-user override cannot change anyone else's
+// verdict, and blowing the whole cache away for one member would cost every
+// connected client a repopulate.
+
+// getPermUser resolves the {userId} path parameter for a per-user override
+// request, writing the error response itself. Returns nil when a response has
+// already been written.
+func getPermUser(database *db.DB, w http.ResponseWriter, r *http.Request) *db.User {
+	userID, err := pathInt64(r, "userId")
+	if err != nil {
+		writeErr(w, http.StatusBadRequest, "BAD_REQUEST", "invalid user id")
+		return nil
+	}
+	user, err := database.GetUserByID(r.Context(), userID)
+	if err != nil {
+		writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "failed to fetch user")
+		return nil
+	}
+	if user == nil {
+		writeErr(w, http.StatusNotFound, "NOT_FOUND", "user not found")
+		return nil
+	}
+	return user
+}
+
+// requireManageableUser refuses a per-user channel override that targets a
+// member whose role sits at or above the actor's own rank, mirroring the
+// hierarchy guard the role-layer handler applies (handlePutChannelPermission).
+// Without it a MANAGE_CHANNELS holder could deny a higher-ranked member access
+// to a channel via the per-user layer, which is last in the resolution order
+// and therefore beats that member's role allow. ADMINISTRATOR bypasses. Writes
+// the error response and returns false when the action must be refused.
+func requireManageableUser(database *db.DB, w http.ResponseWriter, r *http.Request, target *db.User, actorRole *db.Role) bool {
+	if permissions.HasAdmin(actorRole.Permissions) {
+		return true
+	}
+	targetRole, err := database.GetRoleByID(r.Context(), target.RoleID)
+	if err != nil {
+		writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "failed to fetch target role")
+		return false
+	}
+	if targetRole != nil && targetRole.Position >= actorRole.Position {
+		writeErr(w, http.StatusForbidden, "FORBIDDEN", "cannot manage a user ranked at or above your own")
+		return false
+	}
+	return true
+}
+
+func handlePutChannelUserPermission(database *db.DB, hub HubBroadcaster, permInvalidator PermissionInvalidator) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ch := getPermChannel(database, w, r)
+		if ch == nil {
+			return
+		}
+		user := getPermUser(database, w, r)
+		if user == nil {
+			return
+		}
+
+		var req putChannelPermissionRequest
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			writeErr(w, http.StatusBadRequest, "BAD_REQUEST", "invalid request body")
+			return
+		}
+		// Drop unknown bits so garbage input cannot persist undefined perms.
+		allow := req.Allow & permissions.AllPerms
+		deny := req.Deny & permissions.AllPerms
+
+		actorRole := actorRoleFromContext(r)
+		if actorRole == nil {
+			writeErr(w, http.StatusUnauthorized, "UNAUTHORIZED", "not authenticated")
+			return
+		}
+		// Escalation guard: a MANAGE_CHANNELS holder without ADMINISTRATOR
+		// cannot grant bits their own role lacks via a per-user override.
+		if err := requireGrantableOverride(actorRole, allow, deny); err != nil {
+			writeErr(w, http.StatusForbidden, "FORBIDDEN", err.Error())
+			return
+		}
+		// Hierarchy guard: cannot override a member ranked at or above you.
+		if !requireManageableUser(database, w, r, user, actorRole) {
+			return
+		}
+
+		if err := database.UpsertChannelUserOverride(r.Context(), ch.ID, user.ID, allow, deny); err != nil {
+			writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "failed to save channel user permission")
+			return
+		}
+
+		actor := actorFromContext(r)
+		slog.Info("channel user permissions updated", "actor_id", actor, "channel_id", ch.ID,
+			"user_id", user.ID, "allow", allow, "deny", deny)
+		db.WriteAudit(context.WithoutCancel(r.Context()), database, actor, "channel_user_perms_update", "channel", ch.ID,
+			fmt.Sprintf("set overrides for user %s on #%s (allow=%#x deny=%#x)", user.Username, ch.Name, allow, deny))
+
+		// Invalidate BEFORE the hub call: RefreshChannelVisibility resolves the
+		// target's visibility through the same cache (see handlePutChannelPermission).
+		if permInvalidator != nil {
+			permInvalidator.InvalidateUser(user.ID)
+		}
+		if hub != nil {
+			hub.RefreshChannelVisibility(ch)
+		}
+		writeJSON(w, http.StatusOK, db.ChannelUserOverride{
+			UserID:   user.ID,
+			Username: user.Username,
+			RoleID:   user.RoleID,
+			Allow:    allow,
+			Deny:     deny,
+		})
+	}
+}
+
+func handleDeleteChannelUserPermission(database *db.DB, hub HubBroadcaster, permInvalidator PermissionInvalidator) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ch := getPermChannel(database, w, r)
+		if ch == nil {
+			return
+		}
+		user := getPermUser(database, w, r)
+		if user == nil {
+			return
+		}
+		actorRole := actorRoleFromContext(r)
+		if actorRole == nil {
+			writeErr(w, http.StatusUnauthorized, "UNAUTHORIZED", "not authenticated")
+			return
+		}
+		// Hierarchy guard: clearing a higher-ranked member's override is the
+		// same authority as writing one, so gate it identically.
+		if !requireManageableUser(database, w, r, user, actorRole) {
+			return
+		}
+
+		if err := database.DeleteChannelUserOverride(r.Context(), ch.ID, user.ID); err != nil {
+			writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "failed to delete channel user permission")
+			return
+		}
+
+		actor := actorFromContext(r)
+		slog.Info("channel user permissions cleared", "actor_id", actor, "channel_id", ch.ID, "user_id", user.ID)
+		db.WriteAudit(context.WithoutCancel(r.Context()), database, actor, "channel_user_perms_clear", "channel", ch.ID,
+			fmt.Sprintf("cleared overrides for user %s on #%s", user.Username, ch.Name))
+
+		if permInvalidator != nil {
+			permInvalidator.InvalidateUser(user.ID)
+		}
+		if hub != nil {
+			hub.RefreshChannelVisibility(ch)
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}
+}
diff --git a/Server/admin/handlers_channel_perms_test.go b/Server/admin/handlers_channel_perms_test.go
index 449ed264..8a36d41d 100644
--- a/Server/admin/handlers_channel_perms_test.go
+++ b/Server/admin/handlers_channel_perms_test.go
@@ -29,7 +29,7 @@ func (m *mockPermInvalidator) InvalidateAll() {
 
 func TestGetChannelPermissions_ReturnsAllRoles(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	chID, err := database.CreateChannel(context.Background(), "secret", "text", "", "", 0)
@@ -67,7 +67,7 @@ func TestGetChannelPermissions_ReturnsAllRoles(t *testing.T) {
 
 func TestGetChannelPermissions_NotFound(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodGet, "/channels/9999/permissions", token, nil)
@@ -78,7 +78,7 @@ func TestGetChannelPermissions_NotFound(t *testing.T) {
 
 func TestGetChannelPermissions_DMRejected(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	chID, err := database.CreateChannel(context.Background(), "dm-chan", "dm", "", "", 0)
@@ -99,7 +99,7 @@ func TestPutChannelPermission_PersistsAndPropagates(t *testing.T) {
 	database := openAdminTestDB(t)
 	hub := &mockHub{}
 	inv := &mockPermInvalidator{}
-	handler := admin.NewAdminAPI(database, "1.0.0", hub, nil, nil, nil, inv, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", hub, nil, nil, nil, inv, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	chID, err := database.CreateChannel(context.Background(), "secret", "text", "", "", 0)
@@ -147,7 +147,7 @@ func TestPutChannelPermission_PersistsAndPropagates(t *testing.T) {
 
 func TestPutChannelPermission_MasksUnknownBits(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	chID, err := database.CreateChannel(context.Background(), "secret2", "text", "", "", 0)
@@ -177,7 +177,7 @@ func TestPutChannelPermission_MasksUnknownBits(t *testing.T) {
 
 func TestPutChannelPermission_UnknownRole(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	chID, err := database.CreateChannel(context.Background(), "secret3", "text", "", "", 0)
@@ -194,7 +194,7 @@ func TestPutChannelPermission_UnknownRole(t *testing.T) {
 
 func TestPutChannelPermission_NonAdminForbidden(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	_ = createAdminUser(t, database)
 	memberToken := createMemberUser(t, database)
 
@@ -210,13 +210,104 @@ func TestPutChannelPermission_NonAdminForbidden(t *testing.T) {
 	}
 }
 
+// A MANAGE_CHANNELS holder without ADMINISTRATOR must not be able to grant a
+// permission bit their own role lacks (e.g. MANAGE_SERVER) by writing it into
+// a channel override — the escalation this override endpoint must refuse.
+func TestPutChannelPermission_ModeratorCannotEscalate(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
+	_, modToken := createRoleUser(t, database, 10, "Moderator", moderatorMask, 60, "moduser")
+
+	chID, err := database.CreateChannel(context.Background(), "escalate", "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+
+	// Target a role below the Moderator's own position (Member, position 40)
+	// so only the escalation guard, not the hierarchy guard, is exercised.
+	w := doRequest(t, handler, http.MethodPut,
+		"/channels/"+itoa(chID)+"/permissions/3", modToken,
+		map[string]any{"allow": permissions.ManageServer, "deny": 0})
+	if w.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403; body: %s", w.Code, w.Body.String())
+	}
+
+	allow, deny, err := database.GetChannelPermissions(context.Background(), chID, 3)
+	if err != nil {
+		t.Fatalf("GetChannelPermissions: %v", err)
+	}
+	if allow != 0 || deny != 0 {
+		t.Errorf("forbidden grant persisted: (%#x, %#x)", allow, deny)
+	}
+}
+
+// An ADMINISTRATOR-holding actor (e.g. Owner) can still grant any bit through
+// a channel override, since ADMINISTRATOR bypasses the escalation guard.
+func TestPutChannelPermission_AdministratorCanGrantAnyBit(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
+	token := createAdminUser(t, database)
+
+	chID, err := database.CreateChannel(context.Background(), "admin-grant", "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+
+	w := doRequest(t, handler, http.MethodPut,
+		"/channels/"+itoa(chID)+"/permissions/3", token,
+		map[string]any{"allow": permissions.ManageServer, "deny": 0})
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", w.Code, w.Body.String())
+	}
+
+	allow, _, err := database.GetChannelPermissions(context.Background(), chID, 3)
+	if err != nil {
+		t.Fatalf("GetChannelPermissions: %v", err)
+	}
+	if allow != permissions.ManageServer {
+		t.Errorf("allow = %#x, want %#x", allow, permissions.ManageServer)
+	}
+}
+
+// The role-layer endpoint must refuse to write an override for a role at or
+// above the actor's own position, even when the requested bits are within
+// the actor's own mask — mirroring service.requireBelowActor.
+func TestPutChannelPermission_RefusesEqualOrHigherRole(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
+	_, modToken := createRoleUser(t, database, 10, "Moderator", moderatorMask, 60, "moduser")
+
+	chID, err := database.CreateChannel(context.Background(), "hierarchy", "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+
+	cases := []struct {
+		name   string
+		roleID string
+	}{
+		{"higher role (Admin, position 80)", "2"},
+		{"own role (Moderator, position 60)", "10"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			w := doRequest(t, handler, http.MethodPut,
+				"/channels/"+itoa(chID)+"/permissions/"+tc.roleID, modToken,
+				map[string]any{"allow": permissions.ReadMessages, "deny": 0})
+			if w.Code != http.StatusForbidden {
+				t.Fatalf("status = %d, want 403; body: %s", w.Code, w.Body.String())
+			}
+		})
+	}
+}
+
 // ─── DELETE /channels/{id}/permissions/{roleId} ──────────────────────────────
 
 func TestDeleteChannelPermission_ClearsOverride(t *testing.T) {
 	database := openAdminTestDB(t)
 	hub := &mockHub{}
 	inv := &mockPermInvalidator{}
-	handler := admin.NewAdminAPI(database, "1.0.0", hub, nil, nil, nil, inv, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", hub, nil, nil, nil, inv, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	chID, err := database.CreateChannel(context.Background(), "secret5", "text", "", "", 0)
diff --git a/Server/admin/handlers_channel_user_perms_test.go b/Server/admin/handlers_channel_user_perms_test.go
new file mode 100644
index 00000000..94c4e2cc
--- /dev/null
+++ b/Server/admin/handlers_channel_user_perms_test.go
@@ -0,0 +1,384 @@
+package admin_test
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"testing"
+
+	"github.com/owncord/server/admin"
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/permissions"
+)
+
+// ─── PUT/DELETE /channels/{id}/user-permissions/{userId} ─────────────────────
+//
+// The per-user layer is gated on the same MANAGE_CHANNELS bit as the role
+// layer, but invalidates only the TARGET's cached permissions — a per-user
+// override cannot change anyone else's verdict.
+
+func seedOverrideTarget(t *testing.T, database *db.DB, username string) int64 {
+	t.Helper()
+	uid, err := database.CreateUser(context.Background(), username, "$2a$12$placeholder", 3)
+	if err != nil {
+		t.Fatalf("CreateUser %s: %v", username, err)
+	}
+	return uid
+}
+
+func TestPutChannelUserPermission_PersistsInvalidatesAndAudits(t *testing.T) {
+	database := openAdminTestDB(t)
+	hub := &mockHub{}
+	inv := &mockPermInvalidator{}
+	handler := admin.NewAdminAPI(database, "1.0.0", hub, nil, nil, nil, inv, newTestModService(database), newTestRoleService(database))
+	token := createAdminUser(t, database)
+	target := seedOverrideTarget(t, database, "override-target")
+
+	chID, err := database.CreateChannel(context.Background(), "secret", "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+
+	body := map[string]any{"allow": permissions.ReadMessages, "deny": permissions.SendMessages}
+	w := doRequest(t, handler, http.MethodPut,
+		"/channels/"+itoa(chID)+"/user-permissions/"+itoa(target), token, body)
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", w.Code, w.Body.String())
+	}
+
+	var resp db.ChannelUserOverride
+	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if resp.UserID != target || resp.Username != "override-target" {
+		t.Errorf("response = %+v, want user %d/override-target", resp, target)
+	}
+	if resp.Allow != permissions.ReadMessages || resp.Deny != permissions.SendMessages {
+		t.Errorf("response masks = (%#x, %#x)", resp.Allow, resp.Deny)
+	}
+
+	allow, deny, err := database.GetUserChannelPermissions(context.Background(), chID, target)
+	if err != nil {
+		t.Fatalf("GetUserChannelPermissions: %v", err)
+	}
+	if allow != permissions.ReadMessages || deny != permissions.SendMessages {
+		t.Errorf("persisted = (%#x, %#x)", allow, deny)
+	}
+
+	// Only the target's cache is dropped, and never the whole cache.
+	if len(inv.invalidateUserIDs) != 1 || inv.invalidateUserIDs[0] != target {
+		t.Errorf("InvalidateUser calls = %v, want [%d]", inv.invalidateUserIDs, target)
+	}
+	if inv.invalidateAllN != 0 {
+		t.Errorf("InvalidateAll calls = %d, want 0", inv.invalidateAllN)
+	}
+	if len(hub.visibilityRefreshes) != 1 || hub.visibilityRefreshes[0].ID != chID {
+		t.Errorf("RefreshChannelVisibility not called for channel %d", chID)
+	}
+
+	entries, err := database.GetAuditLog(context.Background(), 10, 0)
+	if err != nil {
+		t.Fatalf("GetAuditLog: %v", err)
+	}
+	found := false
+	for _, e := range entries {
+		if e.Action == "channel_user_perms_update" {
+			found = true
+		}
+	}
+	if !found {
+		t.Error("expected channel_user_perms_update audit entry")
+	}
+}
+
+// A round trip through the endpoint must preserve the exact masks the matrix
+// editor writes — one bit per row, in both directions at once.
+func TestPutChannelUserPermission_MaskRoundTrip(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
+	token := createAdminUser(t, database)
+	target := seedOverrideTarget(t, database, "matrix-target")
+
+	chID, err := database.CreateChannel(context.Background(), "matrix", "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+
+	allowMask := permissions.ReadMessages | permissions.AttachFiles | permissions.ConnectVoice | permissions.ShareScreen
+	denyMask := permissions.SendMessages | permissions.AddReactions | permissions.MentionEveryone | permissions.SpeakVoice
+
+	w := doRequest(t, handler, http.MethodPut,
+		"/channels/"+itoa(chID)+"/user-permissions/"+itoa(target), token,
+		map[string]any{"allow": allowMask, "deny": denyMask})
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", w.Code, w.Body.String())
+	}
+
+	get := doRequest(t, handler, http.MethodGet, "/channels/"+itoa(chID)+"/permissions", token, nil)
+	if get.Code != http.StatusOK {
+		t.Fatalf("GET status = %d; body: %s", get.Code, get.Body.String())
+	}
+	var listing struct {
+		Users []db.ChannelUserOverride `json:"users"`
+	}
+	if err := json.Unmarshal(get.Body.Bytes(), &listing); err != nil {
+		t.Fatalf("unmarshal listing: %v", err)
+	}
+	if len(listing.Users) != 1 {
+		t.Fatalf("users = %d, want 1", len(listing.Users))
+	}
+	if listing.Users[0].Allow != allowMask || listing.Users[0].Deny != denyMask {
+		t.Errorf("round trip = (%#x, %#x), want (%#x, %#x)",
+			listing.Users[0].Allow, listing.Users[0].Deny, allowMask, denyMask)
+	}
+}
+
+func TestPutChannelUserPermission_MasksUnknownBits(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
+	token := createAdminUser(t, database)
+	target := seedOverrideTarget(t, database, "junk-target")
+
+	chID, err := database.CreateChannel(context.Background(), "junk", "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+
+	// 0x8 is not a defined bit — it must be dropped, not persisted.
+	w := doRequest(t, handler, http.MethodPut,
+		"/channels/"+itoa(chID)+"/user-permissions/"+itoa(target), token,
+		map[string]any{"allow": permissions.ReadMessages | 0x8, "deny": 0})
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", w.Code, w.Body.String())
+	}
+	allow, _, err := database.GetUserChannelPermissions(context.Background(), chID, target)
+	if err != nil {
+		t.Fatalf("GetUserChannelPermissions: %v", err)
+	}
+	if allow != permissions.ReadMessages {
+		t.Errorf("allow = %#x, want %#x (unknown bits dropped)", allow, permissions.ReadMessages)
+	}
+}
+
+func TestPutChannelUserPermission_UnknownUser(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
+	token := createAdminUser(t, database)
+
+	chID, err := database.CreateChannel(context.Background(), "nope", "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+
+	w := doRequest(t, handler, http.MethodPut,
+		"/channels/"+itoa(chID)+"/user-permissions/9999", token, map[string]any{"allow": 0, "deny": 2})
+	if w.Code != http.StatusNotFound {
+		t.Errorf("status = %d, want 404; body: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestPutChannelUserPermission_DMRejected(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
+	token := createAdminUser(t, database)
+	target := seedOverrideTarget(t, database, "dm-target")
+
+	chID, err := database.CreateChannel(context.Background(), "dm-1-2", "dm", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+
+	w := doRequest(t, handler, http.MethodPut,
+		"/channels/"+itoa(chID)+"/user-permissions/"+itoa(target), token, map[string]any{"allow": 0, "deny": 2})
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("status = %d, want 400; body: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestChannelUserPermission_NonAdminForbidden(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
+	_ = createAdminUser(t, database)
+	memberToken := createMemberUser(t, database)
+	target := seedOverrideTarget(t, database, "forbidden-target")
+
+	chID, err := database.CreateChannel(context.Background(), "gated", "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+
+	for _, method := range []string{http.MethodPut, http.MethodDelete} {
+		w := doRequest(t, handler, method,
+			"/channels/"+itoa(chID)+"/user-permissions/"+itoa(target), memberToken,
+			map[string]any{"allow": 0, "deny": 2})
+		if w.Code != http.StatusForbidden && w.Code != http.StatusUnauthorized {
+			t.Errorf("%s status = %d, want 403/401; body: %s", method, w.Code, w.Body.String())
+		}
+	}
+
+	// The refusal must not have written anything.
+	allow, deny, err := database.GetUserChannelPermissions(context.Background(), chID, target)
+	if err != nil {
+		t.Fatalf("GetUserChannelPermissions: %v", err)
+	}
+	if allow != 0 || deny != 0 {
+		t.Errorf("forbidden request persisted (%#x, %#x)", allow, deny)
+	}
+}
+
+// A MANAGE_CHANNELS holder without ADMINISTRATOR must not be able to grant a
+// permission bit their own role lacks (e.g. MANAGE_SERVER) to a member by
+// writing it into a per-user channel override.
+func TestPutChannelUserPermission_ModeratorCannotEscalate(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
+	_, modToken := createRoleUser(t, database, 10, "Moderator", moderatorMask, 60, "moduser")
+	target := seedOverrideTarget(t, database, "escalate-target")
+
+	chID, err := database.CreateChannel(context.Background(), "escalate", "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+
+	w := doRequest(t, handler, http.MethodPut,
+		"/channels/"+itoa(chID)+"/user-permissions/"+itoa(target), modToken,
+		map[string]any{"allow": permissions.ManageServer, "deny": 0})
+	if w.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403; body: %s", w.Code, w.Body.String())
+	}
+
+	allow, deny, err := database.GetUserChannelPermissions(context.Background(), chID, target)
+	if err != nil {
+		t.Fatalf("GetUserChannelPermissions: %v", err)
+	}
+	if allow != 0 || deny != 0 {
+		t.Errorf("forbidden grant persisted: (%#x, %#x)", allow, deny)
+	}
+}
+
+// A non-admin MANAGE_CHANNELS holder cannot write (or clear) a per-user
+// override against a member whose role outranks their own, even for a bit they
+// legitimately hold — the per-user layer is last in the resolution order, so
+// without this guard a Moderator could deny a higher-ranked member channel
+// access their role grants.
+func TestPutChannelUserPermission_CannotTargetHigherRankedUser(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
+	// Actor: Moderator at position 60 holding MANAGE_CHANNELS + READ_MESSAGES.
+	_, modToken := createRoleUser(t, database, 10, "Moderator", moderatorMask, 60, "mod-hier")
+	// Target holds a role ranked ABOVE the actor.
+	seniorID, _ := createRoleUser(t, database, 11, "Senior", permissions.ReadMessages, 80, "senior-hier")
+
+	chID, err := database.CreateChannel(context.Background(), "hier", "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+
+	// deny READ_MESSAGES — a bit the Moderator holds, so the escalation guard
+	// passes and only the hierarchy guard can stop this.
+	put := doRequest(t, handler, http.MethodPut,
+		"/channels/"+itoa(chID)+"/user-permissions/"+itoa(seniorID), modToken,
+		map[string]any{"allow": 0, "deny": permissions.ReadMessages})
+	if put.Code != http.StatusForbidden {
+		t.Fatalf("PUT status = %d, want 403; body: %s", put.Code, put.Body.String())
+	}
+	del := doRequest(t, handler, http.MethodDelete,
+		"/channels/"+itoa(chID)+"/user-permissions/"+itoa(seniorID), modToken, nil)
+	if del.Code != http.StatusForbidden {
+		t.Fatalf("DELETE status = %d, want 403; body: %s", del.Code, del.Body.String())
+	}
+	allow, deny, err := database.GetUserChannelPermissions(context.Background(), chID, seniorID)
+	if err != nil {
+		t.Fatalf("GetUserChannelPermissions: %v", err)
+	}
+	if allow != 0 || deny != 0 {
+		t.Errorf("override persisted despite hierarchy guard: (%#x, %#x)", allow, deny)
+	}
+}
+
+// An ADMINISTRATOR-holding actor can still grant any bit through a per-user
+// override, since ADMINISTRATOR bypasses the escalation guard.
+func TestPutChannelUserPermission_AdministratorCanGrantAnyBit(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
+	token := createAdminUser(t, database)
+	target := seedOverrideTarget(t, database, "admin-grant-target")
+
+	chID, err := database.CreateChannel(context.Background(), "admin-grant", "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+
+	w := doRequest(t, handler, http.MethodPut,
+		"/channels/"+itoa(chID)+"/user-permissions/"+itoa(target), token,
+		map[string]any{"allow": permissions.ManageServer, "deny": 0})
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", w.Code, w.Body.String())
+	}
+
+	allow, _, err := database.GetUserChannelPermissions(context.Background(), chID, target)
+	if err != nil {
+		t.Fatalf("GetUserChannelPermissions: %v", err)
+	}
+	if allow != permissions.ManageServer {
+		t.Errorf("allow = %#x, want %#x", allow, permissions.ManageServer)
+	}
+}
+
+func TestDeleteChannelUserPermission_ClearsOverride(t *testing.T) {
+	database := openAdminTestDB(t)
+	hub := &mockHub{}
+	inv := &mockPermInvalidator{}
+	handler := admin.NewAdminAPI(database, "1.0.0", hub, nil, nil, nil, inv, newTestModService(database), newTestRoleService(database))
+	token := createAdminUser(t, database)
+	target := seedOverrideTarget(t, database, "clear-target")
+
+	chID, err := database.CreateChannel(context.Background(), "clearme", "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+	if err := database.UpsertChannelUserOverride(context.Background(), chID, target, 0, permissions.ReadMessages); err != nil {
+		t.Fatalf("UpsertChannelUserOverride: %v", err)
+	}
+
+	w := doRequest(t, handler, http.MethodDelete,
+		"/channels/"+itoa(chID)+"/user-permissions/"+itoa(target), token, nil)
+	if w.Code != http.StatusNoContent {
+		t.Fatalf("status = %d, want 204; body: %s", w.Code, w.Body.String())
+	}
+
+	allow, deny, err := database.GetUserChannelPermissions(context.Background(), chID, target)
+	if err != nil {
+		t.Fatalf("GetUserChannelPermissions: %v", err)
+	}
+	if allow != 0 || deny != 0 {
+		t.Errorf("override still present: (%#x, %#x)", allow, deny)
+	}
+	if len(inv.invalidateUserIDs) != 1 || inv.invalidateUserIDs[0] != target {
+		t.Errorf("InvalidateUser calls = %v, want [%d]", inv.invalidateUserIDs, target)
+	}
+	if len(hub.visibilityRefreshes) != 1 {
+		t.Errorf("RefreshChannelVisibility calls = %d, want 1", len(hub.visibilityRefreshes))
+	}
+
+	entries, err := database.GetAuditLog(context.Background(), 10, 0)
+	if err != nil {
+		t.Fatalf("GetAuditLog: %v", err)
+	}
+	found := false
+	for _, e := range entries {
+		if e.Action == "channel_user_perms_clear" {
+			found = true
+		}
+	}
+	if !found {
+		t.Error("expected channel_user_perms_clear audit entry")
+	}
+
+	// Deleting again is idempotent.
+	w = doRequest(t, handler, http.MethodDelete,
+		"/channels/"+itoa(chID)+"/user-permissions/"+itoa(target), token, nil)
+	if w.Code != http.StatusNoContent {
+		t.Errorf("second delete status = %d, want 204", w.Code)
+	}
+}
diff --git a/Server/admin/handlers_channels.go b/Server/admin/handlers_channels.go
index cf41b99b..428fdba0 100644
--- a/Server/admin/handlers_channels.go
+++ b/Server/admin/handlers_channels.go
@@ -12,51 +12,25 @@ import (
 	"github.com/owncord/server/db"
 )
 
-// ─── Category-Type Validation ────────────────────────────────────────────────
+// ─── Channel Type Validation ─────────────────────────────────────────────────
 
-// voiceCategoryNames is the set of canonical category names treated as voice
-// sections. Matching is case-insensitive but requires an exact name match
-// (not a substring) to prevent false positives like "Invoice Channels".
-var voiceCategoryNames = []string{
-	"Voice Channels",
-}
+// validChannelTypes is the set of channel types a create request may name.
+// A channel's CATEGORY deliberately constrains nothing: categories are free
+// text, and pinning "only voice channels live under a category whose name
+// matches 'Voice Channels'" made every other category name a second-class one —
+// a voice channel could not be created under "Gaming", and renaming the
+// category silently changed what could be created there. Grouping is a display
+// concern (the client groups by whatever category a channel carries), so the
+// server validates the type alone.
+var validChannelTypes = []string{"text", "voice", "announcement"}
 
-// isVoiceCategory returns true if the category name is an exact
-// (case-insensitive) match for a known voice category name.
-func isVoiceCategory(category string) bool {
-	for _, name := range voiceCategoryNames {
-		if strings.EqualFold(category, name) {
-			return true
-		}
-	}
-	return false
-}
-
-// allowedChannelTypes returns the set of channel types valid for a category.
-func allowedChannelTypes(category string) []string {
-	if category == "" {
-		return []string{"text", "voice", "announcement"}
-	}
-	if isVoiceCategory(category) {
-		return []string{"voice"}
-	}
-	return []string{"text", "announcement"}
-}
-
-// validateCategoryType checks that the channel type is allowed under the given
-// category. Returns an error message if invalid, or empty string if OK.
-func validateCategoryType(channelType, category string) string {
-	if category == "" {
+// validateChannelType returns an error message when the type is not one of the
+// three real channel types, or an empty string when it is.
+func validateChannelType(channelType string) string {
+	if slices.Contains(validChannelTypes, channelType) {
 		return ""
 	}
-	allowed := allowedChannelTypes(category)
-	if slices.Contains(allowed, channelType) {
-		return ""
-	}
-	if isVoiceCategory(category) {
-		return "only voice channels can be created under a voice category"
-	}
-	return "voice channels can only be created under a voice category"
+	return "type must be one of text, voice, announcement"
 }
 
 // ─── Channel Handlers ────────────────────────────────────────────────────────
@@ -97,7 +71,7 @@ func handleCreateChannel(database *db.DB, hub HubBroadcaster) http.HandlerFunc {
 			req.Type = "text"
 		}
 
-		if msg := validateCategoryType(req.Type, req.Category); msg != "" {
+		if msg := validateChannelType(req.Type); msg != "" {
 			writeErr(w, http.StatusBadRequest, "INVALID_INPUT", msg)
 			return
 		}
@@ -124,13 +98,62 @@ func handleCreateChannel(database *db.DB, hub HubBroadcaster) http.HandlerFunc {
 	}
 }
 
+// Bounds for the numeric channel settings a PATCH may set.
+//
+// They are validated here rather than left to the database because SQLite
+// would happily store a slow mode of six years or a user limit of -3, and the
+// only place that would surface is a client rendering nonsense. The values
+// match what the clients offer: Discord's 6-hour slow-mode ceiling, and a
+// two-digit voice capacity (0 = unlimited in both voice cases).
+const (
+	maxSlowModeSeconds = 21600
+	maxVoiceLimit      = 99
+)
+
 // updateChannelRequest is the JSON body for PATCH /admin/api/channels/{id}.
 type updateChannelRequest struct {
 	Name     string `json:"name"`
 	Topic    string `json:"topic"`
+	Category string `json:"category"`
 	SlowMode int    `json:"slow_mode"`
 	Position int    `json:"position"`
 	Archived bool   `json:"archived"`
+	// NSFW is stored, broadcast and audited; it changes no server-side content
+	// behaviour (see migration 025). Clients decide how to present it.
+	NSFW bool `json:"nsfw"`
+	// Voice capacity limits, enforced on voice join by the ws layer.
+	// 0 = unlimited.
+	VoiceMaxUsers int `json:"voice_max_users"`
+	VoiceMaxVideo int `json:"voice_max_video"`
+}
+
+// validate reports the first out-of-range numeric field, or "" when the
+// request is acceptable. Negative values are rejected rather than clamped: a
+// caller sending -1 meant something, and silently storing 0 would hide it.
+func (r updateChannelRequest) validate() string {
+	switch {
+	case r.SlowMode < 0 || r.SlowMode > maxSlowModeSeconds:
+		return fmt.Sprintf("slow_mode must be between 0 and %d seconds", maxSlowModeSeconds)
+	case r.VoiceMaxUsers < 0 || r.VoiceMaxUsers > maxVoiceLimit:
+		return fmt.Sprintf("voice_max_users must be between 0 and %d", maxVoiceLimit)
+	case r.VoiceMaxVideo < 0 || r.VoiceMaxVideo > maxVoiceLimit:
+		return fmt.Sprintf("voice_max_video must be between 0 and %d", maxVoiceLimit)
+	}
+	return ""
+}
+
+// nsfwAuditSuffix names an NSFW transition in the audit detail, or returns ""
+// when the flag did not move. An age-gate flag flipping is the one part of a
+// channel edit an operator may need to answer for later, and "updated #foo"
+// alone would not record it.
+func nsfwAuditSuffix(before, after bool) string {
+	if before == after {
+		return ""
+	}
+	if after {
+		return " (marked NSFW)"
+	}
+	return " (unmarked NSFW)"
 }
 
 func handlePatchChannel(database *db.DB, hub HubBroadcaster) http.HandlerFunc {
@@ -153,26 +176,45 @@ func handlePatchChannel(database *db.DB, hub HubBroadcaster) http.HandlerFunc {
 
 		// Start from existing values so a partial body is safe.
 		req := updateChannelRequest{
-			Name:     existing.Name,
-			Topic:    existing.Topic,
-			SlowMode: existing.SlowMode,
-			Position: existing.Position,
-			Archived: existing.Archived,
+			Name:          existing.Name,
+			Topic:         existing.Topic,
+			Category:      existing.Category,
+			SlowMode:      existing.SlowMode,
+			Position:      existing.Position,
+			Archived:      existing.Archived,
+			NSFW:          existing.NSFW,
+			VoiceMaxUsers: existing.VoiceMaxUsers,
+			VoiceMaxVideo: existing.VoiceMaxVideo,
 		}
 		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 			writeErr(w, http.StatusBadRequest, "BAD_REQUEST", "invalid request body")
 			return
 		}
 
-		if err := database.AdminUpdateChannel(r.Context(), id, req.Name, req.Topic, req.SlowMode, req.Position, req.Archived); err != nil {
+		if msg := req.validate(); msg != "" {
+			writeErr(w, http.StatusBadRequest, "INVALID_INPUT", msg)
+			return
+		}
+
+		if err := database.AdminUpdateChannel(r.Context(), id, db.ChannelUpdate{
+			Name:          req.Name,
+			Topic:         req.Topic,
+			Category:      strings.TrimSpace(req.Category),
+			SlowMode:      req.SlowMode,
+			Position:      req.Position,
+			Archived:      req.Archived,
+			NSFW:          req.NSFW,
+			VoiceMaxUsers: req.VoiceMaxUsers,
+			VoiceMaxVideo: req.VoiceMaxVideo,
+		}); err != nil {
 			writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "failed to update channel")
 			return
 		}
 
 		actor := actorFromContext(r)
-		slog.Info("channel updated", "actor_id", actor, "channel_id", id, "name", req.Name)
+		slog.Info("channel updated", "actor_id", actor, "channel_id", id, "name", req.Name, "nsfw", req.NSFW)
 		db.WriteAudit(context.WithoutCancel(r.Context()), database, actor, "channel_update", "channel", id,
-			fmt.Sprintf("updated #%s", req.Name))
+			fmt.Sprintf("updated #%s%s", req.Name, nsfwAuditSuffix(existing.NSFW, req.NSFW)))
 
 		updated, err := database.GetChannel(r.Context(), id)
 		if err != nil || updated == nil {
@@ -181,6 +223,12 @@ func handlePatchChannel(database *db.DB, hub HubBroadcaster) http.HandlerFunc {
 		}
 		if hub != nil {
 			hub.BroadcastChannelUpdate(updated)
+			// Archiving/unarchiving changes who sees the channel, not just its
+			// metadata — send targeted channel_create/channel_delete so
+			// connected clients re-sync without a reconnect.
+			if existing.Archived != updated.Archived {
+				hub.RefreshChannelVisibility(updated)
+			}
 		}
 		writeJSON(w, http.StatusOK, updated)
 	}
diff --git a/Server/admin/handlers_channels_test.go b/Server/admin/handlers_channels_test.go
index e8d2c05f..dd461851 100644
--- a/Server/admin/handlers_channels_test.go
+++ b/Server/admin/handlers_channels_test.go
@@ -2,77 +2,72 @@ package admin_test
 
 import (
 	"encoding/json"
+	"fmt"
 	"net/http"
+	"strings"
 	"testing"
 
 	"github.com/owncord/server/admin"
+	"github.com/owncord/server/db"
 )
 
-// ─── Category-Type Validation (via POST /channels) ──────────────────────────
+// ─── Channel-type validation (via POST /channels) ───────────────────────────
+//
+// Categories used to constrain the type: a voice channel could only be created
+// under a category literally named "Voice Channels". That rule is gone —
+// categories are free text and grouping is a display concern — so the tests
+// below assert the inverse: EVERY type is creatable under ANY category, and the
+// only thing a create request can get wrong is the type itself.
 
-func TestCreateChannel_TextUnderTextCategory_OK(t *testing.T) {
+func newChannelTestAPI(t *testing.T) (http.Handler, string, *db.DB) {
+	t.Helper()
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
-	token := createAdminUser(t, database)
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
+	return handler, createAdminUser(t, database), database
+}
 
-	body := map[string]any{
-		"name":     "general",
-		"type":     "text",
-		"category": "Chat",
+func TestCreateChannel_AnyTypeUnderAnyCategory(t *testing.T) {
+	cases := []struct {
+		name     string
+		chType   string
+		category string
+	}{
+		{"text under a text-sounding category", "text", "Chat"},
+		{"announcement under a text-sounding category", "announcement", "Text Channels"},
+		{"voice under the legacy voice category", "voice", "Voice Channels"},
+		{"voice under an arbitrary category", "voice", "Gaming"},
+		{"text under the legacy voice category", "text", "Voice Channels"},
+		{"text under an uppercase voice-sounding category", "text", "VOICE CHANNELS"},
+		{"voice with no category at all", "voice", ""},
 	}
-	w := doRequest(t, handler, http.MethodPost, "/channels", token, body)
-	if w.Code != http.StatusCreated {
-		t.Errorf("text channel under Chat: status = %d, want 201; body: %s", w.Code, w.Body.String())
+	for i, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			handler, token, _ := newChannelTestAPI(t)
+			body := map[string]any{
+				"name":     "ch" + string(rune('a'+i)),
+				"type":     tc.chType,
+				"category": tc.category,
+			}
+			w := doRequest(t, handler, http.MethodPost, "/channels", token, body)
+			if w.Code != http.StatusCreated {
+				t.Errorf("status = %d, want 201; body: %s", w.Code, w.Body.String())
+			}
+		})
 	}
 }
 
-func TestCreateChannel_AnnouncementUnderTextCategory_OK(t *testing.T) {
-	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
-	token := createAdminUser(t, database)
+func TestCreateChannel_UnknownTypeRejected(t *testing.T) {
+	handler, token, _ := newChannelTestAPI(t)
 
 	body := map[string]any{
-		"name":     "announcements",
-		"type":     "announcement",
-		"category": "Text Channels",
-	}
-	w := doRequest(t, handler, http.MethodPost, "/channels", token, body)
-	if w.Code != http.StatusCreated {
-		t.Errorf("announcement under Text Channels: status = %d, want 201; body: %s", w.Code, w.Body.String())
-	}
-}
-
-func TestCreateChannel_VoiceUnderVoiceCategory_OK(t *testing.T) {
-	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
-	token := createAdminUser(t, database)
-
-	body := map[string]any{
-		"name":     "lounge",
-		"type":     "voice",
-		"category": "Voice Channels",
-	}
-	w := doRequest(t, handler, http.MethodPost, "/channels", token, body)
-	if w.Code != http.StatusCreated {
-		t.Errorf("voice under Voice Channels: status = %d, want 201; body: %s", w.Code, w.Body.String())
-	}
-}
-
-func TestCreateChannel_VoiceUnderTextCategory_Rejected(t *testing.T) {
-	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
-	token := createAdminUser(t, database)
-
-	body := map[string]any{
-		"name":     "bad-voice",
-		"type":     "voice",
+		"name":     "weird",
+		"type":     "forum",
 		"category": "Chat",
 	}
 	w := doRequest(t, handler, http.MethodPost, "/channels", token, body)
 	if w.Code != http.StatusBadRequest {
-		t.Errorf("voice under Chat: status = %d, want 400; body: %s", w.Code, w.Body.String())
+		t.Fatalf("status = %d, want 400; body: %s", w.Code, w.Body.String())
 	}
-
 	var resp map[string]string
 	if err := json.Unmarshal(w.Body.Bytes(), &resp); err == nil {
 		if resp["error"] != "INVALID_INPUT" {
@@ -81,62 +76,305 @@ func TestCreateChannel_VoiceUnderTextCategory_Rejected(t *testing.T) {
 	}
 }
 
-func TestCreateChannel_TextUnderVoiceCategory_Rejected(t *testing.T) {
-	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
-	token := createAdminUser(t, database)
+// PATCH now accepts category, so a channel can be moved between categories
+// without being recreated. An omitted category must keep the existing one —
+// the handler seeds the request struct from the current row.
+func TestPatchChannel_MovesCategory(t *testing.T) {
+	handler, token, _ := newChannelTestAPI(t)
 
-	body := map[string]any{
-		"name":     "bad-text",
-		"type":     "text",
-		"category": "Voice Channels",
+	create := doRequest(t, handler, http.MethodPost, "/channels", token, map[string]any{
+		"name": "lounge", "type": "voice", "category": "Gaming",
+	})
+	if create.Code != http.StatusCreated {
+		t.Fatalf("create: status = %d; body: %s", create.Code, create.Body.String())
 	}
-	w := doRequest(t, handler, http.MethodPost, "/channels", token, body)
+	var created struct {
+		ID int64 `json:"id"`
+	}
+	if err := json.Unmarshal(create.Body.Bytes(), &created); err != nil {
+		t.Fatalf("unmarshal created: %v", err)
+	}
+
+	path := fmt.Sprintf("/channels/%d", created.ID)
+	moved := doRequest(t, handler, http.MethodPatch, path, token, map[string]any{
+		"name": "lounge", "category": "Hangout",
+	})
+	if moved.Code != http.StatusOK {
+		t.Fatalf("patch: status = %d; body: %s", moved.Code, moved.Body.String())
+	}
+	var afterMove struct {
+		Category string `json:"category"`
+	}
+	if err := json.Unmarshal(moved.Body.Bytes(), &afterMove); err != nil {
+		t.Fatalf("unmarshal moved: %v", err)
+	}
+	if afterMove.Category != "Hangout" {
+		t.Errorf("category = %q, want Hangout", afterMove.Category)
+	}
+
+	// A body without "category" must not blank it out.
+	kept := doRequest(t, handler, http.MethodPatch, path, token, map[string]any{
+		"name": "lounge-2",
+	})
+	if kept.Code != http.StatusOK {
+		t.Fatalf("patch without category: status = %d; body: %s", kept.Code, kept.Body.String())
+	}
+	var afterKeep struct {
+		Category string `json:"category"`
+	}
+	if err := json.Unmarshal(kept.Body.Bytes(), &afterKeep); err != nil {
+		t.Fatalf("unmarshal kept: %v", err)
+	}
+	if afterKeep.Category != "Hangout" {
+		t.Errorf("category after omitted patch = %q, want Hangout", afterKeep.Category)
+	}
+}
+
+// ─── Channel feature flags: nsfw + voice capacity limits ─────────────────────
+//
+// The three fields ride on the same PATCH as name/topic/category, so the tests
+// below cover the three things that can go wrong with a field bolted onto a
+// partial-body handler: it must round-trip, an omitted field must not clobber
+// the stored value, and an out-of-range value must be refused rather than
+// stored.
+
+// newChannel creates a channel through the API and returns its id.
+func newChannel(t *testing.T, handler http.Handler, token, name, chType string) int64 {
+	t.Helper()
+	w := doRequest(t, handler, http.MethodPost, "/channels", token, map[string]any{
+		"name": name, "type": chType,
+	})
+	if w.Code != http.StatusCreated {
+		t.Fatalf("create %s: status = %d; body: %s", name, w.Code, w.Body.String())
+	}
+	var created struct {
+		ID int64 `json:"id"`
+	}
+	if err := json.Unmarshal(w.Body.Bytes(), &created); err != nil {
+		t.Fatalf("unmarshal created: %v", err)
+	}
+	return created.ID
+}
+
+// channelFlags is the slice of the channel JSON these tests assert on.
+type channelFlags struct {
+	NSFW          bool `json:"nsfw"`
+	SlowMode      int  `json:"slow_mode"`
+	VoiceMaxUsers int  `json:"voice_max_users"`
+	VoiceMaxVideo int  `json:"voice_max_video"`
+}
+
+func patchChannelFlags(t *testing.T, handler http.Handler, token string, id int64, body map[string]any) channelFlags {
+	t.Helper()
+	w := doRequest(t, handler, http.MethodPatch, fmt.Sprintf("/channels/%d", id), token, body)
+	if w.Code != http.StatusOK {
+		t.Fatalf("patch: status = %d; body: %s", w.Code, w.Body.String())
+	}
+	var got channelFlags
+	if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
+		t.Fatalf("unmarshal patched: %v", err)
+	}
+	return got
+}
+
+func TestPatchChannel_SetsFeatureFlags(t *testing.T) {
+	handler, token, _ := newChannelTestAPI(t)
+	id := newChannel(t, handler, token, "lounge", "voice")
+
+	got := patchChannelFlags(t, handler, token, id, map[string]any{
+		"nsfw":            true,
+		"slow_mode":       30,
+		"voice_max_users": 5,
+		"voice_max_video": 2,
+	})
+	want := channelFlags{NSFW: true, SlowMode: 30, VoiceMaxUsers: 5, VoiceMaxVideo: 2}
+	if got != want {
+		t.Errorf("flags after patch = %+v, want %+v", got, want)
+	}
+}
+
+// An omitted field keeps its stored value — the handler seeds the request
+// struct from the current row, which is the only thing that makes a partial
+// PATCH body (the one every client sends) non-destructive.
+func TestPatchChannel_OmittedFlagsPreserved(t *testing.T) {
+	handler, token, _ := newChannelTestAPI(t)
+	id := newChannel(t, handler, token, "lounge", "voice")
+
+	patchChannelFlags(t, handler, token, id, map[string]any{
+		"nsfw": true, "slow_mode": 15, "voice_max_users": 8, "voice_max_video": 3,
+	})
+
+	// A rename touches nothing else.
+	got := patchChannelFlags(t, handler, token, id, map[string]any{"name": "lounge-2"})
+	want := channelFlags{NSFW: true, SlowMode: 15, VoiceMaxUsers: 8, VoiceMaxVideo: 3}
+	if got != want {
+		t.Errorf("flags after rename = %+v, want %+v (unchanged)", got, want)
+	}
+}
+
+func TestPatchChannel_ClearsNSFW(t *testing.T) {
+	handler, token, _ := newChannelTestAPI(t)
+	id := newChannel(t, handler, token, "spicy", "text")
+
+	patchChannelFlags(t, handler, token, id, map[string]any{"nsfw": true})
+	if got := patchChannelFlags(t, handler, token, id, map[string]any{"nsfw": false}); got.NSFW {
+		t.Error("nsfw = true after clearing, want false")
+	}
+}
+
+func TestPatchChannel_RejectsOutOfRangeValues(t *testing.T) {
+	cases := []struct {
+		name string
+		body map[string]any
+	}{
+		{"slow mode above the 6-hour ceiling", map[string]any{"slow_mode": 21601}},
+		{"negative slow mode", map[string]any{"slow_mode": -1}},
+		{"user limit above 99", map[string]any{"voice_max_users": 100}},
+		{"negative user limit", map[string]any{"voice_max_users": -1}},
+		{"video limit above 99", map[string]any{"voice_max_video": 100}},
+		{"negative video limit", map[string]any{"voice_max_video": -5}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			handler, token, _ := newChannelTestAPI(t)
+			id := newChannel(t, handler, token, "lounge", "voice")
+
+			w := doRequest(t, handler, http.MethodPatch, fmt.Sprintf("/channels/%d", id), token, tc.body)
+			if w.Code != http.StatusBadRequest {
+				t.Fatalf("status = %d, want 400; body: %s", w.Code, w.Body.String())
+			}
+			var resp map[string]string
+			if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
+				t.Fatalf("unmarshal error body: %v", err)
+			}
+			if resp["error"] != "INVALID_INPUT" {
+				t.Errorf("error code = %q, want INVALID_INPUT", resp["error"])
+			}
+		})
+	}
+}
+
+// The boundary values themselves are legal — an off-by-one in validate() that
+// refused 21600 or 99 would silently cap what the clients offer.
+func TestPatchChannel_AcceptsBoundaryValues(t *testing.T) {
+	handler, token, _ := newChannelTestAPI(t)
+	id := newChannel(t, handler, token, "lounge", "voice")
+
+	got := patchChannelFlags(t, handler, token, id, map[string]any{
+		"slow_mode": 21600, "voice_max_users": 99, "voice_max_video": 99,
+	})
+	want := channelFlags{SlowMode: 21600, VoiceMaxUsers: 99, VoiceMaxVideo: 99}
+	if got != want {
+		t.Errorf("flags = %+v, want %+v", got, want)
+	}
+}
+
+// A refused patch must not have written anything — validation runs before the
+// update, so a rejected body cannot half-apply the fields that were in range.
+func TestPatchChannel_RejectedPatchWritesNothing(t *testing.T) {
+	handler, token, _ := newChannelTestAPI(t)
+	id := newChannel(t, handler, token, "lounge", "voice")
+
+	w := doRequest(t, handler, http.MethodPatch, fmt.Sprintf("/channels/%d", id), token, map[string]any{
+		"name": "renamed", "nsfw": true, "voice_max_users": 500,
+	})
 	if w.Code != http.StatusBadRequest {
-		t.Errorf("text under Voice Channels: status = %d, want 400; body: %s", w.Code, w.Body.String())
+		t.Fatalf("status = %d, want 400; body: %s", w.Code, w.Body.String())
 	}
+
+	list := doRequest(t, handler, http.MethodGet, "/channels", token, nil)
+	var channels []struct {
+		ID   int64  `json:"id"`
+		Name string `json:"name"`
+		NSFW bool   `json:"nsfw"`
+	}
+	if err := json.Unmarshal(list.Body.Bytes(), &channels); err != nil {
+		t.Fatalf("unmarshal channels: %v", err)
+	}
+	for _, ch := range channels {
+		if ch.ID != id {
+			continue
+		}
+		if ch.Name != "lounge" || ch.NSFW {
+			t.Errorf("channel after refused patch = {name:%q nsfw:%v}, want {lounge false}", ch.Name, ch.NSFW)
+		}
+		return
+	}
+	t.Fatalf("channel %d missing from the list", id)
 }
 
-func TestCreateChannel_EmptyCategory_Allowed(t *testing.T) {
+// The broadcast must carry the new fields, not just the stored row: the
+// desktop client updates its channel store from channel_update alone and would
+// otherwise show a stale gate until the next reconnect.
+func TestPatchChannel_BroadcastCarriesFeatureFlags(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	hub := &mockHub{}
+	handler := admin.NewAdminAPI(database, "1.0.0", hub, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
-	body := map[string]any{
-		"name":     "uncategorized",
-		"type":     "voice",
-		"category": "",
+	id := newChannel(t, handler, token, "lounge", "voice")
+	patchChannelFlags(t, handler, token, id, map[string]any{
+		"nsfw": true, "voice_max_users": 4, "voice_max_video": 1,
+	})
+
+	if len(hub.channelUpdates) == 0 {
+		t.Fatal("no channel_update broadcast")
 	}
-	w := doRequest(t, handler, http.MethodPost, "/channels", token, body)
-	if w.Code != http.StatusCreated {
-		t.Errorf("voice with empty category: status = %d, want 201; body: %s", w.Code, w.Body.String())
+	got := hub.channelUpdates[len(hub.channelUpdates)-1]
+	if !got.NSFW {
+		t.Error("broadcast NSFW = false, want true")
+	}
+	if got.VoiceMaxUsers != 4 || got.VoiceMaxVideo != 1 {
+		t.Errorf("broadcast voice limits = %d/%d, want 4/1", got.VoiceMaxUsers, got.VoiceMaxVideo)
 	}
 }
 
-func TestCreateChannel_CaseInsensitiveVoiceCategory(t *testing.T) {
-	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
-	token := createAdminUser(t, database)
+// Flipping the flag is the one part of a channel edit an operator may need to
+// answer for later, so the audit detail names the transition.
+func TestPatchChannel_AuditsNSFWTransition(t *testing.T) {
+	handler, token, database := newChannelTestAPI(t)
+	id := newChannel(t, handler, token, "spicy", "text")
 
-	// "VOICE" in uppercase should still be treated as a voice category
-	body := map[string]any{
-		"name":     "vc",
-		"type":     "voice",
-		"category": "VOICE CHANNELS",
-	}
-	w := doRequest(t, handler, http.MethodPost, "/channels", token, body)
-	if w.Code != http.StatusCreated {
-		t.Errorf("voice under VOICE CHANNELS: status = %d, want 201; body: %s", w.Code, w.Body.String())
-	}
+	patchChannelFlags(t, handler, token, id, map[string]any{"nsfw": true})
+	patchChannelFlags(t, handler, token, id, map[string]any{"nsfw": false})
+	// A patch that leaves the flag alone must not claim a transition.
+	patchChannelFlags(t, handler, token, id, map[string]any{"name": "spicy-2"})
 
-	// Text under uppercase VOICE should be rejected
-	body2 := map[string]any{
-		"name":     "bad",
-		"type":     "text",
-		"category": "VOICE CHANNELS",
+	entries, err := database.GetAuditLog(t.Context(), 50, 0)
+	if err != nil {
+		t.Fatalf("GetAuditLog: %v", err)
 	}
-	w2 := doRequest(t, handler, http.MethodPost, "/channels", token, body2)
-	if w2.Code != http.StatusBadRequest {
-		t.Errorf("text under VOICE CHANNELS: status = %d, want 400; body: %s", w2.Code, w2.Body.String())
+	var marked, unmarked, plain int
+	for _, e := range entries {
+		if e.Action != "channel_update" {
+			continue
+		}
+		switch {
+		case strings.Contains(e.Detail, "(marked NSFW)"):
+			marked++
+		case strings.Contains(e.Detail, "(unmarked NSFW)"):
+			unmarked++
+		default:
+			plain++
+		}
+	}
+	if marked != 1 || unmarked != 1 || plain != 1 {
+		t.Errorf("audit details: marked=%d unmarked=%d plain=%d, want 1/1/1", marked, unmarked, plain)
+	}
+}
+
+// MANAGE_CHANNELS gates the whole channel surface; a member without it cannot
+// set the flags either. The desktop client hides the controls on the same bit,
+// but the server is the authority.
+func TestPatchChannel_FeatureFlagsRequireManageChannels(t *testing.T) {
+	handler, adminToken, database := newChannelTestAPI(t)
+	id := newChannel(t, handler, adminToken, "lounge", "voice")
+
+	memberToken := createMemberUser(t, database)
+	w := doRequest(t, handler, http.MethodPatch, fmt.Sprintf("/channels/%d", id), memberToken, map[string]any{
+		"nsfw": true,
+	})
+	if w.Code != http.StatusForbidden {
+		t.Errorf("status = %d, want 403; body: %s", w.Code, w.Body.String())
 	}
 }
diff --git a/Server/admin/handlers_roles.go b/Server/admin/handlers_roles.go
new file mode 100644
index 00000000..9a206c0d
--- /dev/null
+++ b/Server/admin/handlers_roles.go
@@ -0,0 +1,245 @@
+package admin
+
+import (
+	"encoding/json"
+	"errors"
+	"log/slog"
+	"net/http"
+
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/service"
+)
+
+// ─── Role Handlers ───────────────────────────────────────────────────────────
+//
+// The whole group sits behind requirePerm(MANAGE_ROLES); RoleService re-checks
+// the bit and owns the hierarchy rules (manage only below your own position,
+// never grant a bit you lack, Owner/default undeletable), so these handlers
+// stay adapters: decode, call, invalidate, fan out.
+//
+// Fan-out after a mutation follows the two existing patterns exactly:
+//   - the permission cache is invalidated BEFORE the hub calls, as the
+//     channel-override handlers do, so the hub's per-client visibility lookups
+//     repopulate from post-change data;
+//   - visibility is re-synced with targeted channel_create/channel_delete
+//     (RefreshChannelVisibility), not a reconnect — a role's mask is the base
+//     for every channel, so the refresh covers all of them.
+
+// roleServiceUnavailable writes the fail-closed response used when the server
+// was constructed without a RoleService. Refusing beats falling back to an
+// unchecked UPDATE, mirroring the nil-ModerationService branches.
+func roleServiceUnavailable(w http.ResponseWriter) {
+	writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "role service unavailable")
+}
+
+// writeRoleErr maps RoleService errors onto admin API responses. Separate from
+// writeModerationErr only because NOT_FOUND means "role", not "user".
+func writeRoleErr(w http.ResponseWriter, err error) {
+	switch {
+	case errors.Is(err, service.ErrForbidden):
+		writeErr(w, http.StatusForbidden, "FORBIDDEN", err.Error())
+	case errors.Is(err, service.ErrNotFound):
+		writeErr(w, http.StatusNotFound, "NOT_FOUND", "role not found")
+	case errors.Is(err, service.ErrBadRequest):
+		writeErr(w, http.StatusBadRequest, "BAD_REQUEST", err.Error())
+	default:
+		writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "role action failed")
+	}
+}
+
+// roleRequest is the JSON body for POST /roles and PATCH /roles/{id}. Every
+// field is a pointer so PATCH can tell "absent" from "set to zero" — a mask of
+// 0 (a role that may do nothing) and an empty color are both legitimate values.
+type roleRequest struct {
+	Name        *string `json:"name"`
+	Color       *string `json:"color"`
+	Permissions *int64  `json:"permissions"`
+	Position    *int    `json:"position"`
+}
+
+func (r roleRequest) toInput() service.RoleInput {
+	return service.RoleInput{
+		Name:        r.Name,
+		Color:       r.Color,
+		Permissions: r.Permissions,
+		Position:    r.Position,
+	}
+}
+
+// reorderRolesRequest is the JSON body for PATCH /roles/reorder: the ids of
+// every role below the caller's own rank, highest first.
+type reorderRolesRequest struct {
+	RoleIDs []int64 `json:"role_ids"`
+}
+
+func handleListRoles(roles *service.RoleService) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if roles == nil {
+			roleServiceUnavailable(w)
+			return
+		}
+		list, err := roles.ListRoles(r.Context(), actorFromContext(r))
+		if err != nil {
+			writeRoleErr(w, err)
+			return
+		}
+		writeJSON(w, http.StatusOK, list)
+	}
+}
+
+func handleCreateRole(database *db.DB, hub HubBroadcaster, roles *service.RoleService) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if roles == nil {
+			roleServiceUnavailable(w)
+			return
+		}
+		var req roleRequest
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			writeErr(w, http.StatusBadRequest, "BAD_REQUEST", "invalid request body")
+			return
+		}
+		role, err := roles.CreateRole(r.Context(), actorFromContext(r), req.toInput())
+		if err != nil {
+			writeRoleErr(w, err)
+			return
+		}
+		// A brand-new role has no members, so nothing's cached mask changed and
+		// no channel changed visibility — only the role list itself moved.
+		broadcastRoles(r, database, hub)
+		writeJSON(w, http.StatusCreated, role)
+	}
+}
+
+func handlePatchRole(database *db.DB, hub HubBroadcaster, permInvalidator PermissionInvalidator, roles *service.RoleService) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if roles == nil {
+			roleServiceUnavailable(w)
+			return
+		}
+		id, err := pathInt64(r, "id")
+		if err != nil {
+			writeErr(w, http.StatusBadRequest, "BAD_REQUEST", "invalid role id")
+			return
+		}
+		var req roleRequest
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			writeErr(w, http.StatusBadRequest, "BAD_REQUEST", "invalid request body")
+			return
+		}
+
+		// Members are read before the update: after it they are the same set,
+		// but reading first keeps the invalidation correct even if a concurrent
+		// role assignment lands in between (the extra id is a wasted eviction,
+		// a missing one is a stale grant).
+		affected := roles.AffectedUserIDs(r.Context(), id)
+
+		role, permsChanged, err := roles.UpdateRole(r.Context(), actorFromContext(r), id, req.toInput())
+		if err != nil {
+			writeRoleErr(w, err)
+			return
+		}
+
+		if permsChanged {
+			invalidateUsers(permInvalidator, affected)
+			// READ_MESSAGES may have moved in either direction, so every
+			// channel's audience for this role has to be re-derived.
+			if hub != nil {
+				hub.RefreshAllChannelVisibility()
+			}
+		}
+		broadcastRoles(r, database, hub)
+		writeJSON(w, http.StatusOK, role)
+	}
+}
+
+func handleDeleteRole(database *db.DB, hub HubBroadcaster, permInvalidator PermissionInvalidator, roles *service.RoleService) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if roles == nil {
+			roleServiceUnavailable(w)
+			return
+		}
+		id, err := pathInt64(r, "id")
+		if err != nil {
+			writeErr(w, http.StatusBadRequest, "BAD_REQUEST", "invalid role id")
+			return
+		}
+		_, fallback, moved, err := roles.DeleteRole(r.Context(), actorFromContext(r), id)
+		if err != nil {
+			writeRoleErr(w, err)
+			return
+		}
+
+		// The service already dropped the moved members' cached masks; this
+		// covers the handler-side invalidator too (they are the same object in
+		// production, distinct in tests).
+		invalidateUsers(permInvalidator, moved)
+		if hub != nil {
+			// Same shape as PATCH /users/{id} role_change: member_update tells
+			// every client the user regrouped, and revokes the subscriptions
+			// the new role may not read.
+			for _, uid := range moved {
+				hub.BroadcastMemberUpdate(uid, fallback.Name)
+			}
+			hub.RefreshAllChannelVisibility()
+		}
+		broadcastRoles(r, database, hub)
+		w.WriteHeader(http.StatusNoContent)
+	}
+}
+
+func handleReorderRoles(hub HubBroadcaster, permInvalidator PermissionInvalidator, roles *service.RoleService) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if roles == nil {
+			roleServiceUnavailable(w)
+			return
+		}
+		var req reorderRolesRequest
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			writeErr(w, http.StatusBadRequest, "BAD_REQUEST", "invalid request body")
+			return
+		}
+		updated, err := roles.ReorderRoles(r.Context(), actorFromContext(r), req.RoleIDs)
+		if err != nil {
+			writeRoleErr(w, err)
+			return
+		}
+		// Positions carry no permission bits, so no channel changes visibility;
+		// but a cached role snapshot holds the old position, which the
+		// hierarchy checks read.
+		if permInvalidator != nil {
+			permInvalidator.InvalidateAll()
+		}
+		if hub != nil {
+			hub.BroadcastRolesUpdate(updated)
+		}
+		writeJSON(w, http.StatusOK, updated)
+	}
+}
+
+// invalidateUsers drops the cached permissions of the given users, if an
+// invalidator is wired.
+func invalidateUsers(permInvalidator PermissionInvalidator, userIDs []int64) {
+	if permInvalidator == nil {
+		return
+	}
+	for _, uid := range userIDs {
+		permInvalidator.InvalidateUser(uid)
+	}
+}
+
+// broadcastRoles re-reads the role list and pushes it to every client. Re-read
+// rather than patched locally so the broadcast always reflects committed state,
+// including any concurrent change.
+func broadcastRoles(r *http.Request, database *db.DB, hub HubBroadcaster) {
+	if hub == nil || database == nil {
+		return
+	}
+	list, err := database.ListRoles(r.Context())
+	if err != nil {
+		// The mutation already committed; clients converge on their next
+		// reconnect rather than seeing a failed request.
+		slog.Warn("admin: roles_update broadcast skipped, role list unreadable", "err", err)
+		return
+	}
+	hub.BroadcastRolesUpdate(list)
+}
diff --git a/Server/admin/handlers_roles_test.go b/Server/admin/handlers_roles_test.go
new file mode 100644
index 00000000..5496ce30
--- /dev/null
+++ b/Server/admin/handlers_roles_test.go
@@ -0,0 +1,421 @@
+package admin_test
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/owncord/server/admin"
+	"github.com/owncord/server/auth"
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/permissions"
+)
+
+// The admin test schema seeds Owner (id 1, pos 100, ADMINISTRATOR), Admin
+// (id 2, pos 80, everything but ADMINISTRATOR) and Member (id 3, pos 40,
+// is_default). createAdminUser signs in as the Owner.
+
+// newRolesHandler wires the full admin API with a mock hub and a recording
+// permission invalidator, and returns them alongside an Owner bearer token.
+func newRolesHandler(t *testing.T, database *db.DB) (http.Handler, *mockHub, *mockPermInvalidator, string) {
+	t.Helper()
+	hub := &mockHub{}
+	inv := &mockPermInvalidator{}
+	handler := admin.NewAdminAPI(database, "1.0.0", hub, nil, nil, nil, inv,
+		newTestModService(database), newTestRoleService(database))
+	return handler, hub, inv, createAdminUser(t, database)
+}
+
+// createUserWithRole creates a user holding an existing roleID and returns a
+// bearer token for them. (perm_gates_test.go's createRoleUser also upserts the
+// role; these tests want the schema's seeded roles left exactly as they are.)
+func createUserWithRole(t *testing.T, database *db.DB, username string, roleID int) string {
+	t.Helper()
+	uid, err := database.CreateUser(context.Background(), username, "$2a$12$placeholder", roleID)
+	if err != nil {
+		t.Fatalf("CreateUser %s: %v", username, err)
+	}
+	token := "test-token-" + username + "-" + t.Name()
+	if _, err := database.CreateSession(context.Background(), uid, auth.HashToken(token), "test", "127.0.0.1"); err != nil {
+		t.Fatalf("CreateSession %s: %v", username, err)
+	}
+	return token
+}
+
+// doRequestRaw sends a request with a raw (possibly malformed) body, which
+// doRequest cannot express because it marshals its body argument.
+func doRequestRaw(t *testing.T, handler http.Handler, method, path, token, body string) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest(method, path, strings.NewReader(body))
+	req.Header.Set("Authorization", "Bearer "+token)
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	handler.ServeHTTP(w, req)
+	return w
+}
+
+// decodeRole unmarshals a role response body.
+func decodeRole(t *testing.T, body []byte) db.Role {
+	t.Helper()
+	var role db.Role
+	if err := json.Unmarshal(body, &role); err != nil {
+		t.Fatalf("unmarshal role: %v (body %s)", err, body)
+	}
+	return role
+}
+
+// ─── POST /roles ─────────────────────────────────────────────────────────────
+
+func TestAdminAPI_CreateRole_OK(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler, hub, _, token := newRolesHandler(t, database)
+
+	w := doRequest(t, handler, http.MethodPost, "/roles", token, map[string]any{
+		"name":        "Helper",
+		"color":       "#12ab34",
+		"permissions": permissions.ReadMessages | permissions.SendMessages,
+		"position":    50,
+	})
+	if w.Code != http.StatusCreated {
+		t.Fatalf("status = %d, want 201; body: %s", w.Code, w.Body.String())
+	}
+	role := decodeRole(t, w.Body.Bytes())
+	if role.Name != "Helper" || role.Position != 50 {
+		t.Errorf("role = %+v", role)
+	}
+	if role.Color == nil || *role.Color != "#12AB34" {
+		t.Errorf("color = %v, want #12AB34", role.Color)
+	}
+	// Every mutation ships the new list to connected clients.
+	if len(hub.rolesUpdates) != 1 {
+		t.Fatalf("BroadcastRolesUpdate called %d times, want 1", len(hub.rolesUpdates))
+	}
+	if len(hub.rolesUpdates[0]) != 4 {
+		t.Errorf("broadcast carried %d roles, want the full list of 4", len(hub.rolesUpdates[0]))
+	}
+	// A new role has no members, so nothing changed visibility.
+	if hub.allVisibilityRefreshes != 0 {
+		t.Errorf("RefreshAllChannelVisibility called %d times on create, want 0", hub.allVisibilityRefreshes)
+	}
+}
+
+func TestAdminAPI_CreateRole_DuplicateNameIsBadRequest(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler, _, _, token := newRolesHandler(t, database)
+
+	w := doRequest(t, handler, http.MethodPost, "/roles", token, map[string]any{"name": "mEmBeR"})
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("status = %d, want 400; body: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestAdminAPI_Roles_RequireManageRoles(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler, _, _, _ := newRolesHandler(t, database)
+	// A role inside the admin perimeter but without MANAGE_ROLES.
+	if _, err := database.ExecContext(context.Background(),
+		`INSERT INTO roles (id, name, permissions, position, is_default) VALUES (9, 'Janitor', ?, 50, 0)`,
+		permissions.ManageChannels,
+	); err != nil {
+		t.Fatalf("seed role: %v", err)
+	}
+	token := createUserWithRole(t, database, "janitor", 9)
+
+	for _, tc := range []struct {
+		method, path string
+		body         any
+	}{
+		{http.MethodGet, "/roles", nil},
+		{http.MethodPost, "/roles", map[string]any{"name": "x"}},
+		{http.MethodPatch, "/roles/3", map[string]any{"name": "x"}},
+		{http.MethodPatch, "/roles/reorder", map[string]any{"role_ids": []int64{3}}},
+		{http.MethodDelete, "/roles/3", nil},
+	} {
+		w := doRequest(t, handler, tc.method, tc.path, token, tc.body)
+		if w.Code != http.StatusForbidden {
+			t.Errorf("%s %s: status = %d, want 403; body: %s", tc.method, tc.path, w.Code, w.Body.String())
+		}
+	}
+}
+
+func TestAdminAPI_Roles_Unauthenticated(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler, _, _, _ := newRolesHandler(t, database)
+
+	if w := doRequest(t, handler, http.MethodGet, "/roles", "", nil); w.Code != http.StatusUnauthorized {
+		t.Errorf("status = %d, want 401", w.Code)
+	}
+}
+
+func TestAdminAPI_Roles_ServiceUnavailableFailsClosed(t *testing.T) {
+	database := openAdminTestDB(t)
+	// nil RoleService: the routes must refuse rather than fall through to an
+	// unchecked write.
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil,
+		newTestModService(database), nil)
+	token := createAdminUser(t, database)
+
+	for _, tc := range []struct {
+		method, path string
+		body         any
+	}{
+		{http.MethodGet, "/roles", nil},
+		{http.MethodPost, "/roles", map[string]any{"name": "x"}},
+		{http.MethodPatch, "/roles/3", map[string]any{"name": "x"}},
+		{http.MethodPatch, "/roles/reorder", map[string]any{"role_ids": []int64{3}}},
+		{http.MethodDelete, "/roles/3", nil},
+	} {
+		w := doRequest(t, handler, tc.method, tc.path, token, tc.body)
+		if w.Code != http.StatusInternalServerError {
+			t.Errorf("%s %s: status = %d, want 500", tc.method, tc.path, w.Code)
+		}
+	}
+}
+
+// ─── GET /roles ──────────────────────────────────────────────────────────────
+
+func TestAdminAPI_ListRoles_CarriesMemberCounts(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler, _, _, token := newRolesHandler(t, database)
+	createUserWithRole(t, database, "member1", 3)
+	createUserWithRole(t, database, "member2", 3)
+
+	w := doRequest(t, handler, http.MethodGet, "/roles", token, nil)
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", w.Code, w.Body.String())
+	}
+	var list []struct {
+		ID          int64 `json:"id"`
+		Position    int   `json:"position"`
+		MemberCount int   `json:"member_count"`
+	}
+	if err := json.Unmarshal(w.Body.Bytes(), &list); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if len(list) != 3 {
+		t.Fatalf("got %d roles, want 3", len(list))
+	}
+	if list[0].Position < list[len(list)-1].Position {
+		t.Error("roles are not ordered by position descending")
+	}
+	counts := map[int64]int{}
+	for _, r := range list {
+		counts[r.ID] = r.MemberCount
+	}
+	if counts[3] != 2 {
+		t.Errorf("member count = %d, want 2", counts[3])
+	}
+	if counts[1] != 1 {
+		t.Errorf("owner count = %d, want 1 (the acting admin)", counts[1])
+	}
+}
+
+// ─── PATCH /roles/{id} ───────────────────────────────────────────────────────
+
+func TestAdminAPI_PatchRole_PermissionChangeInvalidatesAndResyncs(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler, hub, inv, token := newRolesHandler(t, database)
+	createUserWithRole(t, database, "member1", 3)
+
+	w := doRequest(t, handler, http.MethodPatch, "/roles/3", token, map[string]any{
+		"permissions": permissions.ReadMessages,
+	})
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", w.Code, w.Body.String())
+	}
+	// The one member of role 3 has their cached mask dropped …
+	if len(inv.invalidateUserIDs) != 1 || inv.invalidateUserIDs[0] == 0 {
+		t.Errorf("InvalidateUser calls = %v, want the single role member", inv.invalidateUserIDs)
+	}
+	// … and every channel's audience is recomputed, because READ_MESSAGES moved.
+	if hub.allVisibilityRefreshes != 1 {
+		t.Errorf("RefreshAllChannelVisibility called %d times, want 1", hub.allVisibilityRefreshes)
+	}
+	if len(hub.rolesUpdates) != 1 {
+		t.Errorf("roles_update broadcasts = %d, want 1", len(hub.rolesUpdates))
+	}
+}
+
+func TestAdminAPI_PatchRole_RenameOnlySkipsResync(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler, hub, inv, token := newRolesHandler(t, database)
+
+	w := doRequest(t, handler, http.MethodPatch, "/roles/3", token, map[string]any{"name": "Regulars"})
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", w.Code, w.Body.String())
+	}
+	if decodeRole(t, w.Body.Bytes()).Name != "Regulars" {
+		t.Errorf("name not applied: %s", w.Body.String())
+	}
+	if hub.allVisibilityRefreshes != 0 {
+		t.Errorf("RefreshAllChannelVisibility called %d times for a rename, want 0", hub.allVisibilityRefreshes)
+	}
+	if len(inv.invalidateUserIDs) != 0 {
+		t.Errorf("InvalidateUser called %v for a rename, want none", inv.invalidateUserIDs)
+	}
+	if len(hub.rolesUpdates) != 1 {
+		t.Errorf("roles_update broadcasts = %d, want 1 — the name is in the client's role list", len(hub.rolesUpdates))
+	}
+}
+
+func TestAdminAPI_PatchRole_HierarchyDenied(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler, _, _, _ := newRolesHandler(t, database)
+	adminToken := createUserWithRole(t, database, "admin2", 2)
+
+	// The Admin actor (80) may not edit the Owner role (100) …
+	w := doRequest(t, handler, http.MethodPatch, "/roles/1", adminToken, map[string]any{"name": "Pwned"})
+	if w.Code != http.StatusForbidden {
+		t.Errorf("edit owner role: status = %d, want 403; body: %s", w.Code, w.Body.String())
+	}
+	// … nor their own.
+	w = doRequest(t, handler, http.MethodPatch, "/roles/2", adminToken, map[string]any{"name": "Superadmin"})
+	if w.Code != http.StatusForbidden {
+		t.Errorf("edit own role: status = %d, want 403", w.Code)
+	}
+	// … nor push a role up to their own rank.
+	w = doRequest(t, handler, http.MethodPatch, "/roles/3", adminToken, map[string]any{"position": 80})
+	if w.Code != http.StatusForbidden {
+		t.Errorf("promote role to own rank: status = %d, want 403", w.Code)
+	}
+}
+
+func TestAdminAPI_PatchRole_InvalidIDAndBody(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler, _, _, token := newRolesHandler(t, database)
+
+	if w := doRequest(t, handler, http.MethodPatch, "/roles/abc", token, map[string]any{}); w.Code != http.StatusBadRequest {
+		t.Errorf("non-numeric id: status = %d, want 400", w.Code)
+	}
+	if w := doRequest(t, handler, http.MethodPatch, "/roles/999", token, map[string]any{"name": "x"}); w.Code != http.StatusNotFound {
+		t.Errorf("missing role: status = %d, want 404", w.Code)
+	}
+	req := doRequestRaw(t, handler, http.MethodPatch, "/roles/3", token, "{not json")
+	if req.Code != http.StatusBadRequest {
+		t.Errorf("malformed body: status = %d, want 400", req.Code)
+	}
+}
+
+// ─── DELETE /roles/{id} ──────────────────────────────────────────────────────
+
+func TestAdminAPI_DeleteRole_ReassignsAndBroadcasts(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler, hub, inv, token := newRolesHandler(t, database)
+	ctx := context.Background()
+
+	w := doRequest(t, handler, http.MethodPost, "/roles", token, map[string]any{
+		"name": "Contractor", "position": 50,
+	})
+	if w.Code != http.StatusCreated {
+		t.Fatalf("create: %d %s", w.Code, w.Body.String())
+	}
+	created := decodeRole(t, w.Body.Bytes())
+	uid, err := database.CreateUser(ctx, "contractor", "$2a$12$placeholder", int(created.ID))
+	if err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+	hub.rolesUpdates = nil
+
+	w = doRequest(t, handler, http.MethodDelete, "/roles/"+itoa(created.ID), token, nil)
+	if w.Code != http.StatusNoContent {
+		t.Fatalf("delete: status = %d, want 204; body: %s", w.Code, w.Body.String())
+	}
+
+	user, err := database.GetUserByID(ctx, uid)
+	if err != nil || user == nil {
+		t.Fatalf("GetUserByID: %v", err)
+	}
+	if user.RoleID != 3 {
+		t.Errorf("member role after delete = %d, want the default role 3", user.RoleID)
+	}
+	if len(inv.invalidateUserIDs) == 0 {
+		t.Error("reassigned member's cached permissions were not invalidated")
+	}
+	if len(hub.memberUpdates) != 1 || hub.memberUpdates[0].userID != uid {
+		t.Errorf("member_update broadcasts = %+v, want one for the reassigned member", hub.memberUpdates)
+	}
+	if hub.memberUpdates[0].roleName != "Member" {
+		t.Errorf("member_update role = %q, want the default role's name", hub.memberUpdates[0].roleName)
+	}
+	if hub.allVisibilityRefreshes != 1 {
+		t.Errorf("RefreshAllChannelVisibility called %d times, want 1", hub.allVisibilityRefreshes)
+	}
+	if len(hub.rolesUpdates) != 1 {
+		t.Errorf("roles_update broadcasts = %d, want 1", len(hub.rolesUpdates))
+	}
+}
+
+func TestAdminAPI_DeleteRole_OwnerAndDefaultRefused(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler, _, _, token := newRolesHandler(t, database)
+
+	// Nothing outranks the Owner role, so the hierarchy check refuses first.
+	if w := doRequest(t, handler, http.MethodDelete, "/roles/1", token, nil); w.Code != http.StatusForbidden {
+		t.Errorf("delete owner role: status = %d, want 403; body: %s", w.Code, w.Body.String())
+	}
+	// The default role clears the hierarchy check and is stopped by is_default.
+	w := doRequest(t, handler, http.MethodDelete, "/roles/3", token, nil)
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("delete default role: status = %d, want 400; body: %s", w.Code, w.Body.String())
+	}
+	if role, _ := database.GetRoleByID(context.Background(), 3); role == nil {
+		t.Fatal("the default role was deleted")
+	}
+}
+
+// ─── PATCH /roles/reorder ────────────────────────────────────────────────────
+
+func TestAdminAPI_ReorderRoles_NormalizesAndBroadcasts(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler, hub, inv, token := newRolesHandler(t, database)
+
+	w := doRequest(t, handler, http.MethodPatch, "/roles/reorder", token, map[string]any{
+		"role_ids": []int64{3, 2},
+	})
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", w.Code, w.Body.String())
+	}
+	var list []db.Role
+	if err := json.Unmarshal(w.Body.Bytes(), &list); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	positions := map[int64]int{}
+	for _, r := range list {
+		positions[r.ID] = r.Position
+	}
+	if positions[3] != 2 || positions[2] != 1 {
+		t.Errorf("positions = %v, want role 3 above role 2 (2 and 1)", positions)
+	}
+	if positions[1] != 100 {
+		t.Errorf("owner position = %d, want it untouched at 100", positions[1])
+	}
+	// Positions feed the hierarchy checks, so the cached role snapshots go.
+	if inv.invalidateAllN == 0 {
+		t.Error("InvalidateAll was not called after a reorder")
+	}
+	if len(hub.rolesUpdates) != 1 {
+		t.Errorf("roles_update broadcasts = %d, want 1", len(hub.rolesUpdates))
+	}
+	// "reorder" must not be parsed as a role id by the {id} route.
+	if hub.allVisibilityRefreshes != 0 {
+		t.Errorf("RefreshAllChannelVisibility called %d times for a reorder, want 0", hub.allVisibilityRefreshes)
+	}
+}
+
+func TestAdminAPI_ReorderRoles_PartialListRefused(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler, hub, _, token := newRolesHandler(t, database)
+
+	w := doRequest(t, handler, http.MethodPatch, "/roles/reorder", token, map[string]any{
+		"role_ids": []int64{3},
+	})
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("status = %d, want 400; body: %s", w.Code, w.Body.String())
+	}
+	if len(hub.rolesUpdates) != 0 {
+		t.Error("a refused reorder must not broadcast")
+	}
+}
diff --git a/Server/admin/handlers_users.go b/Server/admin/handlers_users.go
index af701fdd..a0ccaf4d 100644
--- a/Server/admin/handlers_users.go
+++ b/Server/admin/handlers_users.go
@@ -1,14 +1,13 @@
 package admin
 
 import (
-	"context"
 	"encoding/json"
 	"errors"
-	"fmt"
-	"log/slog"
 	"net/http"
+	"time"
 
 	"github.com/owncord/server/db"
+	"github.com/owncord/server/permissions"
 	"github.com/owncord/server/service"
 )
 
@@ -52,8 +51,16 @@ type patchUserRequest struct {
 	RoleID    *int64  `json:"role_id"`
 	Banned    *bool   `json:"banned"`
 	BanReason *string `json:"ban_reason"`
+	// BanDurationHours makes the ban temporary: it expires this many hours
+	// from now (login re-checks via IsEffectivelyBanned). Omitted or 0 =
+	// permanent. Only meaningful with banned=true.
+	BanDurationHours *int `json:"ban_duration_hours"`
 }
 
+// maxBanDurationHours caps temporary bans at one year; anything longer is
+// effectively permanent and should be issued as such.
+const maxBanDurationHours = 24 * 365
+
 // writeModerationErr maps ModerationService errors onto admin API responses.
 func writeModerationErr(w http.ResponseWriter, err error) {
 	switch {
@@ -116,9 +123,19 @@ func handlePatchUser(database *db.DB, hub HubBroadcaster, permInvalidator Permis
 			if req.BanReason != nil {
 				banReason = *req.BanReason
 			}
+			var banExpires *time.Time
+			if req.BanDurationHours != nil && *req.BanDurationHours != 0 {
+				hours := *req.BanDurationHours
+				if hours < 0 || hours > maxBanDurationHours {
+					writeErr(w, http.StatusBadRequest, "BAD_REQUEST", "ban_duration_hours must be between 1 and 8760")
+					return
+				}
+				t := time.Now().Add(time.Duration(hours) * time.Hour)
+				banExpires = &t
+			}
 			var actionErr error
 			if *req.Banned {
-				actionErr = mod.BanUser(r.Context(), actor, id, banReason, nil)
+				actionErr = mod.BanUser(r.Context(), actor, id, banReason, banExpires)
 			} else {
 				actionErr = mod.UnbanUser(r.Context(), actor, id)
 			}
@@ -132,16 +149,22 @@ func handlePatchUser(database *db.DB, hub HubBroadcaster, permInvalidator Permis
 		}
 
 		if req.RoleID != nil {
-			if _, err := database.ExecContext(r.Context(), `UPDATE users SET role_id = ? WHERE id = ?`, *req.RoleID, id); err != nil {
-				writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "failed to update role")
+			// Routed through ModerationService, which enforces MANAGE_ROLES,
+			// the actor-outranks-target rule, and the assign-below-own-rank
+			// rule (without it any admin could promote anyone to Owner), and
+			// writes the audit row.
+			if mod == nil {
+				// Fail closed rather than fall back to an unchecked UPDATE.
+				writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "moderation service unavailable")
+				return
+			}
+			if err := mod.ChangeUserRole(r.Context(), actor, id, *req.RoleID); err != nil {
+				writeModerationErr(w, err)
 				return
 			}
-			slog.Info("role changed", "actor_id", actor, "target_user", user.Username, "new_role_id", *req.RoleID)
 			if permInvalidator != nil {
 				permInvalidator.InvalidateUser(id)
 			}
-			db.WriteAudit(context.WithoutCancel(r.Context()), database, actor, "role_change", "user", id,
-				fmt.Sprintf("changed %s role to %d", user.Username, *req.RoleID))
 			if role, err := database.GetRoleByID(r.Context(), *req.RoleID); err == nil && role != nil {
 				if hub != nil {
 					hub.BroadcastMemberUpdate(id, role.Name)
@@ -158,21 +181,49 @@ func handlePatchUser(database *db.DB, hub HubBroadcaster, permInvalidator Permis
 	}
 }
 
-func handleForceLogout(database *db.DB) http.HandlerFunc {
+// handleForceLogout revokes every session of the target user. The route is
+// gated on KICK_MEMBERS; ModerationService additionally enforces the
+// actor-outranks-target hierarchy and writes the audit row.
+func handleForceLogout(mod *service.ModerationService) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		id, err := pathInt64(r, "id")
 		if err != nil {
 			writeErr(w, http.StatusBadRequest, "BAD_REQUEST", "invalid user id")
 			return
 		}
+		if mod == nil {
+			// Fail closed rather than cut sessions without a hierarchy check.
+			writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "moderation service unavailable")
+			return
+		}
 
-		if err := database.ForceLogoutUser(r.Context(), id); err != nil {
-			writeErr(w, http.StatusInternalServerError, "INTERNAL_ERROR", "failed to logout user")
+		if err := mod.ForceLogout(r.Context(), actorFromContext(r), id); err != nil {
+			writeModerationErr(w, err)
 			return
 		}
-		actor := actorFromContext(r)
-		slog.Info("force logout", "actor_id", actor, "target_user_id", id)
-		db.WriteAudit(context.WithoutCancel(r.Context()), database, actor, "force_logout", "user", id, "all sessions terminated")
 		w.WriteHeader(http.StatusNoContent)
 	}
 }
+
+// handleGetMe describes the calling principal so the admin panel can hide the
+// surfaces its role cannot use. Perimeter-level: every authenticated principal
+// may read its own permissions.
+func handleGetMe() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		user, userOK := r.Context().Value(adminUserKey).(*db.User)
+		role, roleOK := r.Context().Value(adminRoleKey).(*db.Role)
+		if !userOK || user == nil || !roleOK || role == nil {
+			writeErr(w, http.StatusUnauthorized, "UNAUTHORIZED", "not authenticated")
+			return
+		}
+		writeJSON(w, http.StatusOK, adminMeResponse{
+			ID:           user.ID,
+			Username:     user.Username,
+			RoleID:       role.ID,
+			RoleName:     role.Name,
+			RolePosition: role.Position,
+			Permissions:  role.Permissions,
+			IsOwner:      role.Position >= permissions.OwnerRolePosition,
+		})
+	}
+}
diff --git a/Server/admin/helpers.go b/Server/admin/helpers.go
index 1553cba2..c1f2b45b 100644
--- a/Server/admin/helpers.go
+++ b/Server/admin/helpers.go
@@ -63,3 +63,15 @@ func actorFromContext(r *http.Request) int64 {
 	}
 	return user.ID
 }
+
+// actorRoleFromContext returns the authenticated principal's *db.Role stored
+// in the request context by adminAuthMiddleware. Returns nil if called
+// outside that middleware (should not happen in production) so callers can
+// fail closed.
+func actorRoleFromContext(r *http.Request) *db.Role {
+	role, ok := r.Context().Value(adminRoleKey).(*db.Role)
+	if !ok {
+		return nil
+	}
+	return role
+}
diff --git a/Server/admin/logstream_apitoken_test.go b/Server/admin/logstream_apitoken_test.go
index 96cbf39e..0807268a 100644
--- a/Server/admin/logstream_apitoken_test.go
+++ b/Server/admin/logstream_apitoken_test.go
@@ -22,7 +22,7 @@ func TestAdminAPI_LogStreamTicketFlow_APIToken(t *testing.T) {
 	database := openAdminTestDB(t)
 	logBuf := admin.NewRingBuffer(8)
 	logBuf.Write(admin.LogEntry{Timestamp: "2026-07-31T10:00:00Z", Level: "INFO", Message: "hello from ring", Source: "server"})
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, logBuf, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, logBuf, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	// An admin user authenticated only by an API token — no session row exists.
 	uid, err := database.CreateUser(context.Background(), "apitokenadmin", "$2a$12$placeholder", 1)
diff --git a/Server/admin/middleware.go b/Server/admin/middleware.go
index da025709..d62250f9 100644
--- a/Server/admin/middleware.go
+++ b/Server/admin/middleware.go
@@ -12,16 +12,24 @@ import (
 
 // ─── Middleware ───────────────────────────────────────────────────────────────
 
-// RequireAdminAuth is the exported form of adminAuthMiddleware. External
-// packages (e.g. api/router.go for the plugin admin handler) reuse it so the
-// session/permission gate stays in one place.
+// RequireAdminAuth is the exported admin gate for surfaces outside this
+// package (api/router.go's plugin admin handler). Those routes stay
+// ADMINISTRATOR-only, so it chains the perimeter check with an explicit
+// ADMINISTRATOR requirement rather than exposing the widened perimeter.
 func RequireAdminAuth(database *db.DB) func(http.Handler) http.Handler {
-	return adminAuthMiddleware(database)
+	perimeter := adminAuthMiddleware(database)
+	administrator := requirePerm(permissions.Administrator)
+	return func(next http.Handler) http.Handler {
+		return perimeter(administrator(next))
+	}
 }
 
-// adminAuthMiddleware validates the Bearer token and requires ADMINISTRATOR.
-// On success it stores the *db.User and *db.Session in the request context so
-// downstream handlers can retrieve them without re-querying the database.
+// adminAuthMiddleware validates the Bearer token and requires at least one
+// moderation-capable bit (permissions.AdminPerimeter) — not ADMINISTRATOR, so
+// a Moderator role can reach the routes its bits allow. Individual route
+// groups re-check the specific bit they need via requirePerm.
+// On success it stores the *db.User, *db.Role and *db.Session in the request
+// context so downstream handlers can retrieve them without re-querying.
 func adminAuthMiddleware(database *db.DB) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -33,8 +41,9 @@ func adminAuthMiddleware(database *db.DB) func(http.Handler) http.Handler {
 
 			hash := auth.HashToken(token)
 			// Resolve the bearer token: login session first, then API token. An
-			// API token whose user carries the ADMINISTRATOR bit authenticates
-			// here too, so /admin/api/* works for headless clients.
+			// API token inherits its owning user's role, so a token whose user
+			// clears the perimeter authenticates here too and /admin/api/*
+			// works for headless clients.
 			user, role, sess, err := auth.ResolveTokenHash(r.Context(), database, hash)
 			if err != nil {
 				switch {
@@ -62,12 +71,13 @@ func adminAuthMiddleware(database *db.DB) func(http.Handler) http.Handler {
 				return
 			}
 
-			if !permissions.HasAdmin(role.Permissions) {
-				writeErr(w, http.StatusForbidden, "FORBIDDEN", "administrator permission required")
+			if !permissions.HasAnyPerm(role.Permissions, permissions.AdminPerimeter) {
+				writeErr(w, http.StatusForbidden, "FORBIDDEN", "moderation permission required")
 				return
 			}
 
 			ctx := context.WithValue(r.Context(), adminUserKey, user)
+			ctx = context.WithValue(ctx, adminRoleKey, role)
 			ctx = context.WithValue(ctx, adminSessionKey, sess) // nil for API-token principals; consumers guard nil
 			ctx = context.WithValue(ctx, adminTokenHashKey, hash)
 			next.ServeHTTP(w, r.WithContext(ctx))
@@ -75,6 +85,27 @@ func adminAuthMiddleware(database *db.DB) func(http.Handler) http.Handler {
 	}
 }
 
+// requirePerm gates a route group on a single server-wide permission bit.
+// ADMINISTRATOR bypasses via permissions.HasServerPerm. The role comes from
+// the request context (set by adminAuthMiddleware), so no extra query runs.
+func requirePerm(perm int64) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			role, ok := r.Context().Value(adminRoleKey).(*db.Role)
+			if !ok || role == nil {
+				writeErr(w, http.StatusUnauthorized, "UNAUTHORIZED", "not authenticated")
+				return
+			}
+			if !permissions.HasServerPerm(role.Permissions, perm) {
+				writeErr(w, http.StatusForbidden, "FORBIDDEN",
+					permissions.Name(perm)+" permission required")
+				return
+			}
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
 // ownerOnlyMiddleware wraps a handler to require Owner role (position == 100).
 // It reads the user from context (set by adminAuthMiddleware) rather than
 // re-authenticating, avoiding redundant DB queries and session-expiry gaps.
diff --git a/Server/admin/middleware_and_spawn_test.go b/Server/admin/middleware_and_spawn_test.go
index d55c7aca..dd1a5ad5 100644
--- a/Server/admin/middleware_and_spawn_test.go
+++ b/Server/admin/middleware_and_spawn_test.go
@@ -55,7 +55,10 @@ CREATE TABLE IF NOT EXISTS users (
     banned      INTEGER NOT NULL DEFAULT 0,
     ban_reason  TEXT,
     ban_expires TEXT,
-    identity_public_key TEXT
+    identity_public_key TEXT,
+    display_name TEXT,
+    about TEXT,
+    custom_status TEXT
 );
 CREATE TABLE IF NOT EXISTS sessions (
     id         INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -90,7 +93,9 @@ CREATE TABLE IF NOT EXISTS channels (
     voice_max_users  INTEGER NOT NULL DEFAULT 0,
     voice_quality    TEXT,
     mixing_threshold INTEGER,
-    voice_max_video  INTEGER NOT NULL DEFAULT 0
+    voice_max_video  INTEGER NOT NULL DEFAULT 0,
+    nsfw             INTEGER NOT NULL DEFAULT 0,
+    is_group         INTEGER NOT NULL DEFAULT 0
 );
 CREATE TABLE IF NOT EXISTS messages (
     id         INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -101,8 +106,15 @@ CREATE TABLE IF NOT EXISTS messages (
     pinned     INTEGER NOT NULL DEFAULT 0,
     timestamp  TEXT    NOT NULL DEFAULT (datetime('now')),
     reply_to   INTEGER REFERENCES messages(id) ON DELETE SET NULL,
-    edited_at  TEXT
+    edited_at  TEXT,
+    mentions_everyone INTEGER NOT NULL DEFAULT 0
 );
+CREATE TABLE IF NOT EXISTS message_mentions (
+    message_id        INTEGER NOT NULL REFERENCES messages(id) ON DELETE CASCADE,
+    mentioned_user_id INTEGER NOT NULL REFERENCES users(id)    ON DELETE CASCADE,
+    PRIMARY KEY (message_id, mentioned_user_id)
+);
+
 CREATE TABLE IF NOT EXISTS invites (
     id          INTEGER PRIMARY KEY AUTOINCREMENT,
     code        TEXT    NOT NULL UNIQUE,
@@ -250,7 +262,7 @@ func TestOwnerOnlyMiddleware_OwnerPassesThrough(t *testing.T) {
 // role_id has been set to a nonexistent value returns 401.
 func TestAdminAuthMiddleware_RoleNotFound(t *testing.T) {
 	database := openWhiteboxTestDB(t)
-	handler := NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, nil)
+	handler := NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, nil, nil)
 
 	uid, err := database.CreateUser(context.Background(), "noroleuser", "$2a$12$x", 1)
 	if err != nil {
@@ -404,6 +416,8 @@ func (m *mockHubWB) BroadcastChannelDelete(channelID int64)                 {}
 func (m *mockHubWB) BroadcastMemberBan(userID int64)                        {}
 func (m *mockHubWB) BroadcastMemberUpdate(userID int64, roleName string)    {}
 func (m *mockHubWB) RefreshChannelVisibility(ch *db.Channel)                {}
+func (m *mockHubWB) RefreshAllChannelVisibility()                           {}
+func (m *mockHubWB) BroadcastRolesUpdate(roles []*db.Role)                  {}
 func (m *mockHubWB) ClientCount() int                                       { return 0 }
 
 // isolateSpawnedTestBinary makes it safe for a test to re-exec the test binary
diff --git a/Server/admin/middleware_coverage_test.go b/Server/admin/middleware_coverage_test.go
index ab9fc599..ea8fb5ee 100644
--- a/Server/admin/middleware_coverage_test.go
+++ b/Server/admin/middleware_coverage_test.go
@@ -19,7 +19,7 @@ import (
 // session has expired is rejected with 401.
 func TestAdminAuthMiddleware_ExpiredSession(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	// Create a user and session, then manually expire the session by setting
 	// expires_at to a past timestamp via the exported Exec helper.
@@ -54,7 +54,7 @@ func TestAdminAuthMiddleware_ExpiredSession(t *testing.T) {
 // access immediately, not only when the session expires.
 func TestAdminAuthMiddleware_BannedAdmin(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	if w := doRequest(t, handler, http.MethodGet, "/stats", token, nil); w.Code != http.StatusOK {
@@ -78,7 +78,7 @@ func TestAdminAuthMiddleware_BannedAdmin(t *testing.T) {
 // Authorization header returns 401.
 func TestAdminAuthMiddleware_MissingBearer(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	w := doRequest(t, handler, http.MethodGet, "/stats", "", nil)
 
@@ -91,7 +91,7 @@ func TestAdminAuthMiddleware_MissingBearer(t *testing.T) {
 // sessions table returns 401.
 func TestAdminAuthMiddleware_InvalidToken(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	w := doRequest(t, handler, http.MethodGet, "/stats", "completely-invalid-token", nil)
 
diff --git a/Server/admin/perm_gates_test.go b/Server/admin/perm_gates_test.go
new file mode 100644
index 00000000..9cd24ff3
--- /dev/null
+++ b/Server/admin/perm_gates_test.go
@@ -0,0 +1,402 @@
+package admin_test
+
+// Route-level permission gates. The /admin/api perimeter admits any role
+// holding a moderation bit; each group then re-checks the specific bit, so a
+// Moderator can manage channels without being able to read settings, the audit
+// log, or the owner-only routes.
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"testing"
+
+	"github.com/owncord/server/admin"
+	"github.com/owncord/server/auth"
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/permissions"
+)
+
+// moderatorMask is migration 001's seeded Moderator role: MANAGE_MESSAGES,
+// MANAGE_CHANNELS, KICK_MEMBERS, BAN_MEMBERS (bits 16-19) and everything below.
+const moderatorMask = int64(0x000FFFFF)
+
+// createRoleUser upserts a role and a user holding it, returning the user id
+// and a bearer token for that user's session.
+func createRoleUser(t *testing.T, database *db.DB, roleID int64, name string, perms int64, position int, username string) (int64, string) {
+	t.Helper()
+	if _, err := database.ExecContext(context.Background(),
+		`INSERT INTO roles (id, name, color, permissions, position, is_default)
+		 VALUES (?, ?, NULL, ?, ?, 0)
+		 ON CONFLICT(id) DO UPDATE SET
+		     name=excluded.name, permissions=excluded.permissions, position=excluded.position`,
+		roleID, name, perms, position,
+	); err != nil {
+		t.Fatalf("seed role %s: %v", name, err)
+	}
+	uid, err := database.CreateUser(context.Background(), username, "$2a$12$placeholder", int(roleID))
+	if err != nil {
+		t.Fatalf("CreateUser %s: %v", username, err)
+	}
+	token := username + "-token-" + t.Name()
+	if _, err := database.CreateSession(context.Background(), uid, auth.HashToken(token), "test", "127.0.0.1"); err != nil {
+		t.Fatalf("CreateSession %s: %v", username, err)
+	}
+	return uid, token
+}
+
+// newModeratorHandler builds the admin API with a Moderator-role principal.
+func newModeratorHandler(t *testing.T) (http.Handler, *db.DB, string) {
+	t.Helper()
+	database := openAdminTestDB(t)
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
+	_, token := createRoleUser(t, database, 10, "Moderator", moderatorMask, 60, "moduser")
+	return handler, database, token
+}
+
+// ─── Perimeter ────────────────────────────────────────────────────────────────
+
+func TestPerimeter_ModeratorAdmitted(t *testing.T) {
+	handler, _, token := newModeratorHandler(t)
+
+	// Perimeter-level routes: reachable with any moderation bit.
+	for _, path := range []string{"/stats", "/users", "/me"} {
+		if w := doRequest(t, handler, http.MethodGet, path, token, nil); w.Code != http.StatusOK {
+			t.Errorf("GET %s = %d, want 200; body: %s", path, w.Code, w.Body.String())
+		}
+	}
+}
+
+func TestPerimeter_NoModerationBitsRejected(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
+	// MANAGE_MESSAGES alone is not a perimeter bit — it has no admin route.
+	_, token := createRoleUser(t, database, 11, "Helper", permissions.ManageMessages, 50, "helperuser")
+
+	if w := doRequest(t, handler, http.MethodGet, "/stats", token, nil); w.Code != http.StatusForbidden {
+		t.Errorf("status = %d, want 403; body: %s", w.Code, w.Body.String())
+	}
+}
+
+// ─── MANAGE_CHANNELS ──────────────────────────────────────────────────────────
+
+func TestChannelRoutes_ModeratorAllowed(t *testing.T) {
+	handler, _, token := newModeratorHandler(t)
+
+	if w := doRequest(t, handler, http.MethodGet, "/channels", token, nil); w.Code != http.StatusOK {
+		t.Fatalf("GET /channels = %d, want 200; body: %s", w.Code, w.Body.String())
+	}
+	w := doRequest(t, handler, http.MethodPost, "/channels", token, map[string]any{"name": "mod-made", "type": "text"})
+	if w.Code != http.StatusCreated {
+		t.Fatalf("POST /channels = %d, want 201; body: %s", w.Code, w.Body.String())
+	}
+	var created db.Channel
+	if err := json.Unmarshal(w.Body.Bytes(), &created); err != nil {
+		t.Fatalf("unmarshal channel: %v", err)
+	}
+	if w := doRequest(t, handler, http.MethodPatch, "/channels/"+itoa(created.ID), token,
+		map[string]any{"name": "mod-renamed"}); w.Code != http.StatusOK {
+		t.Errorf("PATCH /channels = %d, want 200; body: %s", w.Code, w.Body.String())
+	}
+	// Channel-permission overrides ride the same gate.
+	if w := doRequest(t, handler, http.MethodGet, "/channels/"+itoa(created.ID)+"/permissions", token, nil); w.Code != http.StatusOK {
+		t.Errorf("GET channel permissions = %d, want 200; body: %s", w.Code, w.Body.String())
+	}
+	if w := doRequest(t, handler, http.MethodDelete, "/channels/"+itoa(created.ID), token, nil); w.Code != http.StatusNoContent {
+		t.Errorf("DELETE /channels = %d, want 204; body: %s", w.Code, w.Body.String())
+	}
+}
+
+// ─── BAN_MEMBERS reaches PATCH /users/{id} ───────────────────────────────────
+
+// The ban path is authorized inside ModerationService, so the route must stay
+// perimeter-level: gating it on ADMINISTRATOR (or on MANAGE_ROLES) would put
+// banning out of a Moderator's reach entirely.
+func TestPatchUserBan_ModeratorAllowed(t *testing.T) {
+	handler, database, token := newModeratorHandler(t)
+	targetUID, _ := database.CreateUser(context.Background(), "spammer", "hash", 3)
+
+	w := doRequest(t, handler, http.MethodPatch, "/users/"+itoa(targetUID), token,
+		map[string]any{"banned": true, "ban_reason": "spam"})
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", w.Code, w.Body.String())
+	}
+	user, _ := database.GetUserByID(context.Background(), targetUID)
+	if !user.Banned {
+		t.Error("target should be banned")
+	}
+}
+
+func TestChannelRoutes_WithoutManageChannelsForbidden(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
+	_, token := createRoleUser(t, database, 12, "Auditor", permissions.ViewAuditLog, 50, "auditoruser")
+
+	for _, tc := range []struct {
+		method string
+		path   string
+	}{
+		{http.MethodGet, "/channels"},
+		{http.MethodPost, "/channels"},
+		{http.MethodPatch, "/channels/1"},
+		{http.MethodDelete, "/channels/1"},
+		{http.MethodGet, "/channels/1/permissions"},
+	} {
+		if w := doRequest(t, handler, tc.method, tc.path, token, nil); w.Code != http.StatusForbidden {
+			t.Errorf("%s %s = %d, want 403; body: %s", tc.method, tc.path, w.Code, w.Body.String())
+		}
+	}
+}
+
+// ─── VIEW_AUDIT_LOG / MANAGE_SERVER ──────────────────────────────────────────
+
+func TestAuditAndSettings_ModeratorForbidden(t *testing.T) {
+	handler, _, token := newModeratorHandler(t)
+
+	for _, tc := range []struct {
+		method string
+		path   string
+	}{
+		{http.MethodGet, "/audit-log"},
+		{http.MethodGet, "/settings"},
+		{http.MethodPatch, "/settings"},
+		{http.MethodPost, "/logs/ticket"},
+	} {
+		if w := doRequest(t, handler, tc.method, tc.path, token, nil); w.Code != http.StatusForbidden {
+			t.Errorf("%s %s = %d, want 403; body: %s", tc.method, tc.path, w.Code, w.Body.String())
+		}
+	}
+}
+
+func TestAuditAndSettings_BitHoldersAllowed(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
+	_, auditToken := createRoleUser(t, database, 12, "Auditor", permissions.ViewAuditLog, 50, "auditoruser")
+	_, cfgToken := createRoleUser(t, database, 13, "Configurator", permissions.ManageServer, 50, "cfguser")
+
+	if w := doRequest(t, handler, http.MethodGet, "/audit-log", auditToken, nil); w.Code != http.StatusOK {
+		t.Errorf("GET /audit-log = %d, want 200; body: %s", w.Code, w.Body.String())
+	}
+	if w := doRequest(t, handler, http.MethodGet, "/settings", cfgToken, nil); w.Code != http.StatusOK {
+		t.Errorf("GET /settings = %d, want 200; body: %s", w.Code, w.Body.String())
+	}
+	// Each bit gates only its own group.
+	if w := doRequest(t, handler, http.MethodGet, "/settings", auditToken, nil); w.Code != http.StatusForbidden {
+		t.Errorf("auditor GET /settings = %d, want 403", w.Code)
+	}
+	if w := doRequest(t, handler, http.MethodGet, "/audit-log", cfgToken, nil); w.Code != http.StatusForbidden {
+		t.Errorf("configurator GET /audit-log = %d, want 403", w.Code)
+	}
+}
+
+// ─── Owner-only routes stay owner-only ───────────────────────────────────────
+
+func TestOwnerOnlyRoutes_ModeratorForbidden(t *testing.T) {
+	handler, _, token := newModeratorHandler(t)
+
+	for _, tc := range []struct {
+		method string
+		path   string
+	}{
+		{http.MethodGet, "/tokens"},
+		{http.MethodPost, "/tokens"},
+		{http.MethodGet, "/backups"},
+		{http.MethodPost, "/backup"},
+		{http.MethodGet, "/updates"},
+		{http.MethodPost, "/updates/apply"},
+	} {
+		if w := doRequest(t, handler, tc.method, tc.path, token, nil); w.Code != http.StatusForbidden {
+			t.Errorf("%s %s = %d, want 403; body: %s", tc.method, tc.path, w.Code, w.Body.String())
+		}
+	}
+}
+
+// ─── KICK_MEMBERS (force logout) ─────────────────────────────────────────────
+
+func TestForceLogout_RequiresKickMembers(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
+	_, token := createRoleUser(t, database, 14, "ChannelMod", permissions.ManageChannels, 60, "chanmoduser")
+
+	targetUID, _ := database.CreateUser(context.Background(), "victim", "hash", 3)
+	if _, err := database.CreateSession(context.Background(), targetUID, "victim-hash-perm", "web", "1.2.3.4"); err != nil {
+		t.Fatalf("CreateSession: %v", err)
+	}
+
+	w := doRequest(t, handler, http.MethodDelete, "/users/"+itoa(targetUID)+"/sessions", token, nil)
+	if w.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403; body: %s", w.Code, w.Body.String())
+	}
+	sessions, _ := database.GetUserSessions(context.Background(), targetUID)
+	if len(sessions) != 1 {
+		t.Errorf("sessions = %d, want 1 (refused call must not cut sessions)", len(sessions))
+	}
+}
+
+func TestForceLogout_HierarchyEnforced(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
+	_, token := createRoleUser(t, database, 10, "Moderator", moderatorMask, 60, "moduser")
+
+	// Owner (role 1, position 100) outranks the moderator.
+	ownerUID, err := database.CreateUser(context.Background(), "theowner", "hash", 1)
+	if err != nil {
+		t.Fatalf("CreateUser owner: %v", err)
+	}
+	if _, err := database.CreateSession(context.Background(), ownerUID, "owner-hash-hier", "web", "1.2.3.4"); err != nil {
+		t.Fatalf("CreateSession: %v", err)
+	}
+
+	if w := doRequest(t, handler, http.MethodDelete, "/users/"+itoa(ownerUID)+"/sessions", token, nil); w.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403; body: %s", w.Code, w.Body.String())
+	}
+	sessions, _ := database.GetUserSessions(context.Background(), ownerUID)
+	if len(sessions) != 1 {
+		t.Errorf("owner sessions = %d, want 1", len(sessions))
+	}
+
+	// A lower-ranked member is fair game.
+	memberUID, _ := database.CreateUser(context.Background(), "amember", "hash", 3)
+	if _, err := database.CreateSession(context.Background(), memberUID, "member-hash-hier", "web", "1.2.3.4"); err != nil {
+		t.Fatalf("CreateSession: %v", err)
+	}
+	if w := doRequest(t, handler, http.MethodDelete, "/users/"+itoa(memberUID)+"/sessions", token, nil); w.Code != http.StatusNoContent {
+		t.Fatalf("status = %d, want 204; body: %s", w.Code, w.Body.String())
+	}
+}
+
+// ─── MANAGE_ROLES (role assignment) ──────────────────────────────────────────
+
+func TestPatchUserRole_RequiresManageRoles(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
+	// The seeded Moderator mask stops at bit 19 — no MANAGE_ROLES (bit 24).
+	_, token := createRoleUser(t, database, 10, "Moderator", moderatorMask, 60, "moduser")
+	targetUID, _ := database.CreateUser(context.Background(), "promoteme", "hash", 3)
+
+	w := doRequest(t, handler, http.MethodPatch, "/users/"+itoa(targetUID), token, map[string]any{"role_id": 2})
+	if w.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403; body: %s", w.Code, w.Body.String())
+	}
+	user, _ := database.GetUserByID(context.Background(), targetUID)
+	if user.RoleID != 3 {
+		t.Errorf("role_id = %d, want 3 (unchanged)", user.RoleID)
+	}
+}
+
+func TestPatchUserRole_CannotPromoteToOwner(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
+	// Role 2 "Admin" (position 80) holds MANAGE_ROLES but is below Owner.
+	_, token := createRoleUser(t, database, 2, "Admin", 0x3FFFFFFF, 80, "adminuser2")
+	targetUID, _ := database.CreateUser(context.Background(), "wannabeowner", "hash", 3)
+
+	w := doRequest(t, handler, http.MethodPatch, "/users/"+itoa(targetUID), token,
+		map[string]any{"role_id": permissions.OwnerRoleID})
+	if w.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403; body: %s", w.Code, w.Body.String())
+	}
+	user, _ := database.GetUserByID(context.Background(), targetUID)
+	if user.RoleID != 3 {
+		t.Errorf("role_id = %d, want 3 (unchanged)", user.RoleID)
+	}
+}
+
+func TestPatchUserRole_ModeratorCannotDemoteAdmin(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
+	// A moderator that does hold MANAGE_ROLES still cannot touch a higher rank.
+	_, token := createRoleUser(t, database, 10, "Moderator", moderatorMask|permissions.ManageRoles, 60, "moduser")
+	adminUID, err := database.CreateUser(context.Background(), "sitting-admin", "hash", 2)
+	if err != nil {
+		t.Fatalf("CreateUser admin: %v", err)
+	}
+
+	w := doRequest(t, handler, http.MethodPatch, "/users/"+itoa(adminUID), token, map[string]any{"role_id": 3})
+	if w.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403; body: %s", w.Code, w.Body.String())
+	}
+	user, _ := database.GetUserByID(context.Background(), adminUID)
+	if user.RoleID != 2 {
+		t.Errorf("role_id = %d, want 2 (unchanged)", user.RoleID)
+	}
+}
+
+// ─── RequireAdminAuth (plugin admin routes) ──────────────────────────────────
+
+// The exported gate wraps surfaces outside this package (api/router.go mounts
+// the plugin admin handler behind it). Widening the panel perimeter must not
+// widen those: they stay ADMINISTRATOR-only.
+func TestRequireAdminAuth_StaysAdministratorOnly(t *testing.T) {
+	database := openAdminTestDB(t)
+	reached := false
+	guarded := admin.RequireAdminAuth(database)(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		reached = true
+		w.WriteHeader(http.StatusOK)
+	}))
+	_, modToken := createRoleUser(t, database, 10, "Moderator", moderatorMask, 60, "moduser")
+	ownerToken := createAdminUser(t, database)
+
+	if w := doRequest(t, guarded, http.MethodGet, "/plugins", modToken, nil); w.Code != http.StatusForbidden {
+		t.Errorf("moderator = %d, want 403; body: %s", w.Code, w.Body.String())
+	}
+	if reached {
+		t.Error("handler reached by a non-administrator")
+	}
+	if w := doRequest(t, guarded, http.MethodGet, "/plugins", ownerToken, nil); w.Code != http.StatusOK {
+		t.Errorf("owner = %d, want 200; body: %s", w.Code, w.Body.String())
+	}
+	if !reached {
+		t.Error("handler not reached by the owner")
+	}
+}
+
+// ─── GET /me ─────────────────────────────────────────────────────────────────
+
+func TestGetMe_ReportsCallerPermissions(t *testing.T) {
+	handler, _, token := newModeratorHandler(t)
+
+	w := doRequest(t, handler, http.MethodGet, "/me", token, nil)
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", w.Code, w.Body.String())
+	}
+	var me struct {
+		Username     string `json:"username"`
+		RoleName     string `json:"role_name"`
+		RolePosition int    `json:"role_position"`
+		Permissions  int64  `json:"permissions"`
+		IsOwner      bool   `json:"is_owner"`
+	}
+	if err := json.Unmarshal(w.Body.Bytes(), &me); err != nil {
+		t.Fatalf("unmarshal me: %v", err)
+	}
+	if me.Username != "moduser" || me.RoleName != "Moderator" {
+		t.Errorf("me = %+v, want moduser/Moderator", me)
+	}
+	if me.Permissions != moderatorMask {
+		t.Errorf("permissions = %#x, want %#x", me.Permissions, moderatorMask)
+	}
+	if me.RolePosition != 60 || me.IsOwner {
+		t.Errorf("role_position = %d, is_owner = %v; want 60/false", me.RolePosition, me.IsOwner)
+	}
+}
+
+func TestGetMe_OwnerFlagged(t *testing.T) {
+	database := openAdminTestDB(t)
+	handler := admin.NewAdminAPI(database, "1.0.0", &mockHub{}, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
+	token := createAdminUser(t, database)
+
+	w := doRequest(t, handler, http.MethodGet, "/me", token, nil)
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", w.Code, w.Body.String())
+	}
+	var me struct {
+		IsOwner bool `json:"is_owner"`
+	}
+	if err := json.Unmarshal(w.Body.Bytes(), &me); err != nil {
+		t.Fatalf("unmarshal me: %v", err)
+	}
+	if !me.IsOwner {
+		t.Error("is_owner = false for the Owner role")
+	}
+}
diff --git a/Server/admin/perm_grid_test.go b/Server/admin/perm_grid_test.go
new file mode 100644
index 00000000..bd7992b8
--- /dev/null
+++ b/Server/admin/perm_grid_test.go
@@ -0,0 +1,149 @@
+package admin_test
+
+import (
+	"os"
+	"regexp"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/owncord/server/permissions"
+)
+
+// The admin panel's role editor renders one checkbox per permission bit from a
+// PERM_GROUPS literal in the static HTML. Nothing compiles that literal, so a
+// bit added to permissions.AllPerms without being added there becomes silently
+// ungrantable through the panel — the role editor would quietly clear it on
+// every save, because collectRolePerms rebuilds the mask from the boxes it
+// rendered. These tests are the only thing tying the two together.
+
+var permGroupsBlockRe = regexp.MustCompile(`(?s)const PERM_GROUPS=\[(.*?)\n\];`)
+
+// permGridBits extracts the bit values the panel's permission grid renders.
+func permGridBits(t *testing.T) []int64 {
+	t.Helper()
+	source, err := os.ReadFile("static/index.html")
+	if err != nil {
+		t.Fatalf("read admin panel: %v", err)
+	}
+	block := permGroupsBlockRe.FindSubmatch(source)
+	if block == nil {
+		t.Fatal("PERM_GROUPS literal not found in static/index.html")
+	}
+	// Each entry is [0x…,'Label','Description'].
+	entryRe := regexp.MustCompile(`\[(0x[0-9a-fA-F]+),'`)
+	matches := entryRe.FindAllSubmatch(block[1], -1)
+	if len(matches) == 0 {
+		t.Fatal("PERM_GROUPS contains no permission entries")
+	}
+	bits := make([]int64, 0, len(matches))
+	for _, m := range matches {
+		bit, err := strconv.ParseInt(strings.TrimPrefix(string(m[1]), "0x"), 16, 64)
+		if err != nil {
+			t.Fatalf("unparseable bit %q: %v", m[1], err)
+		}
+		bits = append(bits, bit)
+	}
+	return bits
+}
+
+func TestAdminPanelPermGridCoversEveryPermissionBit(t *testing.T) {
+	var mask int64
+	for _, bit := range permGridBits(t) {
+		mask |= bit
+	}
+	if mask != permissions.AllPerms {
+		missing := permissions.AllPerms &^ mask
+		extra := mask &^ permissions.AllPerms
+		t.Errorf("panel permission grid mask = %#x, want %#x (missing %#x, undefined %#x)",
+			mask, permissions.AllPerms, missing, extra)
+	}
+}
+
+func TestAdminPanelPermGridHasNoDuplicateOrCompositeBits(t *testing.T) {
+	seen := make(map[int64]bool)
+	for _, bit := range permGridBits(t) {
+		// A checkbox must map to exactly one bit: collectRolePerms ORs the
+		// checked values together, so a composite entry would grant several
+		// permissions from one box and could not express clearing just one.
+		if bit&(bit-1) != 0 {
+			t.Errorf("permission grid entry %#x sets more than one bit", bit)
+		}
+		if seen[bit] {
+			t.Errorf("permission grid lists bit %#x (%s) twice", bit, permissions.Name(bit))
+		}
+		seen[bit] = true
+	}
+	if len(seen) != len(permGridBits(t)) {
+		t.Errorf("permission grid has %d entries but %d distinct bits", len(permGridBits(t)), len(seen))
+	}
+}
+
+// ─── Override matrix ─────────────────────────────────────────────────────────
+
+var overrideBitsBlockRe = regexp.MustCompile(`(?s)const OVERRIDE_BITS=\[(.*?)\n\];`)
+
+// overrideMatrixBits extracts the bits the channel-permission matrix editor
+// renders one tri-state row for.
+func overrideMatrixBits(t *testing.T) []int64 {
+	t.Helper()
+	source, err := os.ReadFile("static/index.html")
+	if err != nil {
+		t.Fatalf("read admin panel: %v", err)
+	}
+	block := overrideBitsBlockRe.FindSubmatch(source)
+	if block == nil {
+		t.Fatal("OVERRIDE_BITS literal not found in static/index.html")
+	}
+	entryRe := regexp.MustCompile(`\[(0x[0-9a-fA-F]+),'`)
+	matches := entryRe.FindAllSubmatch(block[1], -1)
+	if len(matches) == 0 {
+		t.Fatal("OVERRIDE_BITS contains no entries")
+	}
+	bits := make([]int64, 0, len(matches))
+	for _, m := range matches {
+		bit, err := strconv.ParseInt(strings.TrimPrefix(string(m[1]), "0x"), 16, 64)
+		if err != nil {
+			t.Fatalf("unparseable bit %q: %v", m[1], err)
+		}
+		bits = append(bits, bit)
+	}
+	return bits
+}
+
+// The matrix covers exactly the bits a CHANNEL override can meaningfully carry.
+// Server-wide bits are deliberately absent: an override on MANAGE_ROLES would
+// write a mask nothing ever resolves.
+func TestAdminPanelOverrideMatrixCoversChannelScopedBits(t *testing.T) {
+	want := permissions.ReadMessages | permissions.SendMessages | permissions.AttachFiles |
+		permissions.AddReactions | permissions.ManageMessages | permissions.MentionEveryone |
+		permissions.ConnectVoice | permissions.SpeakVoice | permissions.UseVideo |
+		permissions.ShareScreen
+
+	var mask int64
+	for _, bit := range overrideMatrixBits(t) {
+		mask |= bit
+	}
+	if mask != want {
+		t.Errorf("override matrix mask = %#x, want %#x (missing %#x, extra %#x)",
+			mask, want, want&^mask, mask&^want)
+	}
+}
+
+func TestAdminPanelOverrideMatrixHasSingleDefinedBits(t *testing.T) {
+	seen := make(map[int64]bool)
+	for _, bit := range overrideMatrixBits(t) {
+		// collectOverrideMasks ORs each checked row's bit into one of the two
+		// masks, so a composite row could not express clearing just one bit.
+		if bit&(bit-1) != 0 {
+			t.Errorf("override matrix entry %#x sets more than one bit", bit)
+		}
+		if bit&permissions.AllPerms != bit {
+			t.Errorf("override matrix entry %#x is not a defined permission bit", bit)
+		}
+		if seen[bit] {
+			t.Errorf("override matrix lists bit %#x (%s) twice", bit, permissions.Name(bit))
+		}
+		seen[bit] = true
+	}
+}
diff --git a/Server/admin/setup_handler_test.go b/Server/admin/setup_handler_test.go
index 8d98143b..f450fa42 100644
--- a/Server/admin/setup_handler_test.go
+++ b/Server/admin/setup_handler_test.go
@@ -14,7 +14,7 @@ import (
 
 func TestSetupStatus_NeedsSetup(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	rr := doRequest(t, handler, "GET", "/setup/status", "", nil)
 	if rr.Code != http.StatusOK {
@@ -35,7 +35,7 @@ func TestSetupStatus_NeedsSetup(t *testing.T) {
 func TestSetupStatus_NoSetupNeeded(t *testing.T) {
 	database := openAdminTestDB(t)
 	createAdminUser(t, database) // Create a user first
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	rr := doRequest(t, handler, "GET", "/setup/status", "", nil)
 	if rr.Code != http.StatusOK {
@@ -55,7 +55,7 @@ func TestSetupStatus_NoSetupNeeded(t *testing.T) {
 
 func TestSetup_CreatesOwner(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	rr := doRequest(t, handler, "POST", "/setup", "", map[string]string{
 		"username": "myadmin",
@@ -100,7 +100,7 @@ func TestSetup_CreatesOwner(t *testing.T) {
 
 func TestSetup_BlockedAfterFirstUser(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	// First setup succeeds.
 	rr := doRequest(t, handler, "POST", "/setup", "", map[string]string{
@@ -123,7 +123,7 @@ func TestSetup_BlockedAfterFirstUser(t *testing.T) {
 
 func TestSetup_WeakPassword(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	rr := doRequest(t, handler, "POST", "/setup", "", map[string]string{
 		"username": "admin",
@@ -136,7 +136,7 @@ func TestSetup_WeakPassword(t *testing.T) {
 
 func TestSetup_MissingFields(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	rr := doRequest(t, handler, "POST", "/setup", "", map[string]string{
 		"username": "",
@@ -151,7 +151,7 @@ func TestSetup_MissingFields(t *testing.T) {
 // server and asserts that exactly one owner is created (BUG-119).
 func TestSetup_ConcurrentRace(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	const goroutines = 20
 	results := make(chan int, goroutines)
@@ -204,7 +204,7 @@ func TestSetup_ConcurrentRace(t *testing.T) {
 // on an empty allowlist, and a foreign origin still does not.
 func TestSetup_SameOriginAllowedWithEmptyAllowlist(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	body, err := json.Marshal(map[string]string{"username": "owner", "password": "correct-horse"})
 	if err != nil {
@@ -226,7 +226,7 @@ func TestSetup_SameOriginAllowedWithEmptyAllowlist(t *testing.T) {
 
 func TestSetup_ForeignOriginStillBlocked(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	body, err := json.Marshal(map[string]string{"username": "owner", "password": "correct-horse"})
 	if err != nil {
diff --git a/Server/admin/setup_wizard_test.go b/Server/admin/setup_wizard_test.go
index 4e20e4cf..0cd23839 100644
--- a/Server/admin/setup_wizard_test.go
+++ b/Server/admin/setup_wizard_test.go
@@ -36,7 +36,7 @@ func wizardRunningCfg() *config.Config {
 // that signals restarted (buffered) instead of respawning the process.
 func wizardHandler(t *testing.T, database *db.DB, cfgPath string, restarted chan string) http.Handler {
 	t.Helper()
-	return admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database),
+	return admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database),
 		admin.SetupOptions{
 			ConfigPath: cfgPath,
 			RunningCfg: wizardRunningCfg(),
diff --git a/Server/admin/static/index.html b/Server/admin/static/index.html
index c1bc8f9d..fbead1eb 100644
--- a/Server/admin/static/index.html
+++ b/Server/admin/static/index.html
@@ -111,6 +111,14 @@
   .form-input{width:100%;padding:10px 12px;background:var(--bg-input);color:var(--text-normal);border:1px solid var(--border);border-radius:var(--radius-sm);font-size:14px;transition:border-color .2s}
   .form-input::placeholder{color:var(--text-micro)}.form-input:focus{border-color:var(--accent)}
   .form-textarea{resize:vertical;min-height:80px}
+  .role-swatch{width:14px;height:14px;border-radius:50%;flex-shrink:0;border:1px solid var(--border-strong)}
+  .perm-group{margin-bottom:14px}
+  .perm-group-title{font-size:11px;font-weight:700;color:var(--text-faint);letter-spacing:.04em;text-transform:uppercase;margin-bottom:6px}
+  .perm-grid{display:grid;grid-template-columns:1fr 1fr;gap:4px 12px}
+  .perm-item{display:flex;align-items:flex-start;gap:7px;font-size:13px;color:var(--text-muted);cursor:pointer}
+  .perm-item input{margin-top:2px;flex-shrink:0}
+  .perm-item.locked{opacity:.45;cursor:not-allowed}
+  @media(max-width:600px){.perm-grid{grid-template-columns:1fr}}
   .toggle{width:40px;height:22px;border-radius:11px;background:var(--border-strong);cursor:pointer;position:relative;transition:background .2s;flex-shrink:0;padding:0;appearance:none;-webkit-appearance:none;border:none}
   .toggle.on{background:var(--green)}
   .toggle::after{content:'';position:absolute;width:16px;height:16px;border-radius:50%;background:white;top:3px;left:3px;transition:transform .2s}
@@ -294,13 +302,18 @@ const I={
   lock:'<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="11" width="18" height="11" rx="2" ry="2"/><path d="M7 11V7a5 5 0 0 1 10 0v4"/></svg>',
   plugins:'<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M6 3v6"/><path d="M18 3v6"/><path d="M4 9h16v4a8 8 0 0 1-16 0z"/><path d="M12 21v-4"/></svg>',
   upload:'<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="17 8 12 3 7 8"/><line x1="12" y1="3" x2="12" y2="15"/></svg>',
+  shield:'<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>',
+  arrowUp:'<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="12" y1="19" x2="12" y2="5"/><polyline points="5 12 12 5 19 12"/></svg>',
+  arrowDown:'<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="12" y1="5" x2="12" y2="19"/><polyline points="19 12 12 19 5 12"/></svg>',
+  smile:'<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><path d="M8 14s1.5 2 4 2 4-2 4-2"/><line x1="9" y1="9" x2="9.01" y2="9"/><line x1="15" y1="9" x2="15.01" y2="9"/></svg>',
 };
 
 /* ═══ State ═══ */
 const PAGE_SIZE=50;
 const state={section:'dashboard',token:localStorage.getItem('admin_token')||'',
+  me:null,
   usersPage:1,auditPage:1,auditSearch:'',auditActionFilter:'all',auditCache:[],settingsChanged:false,backupRunning:false,updateApplying:false,
-  cachedStats:null,cachedUpdate:null,channelCache:{},pluginRuntime:'unknown',pluginBusy:false,
+  cachedStats:null,cachedUpdate:null,channelCache:{},roleList:[],pluginRuntime:'unknown',pluginBusy:false,
   logEntries:[],logLevels:{DEBUG:true,INFO:true,WARN:true,ERROR:true},
   logSearch:'',logAutoScroll:true,logPaused:false,logEventSource:null,logReconnectTimer:null,logConnectSeq:0,logMaxLines:2000};
 
@@ -312,7 +325,7 @@ function handleSessionExpired(){
   state.logConnectSeq++;
   if(state.logEventSource){state.logEventSource.close();state.logEventSource=null}
   if(state.logReconnectTimer){clearTimeout(state.logReconnectTimer);state.logReconnectTimer=null}
-  state.token='';localStorage.removeItem('admin_token');
+  state.token='';state.me=null;localStorage.removeItem('admin_token');
   const err=document.getElementById('loginErr');if(err)err.textContent='Your session expired — sign in again.';
   showOverlay('loginOverlay');
 }
@@ -328,6 +341,23 @@ async function api(method,path,body){
   return data;
 }
 
+/* ═══ Permissions ═══ */
+/* The panel perimeter admits any role holding one moderation bit, so what a
+   principal may actually do varies. GET /admin/api/me reports the caller's
+   role mask; tabs and row actions hide what it cannot use. Hiding is an
+   affordance only — every route re-checks the bit server-side. */
+const PERM={MANAGE_CHANNELS:0x20000,KICK_MEMBERS:0x40000,BAN_MEMBERS:0x80000,
+  MUTE_MEMBERS:0x100000,MANAGE_ROLES:0x1000000,MANAGE_SERVER:0x2000000,
+  VIEW_AUDIT_LOG:0x8000000,ADMINISTRATOR:0x40000000};
+function can(bit){
+  const p=(state.me&&state.me.permissions)||0;
+  if((p&PERM.ADMINISTRATOR)!==0)return true;
+  return (p&bit)===bit;
+}
+/* Owner-only routes (tokens, backups, updates) gate on role position, not on
+   a bit, so the mask alone cannot answer this. */
+function isOwner(){return !!(state.me&&state.me.is_owner)}
+
 /* ═══ Utilities ═══ */
 function esc(s){if(s===null||s===undefined)return'';return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;')}
 /* Escape for embedding inside a single-quoted JS string in an inline onclick
@@ -337,8 +367,24 @@ function jsq(s){return esc(String(s).replace(/\\/g,'\\\\').replace(/'/g,"\\'"))}
 function fmtBytes(b){if(b<1024)return b+' B';if(b<1048576)return(b/1024).toFixed(1)+' KB';if(b<1073741824)return(b/1048576).toFixed(1)+' MB';return(b/1073741824).toFixed(2)+' GB'}
 function actionBadge(a){if(!a)return'badge-muted';if(a.includes('ban')||a.includes('kick')||a.includes('delete'))return'badge-red';if(a.includes('create'))return'badge-green';if(a.includes('update'))return'badge-yellow';return'badge-accent'}
 function actionColor(a){if(!a)return'var(--accent)';if(a.includes('ban')||a.includes('kick')||a.includes('delete'))return'var(--red)';if(a.includes('create'))return'var(--green)';if(a.includes('update'))return'var(--yellow)';return'var(--accent)'}
-function roleColor(rid){return{1:'var(--role-owner)',2:'var(--role-admin)',3:'var(--role-mod)'}[rid]||'var(--role-member)'}
-function roleName(rid){return{1:'Owner',2:'Admin',3:'Moderator',4:'Member'}[rid]||'Member'}
+/* Roles are createable now, so the four seeded ids are a fallback, not the set.
+   Anything role-shaped prefers the live list (state.roleList, filled by the
+   Roles section and by openEditUser) and only then the seeded map — otherwise a
+   custom role renders as "Member" in its own colour. */
+function roleFromCache(rid){return (state.roleList||[]).find(r=>r.id===rid)||null}
+function roleColor(rid){
+  const r=roleFromCache(rid);
+  if(r&&r.color)return r.color;
+  return{1:'var(--role-owner)',2:'var(--role-admin)',3:'var(--role-mod)'}[rid]||'var(--role-member)';
+}
+/* name is the server-supplied role_name where the caller has one (the users
+   list ships it); it wins over any cache because it is always current. */
+function roleName(rid,name){
+  if(name)return name;
+  const r=roleFromCache(rid);
+  if(r)return r.name;
+  return{1:'Owner',2:'Admin',3:'Moderator',4:'Member'}[rid]||'Member';
+}
 
 function showToast(msg,type='success'){
   const t=document.getElementById('toast');
@@ -365,7 +411,28 @@ function showApp(){hideAll();document.getElementById('adminShell').classList.rem
 async function checkAuth(){
   try{const r=await fetch('/admin/api/setup/status');const d=await r.json();if(d.needs_setup){wizInit(d.defaults);showOverlay('setupOverlay');return}}catch(e){console.error('setup check:',e)}
   if(!state.token){showOverlay('loginOverlay');return}
-  try{await api('GET','/stats');showApp();renderNav();renderContent()}catch(e){showOverlay('loginOverlay')}
+  try{await enterApp()}catch(e){showOverlay('loginOverlay')}
+}
+
+/* Loads the caller's permissions before the first render — the nav is built
+   from them, so rendering earlier would flash tabs the principal cannot open.
+   Throws on an unusable session so callers fall back to the login overlay. */
+/* A #section fragment deep-links the panel: the desktop client's "Audit Log"
+   entry opens /admin#audit, so the operator lands on the log rather than on the
+   dashboard with a tab still to find. Applied before the permission fallback
+   below, so a fragment naming a section the principal may not open falls back
+   to the dashboard exactly like a stale stored section does. */
+function sectionFromHash(){
+  const id=(location.hash||'').replace(/^#/,'');
+  return NAV.some(n=>n.id===id)?id:'';
+}
+
+async function enterApp(){
+  state.me=await api('GET','/me');
+  const deepLink=sectionFromHash();
+  if(deepLink)state.section=deepLink;
+  if(!sectionAllowed(state.section))state.section='dashboard';
+  showApp();renderNav();renderContent();
 }
 
 /* ═══ First-Run Setup Wizard ═══ */
@@ -577,7 +644,7 @@ function beginRestartWait(url){
   },4000);
 }
 
-document.getElementById('setupContinueBtn').onclick=()=>{showApp();renderNav();renderContent()};
+document.getElementById('setupContinueBtn').onclick=()=>{enterApp().catch(()=>showOverlay('loginOverlay'))};
 function copyInvite(){navigator.clipboard.writeText(document.getElementById('inviteCode').textContent).then(()=>showToast('Copied!','info')).catch(()=>showToast('Copy failed','error'))}
 
 document.getElementById('loginBtn').onclick=async()=>{
@@ -589,7 +656,7 @@ document.getElementById('loginBtn').onclick=async()=>{
   if(btn.disabled)return;
   btn.disabled=true;
   try{const r=await fetch('/api/v1/auth/login',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({username:u,password:p})});const d=await r.json();if(!r.ok)throw new Error(d.message||'Login failed');
-    state.token=d.token;localStorage.setItem('admin_token',state.token);showApp();renderNav();renderContent();
+    state.token=d.token;localStorage.setItem('admin_token',state.token);await enterApp();
   }catch(e){err.textContent=e.message}
   finally{btn.disabled=false}
 };
@@ -598,26 +665,59 @@ document.getElementById('loginBtn').onclick=async()=>{
 ['loginUser','loginPass'].forEach(id=>document.getElementById(id).addEventListener('keydown',e=>{if(e.key==='Enter')document.getElementById('loginBtn').click()}));
 
 /* ═══ Nav ═══ */
+/* `allowed` mirrors the server-side gate on each section's routes; omitted
+   means perimeter-level (any principal the panel let in). */
 const NAV=[
   {section:'Management'},
   {id:'dashboard',label:'Dashboard',icon:I.dashboard},
   {id:'users',label:'Users',icon:I.users},
-  {id:'channels',label:'Channels',icon:I.channels},
+  {id:'channels',label:'Channels',icon:I.channels,allowed:()=>can(PERM.MANAGE_CHANNELS)},
+  {id:'roles',label:'Roles',icon:I.shield,allowed:()=>can(PERM.MANAGE_ROLES)},
+  {id:'emoji',label:'Emoji',icon:I.smile,allowed:()=>can(PERM.MANAGE_SERVER)},
   {sep:true},
   {section:'Configuration'},
-  {id:'audit',label:'Audit Log',icon:I.audit},
-  {id:'tokens',label:'API Tokens',icon:I.lock},
-  {id:'plugins',label:'Plugins',icon:I.plugins},
-  {id:'logs',label:'Server Logs',icon:I.logs},
-  {id:'settings',label:'Settings',icon:I.settings,unsaved:()=>state.settingsChanged},
-  {id:'backups',label:'Backups',icon:I.backup},
-  {id:'updates',label:'Updates',icon:I.updates},
+  {id:'audit',label:'Audit Log',icon:I.audit,allowed:()=>can(PERM.VIEW_AUDIT_LOG)},
+  {id:'tokens',label:'API Tokens',icon:I.lock,allowed:isOwner},
+  {id:'plugins',label:'Plugins',icon:I.plugins,allowed:()=>can(PERM.ADMINISTRATOR)},
+  {id:'logs',label:'Server Logs',icon:I.logs,allowed:()=>can(PERM.ADMINISTRATOR)},
+  {id:'settings',label:'Settings',icon:I.settings,unsaved:()=>state.settingsChanged,allowed:()=>can(PERM.MANAGE_SERVER)},
+  {id:'backups',label:'Backups',icon:I.backup,allowed:isOwner},
+  {id:'updates',label:'Updates',icon:I.updates,allowed:isOwner},
   {sep:true},
   {id:'logout',label:'Sign Out',icon:I.logout,danger:true},
 ];
 
+/* True when the principal may open the section. Unknown ids are refused so a
+   stale localStorage/section value can't route into a hidden page. */
+function sectionAllowed(id){
+  const n=NAV.find(x=>x.id===id);
+  if(!n)return false;
+  return !n.allowed||n.allowed();
+}
+
+/* Drops section labels with no visible item under them and separators that
+   would end up leading, trailing, or doubled once entries are filtered out. */
+function visibleNav(){
+  const kept=NAV.filter(n=>n.section||n.sep||!n.allowed||n.allowed());
+  const out=[];
+  for(let i=0;i<kept.length;i++){
+    const n=kept[i];
+    if(n.section){
+      const next=kept[i+1];
+      if(!next||next.section||next.sep)continue;
+    }
+    if(n.sep){
+      const prev=out[out.length-1];
+      if(!prev||prev.sep)continue;
+    }
+    out.push(n);
+  }
+  while(out.length&&out[out.length-1].sep)out.pop();
+  return out;
+}
+
 function renderNav(){
-  document.getElementById('sidebarNav').innerHTML=NAV.map(n=>{
+  document.getElementById('sidebarNav').innerHTML=visibleNav().map(n=>{
     if(n.section)return'<div class="sidebar-label">'+n.section+'</div>';
     if(n.sep)return'<div class="sidebar-sep"></div>';
     const active=state.section===n.id?'active':'';
@@ -629,6 +729,7 @@ function renderNav(){
 }
 
 function navigateTo(id){
+  if(!sectionAllowed(id)){showToast('You do not have permission to open that section','error');return}
   try{
     if(state.section==='logs'&&id!=='logs'){state.logConnectSeq++;if(state.logEventSource){state.logEventSource.close();state.logEventSource=null}if(state.logReconnectTimer){clearTimeout(state.logReconnectTimer);state.logReconnectTimer=null}}
     state.section=id;renderNav();renderContent();
@@ -639,12 +740,12 @@ function navigateTo(id){
   }
 }
 
-function doLogout(){state.logConnectSeq++;if(state.logEventSource){state.logEventSource.close();state.logEventSource=null}if(state.logReconnectTimer){clearTimeout(state.logReconnectTimer);state.logReconnectTimer=null}state.token='';localStorage.removeItem('admin_token');showOverlay('loginOverlay')}
+function doLogout(){state.logConnectSeq++;if(state.logEventSource){state.logEventSource.close();state.logEventSource=null}if(state.logReconnectTimer){clearTimeout(state.logReconnectTimer);state.logReconnectTimer=null}state.token='';state.me=null;localStorage.removeItem('admin_token');showOverlay('loginOverlay')}
 
 /* ═══ Content Router ═══ */
 function renderContent(){
   const c=document.getElementById('content');if(!c)return;c.scrollTop=0;
-  const r={dashboard:renderDashboard,users:renderUsers,channels:renderChannels,audit:renderAudit,tokens:renderTokens,plugins:renderPlugins,logs:renderLogs,settings:renderSettings,backups:renderBackups,updates:renderUpdates};
+  const r={dashboard:renderDashboard,users:renderUsers,channels:renderChannels,roles:renderRoles,emoji:renderEmoji,audit:renderAudit,tokens:renderTokens,plugins:renderPlugins,logs:renderLogs,settings:renderSettings,backups:renderBackups,updates:renderUpdates};
   c.innerHTML='<div class="page-title">Loading...</div>';
   const fn=r[state.section];
   if(typeof fn!=='function'){console.error('[Admin] No render function for section: '+state.section);c.innerHTML='<div class="page-title">Error</div><p style="color:var(--red)">Unknown section: '+esc(state.section)+'</p><button class="btn btn-accent" onclick="navigateTo(\'dashboard\')">Back to Dashboard</button>';return}
@@ -666,7 +767,9 @@ function renderContent(){
 /* ═══ Dashboard ═══ */
 async function renderDashboard(){
   try{state.cachedStats=await api('GET','/stats')}catch(e){return'<div class="page-title">Dashboard</div><p style="color:var(--red)">Failed to load stats: '+esc(e.message)+'</p>'}
-  try{state.cachedUpdate=await api('GET','/updates')}catch(e){/* the banner is optional; the Updates page reports the failure */}
+  /* Update checks are owner-only; skip the call for everyone else instead of
+     spending a guaranteed 403 on every dashboard load. */
+  if(isOwner()){try{state.cachedUpdate=await api('GET','/updates')}catch(e){/* the banner is optional; the Updates page reports the failure */}}
   const s=state.cachedStats;const u=state.cachedUpdate;
   let html='<div class="page-title">Dashboard</div><div class="page-desc">Server overview and statistics</div>';
   if(u&&u.update_available)html+='<div class="update-card" style="border-color:var(--accent);margin-bottom:20px"><div class="update-icon" style="background:var(--accent-glow);color:var(--accent)">'+I.updates+'</div><div class="update-info"><div class="update-ver">Update Available: '+esc(u.latest)+'</div><div class="update-notes">Current: '+esc(u.current)+' &mdash; <button class="btn btn-accent" style="margin-left:8px" onclick="navigateTo(\'updates\')">View Update</button></div></div></div>';
@@ -676,8 +779,8 @@ async function renderDashboard(){
   html+='<div class="stat-card"><div class="stat-card-header"><span class="stat-card-label">Channels</span><div class="stat-card-icon" style="background:rgba(240,178,50,.15);color:var(--yellow)">'+I.channels+'</div></div><div class="stat-card-value">'+(s.channel_count||0)+'</div><div class="stat-card-sub">active</div></div>';
   html+='<div class="stat-card"><div class="stat-card-header"><span class="stat-card-label">Database</span><div class="stat-card-icon" style="background:rgba(88,101,242,.15);color:var(--accent)">'+I.backup+'</div></div><div class="stat-card-value">'+fmtBytes(s.db_size_bytes||0)+'</div><div class="stat-card-sub">SQLite</div></div>';
   html+='</div>';
-  // Recent audit
-  try{
+  // Recent audit — VIEW_AUDIT_LOG only.
+  if(can(PERM.VIEW_AUDIT_LOG))try{
     const entries=await api('GET','/audit-log?limit=5&offset=0');
     if(entries&&entries.length){
       html+='<div class="section-card"><div class="section-card-header"><h3>Recent Activity</h3><button class="btn btn-ghost" onclick="navigateTo(\'audit\')">View All</button></div><div class="section-card-body">';
@@ -703,7 +806,7 @@ async function renderUsers(){
     const statusDot=banned?'banned':status;const statusLabel=banned?'Banned':status==='online'?'Online':'Offline';
     const initial=uname?uname[0].toUpperCase():'?';
     html+='<tr><td><div style="display:flex;align-items:center;gap:8px"><div class="avatar" style="background:var(--accent)">'+initial+'</div><strong>'+esc(uname)+'</strong></div></td>';
-    html+='<td><span class="role-badge"><span class="role-dot" style="background:'+roleColor(rid)+'"></span>'+roleName(rid)+'</span></td>';
+    html+='<td><span class="role-badge"><span class="role-dot" style="background:'+esc(roleColor(rid))+'"></span>'+esc(roleName(rid,u.role_name||u.RoleName))+'</span></td>';
     html+='<td><span class="dot '+statusDot+'"></span>'+statusLabel+'</td>';
     // The ban reason is collected on ban and stored server-side; showing it
     // here is the only place an admin can read back why someone was banned.
@@ -714,10 +817,12 @@ async function renderUsers(){
       :'<span class="badge badge-muted">No</span>';
     html+='<td>'+bannedCell+'</td>';
     html+='<td><div class="act-group" style="justify-content:flex-end">';
-    html+='<button class="act-btn" title="Edit role" onclick="openEditUser('+uid+',\''+jsq(uname)+'\','+rid+')">'+I.edit+'</button>';
-    html+='<button class="act-btn" title="Force logout" onclick="forceLogout('+uid+')">'+I.disconnect+'</button>';
-    if(banned)html+='<button class="act-btn" title="Unban" onclick="unbanUser('+uid+')">'+I.check+'</button>';
-    else html+='<button class="act-btn danger" title="Ban" onclick="openBanUser('+uid+',\''+jsq(uname)+'\')">'+I.ban+'</button>';
+    if(can(PERM.MANAGE_ROLES))html+='<button class="act-btn" title="Edit role" onclick="openEditUser('+uid+',\''+jsq(uname)+'\','+rid+')">'+I.edit+'</button>';
+    if(can(PERM.KICK_MEMBERS))html+='<button class="act-btn" title="Force Logout" onclick="forceLogout('+uid+')">'+I.disconnect+'</button>';
+    if(can(PERM.BAN_MEMBERS)){
+      if(banned)html+='<button class="act-btn" title="Unban" onclick="unbanUser('+uid+')">'+I.check+'</button>';
+      else html+='<button class="act-btn danger" title="Ban" onclick="openBanUser('+uid+',\''+jsq(uname)+'\')">'+I.ban+'</button>';
+    }
     html+='</div></td></tr>';
   });
   html+='</tbody></table></div></div>';
@@ -729,8 +834,26 @@ async function renderUsers(){
   return html;
 }
 
-function openEditUser(uid,uname,currentRole){
-  openModal('<div class="modal-header"><h3>Edit User</h3><button class="modal-close" onclick="closeModal()">&times;</button></div><div class="modal-body"><div style="display:flex;align-items:center;gap:12px;margin-bottom:20px"><div class="avatar" style="background:var(--accent);width:48px;height:48px;font-size:20px">'+uname[0].toUpperCase()+'</div><div style="font-size:16px;font-weight:700;color:white">'+esc(uname)+'</div></div><div class="form-group"><label class="form-label">Role</label><select class="form-input" id="editRoleSelect" style="appearance:auto"><option value="1" '+(currentRole===1?'selected':'')+'>Owner</option><option value="2" '+(currentRole===2?'selected':'')+'>Admin</option><option value="3" '+(currentRole===3?'selected':'')+'>Moderator</option><option value="4" '+(currentRole===4?'selected':'')+'>Member</option></select></div></div><div class="modal-footer"><button class="btn btn-ghost" onclick="closeModal()">Cancel</button><button class="btn btn-accent" onclick="saveUserRole('+uid+')">Save</button></div>');
+/* Seeded roles with their hierarchy positions — the fallback used only when the
+   live list cannot be read. Role CRUD means the real set is whatever /roles
+   returns, so assigning a custom role must not depend on this literal. */
+const ROLE_CHOICES=[{id:1,name:'Owner',position:100},{id:2,name:'Admin',position:80},{id:3,name:'Moderator',position:60},{id:4,name:'Member',position:40}];
+
+/* The picker needs every assignable role, not the four seeded ones. The button
+   that opens this is gated on MANAGE_ROLES, which is exactly what GET /roles
+   requires, so the fetch is authorized whenever the modal is reachable; a
+   failure degrades to the seeded list rather than blocking the edit. */
+async function openEditUser(uid,uname,currentRole){
+  const myPos=(state.me&&state.me.role_position)||0;
+  let roles;
+  try{roles=await api('GET','/roles');state.roleList=roles||[]}
+  catch(e){roles=ROLE_CHOICES}
+  /* The server refuses to assign a role positioned at or above the actor's
+     own, so anything higher is dropped rather than offered as a guaranteed
+     403. The current role is always listed so the select can show it. */
+  const opts=roles.filter(r=>r.position<myPos||r.id===currentRole)
+    .map(r=>'<option value="'+r.id+'" '+(currentRole===r.id?'selected':'')+'>'+esc(r.name)+'</option>').join('');
+  openModal('<div class="modal-header"><h3>Edit User</h3><button class="modal-close" onclick="closeModal()">&times;</button></div><div class="modal-body"><div style="display:flex;align-items:center;gap:12px;margin-bottom:20px"><div class="avatar" style="background:var(--accent);width:48px;height:48px;font-size:20px">'+uname[0].toUpperCase()+'</div><div style="font-size:16px;font-weight:700;color:white">'+esc(uname)+'</div></div><div class="form-group"><label class="form-label">Role</label><select class="form-input" id="editRoleSelect" style="appearance:auto">'+opts+'</select></div></div><div class="modal-footer"><button class="btn btn-ghost" onclick="closeModal()">Cancel</button><button class="btn btn-accent" onclick="saveUserRole('+uid+')">Save</button></div>');
 }
 
 async function saveUserRole(uid){
@@ -752,11 +875,11 @@ async function unbanUser(uid){
 }
 
 async function forceLogout(uid){
-  openModal('<div class="modal-header"><h3>Force Logout</h3><button class="modal-close" onclick="closeModal()">&times;</button></div><div class="modal-body"><p style="color:var(--text-muted)">Terminate all sessions for this user?</p></div><div class="modal-footer"><button class="btn btn-ghost" onclick="closeModal()">Cancel</button><button class="btn btn-danger" onclick="confirmForceLogout('+uid+')">Logout</button></div>');
+  openModal('<div class="modal-header"><h3>Force Logout</h3><button class="modal-close" onclick="closeModal()">&times;</button></div><div class="modal-body"><p style="color:var(--text-muted)">Terminate all sessions for this user? They can sign back in immediately &mdash; this is not a removal.</p></div><div class="modal-footer"><button class="btn btn-ghost" onclick="closeModal()">Cancel</button><button class="btn btn-danger" onclick="confirmForceLogout('+uid+')">Force Logout</button></div>');
 }
 
 async function confirmForceLogout(uid){
-  try{await api('DELETE','/users/'+uid+'/sessions');closeModal();showToast('Sessions terminated');renderContent()}catch(e){showToast(e.message,'error')}
+  try{await api('DELETE','/users/'+uid+'/sessions');closeModal();showToast('Forced logout: all sessions terminated');renderContent()}catch(e){showToast(e.message,'error')}
 }
 
 /* ═══ Channels ═══ */
@@ -764,6 +887,10 @@ async function renderChannels(){
   let channels;
   try{channels=await api('GET','/channels')}catch(e){return'<div class="page-title">Channels</div><p style="color:var(--red)">'+esc(e.message)+'</p>'}
   const chIcon=t=>t==='voice'?I.voice:t==='announcement'?I.megaphone:I.channels;
+  /* Categories are free text — a channel of any type may live under any one of
+     them. Collect the ones already in use so the create/edit forms can offer
+     them as a datalist instead of hardcoding names nobody has to use. */
+  const catSet={};
   let html='<div class="page-title">Channels</div><div class="page-desc">'+channels.length+' channels</div>';
   html+='<div class="filter-bar"><button class="btn btn-accent" onclick="openChannelModal(null)">'+I.plus+' Create Channel</button></div>';
   html+='<div class="section-card"><div class="section-card-body no-pad"><table class="tbl"><thead><tr><th>Channel</th><th>Type</th><th>Category</th><th>Archived</th><th style="text-align:right">Actions</th></tr></thead><tbody>';
@@ -777,14 +904,25 @@ async function renderChannels(){
     html+='<td>'+(archived?'<span class="badge badge-muted">Yes</span>':'<span class="badge badge-green">No</span>')+'</td>';
     const lockBtn=type==='dm'?'':'<button class="act-btn" title="Access (private channel)" onclick="openChannelPermsModal('+id+',\''+jsq(name)+'\')">'+I.lock+'</button>';
     state.channelCache[id]=ch;
+    if(cat)catSet[cat]=true;
     html+='<td><div class="act-group" style="justify-content:flex-end"><button class="act-btn" title="Edit" onclick="openChannelEditModal('+id+')">'+I.edit+'</button>'+lockBtn+'<button class="act-btn danger" title="Delete" onclick="openDeleteChannel('+id+',\''+jsq(name)+'\')">'+I.trash+'</button></div></td></tr>';
   });
   html+='</tbody></table></div></div>';
+  state.channelCategories=Object.keys(catSet).sort();
   return html;
 }
 
+/* <datalist> of the categories currently in use. Purely a suggestion list —
+   typing a brand-new name is the supported way to create a category. */
+function categoryDatalist(listId){
+  const cats=state.channelCategories||[];
+  let html='<datalist id="'+listId+'">';
+  cats.forEach(c=>{html+='<option value="'+esc(c)+'"></option>'});
+  return html+'</datalist>';
+}
+
 function openChannelModal(){
-  openModal('<div class="modal-header"><h3>Create Channel</h3><button class="modal-close" onclick="closeModal()">&times;</button></div><div class="modal-body"><div class="form-group"><label class="form-label">Name <span class="req">*</span></label><input class="form-input" id="chName" placeholder="general"></div><div class="form-group"><label class="form-label">Type</label><select class="form-input" id="chType" style="appearance:auto"><option value="text">Text</option><option value="voice">Voice</option><option value="announcement">Announcement</option></select></div><div class="form-group"><label class="form-label">Category</label><input class="form-input" id="chCat" placeholder="Text Channels"></div><div class="form-group"><label class="form-label">Topic</label><input class="form-input" id="chTopic"></div><div class="form-group"><label class="form-label">Position</label><input class="form-input" id="chPos" type="number" value="0" min="0"></div></div><div class="modal-footer"><button class="btn btn-ghost" onclick="closeModal()">Cancel</button><button class="btn btn-accent" onclick="createChannel()">Create</button></div>');
+  openModal('<div class="modal-header"><h3>Create Channel</h3><button class="modal-close" onclick="closeModal()">&times;</button></div><div class="modal-body"><div class="form-group"><label class="form-label">Name <span class="req">*</span></label><input class="form-input" id="chName" placeholder="general"></div><div class="form-group"><label class="form-label">Type</label><select class="form-input" id="chType" style="appearance:auto"><option value="text">Text</option><option value="voice">Voice</option><option value="announcement">Announcement</option></select></div><div class="form-group"><label class="form-label">Category</label><input class="form-input" id="chCat" list="chCatList" placeholder="Text Channels" autocomplete="off">'+categoryDatalist('chCatList')+'<div style="font-size:11px;color:var(--text-faint);margin-top:4px">Any name works, for voice and text channels alike. Leave blank for no category.</div></div><div class="form-group"><label class="form-label">Topic</label><input class="form-input" id="chTopic"></div><div class="form-group"><label class="form-label">Position</label><input class="form-input" id="chPos" type="number" value="0" min="0"></div></div><div class="modal-footer"><button class="btn btn-ghost" onclick="closeModal()">Cancel</button><button class="btn btn-accent" onclick="createChannel()">Create</button></div>');
 }
 
 async function createChannel(){
@@ -793,23 +931,43 @@ async function createChannel(){
   try{await api('POST','/channels',body);closeModal();showToast('Channel created');renderContent()}catch(e){showToast(e.message,'error')}
 }
 
-/* PATCH /channels/{id} accepts name, topic, slow_mode, position and archived —
-   the modal used to offer only the name, so the Archived column in the table
-   was read-only state with no control behind it. */
+/* PATCH /channels/{id} accepts name, topic, category, slow_mode, position,
+   archived, nsfw and the two voice capacity limits — the modal used to offer
+   only the name, so the Archived column in the table was read-only state with
+   no control behind it.
+
+   NSFW is a flag and nothing more: the server stores, broadcasts and audits it
+   but applies no content behaviour to a flagged channel. Clients decide what to
+   do with it (the desktop client shows a per-session age gate).
+
+   The voice limits are only rendered for a voice channel. They are stored on
+   any type, but on a text channel they are values nothing will ever read, and
+   offering them there would imply an enforcement that does not exist. */
 function openChannelEditModal(id){
   const ch=state.channelCache[id]||{};
   const name=ch.name||ch.Name||'';
   const topic=ch.topic||ch.Topic||'';
+  const cat=ch.category||ch.Category||'';
   const slow=ch.slow_mode||ch.SlowMode||0;
   const pos=ch.position||ch.Position||0;
   const archived=ch.archived||ch.Archived||false;
+  const nsfw=ch.nsfw||ch.NSFW||false;
+  const type=ch.type||ch.Type||'text';
+  const maxUsers=ch.voice_max_users||ch.VoiceMaxUsers||0;
+  const maxVideo=ch.voice_max_video||ch.VoiceMaxVideo||0;
+  const voiceRows=type!=='voice'?'':
+     '<div class="form-group"><label class="form-label">User limit (0 = unlimited)</label><input class="form-input" id="chEditMaxUsers" type="number" min="0" max="99" value="'+esc(maxUsers)+'"></div>'
+    +'<div class="form-group"><label class="form-label">Video limit (0 = unlimited)</label><input class="form-input" id="chEditMaxVideo" type="number" min="0" max="99" value="'+esc(maxVideo)+'"></div>';
   openModal('<div class="modal-header"><h3>Edit Channel</h3><button class="modal-close" onclick="closeModal()">&times;</button></div>'
     +'<div class="modal-body">'
     +'<div class="form-group"><label class="form-label">Name</label><input class="form-input" id="chEditName" value="'+esc(name)+'"></div>'
     +'<div class="form-group"><label class="form-label">Topic</label><input class="form-input" id="chEditTopic" value="'+esc(topic)+'"></div>'
+    +'<div class="form-group"><label class="form-label">Category</label><input class="form-input" id="chEditCat" list="chEditCatList" value="'+esc(cat)+'" autocomplete="off">'+categoryDatalist('chEditCatList')+'<div style="font-size:11px;color:var(--text-faint);margin-top:4px">Move the channel to another category, or blank it to leave it uncategorized.</div></div>'
     +'<div class="form-group"><label class="form-label">Slow mode (seconds, 0 = off)</label><input class="form-input" id="chEditSlow" type="number" min="0" value="'+esc(slow)+'"></div>'
     +'<div class="form-group"><label class="form-label">Position</label><input class="form-input" id="chEditPos" type="number" min="0" value="'+esc(pos)+'"></div>'
+    +voiceRows
     +'<div class="setting-row"><div class="setting-info"><div class="setting-name">Archived</div><div class="setting-desc">Hide the channel without deleting its messages</div></div><div class="setting-ctrl"><button class="toggle '+(archived?'on':'')+'" id="chEditArchived" onclick="this.classList.toggle(\'on\')"></button></div></div>'
+    +'<div class="setting-row"><div class="setting-info"><div class="setting-name">Age-restricted (NSFW)</div><div class="setting-desc">Clients show a one-time warning and mark the channel. The server does not filter or restrict anything.</div></div><div class="setting-ctrl"><button class="toggle '+(nsfw?'on':'')+'" id="chEditNsfw" onclick="this.classList.toggle(\'on\')"></button></div></div>'
     +'</div>'
     +'<div class="modal-footer"><button class="btn btn-ghost" onclick="closeModal()">Cancel</button><button class="btn btn-accent" onclick="saveChannelEdit('+id+')">Save</button></div>');
 }
@@ -820,10 +978,20 @@ async function saveChannelEdit(id){
   const body={
     name,
     topic:document.getElementById('chEditTopic').value.trim(),
+    category:document.getElementById('chEditCat').value.trim(),
     slow_mode:parseInt(document.getElementById('chEditSlow').value,10)||0,
     position:parseInt(document.getElementById('chEditPos').value,10)||0,
     archived:document.getElementById('chEditArchived').classList.contains('on'),
+    nsfw:document.getElementById('chEditNsfw').classList.contains('on'),
   };
+  /* Only present for a voice channel. Omitting them entirely (rather than
+     sending 0) is what keeps a text-channel edit from clobbering limits a
+     channel might carry from an earlier life as a voice channel — the handler
+     starts from the stored values for every field the body leaves out. */
+  const maxUsersEl=document.getElementById('chEditMaxUsers');
+  const maxVideoEl=document.getElementById('chEditMaxVideo');
+  if(maxUsersEl){body.voice_max_users=parseInt(maxUsersEl.value,10)||0}
+  if(maxVideoEl){body.voice_max_video=parseInt(maxVideoEl.value,10)||0}
   try{await api('PATCH','/channels/'+id,body);closeModal();showToast('Channel updated');renderContent()}catch(e){showToast(e.message,'error')}
 }
 
@@ -835,47 +1003,379 @@ async function confirmDeleteChannel(id){
   try{await api('DELETE','/channels/'+id);closeModal();showToast('Channel deleted');renderContent()}catch(e){showToast(e.message,'error')}
 }
 
-/* ═══ Channel Access (private channels) ═══ */
+/* ═══ Channel permissions (override matrix) ═══ */
+/* Two editors over the same two endpoints, because they answer two different
+   questions. The quick "Can access" list is the 90% case — hide this channel
+   from a role — and still writes exactly the mask it always did. The matrix
+   below it is the honest one: pick a role OR a single member, then set each
+   relevant bit to allow / inherit / deny, which is what the API has always
+   accepted and what the resolution order (base -> role override -> user
+   override) actually resolves. */
 const DENY_PRIVATE=0x202; /* READ_MESSAGES | CONNECT_VOICE */
 const ADMIN_BIT=0x40000000;
 
+/* The bits worth overriding PER CHANNEL. Server-wide bits (Manage Roles, Ban
+   Members, …) are deliberately absent: they answer to the server, not to one
+   channel, so offering them here would write masks nothing ever reads. */
+const OVERRIDE_BITS=[
+  [0x2,'Read Messages'],
+  [0x1,'Send Messages'],
+  [0x20,'Attach Files'],
+  [0x40,'Add Reactions'],
+  [0x10000,'Manage Messages'],
+  [0x200000,'Mention @everyone'],
+  [0x200,'Connect'],
+  [0x400,'Speak'],
+  [0x800,'Video'],
+  [0x1000,'Share Screen'],
+];
+
+/* Tri-state per bit: 'allow' sets the bit in the allow mask, 'deny' sets it in
+   the deny mask, 'inherit' sets it in neither. An override row whose two masks
+   are both zero is deleted rather than stored — an all-inherit row is the same
+   thing as no row, and keeping it would leave phantom entries in the listing. */
+function overrideStateOf(allow,deny,bit){
+  if((allow&bit)===bit)return 'allow';
+  if((deny&bit)===bit)return 'deny';
+  return 'inherit';
+}
+
 async function openChannelPermsModal(id,name){
-  let data;
-  try{data=await api('GET','/channels/'+id+'/permissions')}catch(e){showToast(e.message,'error');return}
-  const roles=data.roles||[];
-  state.permChannelRoles=roles;
-  let rows='';
-  roles.forEach(role=>{
+  let data,users;
+  try{
+    data=await api('GET','/channels/'+id+'/permissions');
+    users=await api('GET','/users?limit=500&offset=0');
+  }catch(e){showToast(e.message,'error');return}
+  state.permChannel={id:id,name:name,roles:data.roles||[],users:data.users||[],allUsers:users||[]};
+  renderChannelPermsModal();
+}
+
+function renderChannelPermsModal(){
+  const pc=state.permChannel;if(!pc)return;
+  let quick='';
+  pc.roles.forEach(role=>{
     const isAdmin=(role.permissions&ADMIN_BIT)!==0;
     const canAccess=isAdmin||((role.deny&0x2)===0);
-    rows+='<div style="display:flex;align-items:center;justify-content:space-between;padding:8px 0;border-bottom:1px solid var(--bg-active)">'
+    quick+='<div style="display:flex;align-items:center;justify-content:space-between;padding:8px 0;border-bottom:1px solid var(--bg-active)">'
       +'<span style="color:'+roleColor(role.role_id)+';font-weight:600">'+esc(role.role_name)+'</span>'
       +(isAdmin
         ?'<span style="font-size:12px;color:var(--text-faint)">always has access</span>'
         :'<label style="display:flex;align-items:center;gap:8px;font-size:13px;color:var(--text-muted);cursor:pointer"><input type="checkbox" id="permRole'+role.role_id+'" '+(canAccess?'checked':'')+'> Can access</label>')
       +'</div>';
   });
-  openModal('<div class="modal-header"><h3>Channel Access — #'+esc(name)+'</h3><button class="modal-close" onclick="closeModal()">&times;</button></div>'
-    +'<div class="modal-body"><p style="color:var(--text-muted);font-size:13px;margin-bottom:12px">Uncheck a role to hide this channel from it (private channel). Changes apply to connected users immediately; users already in the voice channel are not disconnected.</p>'
-    +rows+'</div>'
-    +'<div class="modal-footer"><button class="btn btn-ghost" onclick="closeModal()">Cancel</button><button class="btn btn-accent" onclick="saveChannelPerms('+id+')">Save</button></div>');
+
+  let opts='<option value="">— pick a role or member —</option><optgroup label="Roles">';
+  pc.roles.forEach(r=>{opts+='<option value="r:'+r.role_id+'">'+esc(r.role_name)+'</option>'});
+  opts+='</optgroup><optgroup label="Members">';
+  /* The member list is paginated, so a member who already has an override could
+     fall outside the page and become uneditable. Union the two lists — the
+     override rows carry the username the picker needs. */
+  const picked=[];const seen={};
+  pc.users.forEach(o=>{seen[o.user_id]=true;picked.push({id:o.user_id,username:o.username,has:true})});
+  pc.allUsers.forEach(u=>{if(!seen[u.id])picked.push({id:u.id,username:u.username,has:false})});
+  picked.sort((a,b)=>String(a.username).localeCompare(String(b.username)));
+  picked.forEach(u=>{
+    opts+='<option value="u:'+u.id+'">'+esc(u.username)+(u.has?' (override)':'')+'</option>';
+  });
+  opts+='</optgroup>';
+
+  openModal('<div class="modal-header"><h3>Channel Permissions — #'+esc(pc.name)+'</h3><button class="modal-close" onclick="closeModal()">&times;</button></div>'
+    +'<div class="modal-body">'
+    +'<p style="color:var(--text-muted);font-size:13px;margin-bottom:12px">Uncheck a role to hide this channel from it (private channel). Changes apply to connected users immediately; users already in the voice channel are not disconnected.</p>'
+    +quick
+    +'<div style="margin-top:18px;padding-top:14px;border-top:1px solid var(--bg-active)">'
+    +'<div class="form-group"><label class="form-label">Override matrix</label>'
+    +'<select class="form-input" id="permTarget" style="appearance:auto" onchange="renderPermMatrix()">'+opts+'</select></div>'
+    +'<p style="color:var(--text-faint);font-size:12px;margin:0 0 10px">Resolution order: base role permissions → role override → member override. A member deny beats a role allow; Administrator bypasses everything.</p>'
+    +'<div id="permMatrix"></div>'
+    +'</div></div>'
+    +'<div class="modal-footer"><button class="btn btn-ghost" onclick="closeModal()">Cancel</button><button class="btn btn-accent" onclick="saveChannelPerms()">Save</button></div>');
+  renderPermMatrix();
 }
 
-async function saveChannelPerms(id){
-  const roles=state.permChannelRoles||[];
+/* Reads the current masks for the selected target and paints one tri-state row
+   per bit. A member with no override row starts all-inherit. */
+function renderPermMatrix(){
+  const pc=state.permChannel;if(!pc)return;
+  const box=document.getElementById('permMatrix');if(!box)return;
+  const sel=document.getElementById('permTarget');
+  const val=sel?sel.value:'';
+  if(!val){box.innerHTML='<p style="color:var(--text-faint);font-size:12px">Pick a role or member above to edit its per-channel bits.</p>';return}
+  const kind=val.charAt(0),tid=parseInt(val.slice(2),10);
+  let allow=0,deny=0,adminNote='';
+  if(kind==='r'){
+    const role=pc.roles.find(r=>r.role_id===tid);
+    if(role){allow=role.allow;deny=role.deny;if((role.permissions&ADMIN_BIT)!==0)adminNote='This role holds Administrator — every override below is bypassed.'}
+  }else{
+    const o=pc.users.find(u=>u.user_id===tid);
+    if(o){allow=o.allow;deny=o.deny}
+  }
+  let html='';
+  if(adminNote)html+='<p style="color:var(--yellow);font-size:12px;margin:0 0 8px">'+esc(adminNote)+'</p>';
+  html+='<table class="tbl"><thead><tr><th>Permission</th><th style="text-align:center">Allow</th><th style="text-align:center">Inherit</th><th style="text-align:center">Deny</th></tr></thead><tbody>';
+  OVERRIDE_BITS.forEach(b=>{
+    const bit=b[0],label=b[1],st=overrideStateOf(allow,deny,bit);
+    html+='<tr><td>'+esc(label)+'</td>';
+    ['allow','inherit','deny'].forEach(k=>{
+      html+='<td style="text-align:center"><input type="radio" name="ovr'+bit+'" data-ovrbit="'+bit+'" value="'+k+'"'+(st===k?' checked':'')+'></td>';
+    });
+    html+='</tr>';
+  });
+  html+='</tbody></table>';
+  html+='<div style="margin-top:10px"><button class="btn btn-ghost" onclick="clearPermOverride()">Clear override</button></div>';
+  box.innerHTML=html;
+}
+
+/* Collects the tri-state rows back into the two masks the API takes. */
+function collectOverrideMasks(){
+  let allow=0,deny=0;
+  document.querySelectorAll('#permMatrix input[data-ovrbit]:checked').forEach(el=>{
+    const bit=parseInt(el.getAttribute('data-ovrbit'),10);
+    if(el.value==='allow')allow|=bit;
+    else if(el.value==='deny')deny|=bit;
+  });
+  return {allow:allow,deny:deny};
+}
+
+function permTargetPath(){
+  const pc=state.permChannel;
+  const sel=document.getElementById('permTarget');
+  const val=sel?sel.value:'';
+  if(!pc||!val)return null;
+  const kind=val.charAt(0),tid=parseInt(val.slice(2),10);
+  return '/channels/'+pc.id+(kind==='r'?'/permissions/':'/user-permissions/')+tid;
+}
+
+async function clearPermOverride(){
+  const path=permTargetPath();
+  if(!path){showToast('Pick a role or member first','error');return}
   try{
-    for(const role of roles){
+    await api('DELETE',path);
+    closeModal();showToast('Override cleared');renderContent();
+  }catch(e){showToast(e.message,'error')}
+}
+
+async function saveChannelPerms(){
+  const pc=state.permChannel;if(!pc)return;
+  try{
+    /* Quick toggles first: same masks this panel has always written. */
+    for(const role of pc.roles){
       if((role.permissions&ADMIN_BIT)!==0)continue;
       const box=document.getElementById('permRole'+role.role_id);
       if(!box)continue;
       const wasHidden=(role.deny&0x2)!==0;
-      if(!box.checked)await api('PUT','/channels/'+id+'/permissions/'+role.role_id,{allow:0,deny:DENY_PRIVATE});
-      else if(wasHidden)await api('DELETE','/channels/'+id+'/permissions/'+role.role_id);
+      if(!box.checked)await api('PUT','/channels/'+pc.id+'/permissions/'+role.role_id,{allow:0,deny:DENY_PRIVATE});
+      else if(wasHidden)await api('DELETE','/channels/'+pc.id+'/permissions/'+role.role_id);
     }
-    closeModal();showToast('Channel access updated');renderContent();
+    /* Then the matrix, if a target is selected. An all-inherit row is a delete:
+       storing (0,0) would leave a row that resolves to nothing. */
+    const path=permTargetPath();
+    if(path){
+      const masks=collectOverrideMasks();
+      if(masks.allow===0&&masks.deny===0)await api('DELETE',path);
+      else await api('PUT',path,masks);
+    }
+    closeModal();showToast('Channel permissions updated');renderContent();
   }catch(e){showToast(e.message,'error')}
 }
 
+/* ═══ Roles ═══ */
+/* Roles are real CRUD now, not four seeded rows. Everything here is gated on
+   MANAGE_ROLES, and the server additionally enforces the hierarchy: you may
+   only touch roles strictly BELOW your own position, and may never grant a bit
+   your own role lacks. The UI mirrors both rules so a doomed request is not
+   offered — but the server is the authority, and a 403 surfaces as a toast. */
+
+/* Permission checkboxes, grouped exactly as docs/schema.md's "Permission
+   groups" section groups the bitfield. Keep the two in step: the doc is the
+   reference an operator reads next to this grid, and every one of the 19
+   defined bits must appear in exactly one group or it becomes ungrantable
+   here. */
+const PERM_GROUPS=[
+  {title:'General',bits:[
+    [0x20000,'Manage Channels','Create, edit and delete channels and their overrides'],
+    [0x1000000,'Manage Roles','Create, edit, delete and assign roles below your own'],
+    [0x4000000,'Manage Invites','Create and revoke invite codes'],
+    [0x2000000,'Manage Server','Read and change server settings'],
+    [0x8000000,'View Audit Log','Read the action history'],
+    [0x40000000,'Administrator','Bypasses every permission check'],
+  ]},
+  {title:'Text',bits:[
+    [0x2,'Read Messages','View messages in text channels'],
+    [0x1,'Send Messages','Post messages in text channels'],
+    [0x20,'Attach Files','Upload file attachments'],
+    [0x40,'Add Reactions','React to messages with emoji'],
+    [0x200000,'Mention @everyone','Give @everyone/@here real mention semantics'],
+    [0x10000,'Manage Messages','Delete others’ messages, pin and purge'],
+  ]},
+  {title:'Voice',bits:[
+    [0x200,'Connect','Join voice channels'],
+    [0x400,'Speak','Transmit audio in voice channels'],
+    [0x800,'Video','Enable the camera in voice channels'],
+    [0x1000,'Share Screen','Share the screen in voice channels'],
+  ]},
+  {title:'Moderation',bits:[
+    [0x40000,'Kick Members','Force-logout a lower-ranked member'],
+    [0x80000,'Ban Members','Ban and unban lower-ranked members'],
+    [0x100000,'Mute Members','Server mute, deafen, move and disconnect in voice'],
+  ]},
+];
+
+/* My own position, from GET /me — the hierarchy boundary every row respects. */
+function myPosition(){return (state.me&&state.me.role_position)||0}
+/* True when the signed-in principal may manage this role at all. */
+function canManageRole(role){return role.position<myPosition()}
+/* True when this bit may be granted: ADMINISTRATOR grants anything, otherwise
+   only bits the caller's own role holds. */
+function canGrantBit(bit){
+  const p=(state.me&&state.me.permissions)||0;
+  if((p&PERM.ADMINISTRATOR)!==0)return true;
+  return (p&bit)===bit;
+}
+
+async function renderRoles(){
+  let roles;
+  try{roles=await api('GET','/roles')}catch(e){return'<div class="page-title">Roles</div><p style="color:var(--red)">'+esc(e.message)+'</p>'}
+  state.roleList=roles||[];
+  let html='<div class="page-title">Roles</div><div class="page-desc">'+state.roleList.length+' roles, highest rank first. You can only manage roles below your own.</div>';
+  html+='<div class="filter-bar"><button class="btn btn-accent" onclick="openRoleModal(null)">'+I.plus+' Create Role</button></div>';
+  html+='<div class="section-card"><div class="section-card-body no-pad"><table class="tbl"><thead><tr><th>Role</th><th>Members</th><th>Position</th><th style="text-align:right">Actions</th></tr></thead><tbody>';
+  if(!state.roleList.length)html+='<tr><td colspan="4" style="text-align:center;color:var(--text-faint);padding:24px">No roles</td></tr>';
+  /* Only the manageable slice can be reordered — the reorder endpoint takes
+     exactly the roles below the caller, so the arrows move within that slice. */
+  const movable=state.roleList.filter(canManageRole);
+  state.roleList.forEach(role=>{
+    const mine=canManageRole(role);
+    const mIdx=movable.findIndex(r=>r.id===role.id);
+    const swatch='<span class="role-swatch" style="background:'+(role.color?esc(role.color):'var(--text-micro)')+'"></span>';
+    html+='<tr><td><div style="display:flex;align-items:center;gap:8px">'+swatch+'<strong style="color:'+(role.color?esc(role.color):'var(--text-normal)')+'">'+esc(role.name)+'</strong>';
+    if(role.is_default)html+='<span class="badge badge-muted">default</span>';
+    if(!mine)html+='<span class="badge badge-muted">above you</span>';
+    html+='</div></td>';
+    html+='<td style="color:var(--text-muted)">'+(role.member_count||0)+'</td>';
+    html+='<td style="font-size:12px;color:var(--text-faint)">'+role.position+'</td>';
+    html+='<td><div class="act-group" style="justify-content:flex-end">';
+    if(mine){
+      const upDisabled=mIdx<=0?'disabled style="opacity:.3"':'';
+      const downDisabled=(mIdx<0||mIdx>=movable.length-1)?'disabled style="opacity:.3"':'';
+      html+='<button class="act-btn" title="Move up" '+upDisabled+' onclick="moveRole('+role.id+',-1)">'+I.arrowUp+'</button>';
+      html+='<button class="act-btn" title="Move down" '+downDisabled+' onclick="moveRole('+role.id+',1)">'+I.arrowDown+'</button>';
+      html+='<button class="act-btn" title="Edit" onclick="openRoleModal('+role.id+')">'+I.edit+'</button>';
+      if(role.is_default)html+='<button class="act-btn" title="The default role cannot be deleted" disabled style="opacity:.3">'+I.trash+'</button>';
+      else html+='<button class="act-btn danger" title="Delete" onclick="openDeleteRole('+role.id+')">'+I.trash+'</button>';
+    }else{
+      html+='<span style="font-size:12px;color:var(--text-micro)">read-only</span>';
+    }
+    html+='</div></td></tr>';
+  });
+  html+='</tbody></table></div></div>';
+  return html;
+}
+
+/* Swap a role with its neighbour and send the whole manageable order. The
+   endpoint normalizes positions, so the client never computes them. */
+async function moveRole(id,delta){
+  const movable=state.roleList.filter(canManageRole);
+  const i=movable.findIndex(r=>r.id===id);
+  const j=i+delta;
+  if(i<0||j<0||j>=movable.length)return;
+  const ids=movable.map(r=>r.id);
+  ids[i]=movable[j].id;ids[j]=movable[i].id;
+  try{await api('PATCH','/roles/reorder',{role_ids:ids});showToast('Roles reordered');renderContent()}
+  catch(e){showToast(e.message,'error')}
+}
+
+/* Shared create/edit modal. id === null creates. */
+function openRoleModal(id){
+  const role=id===null?null:state.roleList.find(r=>r.id===id);
+  if(id!==null&&!role){showToast('Role not found','error');return}
+  const name=role?role.name:'';
+  const color=(role&&role.color)?role.color:'';
+  const perms=role?role.permissions:0;
+  /* A new role defaults to just below the caller, which is what the server
+     does for an omitted position — shown so the number is never a surprise. */
+  const position=role?role.position:Math.max(0,myPosition()-1);
+
+  let grid='';
+  PERM_GROUPS.forEach(g=>{
+    grid+='<div class="perm-group"><div class="perm-group-title">'+esc(g.title)+'</div><div class="perm-grid">';
+    g.bits.forEach(b=>{
+      const bit=b[0],label=b[1],desc=b[2];
+      const granted=(perms&bit)===bit;
+      /* A bit the caller does not hold can only be left as it is: checked and
+         locked when the role already has it (removing is a de-escalation the
+         server allows, but the panel keeps the rule to one sentence), unchecked
+         and locked otherwise. */
+      const locked=!canGrantBit(bit);
+      const title=locked?'Your own role does not have this permission':desc;
+      grid+='<label class="perm-item'+(locked?' locked':'')+'" title="'+esc(title)+'">'
+        +'<input type="checkbox" data-permbit="'+bit+'" '+(granted?'checked':'')+' '+(locked?'disabled':'')+'>'
+        +'<span>'+esc(label)+'</span></label>';
+    });
+    grid+='</div></div>';
+  });
+
+  openModal('<div class="modal-header"><h3>'+(role?'Edit Role':'Create Role')+'</h3><button class="modal-close" onclick="closeModal()">&times;</button></div>'
+    +'<div class="modal-body">'
+    +'<div class="form-group"><label class="form-label">Name <span class="req">*</span></label><input class="form-input" id="roleName" maxlength="32" value="'+esc(name)+'" placeholder="Moderator"></div>'
+    +'<div class="form-group"><label class="form-label">Color</label><div style="display:flex;align-items:center;gap:10px">'
+      +'<input type="color" id="roleColor" value="'+esc(color||'#5865F2')+'" style="width:44px;height:34px;padding:2px;background:var(--bg-input);border:1px solid var(--border);border-radius:var(--radius-sm)">'
+      +'<label style="display:flex;align-items:center;gap:6px;font-size:13px;color:var(--text-muted)"><input type="checkbox" id="roleNoColor" '+(color?'':'checked')+'> No color</label>'
+    +'</div></div>'
+    +'<div class="form-group"><label class="form-label">Position (must be below your own rank of '+myPosition()+')</label><input class="form-input" id="rolePos" type="number" min="0" max="'+Math.max(0,myPosition()-1)+'" value="'+position+'"></div>'
+    +'<div class="form-group"><label class="form-label">Permissions</label>'+grid+'</div>'
+    +'</div>'
+    +'<div class="modal-footer"><button class="btn btn-ghost" onclick="closeModal()">Cancel</button><button class="btn btn-accent" onclick="saveRole('+(role?role.id:'null')+')">'+(role?'Save':'Create')+'</button></div>');
+}
+
+/* Collect the checked bits. Disabled boxes still report their state, so a bit
+   the caller cannot grant is preserved rather than silently stripped. */
+function collectRolePerms(){
+  let mask=0;
+  document.querySelectorAll('#modalInner input[data-permbit]').forEach(box=>{
+    if(box.checked)mask|=parseInt(box.getAttribute('data-permbit'),10);
+  });
+  return mask;
+}
+
+async function saveRole(id){
+  const name=document.getElementById('roleName').value.trim();
+  if(!name){showToast('Name is required','error');return}
+  const noColor=document.getElementById('roleNoColor').checked;
+  const body={
+    name:name,
+    color:noColor?'':document.getElementById('roleColor').value,
+    permissions:collectRolePerms(),
+    position:parseInt(document.getElementById('rolePos').value,10)||0,
+  };
+  try{
+    if(id===null)await api('POST','/roles',body);
+    else await api('PATCH','/roles/'+id,body);
+    closeModal();showToast(id===null?'Role created':'Role updated');renderContent();
+  }catch(e){showToast(e.message,'error')}
+}
+
+function openDeleteRole(id){
+  const role=state.roleList.find(r=>r.id===id);
+  if(!role){showToast('Role not found','error');return}
+  const fallback=state.roleList.find(r=>r.is_default);
+  const fallbackName=fallback?fallback.name:'the default role';
+  const count=role.member_count||0;
+  const members=count===0
+    ?'No members hold this role.'
+    :'<strong style="color:white">'+count+' member'+(count===1?'':'s')+'</strong> will be moved to <strong style="color:white">'+esc(fallbackName)+'</strong>.';
+  openModal('<div class="modal-header"><h3>Delete Role</h3><button class="modal-close" onclick="closeModal()">&times;</button></div>'
+    +'<div class="modal-body"><p style="color:var(--text-muted)">Delete <strong style="color:'+(role.color?esc(role.color):'white')+'">'+esc(role.name)+'</strong>?</p>'
+    +'<p style="color:var(--text-muted);margin-top:8px">'+members+'</p>'
+    +'<p style="color:var(--text-faint);font-size:12px;margin-top:8px">Its channel permission overrides are removed too. This cannot be undone.</p></div>'
+    +'<div class="modal-footer"><button class="btn btn-ghost" onclick="closeModal()">Cancel</button><button class="btn btn-danger" onclick="confirmDeleteRole('+id+')">Delete</button></div>');
+}
+
+async function confirmDeleteRole(id){
+  try{await api('DELETE','/roles/'+id);closeModal();showToast('Role deleted');renderContent()}
+  catch(e){showToast(e.message,'error')}
+}
+
 /* ═══ Audit Log ═══ */
 async function renderAudit(){
   const offset=(state.auditPage-1)*PAGE_SIZE;
@@ -1209,6 +1709,98 @@ async function revokeToken(id){
   try{await api('DELETE','/tokens/'+id);closeModal();showToast('Token revoked');renderContent()}catch(e){showToast(e.message,'error')}
 }
 
+/* ═══ Emoji ═══ */
+/* Custom emoji live on the ordinary member API (/api/v1/emoji) rather than
+   under /admin/api: the desktop client reads the same list, and MANAGE_SERVER
+   is enforced by the route itself. The panel's session token authenticates
+   there unchanged, so this needs its own fetch helper — like pluginApi. */
+async function emojiApi(method,path,opts){
+  const init={method,headers:{'Authorization':'Bearer '+state.token}};
+  if(opts&&opts.body!==undefined)init.body=opts.body;
+  const res=await fetch('/api/v1/emoji'+path,init);
+  if(res.status===401){handleSessionExpired();throw new Error('Your session expired — sign in again.')}
+  if(res.status===204)return null;
+  const text=await res.text();
+  let data=null;
+  if(text){try{data=JSON.parse(text)}catch(e){data=null}}
+  if(!res.ok)throw new Error((data&&(data.message||data.error))||text.trim()||res.statusText);
+  return data;
+}
+
+/* The image route needs the Authorization header, which <img src> cannot send.
+   Each thumbnail is therefore fetched with the token and swapped in as a blob:
+   URL once the section has been written into the DOM. */
+async function loadEmojiThumbnails(){
+  const imgs=document.querySelectorAll('img[data-emoji-url]');
+  for(const img of imgs){
+    try{
+      const res=await fetch(img.getAttribute('data-emoji-url'),{headers:{'Authorization':'Bearer '+state.token}});
+      if(!res.ok)continue;
+      const blob=await res.blob();
+      img.src=URL.createObjectURL(blob);
+      img.addEventListener('load',()=>URL.revokeObjectURL(img.src),{once:true});
+    }catch(e){/* a thumbnail that will not load is not worth an error toast */}
+  }
+}
+
+async function renderEmoji(){
+  let list;
+  try{list=await emojiApi('GET','/')}catch(e){return'<div class="page-title">Emoji</div><p style="color:var(--red)">'+esc(e.message)+'</p>'}
+  if(!Array.isArray(list))list=[];
+
+  let html='<div class="page-title">Emoji</div><div class="page-desc">Server-wide custom emoji, usable as <span style="font-family:var(--font-mono)">:shortcode:</span> in messages and reactions</div>';
+  html+='<div class="section-card"><div class="section-card-header"><h3>Upload</h3></div><div class="section-card-body">';
+  html+='<div style="color:var(--text-faint);font-size:13px;margin-bottom:10px">PNG, JPEG, GIF or WebP. Up to 512 KB and 128&times;128 pixels. Shortcodes are 2-32 characters of a-z, 0-9 or underscore.</div>';
+  html+='<div style="display:flex;gap:8px;align-items:center;flex-wrap:wrap">';
+  html+='<input type="text" id="emojiShortcode" class="form-input" style="max-width:200px" placeholder="shortcode" maxlength="32">';
+  html+='<input type="file" id="emojiFile" accept="image/png,image/jpeg,image/gif,image/webp" class="form-input" style="max-width:320px;padding:8px">';
+  html+='<button class="btn btn-accent" onclick="uploadEmoji()">'+I.upload+' Upload</button>';
+  html+='</div></div></div>';
+
+  html+='<div class="section-card"><div class="section-card-header"><h3>Installed ('+list.length+')</h3><button class="btn btn-ghost" onclick="renderContent()">'+I.refresh+' Refresh</button></div><div class="section-card-body no-pad">';
+  html+='<table class="tbl"><thead><tr><th style="width:60px">Preview</th><th>Shortcode</th><th style="text-align:right">Actions</th></tr></thead><tbody>';
+  if(!list.length)html+='<tr><td colspan="3" style="text-align:center;color:var(--text-faint);padding:24px">No custom emoji yet</td></tr>';
+  else list.forEach(function(e){
+    html+='<tr><td><img alt="'+esc(e.shortcode)+'" data-emoji-url="'+esc(e.url)+'" style="width:32px;height:32px;object-fit:contain"></td>';
+    html+='<td style="font-family:var(--font-mono)">:'+esc(e.shortcode)+':</td>';
+    html+='<td><div class="act-group" style="justify-content:flex-end"><button class="act-btn danger" title="Delete" onclick="confirmDeleteEmoji('+e.id+',\''+jsq(e.shortcode)+'\')">'+I.trash+'</button></div></td></tr>';
+  });
+  html+='</tbody></table></div></div>';
+  setTimeout(loadEmojiThumbnails,0);
+  return html;
+}
+
+async function uploadEmoji(){
+  const codeInput=document.getElementById('emojiShortcode');
+  const fileInput=document.getElementById('emojiFile');
+  const shortcode=(codeInput&&codeInput.value||'').trim();
+  const file=fileInput&&fileInput.files&&fileInput.files[0];
+  if(!shortcode){showToast('Enter a shortcode first','error');return}
+  if(!file){showToast('Choose an image first','error');return}
+  const fd=new FormData();
+  fd.append('shortcode',shortcode);
+  fd.append('file',file);
+  try{
+    /* No explicit Content-Type: the browser must set the multipart boundary. */
+    await emojiApi('POST','/',{body:fd});
+    showToast('Added :'+shortcode.toLowerCase()+':');
+    renderContent();
+  }catch(e){showToast(e.message,'error')}
+}
+
+function confirmDeleteEmoji(id,shortcode){
+  openModal('<div class="modal-header"><h3>Delete Emoji</h3><button class="modal-close" onclick="closeModal()">&times;</button></div><div class="modal-body"><p style="color:var(--text-muted)">Delete <strong style="color:white">:'+esc(shortcode)+':</strong>? Messages and reactions that use it will show the plain text instead. This cannot be undone.</p></div><div class="modal-footer"><button class="btn btn-ghost" onclick="closeModal()">Cancel</button><button class="btn btn-danger" onclick="deleteEmoji('+id+')">Delete</button></div>');
+}
+
+async function deleteEmoji(id){
+  try{
+    await emojiApi('DELETE','/'+id);
+    closeModal();
+    showToast('Emoji deleted');
+    renderContent();
+  }catch(e){showToast(e.message,'error')}
+}
+
 /* ═══ Plugins ═══ */
 /* The plugin lifecycle API lives under /api/v1/admin/plugins (same admin auth
    and IP gate, different prefix), so it needs its own fetch helper rather than
diff --git a/Server/admin/types.go b/Server/admin/types.go
index 0f1b7ec2..befd0329 100644
--- a/Server/admin/types.go
+++ b/Server/admin/types.go
@@ -14,6 +14,10 @@ type adminContextKey int
 const (
 	// adminUserKey is the context key for the authenticated *db.User.
 	adminUserKey adminContextKey = iota
+	// adminRoleKey is the context key for the authenticated principal's
+	// *db.Role. Set by adminAuthMiddleware so requirePerm and the /me handler
+	// need no second query.
+	adminRoleKey
 	// adminSessionKey is the context key for the authenticated *db.Session.
 	adminSessionKey
 	// adminTokenHashKey is the context key for the hash (string) of the bearer
@@ -52,6 +56,16 @@ type HubBroadcaster interface {
 	// messages after a channel permission override change so each connected
 	// client's sidebar reflects its new visibility without a reconnect.
 	RefreshChannelVisibility(ch *db.Channel)
+	// RefreshAllChannelVisibility is RefreshChannelVisibility across every
+	// non-DM channel. A role's permission mask is the base every channel's
+	// effective permission derives from, so a role edit can change visibility
+	// of all of them at once — unlike a channel_overrides edit, which touches
+	// exactly one.
+	RefreshAllChannelVisibility()
+	// BroadcastRolesUpdate ships the full role list to every connected client
+	// after a role mutation, so name colors and permission-gated affordances
+	// converge without a reconnect.
+	BroadcastRolesUpdate(roles []*db.Role)
 	ClientCount() int
 }
 
@@ -82,6 +96,23 @@ type adminUserResponse struct {
 	BanExpires *string `json:"ban_expires,omitempty"`
 }
 
+// ─── adminMeResponse ────────────────────────────────────────────────────────
+
+// adminMeResponse describes the calling principal to the admin panel so it can
+// hide the surfaces the principal's role cannot use. It is an affordance hint
+// only — every route re-checks the bit server-side.
+type adminMeResponse struct {
+	ID           int64  `json:"id"`
+	Username     string `json:"username"`
+	RoleID       int64  `json:"role_id"`
+	RoleName     string `json:"role_name"`
+	RolePosition int    `json:"role_position"`
+	Permissions  int64  `json:"permissions"`
+	// IsOwner mirrors ownerOnlyMiddleware: owner-only routes gate on position,
+	// not on a permission bit, so the panel cannot derive this from the mask.
+	IsOwner bool `json:"is_owner"`
+}
+
 // toAdminUserResponse converts a db.UserWithRole to the safe response shape.
 func toAdminUserResponse(u db.UserWithRole) adminUserResponse {
 	return adminUserResponse{
diff --git a/Server/admin/update_handlers_test.go b/Server/admin/update_handlers_test.go
index fa8b5710..c3ef2006 100644
--- a/Server/admin/update_handlers_test.go
+++ b/Server/admin/update_handlers_test.go
@@ -35,7 +35,7 @@ func TestAdminAPI_CheckUpdate_OK(t *testing.T) {
 	u.SetBaseURL(mockGH.URL)
 
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, u, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, u, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodGet, "/updates", token, nil)
@@ -74,7 +74,7 @@ func TestAdminAPI_CheckUpdate_IncompleteReleaseNotInstallable(t *testing.T) {
 	u.SetBaseURL(mockGH.URL)
 
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, u, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, u, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodGet, "/updates", token, nil)
@@ -107,7 +107,7 @@ func TestAdminAPI_CheckUpdate_UpToDate(t *testing.T) {
 	u.SetBaseURL(mockGH.URL)
 
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, u, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, u, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodGet, "/updates", token, nil)
@@ -124,7 +124,7 @@ func TestAdminAPI_CheckUpdate_UpToDate(t *testing.T) {
 
 func TestAdminAPI_CheckUpdate_Unauthenticated(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	w := doRequest(t, handler, http.MethodGet, "/updates", "", nil)
 	if w.Code != http.StatusUnauthorized {
@@ -134,7 +134,7 @@ func TestAdminAPI_CheckUpdate_Unauthenticated(t *testing.T) {
 
 func TestAdminAPI_ApplyUpdate_RequiresOwner(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	// Create admin user (not owner - role 2)
 	adminUID, _ := database.CreateUser(context.Background(), "adminonly2", "hash", 2)
@@ -154,7 +154,7 @@ func TestAdminAPI_ApplyUpdate_RequiresOwner(t *testing.T) {
 func TestAdminAPI_ApplyUpdate_NilUpdater(t *testing.T) {
 	database := openAdminTestDB(t)
 	// nil updater — the endpoint should return 503
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodPost, "/updates/apply", token, nil)
@@ -167,7 +167,7 @@ func TestAdminAPI_ApplyUpdate_NilUpdater(t *testing.T) {
 // in the 503 response.
 func TestAdminAPI_ApplyUpdate_NilUpdater_ErrorCode(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodPost, "/updates/apply", token, nil)
@@ -199,7 +199,7 @@ func TestAdminAPI_ApplyUpdate_NoUpdateAvailable(t *testing.T) {
 	u.SetBaseURL(mockGH.URL)
 
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, u, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, u, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodPost, "/updates/apply", token, nil)
@@ -230,7 +230,7 @@ func TestAdminAPI_ApplyUpdate_CheckFails(t *testing.T) {
 	u.SetBaseURL(mockGH.URL)
 
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, u, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, u, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodPost, "/updates/apply", token, nil)
@@ -258,7 +258,7 @@ func TestAdminAPI_ApplyUpdate_MissingAssets(t *testing.T) {
 	u.SetBaseURL(mockGH.URL)
 
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, u, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, u, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodPost, "/updates/apply", token, nil)
@@ -279,7 +279,7 @@ func TestAdminAPI_ApplyUpdate_MissingAssets(t *testing.T) {
 // unauthenticated requests to POST /updates/apply.
 func TestAdminAPI_ApplyUpdate_Unauthenticated(t *testing.T) {
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 
 	w := doRequest(t, handler, http.MethodPost, "/updates/apply", "", nil)
 	if w.Code != http.StatusUnauthorized {
@@ -346,7 +346,7 @@ func TestAdminAPI_ApplyUpdate_DownloadFails(t *testing.T) {
 	// the important thing is that the code path is executed.
 
 	database := openAdminTestDB(t)
-	handler := admin.NewAdminAPI(database, "1.0.0", nil, u, nil, nil, nil, newTestModService(database))
+	handler := admin.NewAdminAPI(database, "1.0.0", nil, u, nil, nil, nil, newTestModService(database), newTestRoleService(database))
 	token := createAdminUser(t, database)
 
 	w := doRequest(t, handler, http.MethodPost, "/updates/apply", token, nil)
diff --git a/Server/api/auth_handler.go b/Server/api/auth_handler.go
index 74dd3f65..17580273 100644
--- a/Server/api/auth_handler.go
+++ b/Server/api/auth_handler.go
@@ -42,9 +42,17 @@ type loginRequest struct {
 
 // userResponse is the user shape included in auth responses.
 type userResponse struct {
-	ID          int64  `json:"id"`
-	Username    string `json:"username"`
-	Avatar      string `json:"avatar,omitempty"`
+	ID       int64  `json:"id"`
+	Username string `json:"username"`
+	Avatar   string `json:"avatar,omitempty"`
+	// DisplayName and About are always present (null = unset) so the settings
+	// form can tell "cleared" from "the server does not know this field".
+	DisplayName *string `json:"display_name"`
+	About       *string `json:"about"`
+	// CustomStatus is the user's own free-text status line.
+	CustomStatus *string `json:"custom_status"`
+	// Status is the user's own true status, invisible included. This response
+	// only ever describes the caller, so there is nothing to hide from them.
 	Status      string `json:"status"`
 	RoleID      int64  `json:"role_id"`
 	TOTPEnabled bool   `json:"totp_enabled"`
@@ -466,6 +474,14 @@ func handleLogout(database *db.DB) http.HandlerFunc {
 			return
 		}
 
+		// A custom status is a "what I am doing right now" note. Leaving it
+		// standing after the user signed out states something about them that
+		// is no longer true, so logout clears it — unlike the chosen presence
+		// status, which is a preference and deliberately survives.
+		if err := database.UpdateUserCustomStatus(context.WithoutCancel(r.Context()), sess.UserID, nil); err != nil {
+			slog.Warn("failed to clear custom status on logout", "user_id", sess.UserID, "err", err)
+		}
+
 		slog.Info("user logged out", "user_id", sess.UserID)
 		db.WriteAudit(context.WithoutCancel(r.Context()), database, sess.UserID, "user_logout", "user", sess.UserID, "")
 
@@ -580,13 +596,16 @@ func toUserResponse(u *db.User) *userResponse {
 		avatar = *u.Avatar
 	}
 	resp := &userResponse{
-		ID:          u.ID,
-		Username:    u.Username,
-		Avatar:      avatar,
-		Status:      u.Status,
-		RoleID:      u.RoleID,
-		TOTPEnabled: u.TOTPSecret != nil,
-		CreatedAt:   u.CreatedAt,
+		ID:           u.ID,
+		Username:     u.Username,
+		Avatar:       avatar,
+		DisplayName:  u.DisplayName,
+		About:        u.About,
+		CustomStatus: u.CustomStatus,
+		Status:       u.Status,
+		RoleID:       u.RoleID,
+		TOTPEnabled:  u.TOTPSecret != nil,
+		CreatedAt:    u.CreatedAt,
 	}
 	return resp
 }
diff --git a/Server/api/avatar_handler_test.go b/Server/api/avatar_handler_test.go
new file mode 100644
index 00000000..fb637830
--- /dev/null
+++ b/Server/api/avatar_handler_test.go
@@ -0,0 +1,327 @@
+package api_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/owncord/server/api"
+	"github.com/owncord/server/auth"
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/service"
+	"github.com/owncord/server/storage"
+	"github.com/owncord/server/ws"
+)
+
+// Avatar upload. The interesting properties are the ones a URL-only avatar
+// field never had to answer: what the server accepts as an image, where the
+// bytes end up, and — the one that would otherwise be a privacy bug — who is
+// allowed to fetch them back.
+
+// buildAvatarRouter mounts the profile routes (with storage, so the upload
+// route exists) and the upload routes (so the file can be fetched back)
+// against one database.
+func buildAvatarRouter(database *db.DB, store *storage.Storage) http.Handler {
+	r := chi.NewRouter()
+	limiter := auth.NewRateLimiter()
+	svc := service.New(database, limiter)
+	api.MountProfileRoutes(r, database, svc, store, limiter, nil, nil)
+	api.MountUploadRoutes(r, database, store, limiter, nil, svc.Permissions)
+	return r
+}
+
+func doAvatarUpload(t *testing.T, router http.Handler, token, filename string, content []byte) *httptest.ResponseRecorder {
+	t.Helper()
+	body, contentType := makeMultipartFile(t, "file", filename, content)
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/users/me/avatar", body)
+	req.Header.Set("Content-Type", contentType)
+	if token != "" {
+		req.Header.Set("Authorization", "Bearer "+token)
+	}
+	req.RemoteAddr = "127.0.0.1:9999"
+	rr := httptest.NewRecorder()
+	router.ServeHTTP(rr, req)
+	return rr
+}
+
+func TestUploadAvatar_StoresAndSetsAvatarURL(t *testing.T) {
+	database := newUploadTestDB(t)
+	store := newUploadTestStorage(t)
+	router := buildAvatarRouter(database, store)
+	token := uploadCreateToken(t, database, "pfp_owner", 4)
+
+	rr := doAvatarUpload(t, router, token, "me.png", makePNGBytes(t, 64, 64))
+	if rr.Code != http.StatusCreated {
+		t.Fatalf("status = %d, want 201; body = %s", rr.Code, rr.Body.String())
+	}
+	var resp map[string]any
+	if err := json.NewDecoder(rr.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	id, _ := resp["id"].(string)
+	if id == "" {
+		t.Fatal("response carried no file id")
+	}
+	if resp["url"] != service.AvatarFileURL(id) {
+		t.Errorf("url = %v, want %q", resp["url"], service.AvatarFileURL(id))
+	}
+	if resp["mime"] != "image/png" {
+		t.Errorf("mime = %v, want image/png", resp["mime"])
+	}
+
+	// The column must now point at the served file — that is what makes the
+	// avatar both renderable and readable.
+	user, err := database.GetUserByUsername(context.Background(), "pfp_owner")
+	if err != nil || user == nil {
+		t.Fatalf("GetUserByUsername: %v", err)
+	}
+	if user.Avatar == nil || *user.Avatar != service.AvatarFileURL(id) {
+		t.Fatalf("stored avatar = %v, want %q", user.Avatar, service.AvatarFileURL(id))
+	}
+}
+
+func TestUploadAvatar_IsReadableByOtherUsersWhileInUse(t *testing.T) {
+	database := newUploadTestDB(t)
+	store := newUploadTestStorage(t)
+	router := buildAvatarRouter(database, store)
+	ownerToken := uploadCreateToken(t, database, "avatar_owner", 4)
+	otherToken := uploadCreateToken(t, database, "avatar_peer", 4)
+
+	rr := doAvatarUpload(t, router, ownerToken, "me.png", makePNGBytes(t, 32, 32))
+	if rr.Code != http.StatusCreated {
+		t.Fatalf("upload status = %d; body = %s", rr.Code, rr.Body.String())
+	}
+	var resp map[string]any
+	_ = json.NewDecoder(rr.Body).Decode(&resp)
+	id, _ := resp["id"].(string)
+
+	// An unlinked attachment is normally uploader-only. An avatar has to be
+	// visible to the people who see the messages it sits beside.
+	if got := doServeFile(t, router, id, otherToken, nil); got.Code != http.StatusOK {
+		t.Fatalf("peer fetch status = %d, want 200; body = %s", got.Code, got.Body.String())
+	}
+
+	// Replacing the avatar revokes that: the old file goes back to being a
+	// private unlinked attachment.
+	rr2 := doAvatarUpload(t, router, ownerToken, "me2.png", makePNGBytes(t, 33, 33))
+	if rr2.Code != http.StatusCreated {
+		t.Fatalf("second upload status = %d; body = %s", rr2.Code, rr2.Body.String())
+	}
+	if got := doServeFile(t, router, id, otherToken, nil); got.Code != http.StatusForbidden {
+		t.Errorf("peer fetch of replaced avatar = %d, want 403", got.Code)
+	}
+	// The uploader can still reach their own old file.
+	if got := doServeFile(t, router, id, ownerToken, nil); got.Code != http.StatusOK {
+		t.Errorf("uploader fetch of replaced avatar = %d, want 200", got.Code)
+	}
+}
+
+func TestUploadAvatar_RejectsNonImageAndOversizedDimensions(t *testing.T) {
+	database := newUploadTestDB(t)
+	store := newUploadTestStorage(t)
+	router := buildAvatarRouter(database, store)
+	token := uploadCreateToken(t, database, "avatar_bad", 4)
+
+	// Sniffed from the bytes, never from the filename or the client's header.
+	if rr := doAvatarUpload(t, router, token, "me.png", []byte("this is plain text, not a PNG")); rr.Code != http.StatusBadRequest {
+		t.Errorf("text-as-png status = %d, want 400", rr.Code)
+	}
+	// GIF is a real image and still refused: an animated avatar in every
+	// message row is a distraction the renderer cannot opt out of.
+	gif := []byte("GIF89a")
+	if rr := doAvatarUpload(t, router, token, "me.gif", gif); rr.Code != http.StatusBadRequest {
+		t.Errorf("gif status = %d, want 400", rr.Code)
+	}
+	// Too many pixels for any surface that renders it.
+	if rr := doAvatarUpload(t, router, token, "huge.png", makePNGBytes(t, 2000, 100)); rr.Code != http.StatusBadRequest {
+		t.Errorf("oversized status = %d, want 400", rr.Code)
+	}
+
+	// None of the rejections may have moved the column.
+	user, _ := database.GetUserByUsername(context.Background(), "avatar_bad")
+	if user != nil && user.Avatar != nil && *user.Avatar != "" {
+		t.Errorf("a rejected upload set the avatar to %q", *user.Avatar)
+	}
+}
+
+func TestUploadAvatar_RequiresAuthAndAFile(t *testing.T) {
+	database := newUploadTestDB(t)
+	store := newUploadTestStorage(t)
+	router := buildAvatarRouter(database, store)
+	token := uploadCreateToken(t, database, "avatar_auth", 4)
+
+	if rr := doAvatarUpload(t, router, "", "me.png", makePNGBytes(t, 8, 8)); rr.Code != http.StatusUnauthorized {
+		t.Errorf("anonymous status = %d, want 401", rr.Code)
+	}
+	// Right form, wrong field name.
+	body, contentType := makeMultipartFile(t, "avatar", "me.png", makePNGBytes(t, 8, 8))
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/users/me/avatar", body)
+	req.Header.Set("Content-Type", contentType)
+	req.Header.Set("Authorization", "Bearer "+token)
+	rr := httptest.NewRecorder()
+	router.ServeHTTP(rr, req)
+	if rr.Code != http.StatusBadRequest {
+		t.Errorf("wrong field status = %d, want 400", rr.Code)
+	}
+}
+
+func TestUploadAvatar_NotMountedWithoutStorage(t *testing.T) {
+	database := newUploadTestDB(t)
+	r := chi.NewRouter()
+	limiter := auth.NewRateLimiter()
+	api.MountProfileRoutes(r, database, service.New(database, limiter), nil, limiter, nil, nil)
+	token := uploadCreateToken(t, database, "no_storage", 4)
+
+	if rr := doAvatarUpload(t, r, token, "me.png", makePNGBytes(t, 8, 8)); rr.Code == http.StatusCreated {
+		t.Error("avatar upload must not be served when there is no storage backend")
+	}
+}
+
+// ─── PATCH /users/me: display name and about ─────────────────────────────────
+
+func TestUpdateProfile_SetsDisplayNameAndAbout(t *testing.T) {
+	database := newAuthTestDB(t)
+	router := buildProfileRouter(database)
+	token := profileCreateToken(t, database, "bio_user", 4)
+
+	rr := patchJSON(t, router, "/api/v1/users/me", token, map[string]any{
+		"username":     "bio_user",
+		"display_name": "Bio User",
+		"about":        "writes tests",
+	})
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body = %s", rr.Code, rr.Body.String())
+	}
+	var resp map[string]any
+	_ = json.NewDecoder(rr.Body).Decode(&resp)
+	if resp["display_name"] != "Bio User" {
+		t.Errorf("display_name = %v", resp["display_name"])
+	}
+	if resp["about"] != "writes tests" {
+		t.Errorf("about = %v", resp["about"])
+	}
+
+	// Omitting them leaves them alone.
+	rr = patchJSON(t, router, "/api/v1/users/me", token, map[string]any{"username": "bio_user"})
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", rr.Code)
+	}
+	resp = map[string]any{}
+	_ = json.NewDecoder(rr.Body).Decode(&resp)
+	if resp["display_name"] != "Bio User" || resp["about"] != "writes tests" {
+		t.Errorf("a username-only PATCH cleared fields: %v / %v", resp["display_name"], resp["about"])
+	}
+
+	// An explicit empty string clears them.
+	rr = patchJSON(t, router, "/api/v1/users/me", token, map[string]any{
+		"username": "bio_user", "display_name": "", "about": "",
+	})
+	resp = map[string]any{}
+	_ = json.NewDecoder(rr.Body).Decode(&resp)
+	if resp["display_name"] != nil || resp["about"] != nil {
+		t.Errorf("expected cleared, got %v / %v", resp["display_name"], resp["about"])
+	}
+}
+
+func TestUpdateProfile_RejectsBadDisplayName(t *testing.T) {
+	database := newAuthTestDB(t)
+	router := buildProfileRouter(database)
+	token := profileCreateToken(t, database, "dn_user", 4)
+
+	// A right-to-left override makes a name render as something other than
+	// what it says — the same spoof auth.ValidateUsername rejects.
+	rr := patchJSON(t, router, "/api/v1/users/me", token, map[string]any{
+		"username": "dn_user", "display_name": "ada\u202egnp.exe",
+	})
+	if rr.Code != http.StatusBadRequest {
+		t.Errorf("bidi-override display_name status = %d, want 400", rr.Code)
+	}
+
+	rr = patchJSON(t, router, "/api/v1/users/me", token, map[string]any{
+		"username": "dn_user", "display_name": strings.Repeat("a", 33),
+	})
+	if rr.Code != http.StatusBadRequest {
+		t.Errorf("overlong display_name status = %d, want 400", rr.Code)
+	}
+
+	rr = patchJSON(t, router, "/api/v1/users/me", token, map[string]any{
+		"username": "dn_user", "about": strings.Repeat("b", 301),
+	})
+	if rr.Code != http.StatusBadRequest {
+		t.Errorf("overlong about status = %d, want 400", rr.Code)
+	}
+}
+
+func TestUpdateProfile_BroadcastCarriesEveryProfileField(t *testing.T) {
+	database := newAuthTestDB(t)
+	r := chi.NewRouter()
+	limiter := auth.NewRateLimiter()
+	spy := &userUpdateSpy{}
+	api.MountProfileRoutes(r, database, service.New(database, limiter), nil, limiter, nil, spy)
+	token := profileCreateToken(t, database, "bc_user", 4)
+
+	rr := patchJSON(t, r, "/api/v1/users/me", token, map[string]any{
+		"username": "bc_user", "display_name": "Broadcaster", "about": "hi",
+	})
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d; body = %s", rr.Code, rr.Body.String())
+	}
+	if len(spy.got) != 1 {
+		t.Fatalf("broadcasts = %d, want 1", len(spy.got))
+	}
+	u := spy.got[0]
+	// user_update replaces the client's copy wholesale, so a broadcast that
+	// omits a field would silently blank it everywhere.
+	if u.DisplayName == nil || *u.DisplayName != "Broadcaster" {
+		t.Errorf("broadcast display_name = %v", u.DisplayName)
+	}
+	if u.About == nil || *u.About != "hi" {
+		t.Errorf("broadcast about = %v", u.About)
+	}
+	if u.Username != "bc_user" {
+		t.Errorf("broadcast username = %q", u.Username)
+	}
+}
+
+func TestLogout_ClearsCustomStatus(t *testing.T) {
+	database := newAuthTestDB(t)
+	router := buildAuthRouter(database, auth.NewRateLimiter())
+	token := profileCreateToken(t, database, "logout_status", 4)
+
+	user, err := database.GetUserByUsername(context.Background(), "logout_status")
+	if err != nil || user == nil {
+		t.Fatalf("GetUserByUsername: %v", err)
+	}
+	text := "in a meeting"
+	if err := database.UpdateUserCustomStatus(context.Background(), user.ID, &text); err != nil {
+		t.Fatalf("UpdateUserCustomStatus: %v", err)
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/auth/logout", bytes.NewReader(nil))
+	req.Header.Set("Authorization", "Bearer "+token)
+	req.RemoteAddr = "127.0.0.1:9999"
+	rr := httptest.NewRecorder()
+	router.ServeHTTP(rr, req)
+	if rr.Code != http.StatusNoContent {
+		t.Fatalf("logout status = %d, want 204; body = %s", rr.Code, rr.Body.String())
+	}
+
+	after, _ := database.GetUserByID(context.Background(), user.ID)
+	if after.CustomStatus != nil {
+		t.Errorf("custom_status = %q, want cleared on logout", *after.CustomStatus)
+	}
+}
+
+// userUpdateSpy captures the user_update broadcasts the profile routes emit.
+type userUpdateSpy struct {
+	got []ws.UserUpdate
+}
+
+func (s *userUpdateSpy) BroadcastUserUpdate(u ws.UserUpdate) {
+	s.got = append(s.got, u)
+}
diff --git a/Server/api/channel_around_test.go b/Server/api/channel_around_test.go
new file mode 100644
index 00000000..fd927383
--- /dev/null
+++ b/Server/api/channel_around_test.go
@@ -0,0 +1,399 @@
+package api_test
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/owncord/server/db"
+)
+
+// ─── GET /api/v1/channels/{id}/messages/around/{messageId} ───────────────────
+//
+// The around window is what turns a "jump to this message" affordance (search
+// hit, pinned entry, reply reference, permalink) into something that works for
+// a message outside the client's loaded history. Its contract has three parts
+// worth pinning: the same read gate as history, a window actually centred on
+// the target, and honest has-more flags at the edges of a channel.
+
+type aroundResponse struct {
+	Messages []struct {
+		ID      int64  `json:"id"`
+		Content string `json:"content"`
+	} `json:"messages"`
+	HasMoreBefore bool `json:"has_more_before"`
+	HasMoreAfter  bool `json:"has_more_after"`
+}
+
+func aroundPath(channelID, messageID int64, query string) string {
+	p := fmt.Sprintf("/api/v1/channels/%d/messages/around/%d", channelID, messageID)
+	if query != "" {
+		p += "?" + query
+	}
+	return p
+}
+
+// seedAroundChannel creates a channel owned by username and fills it with n
+// messages, returning the channel id and the message ids in ascending order.
+func seedAroundChannel(t *testing.T, database *db.DB, username string, n int) (int64, []int64) {
+	t.Helper()
+	user, err := database.GetUserByUsername(context.Background(), username)
+	if err != nil {
+		t.Fatalf("GetUserByUsername(%q): %v", username, err)
+	}
+	chID, err := database.CreateChannel(context.Background(), "around-"+username, "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+	ids := make([]int64, 0, n)
+	for i := range n {
+		id, msgErr := database.CreateMessage(context.Background(), chID, user.ID, fmt.Sprintf("m%d", i), nil)
+		if msgErr != nil {
+			t.Fatalf("CreateMessage %d: %v", i, msgErr)
+		}
+		ids = append(ids, id)
+	}
+	return chID, ids
+}
+
+func decodeAround(t *testing.T, rr *httptest.ResponseRecorder) aroundResponse {
+	t.Helper()
+	var resp aroundResponse
+	if err := json.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("decode around response: %v (body: %s)", err, rr.Body.String())
+	}
+	return resp
+}
+
+func TestMessagesAround_Unauthenticated(t *testing.T) {
+	router := buildChannelRouter(newChannelTestDB(t))
+	rr := chGet(t, router, aroundPath(1, 1, ""), "")
+	if rr.Code != http.StatusUnauthorized {
+		t.Errorf("status = %d, want 401", rr.Code)
+	}
+}
+
+func TestMessagesAround_InvalidMessageID(t *testing.T) {
+	database := newChannelTestDB(t)
+	router := buildChannelRouter(database)
+	token := chTestCreateToken(t, database, "aroundbadid", 1)
+	chID, _ := seedAroundChannel(t, database, "aroundbadid", 1)
+
+	for _, raw := range []string{"abc", "0", "-3"} {
+		path := fmt.Sprintf("/api/v1/channels/%d/messages/around/%s", chID, raw)
+		rr := chGet(t, router, path, token)
+		if rr.Code != http.StatusBadRequest {
+			t.Errorf("message id %q: status = %d, want 400; body: %s", raw, rr.Code, rr.Body.String())
+		}
+	}
+}
+
+func TestMessagesAround_InvalidLimit(t *testing.T) {
+	database := newChannelTestDB(t)
+	router := buildChannelRouter(database)
+	token := chTestCreateToken(t, database, "aroundbadlimit", 1)
+	chID, ids := seedAroundChannel(t, database, "aroundbadlimit", 3)
+
+	rr := chGet(t, router, aroundPath(chID, ids[1], "limit=abc"), token)
+	if rr.Code != http.StatusBadRequest {
+		t.Errorf("status = %d, want 400; body: %s", rr.Code, rr.Body.String())
+	}
+}
+
+func TestMessagesAround_ChannelNotFound(t *testing.T) {
+	database := newChannelTestDB(t)
+	router := buildChannelRouter(database)
+	token := chTestCreateToken(t, database, "aroundnochan", 1)
+
+	rr := chGet(t, router, aroundPath(9999, 1, ""), token)
+	if rr.Code != http.StatusNotFound {
+		t.Errorf("status = %d, want 404; body: %s", rr.Code, rr.Body.String())
+	}
+}
+
+func TestMessagesAround_MessageInAnotherChannel(t *testing.T) {
+	database := newChannelTestDB(t)
+	router := buildChannelRouter(database)
+	token := chTestCreateToken(t, database, "aroundcross", 1)
+	_, idsA := seedAroundChannel(t, database, "aroundcross", 2)
+	chB, _ := seedAroundChannel(t, database, "aroundcross", 2)
+
+	rr := chGet(t, router, aroundPath(chB, idsA[0], ""), token)
+	if rr.Code != http.StatusNotFound {
+		t.Errorf("status = %d, want 404; body: %s", rr.Code, rr.Body.String())
+	}
+}
+
+func TestMessagesAround_DeletedMessageIsNotFound(t *testing.T) {
+	database := newChannelTestDB(t)
+	router := buildChannelRouter(database)
+	token := chTestCreateToken(t, database, "arounddeleted", 1)
+	user, _ := database.GetUserByUsername(context.Background(), "arounddeleted")
+	chID, ids := seedAroundChannel(t, database, "arounddeleted", 3)
+
+	if err := database.DeleteMessage(context.Background(), ids[1], user.ID, false); err != nil {
+		t.Fatalf("DeleteMessage: %v", err)
+	}
+
+	rr := chGet(t, router, aroundPath(chID, ids[1], ""), token)
+	if rr.Code != http.StatusNotFound {
+		t.Errorf("status = %d, want 404; body: %s", rr.Code, rr.Body.String())
+	}
+}
+
+func TestMessagesAround_CentersTheWindow(t *testing.T) {
+	database := newChannelTestDB(t)
+	router := buildChannelRouter(database)
+	token := chTestCreateToken(t, database, "aroundcenter", 1)
+	chID, ids := seedAroundChannel(t, database, "aroundcenter", 40)
+
+	target := ids[20]
+	rr := chGet(t, router, aroundPath(chID, target, "limit=10"), token)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", rr.Code, rr.Body.String())
+	}
+	resp := decodeAround(t, rr)
+
+	if len(resp.Messages) != 10 {
+		t.Fatalf("window size = %d, want 10", len(resp.Messages))
+	}
+	// limit 10 → 5 older, the centre, 4 newer.
+	if resp.Messages[5].ID != target {
+		t.Errorf("centre at index 5 = %d, want %d", resp.Messages[5].ID, target)
+	}
+	for i := 1; i < len(resp.Messages); i++ {
+		if resp.Messages[i-1].ID >= resp.Messages[i].ID {
+			t.Fatalf("window is not ascending at index %d: %v then %v",
+				i, resp.Messages[i-1].ID, resp.Messages[i].ID)
+		}
+	}
+	if !resp.HasMoreBefore || !resp.HasMoreAfter {
+		t.Errorf("has_more_before = %v, has_more_after = %v; want both true mid-channel",
+			resp.HasMoreBefore, resp.HasMoreAfter)
+	}
+}
+
+func TestMessagesAround_NearChannelStart(t *testing.T) {
+	database := newChannelTestDB(t)
+	router := buildChannelRouter(database)
+	token := chTestCreateToken(t, database, "aroundstart", 1)
+	chID, ids := seedAroundChannel(t, database, "aroundstart", 30)
+
+	rr := chGet(t, router, aroundPath(chID, ids[0], "limit=10"), token)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", rr.Code, rr.Body.String())
+	}
+	resp := decodeAround(t, rr)
+
+	if len(resp.Messages) == 0 || resp.Messages[0].ID != ids[0] {
+		t.Fatalf("first entry = %v, want the centre %d at the head", resp.Messages, ids[0])
+	}
+	if resp.HasMoreBefore {
+		t.Error("has_more_before = true at the first message of the channel")
+	}
+	if !resp.HasMoreAfter {
+		t.Error("has_more_after = false with 29 newer messages")
+	}
+	// Only the after half is available, so the window is shorter than limit.
+	if len(resp.Messages) != 5 {
+		t.Errorf("window size = %d, want 5 (centre + 4 newer)", len(resp.Messages))
+	}
+}
+
+func TestMessagesAround_NearChannelEnd(t *testing.T) {
+	database := newChannelTestDB(t)
+	router := buildChannelRouter(database)
+	token := chTestCreateToken(t, database, "aroundend", 1)
+	chID, ids := seedAroundChannel(t, database, "aroundend", 30)
+
+	last := ids[len(ids)-1]
+	rr := chGet(t, router, aroundPath(chID, last, "limit=10"), token)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", rr.Code, rr.Body.String())
+	}
+	resp := decodeAround(t, rr)
+
+	if resp.HasMoreAfter {
+		t.Error("has_more_after = true at the newest message of the channel")
+	}
+	if !resp.HasMoreBefore {
+		t.Error("has_more_before = false with 29 older messages")
+	}
+	tail := resp.Messages[len(resp.Messages)-1]
+	if tail.ID != last {
+		t.Errorf("last entry = %d, want the centre %d", tail.ID, last)
+	}
+	if len(resp.Messages) != 6 {
+		t.Errorf("window size = %d, want 6 (5 older + centre)", len(resp.Messages))
+	}
+}
+
+func TestMessagesAround_ShortChannelReturnsEverything(t *testing.T) {
+	database := newChannelTestDB(t)
+	router := buildChannelRouter(database)
+	token := chTestCreateToken(t, database, "aroundshort", 1)
+	chID, ids := seedAroundChannel(t, database, "aroundshort", 3)
+
+	rr := chGet(t, router, aroundPath(chID, ids[1], "limit=50"), token)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", rr.Code, rr.Body.String())
+	}
+	resp := decodeAround(t, rr)
+
+	if len(resp.Messages) != 3 {
+		t.Fatalf("window size = %d, want all 3 messages", len(resp.Messages))
+	}
+	if resp.HasMoreBefore || resp.HasMoreAfter {
+		t.Errorf("has_more_before = %v, has_more_after = %v; want both false",
+			resp.HasMoreBefore, resp.HasMoreAfter)
+	}
+}
+
+func TestMessagesAround_SkipsDeletedNeighbours(t *testing.T) {
+	database := newChannelTestDB(t)
+	router := buildChannelRouter(database)
+	token := chTestCreateToken(t, database, "aroundtomb", 1)
+	user, _ := database.GetUserByUsername(context.Background(), "aroundtomb")
+	chID, ids := seedAroundChannel(t, database, "aroundtomb", 5)
+
+	// Soft-delete a neighbour: history omits deleted rows, so the window must
+	// too — otherwise the client renders a tombstone it never asked for.
+	if err := database.DeleteMessage(context.Background(), ids[0], user.ID, false); err != nil {
+		t.Fatalf("DeleteMessage: %v", err)
+	}
+
+	rr := chGet(t, router, aroundPath(chID, ids[2], "limit=50"), token)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", rr.Code, rr.Body.String())
+	}
+	resp := decodeAround(t, rr)
+
+	if len(resp.Messages) != 4 {
+		t.Fatalf("window size = %d, want 4 (5 minus the deleted one)", len(resp.Messages))
+	}
+	for _, m := range resp.Messages {
+		if m.ID == ids[0] {
+			t.Errorf("deleted message %d present in the window", ids[0])
+		}
+	}
+}
+
+func TestMessagesAround_DMNonParticipantIsNotFound(t *testing.T) {
+	database := newPinTestDB(t)
+	router := buildChannelRouter(database)
+
+	chTestCreateToken(t, database, "arounddm1", 4)
+	chTestCreateToken(t, database, "arounddm2", 4)
+	outsiderToken := chTestCreateToken(t, database, "arounddmout", 4)
+
+	user1, _ := database.GetUserByUsername(context.Background(), "arounddm1")
+	user2, _ := database.GetUserByUsername(context.Background(), "arounddm2")
+	dmCh, _, err := database.GetOrCreateDMChannel(context.Background(), user1.ID, user2.ID)
+	if err != nil {
+		t.Fatalf("GetOrCreateDMChannel: %v", err)
+	}
+	msgID, _ := database.CreateMessage(context.Background(), dmCh.ID, user1.ID, "private", nil)
+
+	rr := chGet(t, router, aroundPath(dmCh.ID, msgID, ""), outsiderToken)
+	if rr.Code != http.StatusNotFound {
+		t.Errorf("outsider status = %d, want 404; body: %s", rr.Code, rr.Body.String())
+	}
+}
+
+func TestMessagesAround_DMParticipantAllowed(t *testing.T) {
+	database := newPinTestDB(t)
+	router := buildChannelRouter(database)
+
+	token1 := chTestCreateToken(t, database, "arounddmok1", 4)
+	chTestCreateToken(t, database, "arounddmok2", 4)
+	user1, _ := database.GetUserByUsername(context.Background(), "arounddmok1")
+	user2, _ := database.GetUserByUsername(context.Background(), "arounddmok2")
+	dmCh, _, err := database.GetOrCreateDMChannel(context.Background(), user1.ID, user2.ID)
+	if err != nil {
+		t.Fatalf("GetOrCreateDMChannel: %v", err)
+	}
+	msgID, _ := database.CreateMessage(context.Background(), dmCh.ID, user1.ID, "private", nil)
+
+	rr := chGet(t, router, aroundPath(dmCh.ID, msgID, ""), token1)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("participant status = %d, want 200; body: %s", rr.Code, rr.Body.String())
+	}
+	resp := decodeAround(t, rr)
+	if len(resp.Messages) != 1 || resp.Messages[0].ID != msgID {
+		t.Errorf("window = %v, want just the DM message %d", resp.Messages, msgID)
+	}
+}
+
+func TestMessagesAround_NoReadPermissionIsForbidden(t *testing.T) {
+	database := newPinTestDB(t)
+	router := buildChannelRouter(database)
+
+	// Role 4 (Member) with READ_MESSAGES denied on this channel by override.
+	ownerToken := chTestCreateToken(t, database, "aroundowner", 1)
+	deniedToken := chTestCreateToken(t, database, "arounddenied", 4)
+	chID, ids := seedAroundChannel(t, database, "aroundowner", 3)
+
+	if _, err := database.ExecContext(context.Background(),
+		`INSERT INTO channel_overrides (channel_id, role_id, allow, deny) VALUES (?, 4, 0, 2147483647)`,
+		chID,
+	); err != nil {
+		t.Fatalf("insert override: %v", err)
+	}
+
+	rr := chGet(t, router, aroundPath(chID, ids[1], ""), deniedToken)
+	if rr.Code != http.StatusForbidden {
+		t.Errorf("denied member status = %d, want 403; body: %s", rr.Code, rr.Body.String())
+	}
+	// The owner still gets the window — the override, not the endpoint, is the gate.
+	rr = chGet(t, router, aroundPath(chID, ids[1], ""), ownerToken)
+	if rr.Code != http.StatusOK {
+		t.Errorf("owner status = %d, want 200; body: %s", rr.Code, rr.Body.String())
+	}
+}
+
+func TestMessagesAround_EnrichesReactionsAndMentions(t *testing.T) {
+	database := newChannelTestDB(t)
+	router := buildChannelRouter(database)
+	token := chTestCreateToken(t, database, "aroundrich", 1)
+	user, _ := database.GetUserByUsername(context.Background(), "aroundrich")
+	chID, ids := seedAroundChannel(t, database, "aroundrich", 3)
+
+	if err := database.AddReaction(context.Background(), ids[1], user.ID, "👍"); err != nil {
+		t.Fatalf("AddReaction: %v", err)
+	}
+
+	rr := chGet(t, router, aroundPath(chID, ids[1], ""), token)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", rr.Code, rr.Body.String())
+	}
+
+	var raw struct {
+		Messages []struct {
+			ID        int64 `json:"id"`
+			Reactions []struct {
+				Emoji string `json:"emoji"`
+				Count int    `json:"count"`
+				Me    bool   `json:"me"`
+			} `json:"reactions"`
+			Attachments []any   `json:"attachments"`
+			Mentions    []int64 `json:"mentions"`
+		} `json:"messages"`
+	}
+	if err := json.Unmarshal(rr.Body.Bytes(), &raw); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	for _, m := range raw.Messages {
+		if m.Attachments == nil || m.Mentions == nil {
+			t.Errorf("message %d has null attachments/mentions; the enrichment path was skipped", m.ID)
+		}
+		if m.ID != ids[1] {
+			continue
+		}
+		if len(m.Reactions) != 1 || m.Reactions[0].Emoji != "👍" || !m.Reactions[0].Me {
+			t.Errorf("centre reactions = %v, want one 👍 with me=true", m.Reactions)
+		}
+	}
+}
diff --git a/Server/api/channel_handler.go b/Server/api/channel_handler.go
index 78e23cb5..9f1dcaa7 100644
--- a/Server/api/channel_handler.go
+++ b/Server/api/channel_handler.go
@@ -2,9 +2,11 @@ package api
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"log/slog"
 	"net/http"
+	"net/url"
 	"strconv"
 	"strings"
 	"time"
@@ -49,14 +51,24 @@ func searchRateLimitMiddleware(limiter *auth.RateLimiter, limit int, window time
 	}
 }
 
+// PurgeBroadcaster is the interface needed to fan a bulk delete out over
+// WebSocket from a REST handler. Satisfied by *ws.Hub.
+type PurgeBroadcaster interface {
+	BroadcastChatBulkDeleted(channelID int64, messageIDs []int64)
+}
+
 // MountChannelRoutes registers all channel-related routes onto r.
 // All routes require authentication. The limiter is used to rate-limit
-// expensive endpoints like search.
-func MountChannelRoutes(r chi.Router, database *db.DB, svc *service.Services, limiter *auth.RateLimiter, trustedProxies []string) {
+// expensive endpoints like search. broadcaster may be nil, in which case a
+// purge still commits but no chat_bulk_deleted event is emitted.
+func MountChannelRoutes(r chi.Router, database *db.DB, svc *service.Services, limiter *auth.RateLimiter, trustedProxies []string, broadcaster PurgeBroadcaster) {
 	r.Route("/api/v1/channels", func(r chi.Router) {
 		r.Use(AuthMiddleware(database))
 		r.Get("/", handleListChannels(svc))
 		r.Get("/{id}/messages", handleGetMessages(svc))
+		r.Get("/{id}/messages/around/{messageId}", handleGetMessagesAround(svc))
+		r.Post("/{id}/messages/purge", handlePurgeMessages(svc, broadcaster))
+		r.Get("/{id}/messages/{messageId}/reactions/{emoji}/users", handleGetReactionUsers(svc))
 		r.Get("/{id}/pins", handleGetPins(svc))
 		r.Post("/{id}/pins/{messageId}", handleSetPinned(svc, true))
 		r.Delete("/{id}/pins/{messageId}", handleSetPinned(svc, false))
@@ -118,19 +130,9 @@ func handleGetMessages(svc *service.Services) http.HandlerFunc {
 			before = v
 		}
 
-		limit := defaultMessageLimit
-		if raw := r.URL.Query().Get("limit"); raw != "" {
-			v, parseErr := strconv.Atoi(raw)
-			if parseErr != nil || v < 1 {
-				writeJSON(w, http.StatusBadRequest, errorResponse{
-					Error: "BAD_REQUEST", Message: "limit must be a positive integer",
-				})
-				return
-			}
-			if v > maxMessageLimit {
-				v = maxMessageLimit
-			}
-			limit = v
+		limit, ok := parseLimitParam(w, r)
+		if !ok {
+			return
 		}
 
 		msgs, hasMore, err := svc.Messages.GetMessages(r.Context(), user.ID, channelID, before, limit)
@@ -147,6 +149,143 @@ func handleGetMessages(svc *service.Services) http.HandlerFunc {
 	}
 }
 
+// handleGetMessagesAround returns the window of messages centred on a message,
+// oldest-first. Used to jump to a message (search hit, pinned entry, reply
+// reference, permalink) that is not in the client's loaded history.
+func handleGetMessagesAround(svc *service.Services) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		channelID, ok := parseIDParam(w, r, "id")
+		if !ok {
+			return
+		}
+		messageID, ok := parseIDParam(w, r, "messageId")
+		if !ok {
+			return
+		}
+
+		user, _ := r.Context().Value(UserKey).(*db.User)
+		if user == nil {
+			writeJSON(w, http.StatusUnauthorized, errorResponse{
+				Error: "UNAUTHORIZED", Message: "authentication required",
+			})
+			return
+		}
+
+		limit, ok := parseLimitParam(w, r)
+		if !ok {
+			return
+		}
+
+		window, err := svc.Messages.GetMessagesAround(r.Context(), user.ID, channelID, messageID, limit)
+		if err != nil {
+			writeServiceError(r.Context(), w, err)
+			return
+		}
+		writeJSON(w, http.StatusOK, window)
+	}
+}
+
+// handleGetReactionUsers returns the users who reacted to a message with a
+// given emoji, capped server-side at 100. The emoji arrives percent-encoded in
+// the path; chi routes on RawPath when it differs from Path, so the param must
+// be unescaped here rather than taken verbatim.
+func handleGetReactionUsers(svc *service.Services) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		channelID, ok := parseIDParam(w, r, "id")
+		if !ok {
+			return
+		}
+		messageID, ok := parseIDParam(w, r, "messageId")
+		if !ok {
+			return
+		}
+
+		user, _ := r.Context().Value(UserKey).(*db.User)
+		if user == nil {
+			writeJSON(w, http.StatusUnauthorized, errorResponse{
+				Error: "UNAUTHORIZED", Message: "authentication required",
+			})
+			return
+		}
+
+		emoji := chi.URLParam(r, "emoji")
+		if decoded, decErr := url.PathUnescape(emoji); decErr == nil {
+			emoji = decoded
+		}
+
+		users, err := svc.Messages.GetReactionUsers(r.Context(), user.ID, channelID, messageID, emoji)
+		if err != nil {
+			writeServiceError(r.Context(), w, err)
+			return
+		}
+
+		type response struct {
+			Users []db.ReactionUser `json:"users"`
+		}
+		writeJSON(w, http.StatusOK, response{Users: users})
+	}
+}
+
+// purgeRequest is the JSON body for POST /api/v1/channels/{id}/messages/purge.
+// Before is optional; 0 means "start from the newest message".
+type purgeRequest struct {
+	Limit  int   `json:"limit"`
+	Before int64 `json:"before"`
+}
+
+// purgeResponse reports what the purge actually deleted, which can be fewer
+// than Limit rows when the channel holds less history.
+type purgeResponse struct {
+	ChannelID int64   `json:"channel_id"`
+	IDs       []int64 `json:"ids"`
+	Count     int     `json:"count"`
+}
+
+// handlePurgeMessages bulk soft-deletes the newest messages in a channel and
+// broadcasts a single chat_bulk_deleted event.
+func handlePurgeMessages(svc *service.Services, broadcaster PurgeBroadcaster) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		channelID, ok := parseIDParam(w, r, "id")
+		if !ok {
+			return
+		}
+
+		user, _ := r.Context().Value(UserKey).(*db.User)
+		if user == nil {
+			writeJSON(w, http.StatusUnauthorized, errorResponse{
+				Error: "UNAUTHORIZED", Message: "authentication required",
+			})
+			return
+		}
+
+		var req purgeRequest
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			writeJSON(w, http.StatusBadRequest, errorResponse{
+				Error: "BAD_REQUEST", Message: "invalid request body",
+			})
+			return
+		}
+
+		result, err := svc.Messages.PurgeMessages(r.Context(), user.ID, channelID, req.Limit, req.Before)
+		if err != nil {
+			writeServiceError(r.Context(), w, err)
+			return
+		}
+
+		// A purge that matched nothing is still a success, but there is no
+		// state change to announce.
+		if broadcaster != nil && len(result.MessageIDs) > 0 {
+			broadcaster.BroadcastChatBulkDeleted(result.ChannelID, result.MessageIDs)
+		}
+
+		writeJSON(w, http.StatusOK, purgeResponse{
+			ChannelID: result.ChannelID,
+			IDs:       result.MessageIDs,
+			Count:     len(result.MessageIDs),
+		})
+	}
+}
+
 // handleSearch performs a full-text search across messages.
 func handleSearch(svc *service.Services) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
@@ -178,19 +317,9 @@ func handleSearch(svc *service.Services) http.HandlerFunc {
 			channelID = &v
 		}
 
-		limit := defaultMessageLimit
-		if raw := r.URL.Query().Get("limit"); raw != "" {
-			v, parseErr := strconv.Atoi(raw)
-			if parseErr != nil || v < 1 {
-				writeJSON(w, http.StatusBadRequest, errorResponse{
-					Error: "BAD_REQUEST", Message: "limit must be a positive integer",
-				})
-				return
-			}
-			if v > maxMessageLimit {
-				v = maxMessageLimit
-			}
-			limit = v
+		limit, ok := parseLimitParam(w, r)
+		if !ok {
+			return
 		}
 
 		results, err := svc.Messages.SearchMessages(r.Context(), user.ID, q, channelID, limit)
@@ -297,6 +426,24 @@ func writeServiceError(ctx context.Context, w http.ResponseWriter, err error) {
 	}
 }
 
+// parseLimitParam reads the shared `limit` query parameter, defaulting to
+// defaultMessageLimit and clamping at maxMessageLimit. Writes a 400 response
+// and returns false when the value is present but not a positive integer.
+func parseLimitParam(w http.ResponseWriter, r *http.Request) (int, bool) {
+	raw := r.URL.Query().Get("limit")
+	if raw == "" {
+		return defaultMessageLimit, true
+	}
+	v, err := strconv.Atoi(raw)
+	if err != nil || v < 1 {
+		writeJSON(w, http.StatusBadRequest, errorResponse{
+			Error: "BAD_REQUEST", Message: "limit must be a positive integer",
+		})
+		return 0, false
+	}
+	return min(v, maxMessageLimit), true
+}
+
 // parseIDParam extracts and validates a chi URL param as int64.
 // Writes a 400 response and returns false on failure.
 func parseIDParam(w http.ResponseWriter, r *http.Request, param string) (int64, bool) {
diff --git a/Server/api/channel_handler_test.go b/Server/api/channel_handler_test.go
index a8dd681e..956f5500 100644
--- a/Server/api/channel_handler_test.go
+++ b/Server/api/channel_handler_test.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 	"testing/fstest"
 
@@ -46,7 +47,10 @@ CREATE TABLE IF NOT EXISTS users (
     banned      INTEGER NOT NULL DEFAULT 0,
     ban_reason  TEXT,
     ban_expires TEXT,
-    identity_public_key TEXT
+    identity_public_key TEXT,
+    display_name TEXT,
+    about TEXT,
+    custom_status TEXT
 );
 CREATE TABLE IF NOT EXISTS sessions (
     id         INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -73,7 +77,9 @@ CREATE TABLE IF NOT EXISTS channels (
     voice_max_users  INTEGER NOT NULL DEFAULT 0,
     voice_quality    TEXT,
     mixing_threshold INTEGER,
-    voice_max_video  INTEGER NOT NULL DEFAULT 0
+    voice_max_video  INTEGER NOT NULL DEFAULT 0,
+    nsfw             INTEGER NOT NULL DEFAULT 0,
+    is_group         INTEGER NOT NULL DEFAULT 0
 );
 CREATE TABLE IF NOT EXISTS channel_overrides (
     id         INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -83,6 +89,14 @@ CREATE TABLE IF NOT EXISTS channel_overrides (
     deny       INTEGER NOT NULL DEFAULT 0,
     UNIQUE(channel_id, role_id)
 );
+
+CREATE TABLE IF NOT EXISTS channel_user_overrides (
+    channel_id INTEGER NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
+    user_id    INTEGER NOT NULL REFERENCES users(id)    ON DELETE CASCADE,
+    allow      INTEGER NOT NULL DEFAULT 0,
+    deny       INTEGER NOT NULL DEFAULT 0,
+    PRIMARY KEY (channel_id, user_id)
+);
 CREATE TABLE IF NOT EXISTS messages (
     id         INTEGER PRIMARY KEY AUTOINCREMENT,
     channel_id INTEGER NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
@@ -92,8 +106,15 @@ CREATE TABLE IF NOT EXISTS messages (
     edited_at  TEXT,
     deleted    INTEGER NOT NULL DEFAULT 0,
     pinned     INTEGER NOT NULL DEFAULT 0,
-    timestamp  TEXT    NOT NULL DEFAULT (datetime('now'))
+    timestamp  TEXT    NOT NULL DEFAULT (datetime('now')),
+    mentions_everyone INTEGER NOT NULL DEFAULT 0
 );
+CREATE TABLE IF NOT EXISTS message_mentions (
+    message_id        INTEGER NOT NULL REFERENCES messages(id) ON DELETE CASCADE,
+    mentioned_user_id INTEGER NOT NULL REFERENCES users(id)    ON DELETE CASCADE,
+    PRIMARY KEY (message_id, mentioned_user_id)
+);
+
 CREATE INDEX IF NOT EXISTS idx_messages_channel ON messages(channel_id, id DESC);
 
 CREATE VIRTUAL TABLE IF NOT EXISTS messages_fts USING fts5(
@@ -163,6 +184,16 @@ CREATE TABLE IF NOT EXISTS dm_participants (
 );
 CREATE INDEX IF NOT EXISTS idx_dm_participants_user ON dm_participants(user_id);
 
+CREATE TABLE IF NOT EXISTS audit_log (
+    id          INTEGER PRIMARY KEY AUTOINCREMENT,
+    actor_id    INTEGER NOT NULL DEFAULT 0,
+    action      TEXT    NOT NULL,
+    target_type TEXT    NOT NULL DEFAULT '',
+    target_id   INTEGER NOT NULL DEFAULT 0,
+    detail      TEXT    NOT NULL DEFAULT '',
+    created_at  TEXT    NOT NULL DEFAULT (datetime('now'))
+);
+
 CREATE TABLE IF NOT EXISTS dm_open_state (
     user_id    INTEGER NOT NULL REFERENCES users(id)    ON DELETE CASCADE,
     channel_id INTEGER NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
@@ -192,7 +223,7 @@ func buildChannelRouter(database *db.DB) http.Handler {
 	limiter := auth.NewRateLimiter()
 	st := database
 	svc := service.New(st, limiter)
-	api.MountChannelRoutes(r, database, svc, limiter, nil)
+	api.MountChannelRoutes(r, database, svc, limiter, nil, nil)
 	return r
 }
 
@@ -612,7 +643,7 @@ func TestSearch_TrustedProxyRateLimitUsesForwardedIP(t *testing.T) {
 	r := chi.NewRouter()
 	limiter := auth.NewRateLimiter()
 	svc := service.New(database, limiter)
-	api.MountChannelRoutes(r, database, svc, limiter, []string{"127.0.0.0/8"})
+	api.MountChannelRoutes(r, database, svc, limiter, []string{"127.0.0.0/8"}, nil)
 	token := chTestCreateToken(t, database, "proxysearch", 1)
 
 	for i := range 30 {
@@ -936,3 +967,260 @@ func TestSetPinned_Idempotent(t *testing.T) {
 		t.Errorf("idempotent pin status = %d, want 204; body: %s", rr.Code, rr.Body.String())
 	}
 }
+
+// ─── POST /api/v1/channels/{id}/messages/purge ──────────────────────────────
+
+// recordingPurgeBroadcaster captures the chat_bulk_deleted fan-out so tests can
+// assert one event carries every purged id.
+type recordingPurgeBroadcaster struct {
+	calls []purgeBroadcast
+}
+
+type purgeBroadcast struct {
+	channelID int64
+	ids       []int64
+}
+
+func (b *recordingPurgeBroadcaster) BroadcastChatBulkDeleted(channelID int64, ids []int64) {
+	b.calls = append(b.calls, purgeBroadcast{channelID: channelID, ids: ids})
+}
+
+// buildPurgeRouter wires the channel routes with a recording broadcaster onto a
+// DB that has the DM and audit tables the purge path touches.
+func buildPurgeRouter(t *testing.T) (http.Handler, *db.DB, *recordingPurgeBroadcaster) {
+	t.Helper()
+	database := newPinTestDB(t)
+	broadcaster := &recordingPurgeBroadcaster{}
+	r := chi.NewRouter()
+	limiter := auth.NewRateLimiter()
+	svc := service.New(database, limiter)
+	api.MountChannelRoutes(r, database, svc, limiter, nil, broadcaster)
+	return r, database, broadcaster
+}
+
+// chPurge posts a purge body and returns the recorder.
+func chPurge(t *testing.T, router http.Handler, channelID int64, token, body string) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodPost,
+		fmt.Sprintf("/api/v1/channels/%d/messages/purge", channelID), strings.NewReader(body))
+	if token != "" {
+		req.Header.Set("Authorization", "Bearer "+token)
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.RemoteAddr = "127.0.0.1:9999"
+	rr := httptest.NewRecorder()
+	router.ServeHTTP(rr, req)
+	return rr
+}
+
+// seedPurgeChannel creates a text channel with n messages authored by username.
+func seedPurgeChannel(t *testing.T, database *db.DB, username string, n int) (int64, []int64) {
+	t.Helper()
+	user, err := database.GetUserByUsername(context.Background(), username)
+	if err != nil || user == nil {
+		t.Fatalf("GetUserByUsername(%q): %v", username, err)
+	}
+	chID, err := database.CreateChannel(context.Background(), "purge-"+username, "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+	ids := make([]int64, 0, n)
+	for i := range n {
+		id, msgErr := database.CreateMessage(context.Background(), chID, user.ID, fmt.Sprintf("m%d", i), nil)
+		if msgErr != nil {
+			t.Fatalf("CreateMessage: %v", msgErr)
+		}
+		ids = append(ids, id)
+	}
+	return chID, ids
+}
+
+type purgeResponseBody struct {
+	ChannelID int64   `json:"channel_id"`
+	IDs       []int64 `json:"ids"`
+	Count     int     `json:"count"`
+}
+
+func TestPurgeMessages_ModeratorSucceedsAndBroadcastsOnce(t *testing.T) {
+	router, database, broadcaster := buildPurgeRouter(t)
+	token := chTestCreateToken(t, database, "purgemod", 3) // Moderator: MANAGE_MESSAGES
+	chID, ids := seedPurgeChannel(t, database, "purgemod", 5)
+
+	rr := chPurge(t, router, chID, token, `{"limit":3}`)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", rr.Code, rr.Body.String())
+	}
+
+	var body purgeResponseBody
+	if err := json.Unmarshal(rr.Body.Bytes(), &body); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if body.Count != 3 || len(body.IDs) != 3 {
+		t.Fatalf("count = %d, ids = %v, want 3 of each", body.Count, body.IDs)
+	}
+	if body.IDs[0] != ids[4] {
+		t.Errorf("ids[0] = %d, want the newest message %d", body.IDs[0], ids[4])
+	}
+
+	// One chat_bulk_deleted event, not three chat_deleted ones.
+	if len(broadcaster.calls) != 1 {
+		t.Fatalf("broadcast calls = %d, want exactly 1", len(broadcaster.calls))
+	}
+	if broadcaster.calls[0].channelID != chID {
+		t.Errorf("broadcast channel = %d, want %d", broadcaster.calls[0].channelID, chID)
+	}
+	if len(broadcaster.calls[0].ids) != 3 {
+		t.Errorf("broadcast ids = %v, want 3 entries", broadcaster.calls[0].ids)
+	}
+
+	// Tombstones: the rows survive, flagged deleted.
+	for _, id := range body.IDs {
+		msg, _ := database.GetMessage(context.Background(), id)
+		if msg == nil || !msg.Deleted {
+			t.Errorf("message %d is not a surviving tombstone", id)
+		}
+	}
+	// The two oldest are untouched.
+	for _, id := range ids[:2] {
+		msg, _ := database.GetMessage(context.Background(), id)
+		if msg.Deleted {
+			t.Errorf("message %d outside the purge window was deleted", id)
+		}
+	}
+}
+
+func TestPurgeMessages_MemberForbidden(t *testing.T) {
+	router, database, broadcaster := buildPurgeRouter(t)
+	token := chTestCreateToken(t, database, "purgemember", 4) // Member: no MANAGE_MESSAGES
+	chID, ids := seedPurgeChannel(t, database, "purgemember", 3)
+
+	rr := chPurge(t, router, chID, token, `{"limit":3}`)
+	if rr.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403; body: %s", rr.Code, rr.Body.String())
+	}
+	if len(broadcaster.calls) != 0 {
+		t.Errorf("denied purge still broadcast: %v", broadcaster.calls)
+	}
+	for _, id := range ids {
+		msg, _ := database.GetMessage(context.Background(), id)
+		if msg.Deleted {
+			t.Errorf("denied purge deleted message %d", id)
+		}
+	}
+}
+
+func TestPurgeMessages_DMForbidden(t *testing.T) {
+	router, database, broadcaster := buildPurgeRouter(t)
+	token := chTestCreateToken(t, database, "purgedmmod", 1) // Owner — every bit set
+	user, _ := database.GetUserByUsername(context.Background(), "purgedmmod")
+	dmID, _ := database.CreateChannel(context.Background(), "dm", "dm", "", "", 0)
+	if _, err := database.ExecContext(context.Background(),
+		`INSERT INTO dm_participants (channel_id, user_id) VALUES (?, ?)`, dmID, user.ID); err != nil {
+		t.Fatalf("seed dm participant: %v", err)
+	}
+	msgID, _ := database.CreateMessage(context.Background(), dmID, user.ID, "private", nil)
+
+	rr := chPurge(t, router, dmID, token, `{"limit":10}`)
+	if rr.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403 for a DM; body: %s", rr.Code, rr.Body.String())
+	}
+	if len(broadcaster.calls) != 0 {
+		t.Errorf("DM purge broadcast: %v", broadcaster.calls)
+	}
+	msg, _ := database.GetMessage(context.Background(), msgID)
+	if msg.Deleted {
+		t.Error("DM message was purged")
+	}
+}
+
+func TestPurgeMessages_LimitClampedToHundred(t *testing.T) {
+	router, database, _ := buildPurgeRouter(t)
+	token := chTestCreateToken(t, database, "purgeclamp", 3)
+	chID, _ := seedPurgeChannel(t, database, "purgeclamp", 105)
+
+	rr := chPurge(t, router, chID, token, `{"limit":1000}`)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", rr.Code, rr.Body.String())
+	}
+	var body purgeResponseBody
+	if err := json.Unmarshal(rr.Body.Bytes(), &body); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if body.Count != 100 {
+		t.Fatalf("count = %d, want the clamp of 100", body.Count)
+	}
+}
+
+func TestPurgeMessages_BadRequests(t *testing.T) {
+	router, database, _ := buildPurgeRouter(t)
+	token := chTestCreateToken(t, database, "purgebad", 3)
+	chID, _ := seedPurgeChannel(t, database, "purgebad", 2)
+
+	cases := []struct {
+		name string
+		body string
+	}{
+		{"zero limit", `{"limit":0}`},
+		{"negative limit", `{"limit":-5}`},
+		{"malformed json", `{"limit":`},
+		{"negative before", `{"limit":5,"before":-1}`},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			rr := chPurge(t, router, chID, token, tc.body)
+			if rr.Code != http.StatusBadRequest {
+				t.Errorf("status = %d, want 400; body: %s", rr.Code, rr.Body.String())
+			}
+		})
+	}
+}
+
+func TestPurgeMessages_Unauthenticated(t *testing.T) {
+	router, database, _ := buildPurgeRouter(t)
+	chTestCreateToken(t, database, "purgeanon", 3)
+	chID, _ := seedPurgeChannel(t, database, "purgeanon", 2)
+
+	rr := chPurge(t, router, chID, "", `{"limit":2}`)
+	if rr.Code != http.StatusUnauthorized {
+		t.Errorf("status = %d, want 401; body: %s", rr.Code, rr.Body.String())
+	}
+}
+
+func TestPurgeMessages_EmptyChannelDoesNotBroadcast(t *testing.T) {
+	router, database, broadcaster := buildPurgeRouter(t)
+	token := chTestCreateToken(t, database, "purgeempty", 3)
+	chID, _ := seedPurgeChannel(t, database, "purgeempty", 0)
+
+	rr := chPurge(t, router, chID, token, `{"limit":50}`)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", rr.Code, rr.Body.String())
+	}
+	var body purgeResponseBody
+	if err := json.Unmarshal(rr.Body.Bytes(), &body); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if body.Count != 0 || body.IDs == nil {
+		t.Errorf("count = %d, ids = %v, want 0 and a non-null array", body.Count, body.IDs)
+	}
+	if len(broadcaster.calls) != 0 {
+		t.Errorf("a no-op purge broadcast: %v", broadcaster.calls)
+	}
+}
+
+func TestPurgeMessages_NilBroadcasterStillPurges(t *testing.T) {
+	database := newPinTestDB(t)
+	router := buildChannelRouter(database) // mounted with a nil broadcaster
+	token := chTestCreateToken(t, database, "purgenilbc", 3)
+	chID, ids := seedPurgeChannel(t, database, "purgenilbc", 2)
+
+	rr := chPurge(t, router, chID, token, `{"limit":2}`)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", rr.Code, rr.Body.String())
+	}
+	for _, id := range ids {
+		msg, _ := database.GetMessage(context.Background(), id)
+		if !msg.Deleted {
+			t.Errorf("message %d not purged", id)
+		}
+	}
+}
diff --git a/Server/api/channel_reaction_users_test.go b/Server/api/channel_reaction_users_test.go
new file mode 100644
index 00000000..6e6affd2
--- /dev/null
+++ b/Server/api/channel_reaction_users_test.go
@@ -0,0 +1,168 @@
+package api_test
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/permissions"
+)
+
+// ─── GET /api/v1/channels/{id}/messages/{messageId}/reactions/{emoji}/users ──
+//
+// The who-reacted list is a separate endpoint rather than inline user_ids on
+// every reaction summary, so the contract worth pinning is: the same read gate
+// as history, and a path emoji that survives percent-encoding.
+
+type reactionUsersResponse struct {
+	Users []struct {
+		ID       int64  `json:"id"`
+		Username string `json:"username"`
+		Avatar   string `json:"avatar"`
+	} `json:"users"`
+}
+
+func reactionUsersPath(channelID, messageID int64, emoji string) string {
+	return fmt.Sprintf("/api/v1/channels/%d/messages/%d/reactions/%s/users",
+		channelID, messageID, url.PathEscape(emoji))
+}
+
+// seedReactedMessage creates a channel with one message and has each of the
+// named users react to it with emoji. Returns the channel and message ids.
+func seedReactedMessage(t *testing.T, database *db.DB, chName string, author string, emoji string, reactors ...string) (int64, int64) {
+	t.Helper()
+	user, err := database.GetUserByUsername(context.Background(), author)
+	if err != nil {
+		t.Fatalf("GetUserByUsername(%q): %v", author, err)
+	}
+	chID, err := database.CreateChannel(context.Background(), chName, "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+	msgID, err := database.CreateMessage(context.Background(), chID, user.ID, "react to me", nil)
+	if err != nil {
+		t.Fatalf("CreateMessage: %v", err)
+	}
+	for _, name := range reactors {
+		u, uErr := database.GetUserByUsername(context.Background(), name)
+		if uErr != nil {
+			t.Fatalf("GetUserByUsername(%q): %v", name, uErr)
+		}
+		if rErr := database.AddReaction(context.Background(), msgID, u.ID, emoji); rErr != nil {
+			t.Fatalf("AddReaction(%q): %v", name, rErr)
+		}
+	}
+	return chID, msgID
+}
+
+func decodeReactionUsers(t *testing.T, rr *httptest.ResponseRecorder) reactionUsersResponse {
+	t.Helper()
+	var resp reactionUsersResponse
+	if err := json.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("decode: %v (body: %s)", err, rr.Body.String())
+	}
+	return resp
+}
+
+func TestReactionUsers_Unauthenticated(t *testing.T) {
+	router := buildChannelRouter(newChannelTestDB(t))
+	rr := chGet(t, router, reactionUsersPath(1, 1, "👍"), "")
+	if rr.Code != http.StatusUnauthorized {
+		t.Errorf("status = %d, want 401", rr.Code)
+	}
+}
+
+// The emoji reaches the handler percent-encoded; chi routes on RawPath, so the
+// handler must unescape it or every non-ASCII emoji looks like a different one.
+func TestReactionUsers_PercentEncodedEmojiResolves(t *testing.T) {
+	database := newChannelTestDB(t)
+	router := buildChannelRouter(database)
+	token := chTestCreateToken(t, database, "ru-author", 4)
+	_ = chTestCreateToken(t, database, "ru-bob", 4)
+	chID, msgID := seedReactedMessage(t, database, "ru-chan", "ru-author", "👍", "ru-author", "ru-bob")
+
+	path := reactionUsersPath(chID, msgID, "👍")
+	if path == fmt.Sprintf("/api/v1/channels/%d/messages/%d/reactions/👍/users", chID, msgID) {
+		t.Fatal("test precondition: the emoji should be percent-encoded in the path")
+	}
+
+	rr := chGet(t, router, path, token)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", rr.Code, rr.Body.String())
+	}
+	resp := decodeReactionUsers(t, rr)
+	if len(resp.Users) != 2 {
+		t.Fatalf("len(users) = %d, want 2 (%+v)", len(resp.Users), resp.Users)
+	}
+	if resp.Users[0].Username != "ru-author" || resp.Users[1].Username != "ru-bob" {
+		t.Errorf("usernames = [%s %s], want [ru-author ru-bob]",
+			resp.Users[0].Username, resp.Users[1].Username)
+	}
+}
+
+func TestReactionUsers_EmojiWithNoReactorsIsEmptyList(t *testing.T) {
+	database := newChannelTestDB(t)
+	router := buildChannelRouter(database)
+	token := chTestCreateToken(t, database, "ru-empty", 4)
+	chID, msgID := seedReactedMessage(t, database, "ru-emptychan", "ru-empty", "👍", "ru-empty")
+
+	rr := chGet(t, router, reactionUsersPath(chID, msgID, "🎉"), token)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", rr.Code, rr.Body.String())
+	}
+	resp := decodeReactionUsers(t, rr)
+	if len(resp.Users) != 0 {
+		t.Errorf("len(users) = %d, want 0", len(resp.Users))
+	}
+	// null would not be iterable client-side.
+	if !json.Valid(rr.Body.Bytes()) || rr.Body.String() == "" {
+		t.Fatalf("invalid body: %s", rr.Body.String())
+	}
+}
+
+func TestReactionUsers_DeniedChannelIsForbidden(t *testing.T) {
+	database := newChannelTestDB(t)
+	router := buildChannelRouter(database)
+	token := chTestCreateToken(t, database, "ru-denied", 4)
+	chID, msgID := seedReactedMessage(t, database, "ru-deniedchan", "ru-denied", "👍", "ru-denied")
+	denyReadMessages(t, database, chID, permissions.MemberRoleID)
+
+	rr := chGet(t, router, reactionUsersPath(chID, msgID, "👍"), token)
+	if rr.Code != http.StatusForbidden {
+		t.Errorf("status = %d, want 403; body: %s", rr.Code, rr.Body.String())
+	}
+}
+
+func TestReactionUsers_MessageFromAnotherChannelIsNotFound(t *testing.T) {
+	database := newChannelTestDB(t)
+	router := buildChannelRouter(database)
+	token := chTestCreateToken(t, database, "ru-cross", 4)
+	_, msgID := seedReactedMessage(t, database, "ru-crossA", "ru-cross", "👍", "ru-cross")
+	otherID, _ := database.CreateChannel(context.Background(), "ru-crossB", "text", "", "", 1)
+
+	rr := chGet(t, router, reactionUsersPath(otherID, msgID, "👍"), token)
+	if rr.Code != http.StatusNotFound {
+		t.Errorf("status = %d, want 404; body: %s", rr.Code, rr.Body.String())
+	}
+}
+
+func TestReactionUsers_InvalidIDs(t *testing.T) {
+	database := newChannelTestDB(t)
+	router := buildChannelRouter(database)
+	token := chTestCreateToken(t, database, "ru-badid", 4)
+
+	for _, path := range []string{
+		"/api/v1/channels/abc/messages/1/reactions/%F0%9F%91%8D/users",
+		"/api/v1/channels/1/messages/0/reactions/%F0%9F%91%8D/users",
+	} {
+		rr := chGet(t, router, path, token)
+		if rr.Code != http.StatusBadRequest {
+			t.Errorf("%s: status = %d, want 400", path, rr.Code)
+		}
+	}
+}
diff --git a/Server/api/constants.go b/Server/api/constants.go
index 07eae056..f0a96111 100644
--- a/Server/api/constants.go
+++ b/Server/api/constants.go
@@ -106,6 +106,11 @@ const (
 
 	// uploadRateLimitPerMinute is the maximum file uploads per user per minute.
 	uploadRateLimitPerMinute = 10
+
+	// emojiUploadRateLimitPerMinute is the maximum custom-emoji uploads per
+	// MANAGE_SERVER holder per minute. Lower than the attachment limit: every
+	// accepted upload fans an emoji_update out to every connected session.
+	emojiUploadRateLimitPerMinute = 10
 )
 
 // ─── Timeouts & TTLs ────────────────────────────────────────────────────────
@@ -148,6 +153,50 @@ const (
 	// maxAvatarURLLen is the maximum length of a user avatar URL.
 	maxAvatarURLLen = 512
 
+	// maxEmojiFileBytes is the largest custom-emoji image accepted (512 KiB).
+	// An emoji renders at 22px inline and 48px jumbo, so anything approaching
+	// this is already far more data than the pixels can use.
+	maxEmojiFileBytes = 512 << 10
+
+	// maxEmojiDimension caps an emoji's width and height in pixels. Discord
+	// normalizes to 128px; matching it means an emoji uploaded for OwnCord
+	// looks the same as the one it was copied from, jumbo included.
+	maxEmojiDimension = 128
+
+	// emojiMaxBodySize bounds the whole multipart request. The image cap plus
+	// the form's own framing (boundaries, headers, the shortcode field) —
+	// generous enough that a legitimate 512 KiB upload never trips it.
+	emojiMaxBodySize = 1 << 20
+
+	// emojiMultipartMemoryLimit is the in-memory limit for parsing an emoji
+	// upload. Above maxEmojiFileBytes, so a valid emoji never spills to disk.
+	emojiMultipartMemoryLimit = 1 << 20
+
+	// maxAvatarFileBytes is the largest avatar image accepted (1 MiB). An
+	// avatar renders at 40px in a message row and 64px in the profile popup,
+	// so this is already generous; the client downscales before uploading and
+	// the cap is what stops it being used as free file hosting.
+	maxAvatarFileBytes = 1 << 20
+
+	// maxAvatarDimension caps an avatar's stored width and height. Bigger than
+	// any surface renders it, so a retina display still has pixels to spare
+	// while a 6000px camera JPEG is refused rather than shipped to every
+	// client that sees the user post.
+	maxAvatarDimension = 1024
+
+	// avatarMaxBodySize bounds the whole multipart avatar request: the image
+	// cap plus room for the form's boundaries and headers.
+	avatarMaxBodySize = 2 << 20
+
+	// avatarMultipartMemoryLimit is the in-memory limit for parsing an avatar
+	// upload. Above maxAvatarFileBytes, so a valid avatar never spills to disk.
+	avatarMultipartMemoryLimit = 2 << 20
+
+	// avatarUploadRateLimitPerMinute is the maximum avatar uploads per user per
+	// minute. Lower than the attachment limit: every accepted upload fans a
+	// user_update out to every connected session and orphans the previous file.
+	avatarUploadRateLimitPerMinute = 5
+
 	// maxRequestIDLen bounds a client-supplied X-Request-Id. chi's
 	// middleware.RequestID adopts that header verbatim, and the value then
 	// reaches every log record for the request (logctx, requestLogger,
diff --git a/Server/api/coverage_push_test.go b/Server/api/coverage_push_test.go
index 97ee1ed3..bc8630ee 100644
--- a/Server/api/coverage_push_test.go
+++ b/Server/api/coverage_push_test.go
@@ -751,7 +751,7 @@ func buildCombinedRouter(t *testing.T) (http.Handler, *auth.RateLimiter, string)
 	r := chi.NewRouter()
 	svc := service.New(database, limiter)
 	api.MountAuthRoutes(r, database, limiter, nil, testTOTPKey)
-	api.MountProfileRoutes(r, database, svc, limiter, nil, nil)
+	api.MountProfileRoutes(r, database, svc, nil, limiter, nil, nil)
 	api.MountInviteRoutes(r, database, svc)
 
 	token := loginAndGetToken(t, r, database, "combined1", 2)
diff --git a/Server/api/dm_group_handler_test.go b/Server/api/dm_group_handler_test.go
new file mode 100644
index 00000000..e708e5ce
--- /dev/null
+++ b/Server/api/dm_group_handler_test.go
@@ -0,0 +1,452 @@
+package api_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/owncord/server/db"
+)
+
+// ─── helpers ────────────────────────────────────────────────────────────────
+
+func dmPatch(t *testing.T, router http.Handler, path, token string, body any) *httptest.ResponseRecorder {
+	t.Helper()
+	raw, _ := json.Marshal(body)
+	req := httptest.NewRequest(http.MethodPatch, path, bytes.NewReader(raw))
+	req.Header.Set("Content-Type", "application/json")
+	if token != "" {
+		req.Header.Set("Authorization", "Bearer "+token)
+	}
+	req.RemoteAddr = "127.0.0.1:9999"
+	rr := httptest.NewRecorder()
+	router.ServeHTTP(rr, req)
+	return rr
+}
+
+// decodeDMInfo decodes a db.DMChannelInfo response body.
+func decodeDMInfo(t *testing.T, rr *httptest.ResponseRecorder) db.DMChannelInfo {
+	t.Helper()
+	var info db.DMChannelInfo
+	if err := json.Unmarshal(rr.Body.Bytes(), &info); err != nil {
+		t.Fatalf("decode DMChannelInfo: %v (body=%s)", err, rr.Body.String())
+	}
+	return info
+}
+
+// groupFixture stands up three users and returns their tokens.
+func groupFixture(t *testing.T) (*db.DB, http.Handler, *mockBroadcaster, []string) {
+	t.Helper()
+	database := newDMTestDB(t)
+	bc := &mockBroadcaster{}
+	router := buildDMRouter(database, bc)
+	tokens := []string{
+		dmCreateToken(t, database, "alice", 4),
+		dmCreateToken(t, database, "bob", 4),
+		dmCreateToken(t, database, "carol", 4),
+	}
+	return database, router, bc, tokens
+}
+
+// ─── creation ───────────────────────────────────────────────────────────────
+
+func TestCreateGroupDM_CreatesChannelWithAllParticipants(t *testing.T) {
+	_, router, bc, tokens := groupFixture(t)
+
+	rr := dmPost(t, router, "/api/v1/dms/group", tokens[0], map[string]any{
+		"recipient_ids": []int64{2, 3},
+		"name":          "Lunch crew",
+	})
+	if rr.Code != http.StatusCreated {
+		t.Fatalf("expected 201, got %d: %s", rr.Code, rr.Body.String())
+	}
+
+	info := decodeDMInfo(t, rr)
+	if !info.IsGroup {
+		t.Error("expected is_group=true")
+	}
+	if info.Name != "Lunch crew" {
+		t.Errorf("expected name %q, got %q", "Lunch crew", info.Name)
+	}
+	if len(info.Recipients) != 2 {
+		t.Fatalf("expected 2 recipients (creator excluded), got %d", len(info.Recipients))
+	}
+	// Backward compat: a pre-group client reads `recipient` and must find one.
+	if info.Recipient.ID == 0 {
+		t.Error("expected a populated backward-compat recipient field")
+	}
+	for _, r := range info.Recipients {
+		if r.ID == 1 {
+			t.Error("creator must not appear in their own recipients list")
+		}
+	}
+
+	// Every participant, creator included, is told about the new DM.
+	got := map[int64]bool{}
+	for _, m := range bc.sent {
+		got[m.UserID] = true
+	}
+	for _, want := range []int64{1, 2, 3} {
+		if !got[want] {
+			t.Errorf("expected dm_channel_open broadcast to user %d", want)
+		}
+	}
+}
+
+func TestCreateGroupDM_RequiresTwoOtherUsers(t *testing.T) {
+	_, router, _, tokens := groupFixture(t)
+
+	rr := dmPost(t, router, "/api/v1/dms/group", tokens[0], map[string]any{
+		"recipient_ids": []int64{2},
+	})
+	if rr.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400 for a one-recipient group, got %d: %s", rr.Code, rr.Body.String())
+	}
+}
+
+func TestCreateGroupDM_DeduplicatesAndDropsSelf(t *testing.T) {
+	_, router, _, tokens := groupFixture(t)
+
+	// Naming the creator and repeating bob leaves only bob + carol.
+	rr := dmPost(t, router, "/api/v1/dms/group", tokens[0], map[string]any{
+		"recipient_ids": []int64{1, 2, 2, 3},
+	})
+	if rr.Code != http.StatusCreated {
+		t.Fatalf("expected 201, got %d: %s", rr.Code, rr.Body.String())
+	}
+	info := decodeDMInfo(t, rr)
+	if len(info.Recipients) != 2 {
+		t.Fatalf("expected 2 unique recipients, got %d", len(info.Recipients))
+	}
+}
+
+func TestCreateGroupDM_RejectsOverCap(t *testing.T) {
+	database, router, _, tokens := groupFixture(t)
+	ids := make([]int64, 0, 2+db.MaxGroupDMParticipants)
+	ids = append(ids, 2, 3)
+	for i := range db.MaxGroupDMParticipants {
+		name := fmt.Sprintf("extra%d", i)
+		if _, err := database.CreateUser(context.Background(), name, "$2a$12$fake", 4); err != nil {
+			t.Fatalf("CreateUser: %v", err)
+		}
+		ids = append(ids, int64(4+i))
+	}
+
+	rr := dmPost(t, router, "/api/v1/dms/group", tokens[0], map[string]any{"recipient_ids": ids})
+	if rr.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400 over the participant cap, got %d: %s", rr.Code, rr.Body.String())
+	}
+}
+
+func TestCreateGroupDM_RejectsUnknownRecipient(t *testing.T) {
+	_, router, _, tokens := groupFixture(t)
+
+	rr := dmPost(t, router, "/api/v1/dms/group", tokens[0], map[string]any{
+		"recipient_ids": []int64{2, 9999},
+	})
+	if rr.Code != http.StatusNotFound {
+		t.Fatalf("expected 404 for an unknown recipient, got %d: %s", rr.Code, rr.Body.String())
+	}
+}
+
+// ─── blocks ─────────────────────────────────────────────────────────────────
+
+func TestCreateGroupDM_BlockerCannotAddBlocked(t *testing.T) {
+	database, router, _, tokens := groupFixture(t)
+	if err := database.BlockUser(context.Background(), 1, 3); err != nil {
+		t.Fatalf("BlockUser: %v", err)
+	}
+
+	rr := dmPost(t, router, "/api/v1/dms/group", tokens[0], map[string]any{
+		"recipient_ids": []int64{2, 3},
+	})
+	if rr.Code != http.StatusForbidden {
+		t.Fatalf("expected 403 when adding a user the creator blocked, got %d: %s", rr.Code, rr.Body.String())
+	}
+}
+
+func TestCreateGroupDM_BlockedCannotAddBlocker(t *testing.T) {
+	database, router, _, tokens := groupFixture(t)
+	// carol blocks alice; alice must not be able to pull carol in either.
+	if err := database.BlockUser(context.Background(), 3, 1); err != nil {
+		t.Fatalf("BlockUser: %v", err)
+	}
+
+	rr := dmPost(t, router, "/api/v1/dms/group", tokens[0], map[string]any{
+		"recipient_ids": []int64{2, 3},
+	})
+	if rr.Code != http.StatusForbidden {
+		t.Fatalf("expected 403 when the target blocked the creator, got %d: %s", rr.Code, rr.Body.String())
+	}
+}
+
+// ─── listing ────────────────────────────────────────────────────────────────
+
+func TestListDMs_ReturnsGroupWithParticipants(t *testing.T) {
+	_, router, _, tokens := groupFixture(t)
+
+	if rr := dmPost(t, router, "/api/v1/dms/group", tokens[0], map[string]any{
+		"recipient_ids": []int64{2, 3},
+		"name":          "Trio",
+	}); rr.Code != http.StatusCreated {
+		t.Fatalf("create group: %d %s", rr.Code, rr.Body.String())
+	}
+
+	rr := dmGet(t, router, "/api/v1/dms", tokens[1])
+	if rr.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d", rr.Code)
+	}
+	var resp struct {
+		DMChannels []db.DMChannelInfo `json:"dm_channels"`
+	}
+	if err := json.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if len(resp.DMChannels) != 1 {
+		t.Fatalf("expected 1 DM for bob, got %d", len(resp.DMChannels))
+	}
+	dm := resp.DMChannels[0]
+	if !dm.IsGroup || dm.Name != "Trio" {
+		t.Errorf("expected group named Trio, got is_group=%v name=%q", dm.IsGroup, dm.Name)
+	}
+	if len(dm.Recipients) != 2 {
+		t.Fatalf("expected bob to see 2 others, got %d", len(dm.Recipients))
+	}
+	for _, r := range dm.Recipients {
+		if r.ID == 2 {
+			t.Error("bob must not be in his own recipients list")
+		}
+	}
+}
+
+// A 1:1 DM must keep listing exactly one recipient and is_group=false, so an
+// older client's `recipient`-only rendering is unaffected by group support.
+func TestListDMs_OneToOneStaysUngrouped(t *testing.T) {
+	_, router, _, tokens := groupFixture(t)
+
+	if rr := dmPost(t, router, "/api/v1/dms", tokens[0], map[string]any{"recipient_id": 2}); rr.Code != http.StatusCreated {
+		t.Fatalf("create dm: %d %s", rr.Code, rr.Body.String())
+	}
+
+	rr := dmGet(t, router, "/api/v1/dms", tokens[0])
+	var resp struct {
+		DMChannels []db.DMChannelInfo `json:"dm_channels"`
+	}
+	if err := json.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if len(resp.DMChannels) != 1 {
+		t.Fatalf("expected 1 DM, got %d", len(resp.DMChannels))
+	}
+	dm := resp.DMChannels[0]
+	if dm.IsGroup {
+		t.Error("a two-person DM must not report is_group")
+	}
+	if len(dm.Recipients) != 1 || dm.Recipients[0].ID != 2 || dm.Recipient.ID != 2 {
+		t.Errorf("expected recipient=bob in both fields, got %+v / %+v", dm.Recipient, dm.Recipients)
+	}
+}
+
+// A group DM containing both users must never be handed back as "the DM
+// between alice and bob" — that would deliver a private message to the group.
+func TestCreateDM_DoesNotReuseGroupChannel(t *testing.T) {
+	_, router, _, tokens := groupFixture(t)
+
+	groupRR := dmPost(t, router, "/api/v1/dms/group", tokens[0], map[string]any{
+		"recipient_ids": []int64{2, 3},
+	})
+	group := decodeDMInfo(t, groupRR)
+
+	rr := dmPost(t, router, "/api/v1/dms", tokens[0], map[string]any{"recipient_id": 2})
+	if rr.Code != http.StatusCreated {
+		t.Fatalf("expected a NEW 1:1 DM (201), got %d: %s", rr.Code, rr.Body.String())
+	}
+	var created struct {
+		ChannelID int64 `json:"channel_id"`
+	}
+	if err := json.Unmarshal(rr.Body.Bytes(), &created); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if created.ChannelID == group.ChannelID {
+		t.Fatal("1:1 DM creation reused the group DM channel")
+	}
+}
+
+// ─── rename ─────────────────────────────────────────────────────────────────
+
+func TestRenameGroupDM_ParticipantMayRename(t *testing.T) {
+	_, router, bc, tokens := groupFixture(t)
+	group := decodeDMInfo(t, dmPost(t, router, "/api/v1/dms/group", tokens[0], map[string]any{
+		"recipient_ids": []int64{2, 3},
+	}))
+	bc.sent = nil
+
+	rr := dmPatch(t, router, fmt.Sprintf("/api/v1/dms/%d", group.ChannelID), tokens[1],
+		map[string]any{"name": "Renamed by bob"})
+	if rr.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d: %s", rr.Code, rr.Body.String())
+	}
+	if got := decodeDMInfo(t, rr).Name; got != "Renamed by bob" {
+		t.Errorf("expected renamed group, got %q", got)
+	}
+	if len(bc.sent) != 3 {
+		t.Errorf("expected all 3 participants notified of the rename, got %d", len(bc.sent))
+	}
+}
+
+func TestRenameGroupDM_NonParticipantRefused(t *testing.T) {
+	database, router, _, tokens := groupFixture(t)
+	group := decodeDMInfo(t, dmPost(t, router, "/api/v1/dms/group", tokens[0], map[string]any{
+		"recipient_ids": []int64{2, 3},
+	}))
+	outsider := dmCreateToken(t, database, "dave", 4)
+
+	rr := dmPatch(t, router, fmt.Sprintf("/api/v1/dms/%d", group.ChannelID), outsider,
+		map[string]any{"name": "hijacked"})
+	if rr.Code != http.StatusNotFound {
+		t.Fatalf("expected 404 for a non-participant, got %d: %s", rr.Code, rr.Body.String())
+	}
+}
+
+func TestRenameGroupDM_RefusesOneToOne(t *testing.T) {
+	_, router, _, tokens := groupFixture(t)
+	rr := dmPost(t, router, "/api/v1/dms", tokens[0], map[string]any{"recipient_id": 2})
+	var created struct {
+		ChannelID int64 `json:"channel_id"`
+	}
+	_ = json.Unmarshal(rr.Body.Bytes(), &created)
+
+	renameRR := dmPatch(t, router, fmt.Sprintf("/api/v1/dms/%d", created.ChannelID), tokens[0],
+		map[string]any{"name": "not allowed"})
+	if renameRR.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400 renaming a 1:1 DM, got %d: %s", renameRR.Code, renameRR.Body.String())
+	}
+}
+
+func TestRenameGroupDM_RejectsOverlongName(t *testing.T) {
+	_, router, _, tokens := groupFixture(t)
+	group := decodeDMInfo(t, dmPost(t, router, "/api/v1/dms/group", tokens[0], map[string]any{
+		"recipient_ids": []int64{2, 3},
+	}))
+
+	long := make([]byte, 200)
+	for i := range long {
+		long[i] = 'x'
+	}
+	rr := dmPatch(t, router, fmt.Sprintf("/api/v1/dms/%d", group.ChannelID), tokens[0],
+		map[string]any{"name": string(long)})
+	if rr.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400 for an overlong name, got %d", rr.Code)
+	}
+}
+
+// ─── leaving ────────────────────────────────────────────────────────────────
+
+func TestLeaveGroupDM_RemovesParticipantAndNotifiesSurvivors(t *testing.T) {
+	database, router, bc, tokens := groupFixture(t)
+	group := decodeDMInfo(t, dmPost(t, router, "/api/v1/dms/group", tokens[0], map[string]any{
+		"recipient_ids": []int64{2, 3},
+	}))
+	bc.sent = nil
+
+	rr := dmDelete(t, router, fmt.Sprintf("/api/v1/dms/%d", group.ChannelID), tokens[1])
+	if rr.Code != http.StatusNoContent {
+		t.Fatalf("expected 204, got %d: %s", rr.Code, rr.Body.String())
+	}
+
+	ok, err := database.IsDMParticipant(context.Background(), 2, group.ChannelID)
+	if err != nil {
+		t.Fatalf("IsDMParticipant: %v", err)
+	}
+	if ok {
+		t.Error("bob is still a participant after leaving")
+	}
+
+	// The leaver gets a close; the survivors get a refreshed membership.
+	var closes, opens int
+	for _, m := range bc.sent {
+		var env struct {
+			Type string `json:"type"`
+		}
+		_ = json.Unmarshal(m.Msg, &env)
+		switch env.Type {
+		case "dm_channel_close":
+			closes++
+			if m.UserID != 2 {
+				t.Errorf("close sent to user %d, expected the leaver (2)", m.UserID)
+			}
+		case "dm_channel_open":
+			opens++
+			if m.UserID == 2 {
+				t.Error("the leaver must not receive a refreshed membership")
+			}
+		}
+	}
+	if closes != 1 {
+		t.Errorf("expected 1 dm_channel_close, got %d", closes)
+	}
+	if opens != 2 {
+		t.Errorf("expected 2 survivors notified, got %d", opens)
+	}
+}
+
+func TestLeaveGroupDM_LastParticipantDeletesChannel(t *testing.T) {
+	database, router, _, tokens := groupFixture(t)
+	group := decodeDMInfo(t, dmPost(t, router, "/api/v1/dms/group", tokens[0], map[string]any{
+		"recipient_ids": []int64{2, 3},
+	}))
+
+	for _, tok := range tokens {
+		if rr := dmDelete(t, router, fmt.Sprintf("/api/v1/dms/%d", group.ChannelID), tok); rr.Code != http.StatusNoContent {
+			t.Fatalf("leave: %d %s", rr.Code, rr.Body.String())
+		}
+	}
+
+	ch, err := database.GetChannel(context.Background(), group.ChannelID)
+	if err != nil {
+		t.Fatalf("GetChannel: %v", err)
+	}
+	if ch != nil {
+		t.Error("the channel should be gone once the last participant leaves")
+	}
+}
+
+// Closing a 1:1 DM must stay a hide, not a leave: the closer remains a
+// participant so the next message from either side reopens the conversation.
+func TestCloseDM_OneToOneKeepsParticipation(t *testing.T) {
+	database, router, _, tokens := groupFixture(t)
+	rr := dmPost(t, router, "/api/v1/dms", tokens[0], map[string]any{"recipient_id": 2})
+	var created struct {
+		ChannelID int64 `json:"channel_id"`
+	}
+	_ = json.Unmarshal(rr.Body.Bytes(), &created)
+
+	if delRR := dmDelete(t, router, fmt.Sprintf("/api/v1/dms/%d", created.ChannelID), tokens[0]); delRR.Code != http.StatusNoContent {
+		t.Fatalf("close: %d", delRR.Code)
+	}
+
+	ok, err := database.IsDMParticipant(context.Background(), 1, created.ChannelID)
+	if err != nil {
+		t.Fatalf("IsDMParticipant: %v", err)
+	}
+	if !ok {
+		t.Error("closing a 1:1 DM must not remove the participant row")
+	}
+}
+
+func TestLeaveGroupDM_NonParticipantRefused(t *testing.T) {
+	database, router, _, tokens := groupFixture(t)
+	group := decodeDMInfo(t, dmPost(t, router, "/api/v1/dms/group", tokens[0], map[string]any{
+		"recipient_ids": []int64{2, 3},
+	}))
+	outsider := dmCreateToken(t, database, "erin", 4)
+
+	rr := dmDelete(t, router, fmt.Sprintf("/api/v1/dms/%d", group.ChannelID), outsider)
+	if rr.Code != http.StatusNotFound {
+		t.Fatalf("expected 404, got %d", rr.Code)
+	}
+}
diff --git a/Server/api/dm_handler.go b/Server/api/dm_handler.go
index c5925e16..b10643dc 100644
--- a/Server/api/dm_handler.go
+++ b/Server/api/dm_handler.go
@@ -1,6 +1,7 @@
 package api
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"log/slog"
@@ -24,7 +25,9 @@ func MountDMRoutes(r chi.Router, database *db.DB, svc *service.Services, broadca
 	r.Route("/api/v1/dms", func(r chi.Router) {
 		r.Use(AuthMiddleware(database))
 		r.Post("/", handleCreateDM(svc))
+		r.Post("/group", handleCreateGroupDM(svc, broadcaster))
 		r.Get("/", handleListDMs(svc))
+		r.Patch("/{channelId}", handleRenameGroupDM(svc, broadcaster))
 		r.Delete("/{channelId}", handleCloseDM(svc, broadcaster))
 	})
 
@@ -49,6 +52,17 @@ type createDMResponse struct {
 	Created   bool      `json:"created"`
 }
 
+// createGroupDMRequest is the JSON body for POST /api/v1/dms/group.
+type createGroupDMRequest struct {
+	RecipientIDs []int64 `json:"recipient_ids"`
+	Name         string  `json:"name"`
+}
+
+// renameDMRequest is the JSON body for PATCH /api/v1/dms/{channelId}.
+type renameDMRequest struct {
+	Name string `json:"name"`
+}
+
 // listDMsResponse is the JSON response for GET /api/v1/dms.
 type listDMsResponse struct {
 	DMChannels []db.DMChannelInfo `json:"dm_channels"`
@@ -83,11 +97,16 @@ func handleCreateDM(svc *service.Services) http.HandlerFunc {
 		if result.Recipient.Avatar != nil {
 			avatarStr = *result.Recipient.Avatar
 		}
+		displayName := ""
+		if result.Recipient.DisplayName != nil {
+			displayName = *result.Recipient.DisplayName
+		}
 		dmUser := db.DMUser{
-			ID:       result.Recipient.ID,
-			Username: result.Recipient.Username,
-			Avatar:   avatarStr,
-			Status:   result.Recipient.Status,
+			ID:          result.Recipient.ID,
+			Username:    result.Recipient.Username,
+			Avatar:      avatarStr,
+			Status:      db.StatusForViewer(result.Recipient.Status, result.Recipient.ID, user.ID),
+			DisplayName: displayName,
 		}
 
 		status := http.StatusOK
@@ -138,7 +157,8 @@ func handleCloseDM(svc *service.Services, broadcaster DMBroadcaster) http.Handle
 			return
 		}
 
-		if err := svc.DMs.CloseDM(r.Context(), user.ID, channelID); err != nil {
+		result, err := svc.DMs.CloseDM(r.Context(), user.ID, channelID)
+		if err != nil {
 			writeServiceError(r.Context(), w, err)
 			return
 		}
@@ -149,12 +169,128 @@ func handleCloseDM(svc *service.Services, broadcaster DMBroadcaster) http.Handle
 			if ok := broadcaster.SendToUser(user.ID, closeMsg); !ok {
 				slog.Debug("handleCloseDM: user not connected", "user_id", user.ID, "channel_id", channelID)
 			}
+			// A group leave changes the membership everyone else renders, so
+			// the survivors get a refreshed dm_channel_open rather than being
+			// left showing a member who has gone.
+			if result.Left && !result.ChannelDeleted {
+				broadcastDMOpen(r.Context(), svc, broadcaster, channelID, result.RemainingParticipantIDs)
+			}
 		}
 
 		w.WriteHeader(http.StatusNoContent)
 	}
 }
 
+// broadcastDMOpen sends a per-viewer dm_channel_open for channelID to each of
+// targetIDs. The payload differs per addressee (`recipient`/`recipients` are
+// relative to who is reading), so it is rebuilt inside the loop.
+//
+// Failures are logged and skipped, never surfaced: the mutation that prompted
+// this has already committed, and a client that misses the event re-derives
+// the same state from its next `ready`.
+func broadcastDMOpen(ctx context.Context, svc *service.Services, broadcaster DMBroadcaster, channelID int64, targetIDs []int64) {
+	if broadcaster == nil || len(targetIDs) == 0 {
+		return
+	}
+	for _, pid := range targetIDs {
+		summary, pErr := svc.DMs.DMSummaryFor(ctx, pid, channelID)
+		if pErr != nil {
+			slog.Debug("broadcastDMOpen: summary unavailable", "user_id", pid, "channel_id", channelID, "err", pErr)
+			continue
+		}
+		msg, mErr := json.Marshal(map[string]any{
+			"type":    "dm_channel_open",
+			"payload": summary,
+		})
+		if mErr != nil {
+			slog.Warn("broadcastDMOpen: marshal failed", "err", mErr, "channel_id", channelID)
+			continue
+		}
+		if ok := broadcaster.SendToUser(pid, msg); !ok {
+			slog.Debug("broadcastDMOpen: user not connected", "user_id", pid, "channel_id", channelID)
+		}
+	}
+}
+
+// handleCreateGroupDM creates a group DM between the caller and 2..8 others.
+func handleCreateGroupDM(svc *service.Services, broadcaster DMBroadcaster) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		user, ok := r.Context().Value(UserKey).(*db.User)
+		if !ok || user == nil {
+			writeJSON(w, http.StatusUnauthorized, errorResponse{
+				Error: "UNAUTHORIZED", Message: "authentication required",
+			})
+			return
+		}
+
+		var req createGroupDMRequest
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			writeJSON(w, http.StatusBadRequest, errorResponse{
+				Error: "BAD_REQUEST", Message: "invalid request body",
+			})
+			return
+		}
+
+		result, err := svc.DMs.CreateGroupDM(r.Context(), user.ID, req.RecipientIDs, req.Name)
+		if err != nil {
+			writeServiceError(r.Context(), w, err)
+			return
+		}
+
+		// Everyone gets the DM in their sidebar immediately, the creator
+		// included — the REST response is only the creator's copy, and a
+		// second window of theirs needs the event just as much as the others.
+		broadcastDMOpen(r.Context(), svc, broadcaster, result.Channel.ID, result.ParticipantIDs)
+
+		writeJSON(w, http.StatusCreated,
+			db.NewDMChannelInfo(result.Channel.ID, result.Channel.Name, true, result.Participants, user.ID))
+	}
+}
+
+// handleRenameGroupDM sets or clears a group DM's name. Participants only —
+// there is no owner, so every member holds the same authority over it.
+func handleRenameGroupDM(svc *service.Services, broadcaster DMBroadcaster) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		user, ok := r.Context().Value(UserKey).(*db.User)
+		if !ok || user == nil {
+			writeJSON(w, http.StatusUnauthorized, errorResponse{
+				Error: "UNAUTHORIZED", Message: "authentication required",
+			})
+			return
+		}
+
+		channelID, ok := parseIDParam(w, r, "channelId")
+		if !ok {
+			return
+		}
+
+		var req renameDMRequest
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			writeJSON(w, http.StatusBadRequest, errorResponse{
+				Error: "BAD_REQUEST", Message: "invalid request body",
+			})
+			return
+		}
+
+		if _, err := svc.DMs.RenameGroupDM(r.Context(), user.ID, channelID, req.Name); err != nil {
+			writeServiceError(r.Context(), w, err)
+			return
+		}
+
+		participantIDs, pErr := svc.Channels.GetDMParticipantIDs(r.Context(), channelID)
+		if pErr == nil {
+			broadcastDMOpen(r.Context(), svc, broadcaster, channelID, participantIDs)
+		}
+
+		summary, sErr := svc.DMs.DMSummaryFor(r.Context(), user.ID, channelID)
+		if sErr != nil {
+			writeServiceError(r.Context(), w, sErr)
+			return
+		}
+		writeJSON(w, http.StatusOK, summary)
+	}
+}
+
 // handleBlockUser blocks a user.
 func handleBlockUser(svc *service.Services) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
diff --git a/Server/api/dm_handler_test.go b/Server/api/dm_handler_test.go
index 88ab61d7..de42795f 100644
--- a/Server/api/dm_handler_test.go
+++ b/Server/api/dm_handler_test.go
@@ -49,7 +49,10 @@ CREATE TABLE IF NOT EXISTS users (
     banned      INTEGER NOT NULL DEFAULT 0,
     ban_reason  TEXT,
     ban_expires TEXT,
-    identity_public_key TEXT
+    identity_public_key TEXT,
+    display_name TEXT,
+    about TEXT,
+    custom_status TEXT
 );
 
 CREATE TABLE IF NOT EXISTS sessions (
@@ -77,7 +80,9 @@ CREATE TABLE IF NOT EXISTS channels (
     voice_max_users  INTEGER NOT NULL DEFAULT 0,
     voice_quality    TEXT,
     mixing_threshold INTEGER,
-    voice_max_video  INTEGER NOT NULL DEFAULT 0
+    voice_max_video  INTEGER NOT NULL DEFAULT 0,
+    nsfw             INTEGER NOT NULL DEFAULT 0,
+    is_group         INTEGER NOT NULL DEFAULT 0
 );
 
 CREATE TABLE IF NOT EXISTS messages (
@@ -89,8 +94,15 @@ CREATE TABLE IF NOT EXISTS messages (
     edited_at  TEXT,
     deleted    INTEGER NOT NULL DEFAULT 0,
     pinned     INTEGER NOT NULL DEFAULT 0,
-    timestamp  TEXT    NOT NULL DEFAULT (datetime('now'))
+    timestamp  TEXT    NOT NULL DEFAULT (datetime('now')),
+    mentions_everyone INTEGER NOT NULL DEFAULT 0
 );
+CREATE TABLE IF NOT EXISTS message_mentions (
+    message_id        INTEGER NOT NULL REFERENCES messages(id) ON DELETE CASCADE,
+    mentioned_user_id INTEGER NOT NULL REFERENCES users(id)    ON DELETE CASCADE,
+    PRIMARY KEY (message_id, mentioned_user_id)
+);
+
 
 CREATE TABLE IF NOT EXISTS dm_participants (
     channel_id INTEGER NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
diff --git a/Server/api/emoji_handler.go b/Server/api/emoji_handler.go
new file mode 100644
index 00000000..c3e91592
--- /dev/null
+++ b/Server/api/emoji_handler.go
@@ -0,0 +1,407 @@
+package api
+
+import (
+	"bytes"
+	"context"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"image"
+	_ "image/gif"  // register the GIF decoder for image.DecodeConfig
+	_ "image/jpeg" // register the JPEG decoder for image.DecodeConfig
+	_ "image/png"  // register the PNG decoder for image.DecodeConfig
+	"io"
+	"log/slog"
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+	"github.com/owncord/server/auth"
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/service"
+	"github.com/owncord/server/storage"
+)
+
+// EmojiBroadcaster is the slice of the hub the emoji routes need: after every
+// mutation the full set is pushed to every connected client so pickers,
+// message rendering and reaction pills converge without a reconnect.
+type EmojiBroadcaster interface {
+	BroadcastEmojiUpdate(list []*db.Emoji)
+}
+
+// emojiResponse is the JSON shape of one emoji in GET/POST /api/v1/emoji.
+// Deliberately not db.Emoji: the storage id and sniffed mime type are
+// server-side details, and `url` is what a client actually needs.
+type emojiResponse struct {
+	ID        int64  `json:"id"`
+	Shortcode string `json:"shortcode"`
+	URL       string `json:"url"`
+}
+
+func toEmojiResponse(e *db.Emoji) emojiResponse {
+	return emojiResponse{ID: e.ID, Shortcode: e.Shortcode, URL: service.EmojiImageURL(e.ID)}
+}
+
+func toEmojiResponses(list []*db.Emoji) []emojiResponse {
+	out := make([]emojiResponse, 0, len(list))
+	for _, e := range list {
+		if e == nil {
+			continue
+		}
+		out = append(out, toEmojiResponse(e))
+	}
+	return out
+}
+
+// allowedEmojiMIME is the set of image types an emoji may be, matched against
+// the type sniffed from the file's own bytes. SVG is absent on purpose: it is
+// markup with script and external-fetch capability, which is exactly what
+// isUnsafeInlineMIME forces to a download on the attachment route -- an emoji
+// is by definition rendered inline, so the format simply cannot be allowed.
+var allowedEmojiMIME = map[string]bool{
+	"image/png":  true,
+	"image/jpeg": true,
+	"image/gif":  true,
+	"image/webp": true,
+}
+
+// MountEmojiRoutes registers the custom-emoji endpoints.
+//
+// Every route requires authentication: reading the set is ungated beyond that
+// (emoji are server-wide and every member renders them), while POST and DELETE
+// are gated on MANAGE_SERVER inside EmojiService. The image route is
+// authenticated rather than public so an emoji cannot be used as an
+// unauthenticated tracking pixel hosted on someone else's server.
+func MountEmojiRoutes(r chi.Router, database *db.DB, svc *service.Services, store *storage.Storage, limiter *auth.RateLimiter, broadcaster EmojiBroadcaster) {
+	r.Route("/api/v1/emoji", func(r chi.Router) {
+		r.Use(AuthMiddleware(database))
+		r.Get("/", handleListEmoji(svc))
+		r.Get("/{id}/image", handleServeEmojiImage(svc, store))
+		r.With(MaxBodySize(emojiMaxBodySize)).
+			Post("/", handleCreateEmoji(svc, store, limiter, broadcaster))
+		r.Delete("/{id}", handleDeleteEmoji(svc, store, broadcaster))
+	})
+}
+
+func handleListEmoji(svc *service.Services) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		list, err := svc.Emoji.List(r.Context())
+		if err != nil {
+			writeServiceError(r.Context(), w, err)
+			return
+		}
+		writeJSON(w, http.StatusOK, toEmojiResponses(list))
+	}
+}
+
+// handleCreateEmoji processes POST /api/v1/emoji (multipart: `file` + `shortcode`).
+//
+// Order matters here. The permission gate runs BEFORE the multipart parse, so a
+// member without MANAGE_SERVER cannot make the server spool a body to disk; the
+// shortcode is validated next, so a malformed name costs nothing either; only
+// then are the bytes read, sniffed, measured and stored.
+func handleCreateEmoji(svc *service.Services, store *storage.Storage, limiter *auth.RateLimiter, broadcaster EmojiBroadcaster) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		user, ok := r.Context().Value(UserKey).(*db.User)
+		if !ok || user == nil {
+			writeJSON(w, http.StatusUnauthorized, errorResponse{
+				Error: "UNAUTHORIZED", Message: "not authenticated",
+			})
+			return
+		}
+
+		if err := svc.Emoji.RequireManage(r.Context(), user.ID); err != nil {
+			writeServiceError(r.Context(), w, err)
+			return
+		}
+
+		if limiter != nil && !limiter.Allow(auth.Key("emoji_upload", user.ID), emojiUploadRateLimitPerMinute, time.Minute) {
+			writeJSON(w, http.StatusTooManyRequests, errorResponse{
+				Error: "RATE_LIMITED", Message: "emoji upload rate limit exceeded, try again later",
+			})
+			return
+		}
+
+		// Bound the body before the multipart parser touches it. The route also
+		// carries MaxBodySize, but a handler that parses a form has to state
+		// its own limit — the parser is what turns an unbounded body into heap.
+		r.Body = http.MaxBytesReader(w, r.Body, emojiMaxBodySize)
+
+		if err := r.ParseMultipartForm(emojiMultipartMemoryLimit); err != nil {
+			writeJSON(w, http.StatusBadRequest, errorResponse{
+				Error: "BAD_REQUEST", Message: "invalid multipart form",
+			})
+			return
+		}
+
+		shortcode, err := service.ValidateShortcode(r.FormValue("shortcode"))
+		if err != nil {
+			writeServiceError(r.Context(), w, err)
+			return
+		}
+
+		file, _, err := r.FormFile("file")
+		if err != nil {
+			writeJSON(w, http.StatusBadRequest, errorResponse{
+				Error: "BAD_REQUEST", Message: "missing file field",
+			})
+			return
+		}
+		defer file.Close() //nolint:errcheck
+
+		// Read at most one byte past the cap so "exactly at the limit" passes
+		// and "one byte over" is caught, without buffering an unbounded body.
+		raw, err := io.ReadAll(io.LimitReader(file, maxEmojiFileBytes+1))
+		if err != nil {
+			writeJSON(w, http.StatusBadRequest, errorResponse{
+				Error: "BAD_REQUEST", Message: "failed to read uploaded file",
+			})
+			return
+		}
+		if int64(len(raw)) > maxEmojiFileBytes {
+			writeJSON(w, http.StatusBadRequest, errorResponse{
+				Error:   "BAD_REQUEST",
+				Message: fmt.Sprintf("emoji must be at most %d KB", maxEmojiFileBytes>>10),
+			})
+			return
+		}
+
+		mimeType := http.DetectContentType(raw)
+		if !allowedEmojiMIME[mimeType] {
+			writeJSON(w, http.StatusBadRequest, errorResponse{
+				Error:   "BAD_REQUEST",
+				Message: "emoji must be a PNG, JPEG, GIF or WebP image",
+			})
+			return
+		}
+
+		width, height, err := imageDimensions(raw, mimeType)
+		if err != nil {
+			writeJSON(w, http.StatusBadRequest, errorResponse{
+				Error: "BAD_REQUEST", Message: "could not read image dimensions",
+			})
+			return
+		}
+		// Re-check the sniffed dimensions rather than trusting anything the
+		// client said about the image: the cap is what keeps an "emoji" from
+		// being a full-size picture inlined into every message that names it.
+		if width <= 0 || height <= 0 || width > maxEmojiDimension || height > maxEmojiDimension {
+			writeJSON(w, http.StatusBadRequest, errorResponse{
+				Error:   "BAD_REQUEST",
+				Message: fmt.Sprintf("emoji must be at most %dx%d pixels (got %dx%d)", maxEmojiDimension, maxEmojiDimension, width, height),
+			})
+			return
+		}
+
+		storedAs := uuid.New().String()
+		if _, saveErr := store.Save(storedAs, bytes.NewReader(raw)); saveErr != nil {
+			slog.Warn("emoji upload rejected by storage", "error", saveErr)
+			writeJSON(w, http.StatusBadRequest, errorResponse{
+				Error: "BAD_REQUEST", Message: fmt.Sprintf("upload rejected: %s", saveErr),
+			})
+			return
+		}
+
+		created, err := svc.Emoji.Create(r.Context(), user.ID, shortcode, storedAs, mimeType)
+		if err != nil {
+			// The row never landed, so the file is an orphan — unlink it.
+			if delErr := store.Delete(storedAs); delErr != nil {
+				slog.Error("failed to clean up orphaned emoji file", "stored_as", storedAs, "error", delErr)
+			}
+			writeServiceError(r.Context(), w, err)
+			return
+		}
+
+		broadcastEmojiSet(r.Context(), svc, broadcaster)
+		writeJSON(w, http.StatusCreated, toEmojiResponse(created))
+	}
+}
+
+func handleDeleteEmoji(svc *service.Services, store *storage.Storage, broadcaster EmojiBroadcaster) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		user, ok := r.Context().Value(UserKey).(*db.User)
+		if !ok || user == nil {
+			writeJSON(w, http.StatusUnauthorized, errorResponse{
+				Error: "UNAUTHORIZED", Message: "not authenticated",
+			})
+			return
+		}
+		id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
+		if err != nil || id <= 0 {
+			writeJSON(w, http.StatusBadRequest, errorResponse{
+				Error: "BAD_REQUEST", Message: "invalid emoji id",
+			})
+			return
+		}
+
+		removed, err := svc.Emoji.Delete(r.Context(), user.ID, id)
+		if err != nil {
+			writeServiceError(r.Context(), w, err)
+			return
+		}
+		// The row is already gone, so a failed unlink leaves an orphaned blob,
+		// not a broken emoji — log it rather than failing a successful delete.
+		if delErr := store.Delete(removed.StoredAs); delErr != nil {
+			slog.Warn("failed to remove emoji file", "stored_as", removed.StoredAs, "error", delErr)
+		}
+
+		broadcastEmojiSet(r.Context(), svc, broadcaster)
+		w.WriteHeader(http.StatusNoContent)
+	}
+}
+
+// broadcastEmojiSet re-reads the set and pushes it to every client. A failure
+// here is logged and swallowed: the mutation itself already succeeded, and the
+// caller's own response carries the change.
+func broadcastEmojiSet(ctx context.Context, svc *service.Services, broadcaster EmojiBroadcaster) {
+	if broadcaster == nil {
+		return
+	}
+	list, err := svc.Emoji.List(ctx)
+	if err != nil {
+		slog.Error("failed to load emoji for broadcast", "error", err)
+		return
+	}
+	broadcaster.BroadcastEmojiUpdate(list)
+}
+
+// handleServeEmojiImage serves the stored bytes of one emoji.
+//
+// Unlike /api/v1/files/{id} there is no per-channel ACL to apply: an emoji is
+// server-wide by construction, so authentication is the whole check. The
+// response is immutable for the id's lifetime (an emoji's bytes never change
+// — a replacement is a new row), which is what lets it be cached hard.
+func handleServeEmojiImage(svc *service.Services, store *storage.Storage) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
+		if err != nil || id <= 0 {
+			http.NotFound(w, r)
+			return
+		}
+		e, err := svc.Emoji.Get(r.Context(), id)
+		if err != nil {
+			if errors.Is(err, service.ErrNotFound) {
+				http.NotFound(w, r)
+				return
+			}
+			writeServiceError(r.Context(), w, err)
+			return
+		}
+		f, err := store.Open(e.StoredAs)
+		if err != nil {
+			http.NotFound(w, r)
+			return
+		}
+		defer f.Close() //nolint:errcheck
+
+		w.Header().Set("Content-Type", e.MimeType)
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		w.Header().Set("Content-Disposition", "inline")
+		// Private (it needed a session to fetch) but immutable, so a client may
+		// keep it for a day rather than re-fetching it for every message.
+		w.Header().Set("Cache-Control", "private, max-age=86400, immutable")
+
+		var modTime time.Time
+		if info, statErr := f.Stat(); statErr == nil {
+			modTime = info.ModTime()
+		}
+		http.ServeContent(w, r, e.Shortcode, modTime, f)
+	}
+}
+
+// ─── Dimension extraction ────────────────────────────────────────────────────
+
+// imageDimensions returns the pixel size of an image already known to be one of
+// the allowed types. PNG/JPEG/GIF go through image.DecodeConfig; WebP has no
+// decoder in the standard library and none is vendored, so its header is read
+// directly — which is all that is wanted here anyway, since decoding a whole
+// frame just to learn its size is work the cap exists to avoid.
+//
+// Shared by the emoji and avatar upload routes: both refuse an image too big
+// for the surface it renders on, and both have to answer the same question
+// about the same four formats.
+func imageDimensions(raw []byte, mimeType string) (width, height int, err error) {
+	if mimeType == "image/webp" {
+		width, height, err = webpDimensions(raw)
+	} else {
+		var cfg image.Config
+		cfg, _, err = image.DecodeConfig(bytes.NewReader(raw))
+		if err != nil {
+			return 0, 0, fmt.Errorf("decoding image config: %w", err)
+		}
+		width, height = cfg.Width, cfg.Height
+	}
+	if err != nil {
+		return 0, 0, err
+	}
+	// Both callers treat a non-error return as trustworthy enough to compare
+	// straight against their pixel cap. A width or height of zero is not a
+	// "small" image, it is a decoder -- Go's own GIF DecodeConfig happily
+	// reports height=0 for a malformed logical screen descriptor -- accepting
+	// a degenerate header as valid. Rejecting it here means the invariant
+	// holds even for a caller that forgets to re-check, instead of relying on
+	// every call site getting its own bounds check right.
+	if width <= 0 || height <= 0 {
+		return 0, 0, fmt.Errorf("decoding image config: non-positive dimensions %dx%d", width, height)
+	}
+	return width, height, nil
+}
+
+// errBadWebP is returned for any WebP whose header does not parse; the caller
+// turns it into the same 400 a corrupt PNG gets.
+var errBadWebP = errors.New("malformed WebP header")
+
+// webpDimensions reads the canvas size out of a RIFF/WEBP container. All three
+// chunk flavours are handled: VP8 (lossy), VP8L (lossless) and VP8X (extended,
+// which is what an animated or alpha WebP uses).
+func webpDimensions(raw []byte) (width, height int, err error) {
+	// 12-byte RIFF header + at least a 4-byte chunk fourcc.
+	if len(raw) < 16 || string(raw[0:4]) != "RIFF" || string(raw[8:12]) != "WEBP" {
+		return 0, 0, errBadWebP
+	}
+	switch string(raw[12:16]) {
+	case "VP8 ":
+		// Chunk payload starts at 20; the keyframe start code sits 3 bytes in,
+		// followed by two 14-bit dimensions (the top 2 bits are a scale field).
+		if len(raw) < 30 {
+			return 0, 0, errBadWebP
+		}
+		if raw[23] != 0x9d || raw[24] != 0x01 || raw[25] != 0x2a {
+			return 0, 0, errBadWebP
+		}
+		w := int(binary.LittleEndian.Uint16(raw[26:28]) & 0x3FFF)
+		h := int(binary.LittleEndian.Uint16(raw[28:30]) & 0x3FFF)
+		// Unlike VP8L/VP8X (which store size-1, so they can never encode
+		// zero), the VP8 keyframe stores the size directly: an all-zero
+		// dimension field is a validly-shaped but degenerate header, not a
+		// real 0x0 canvas. Reject it here rather than reporting "success"
+		// with a size no image actually has.
+		if w == 0 || h == 0 {
+			return 0, 0, errBadWebP
+		}
+		return w, h, nil
+	case "VP8L":
+		// Payload starts at 20 with a 0x2F signature byte, then a packed
+		// 14+14-bit (width-1, height-1) pair.
+		if len(raw) < 25 || raw[20] != 0x2F {
+			return 0, 0, errBadWebP
+		}
+		bits := binary.LittleEndian.Uint32(raw[21:25])
+		w := int(bits&0x3FFF) + 1
+		h := int((bits>>14)&0x3FFF) + 1
+		return w, h, nil
+	case "VP8X":
+		// Payload starts at 20: flags byte, 3 reserved bytes, then canvas
+		// width-1 and height-1 as 24-bit little-endian values.
+		if len(raw) < 30 {
+			return 0, 0, errBadWebP
+		}
+		w := int(uint32(raw[24]) | uint32(raw[25])<<8 | uint32(raw[26])<<16)
+		h := int(uint32(raw[27]) | uint32(raw[28])<<8 | uint32(raw[29])<<16)
+		return w + 1, h + 1, nil
+	default:
+		return 0, 0, errBadWebP
+	}
+}
diff --git a/Server/api/emoji_handler_test.go b/Server/api/emoji_handler_test.go
new file mode 100644
index 00000000..77dc3966
--- /dev/null
+++ b/Server/api/emoji_handler_test.go
@@ -0,0 +1,593 @@
+package api_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/binary"
+	"encoding/json"
+	"fmt"
+	"image"
+	"image/color"
+	"image/gif"
+	"image/jpeg"
+	"image/png"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/owncord/server/api"
+	"github.com/owncord/server/auth"
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/permissions"
+	"github.com/owncord/server/service"
+	"github.com/owncord/server/storage"
+)
+
+// ─── harness ─────────────────────────────────────────────────────────────────
+
+// recordingEmojiBroadcaster captures every emoji_update fan-out so a test can
+// assert the set was pushed (and what it contained) without a live hub.
+type recordingEmojiBroadcaster struct {
+	calls [][]*db.Emoji
+}
+
+func (b *recordingEmojiBroadcaster) BroadcastEmojiUpdate(list []*db.Emoji) {
+	b.calls = append(b.calls, list)
+}
+
+type emojiHarness struct {
+	router      http.Handler
+	database    *db.DB
+	store       *storage.Storage
+	broadcaster *recordingEmojiBroadcaster
+	// Tokens for the three principals the gate tests need.
+	ownerToken  string // ADMINISTRATOR
+	adminToken  string // MANAGE_SERVER, no ADMINISTRATOR
+	memberToken string // neither
+}
+
+func newEmojiHarness(t *testing.T) *emojiHarness {
+	t.Helper()
+	database, err := db.Open(":memory:")
+	if err != nil {
+		t.Fatalf("db.Open: %v", err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	if err := db.Migrate(database); err != nil {
+		t.Fatalf("db.Migrate: %v", err)
+	}
+
+	// Pin the exact permission masks the gate tests depend on rather than
+	// inheriting whatever the seeded defaults happen to carry.
+	exec := func(q string, args ...any) {
+		t.Helper()
+		if _, execErr := database.ExecContext(context.Background(), q, args...); execErr != nil {
+			t.Fatalf("exec %q: %v", q, execErr)
+		}
+	}
+	exec(`UPDATE roles SET permissions = ? WHERE id = ?`, permissions.Administrator, permissions.OwnerRoleID)
+	exec(`UPDATE roles SET permissions = ? WHERE id = ?`,
+		permissions.ManageServer|permissions.ReadMessages|permissions.SendMessages, permissions.AdminRoleID)
+	exec(`UPDATE roles SET permissions = ? WHERE id = ?`,
+		permissions.ReadMessages|permissions.SendMessages|permissions.AddReactions, permissions.MemberRoleID)
+
+	store, err := storage.New(t.TempDir(), 10)
+	if err != nil {
+		t.Fatalf("storage.New: %v", err)
+	}
+
+	h := &emojiHarness{
+		database:    database,
+		store:       store,
+		broadcaster: &recordingEmojiBroadcaster{},
+	}
+	svc := service.New(database, auth.NewRateLimiter())
+	r := chi.NewRouter()
+	api.MountEmojiRoutes(r, database, svc, store, auth.NewRateLimiter(), h.broadcaster)
+	h.router = r
+
+	h.ownerToken = emojiSeedUser(t, database, "owner", int(permissions.OwnerRoleID))
+	h.adminToken = emojiSeedUser(t, database, "admin", int(permissions.AdminRoleID))
+	h.memberToken = emojiSeedUser(t, database, "member", int(permissions.MemberRoleID))
+	return h
+}
+
+// emojiSeedUser creates a user with roleID and an unexpired session, returning
+// the plaintext bearer token.
+func emojiSeedUser(t *testing.T, database *db.DB, username string, roleID int) string {
+	t.Helper()
+	if _, err := database.CreateUser(context.Background(), username, "$2a$12$fake", roleID); err != nil {
+		t.Fatalf("CreateUser %q: %v", username, err)
+	}
+	token := "emoji-test-token-" + username
+	_, err := database.ExecContext(context.Background(),
+		`INSERT INTO sessions (user_id, token, device, ip_address, expires_at)
+		 SELECT id, ?, 'test', '127.0.0.1', '2099-01-01T00:00:00Z' FROM users WHERE username = ?`,
+		auth.HashToken(token), username)
+	if err != nil {
+		t.Fatalf("insert session for %q: %v", username, err)
+	}
+	return token
+}
+
+func (h *emojiHarness) do(t *testing.T, method, path, token string, body *bytes.Buffer, contentType string) *httptest.ResponseRecorder {
+	t.Helper()
+	var req *http.Request
+	if body == nil {
+		req = httptest.NewRequest(method, path, nil)
+	} else {
+		req = httptest.NewRequest(method, path, body)
+		req.Header.Set("Content-Type", contentType)
+	}
+	if token != "" {
+		req.Header.Set("Authorization", "Bearer "+token)
+	}
+	rec := httptest.NewRecorder()
+	h.router.ServeHTTP(rec, req)
+	return rec
+}
+
+// upload POSTs a multipart emoji and returns the recorder.
+func (h *emojiHarness) upload(t *testing.T, token, shortcode string, content []byte) *httptest.ResponseRecorder {
+	t.Helper()
+	body := &bytes.Buffer{}
+	w := multipart.NewWriter(body)
+	if shortcode != "" {
+		if err := w.WriteField("shortcode", shortcode); err != nil {
+			t.Fatalf("WriteField: %v", err)
+		}
+	}
+	if content != nil {
+		part, err := w.CreateFormFile("file", "emoji.bin")
+		if err != nil {
+			t.Fatalf("CreateFormFile: %v", err)
+		}
+		if _, err := part.Write(content); err != nil {
+			t.Fatalf("write part: %v", err)
+		}
+	}
+	if err := w.Close(); err != nil {
+		t.Fatalf("close writer: %v", err)
+	}
+	return h.do(t, http.MethodPost, "/api/v1/emoji", token, body, w.FormDataContentType())
+}
+
+// ─── image fixtures ──────────────────────────────────────────────────────────
+
+func pngBytes(t *testing.T, w, h int) []byte {
+	t.Helper()
+	img := image.NewRGBA(image.Rect(0, 0, w, h))
+	img.Set(0, 0, color.RGBA{R: 255, A: 255})
+	var buf bytes.Buffer
+	if err := png.Encode(&buf, img); err != nil {
+		t.Fatalf("png.Encode: %v", err)
+	}
+	return buf.Bytes()
+}
+
+func gifBytes(t *testing.T, w, h int) []byte {
+	t.Helper()
+	img := image.NewPaletted(image.Rect(0, 0, w, h), color.Palette{color.Black, color.White})
+	var buf bytes.Buffer
+	if err := gif.Encode(&buf, img, nil); err != nil {
+		t.Fatalf("gif.Encode: %v", err)
+	}
+	return buf.Bytes()
+}
+
+func jpegBytes(t *testing.T, w, h int) []byte {
+	t.Helper()
+	img := image.NewRGBA(image.Rect(0, 0, w, h))
+	var buf bytes.Buffer
+	if err := jpeg.Encode(&buf, img, nil); err != nil {
+		t.Fatalf("jpeg.Encode: %v", err)
+	}
+	return buf.Bytes()
+}
+
+// webpVP8LBytes builds the smallest byte sequence that both sniffs as
+// image/webp and carries a readable lossless header of the given size. Go has
+// no WebP encoder, so the container is written by hand — which is also what the
+// dimension reader under test parses.
+func webpVP8LBytes(w, h int) []byte {
+	buf := make([]byte, 30)
+	copy(buf[0:4], "RIFF")
+	binary.LittleEndian.PutUint32(buf[4:8], uint32(len(buf)-8))
+	copy(buf[8:12], "WEBP")
+	copy(buf[12:16], "VP8L")
+	binary.LittleEndian.PutUint32(buf[16:20], uint32(len(buf)-20))
+	buf[20] = 0x2F
+	bits := uint32(w-1) | uint32(h-1)<<14
+	binary.LittleEndian.PutUint32(buf[21:25], bits)
+	return buf
+}
+
+// ─── GET /api/v1/emoji ───────────────────────────────────────────────────────
+
+func TestEmojiList_RequiresAuth(t *testing.T) {
+	h := newEmojiHarness(t)
+	rec := h.do(t, http.MethodGet, "/api/v1/emoji", "", nil, "")
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("status = %d, want 401", rec.Code)
+	}
+}
+
+func TestEmojiList_EmptyIsJSONArray(t *testing.T) {
+	h := newEmojiHarness(t)
+	rec := h.do(t, http.MethodGet, "/api/v1/emoji", h.memberToken, nil, "")
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200 (%s)", rec.Code, rec.Body.String())
+	}
+	if got := strings.TrimSpace(rec.Body.String()); got != "[]" {
+		t.Errorf("body = %q, want []", got)
+	}
+}
+
+func TestEmojiList_AnyMemberMaySee(t *testing.T) {
+	h := newEmojiHarness(t)
+	if rec := h.upload(t, h.ownerToken, "wave", pngBytes(t, 64, 64)); rec.Code != http.StatusCreated {
+		t.Fatalf("upload status = %d (%s)", rec.Code, rec.Body.String())
+	}
+
+	rec := h.do(t, http.MethodGet, "/api/v1/emoji", h.memberToken, nil, "")
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", rec.Code)
+	}
+	var list []struct {
+		ID        int64  `json:"id"`
+		Shortcode string `json:"shortcode"`
+		URL       string `json:"url"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &list); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if len(list) != 1 {
+		t.Fatalf("len = %d, want 1", len(list))
+	}
+	if list[0].Shortcode != "wave" {
+		t.Errorf("shortcode = %q, want wave", list[0].Shortcode)
+	}
+	if want := fmt.Sprintf("/api/v1/emoji/%d/image", list[0].ID); list[0].URL != want {
+		t.Errorf("url = %q, want %q", list[0].URL, want)
+	}
+}
+
+// ─── POST permission gate ────────────────────────────────────────────────────
+
+func TestEmojiUpload_MemberIsForbidden(t *testing.T) {
+	h := newEmojiHarness(t)
+	rec := h.upload(t, h.memberToken, "wave", pngBytes(t, 64, 64))
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403 (%s)", rec.Code, rec.Body.String())
+	}
+	if len(h.broadcaster.calls) != 0 {
+		t.Errorf("broadcast fired on a refused upload")
+	}
+}
+
+func TestEmojiUpload_ManageServerIsEnough(t *testing.T) {
+	h := newEmojiHarness(t)
+	rec := h.upload(t, h.adminToken, "wave", pngBytes(t, 64, 64))
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("status = %d, want 201 (%s)", rec.Code, rec.Body.String())
+	}
+	if len(h.broadcaster.calls) != 1 {
+		t.Fatalf("broadcast calls = %d, want 1", len(h.broadcaster.calls))
+	}
+	if got := h.broadcaster.calls[0]; len(got) != 1 || got[0].Shortcode != "wave" {
+		t.Errorf("broadcast payload = %+v, want one :wave:", got)
+	}
+}
+
+func TestEmojiUpload_Unauthenticated(t *testing.T) {
+	h := newEmojiHarness(t)
+	rec := h.upload(t, "", "wave", pngBytes(t, 64, 64))
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("status = %d, want 401", rec.Code)
+	}
+}
+
+// ─── POST validation ─────────────────────────────────────────────────────────
+
+func TestEmojiUpload_AcceptsEveryAllowedFormat(t *testing.T) {
+	h := newEmojiHarness(t)
+	cases := map[string][]byte{
+		"apng":  pngBytes(t, 128, 128),
+		"agif":  gifBytes(t, 100, 100),
+		"ajpeg": jpegBytes(t, 64, 32),
+		"awebp": webpVP8LBytes(48, 48),
+	}
+	for shortcode, content := range cases {
+		rec := h.upload(t, h.ownerToken, shortcode, content)
+		if rec.Code != http.StatusCreated {
+			t.Errorf("%s: status = %d, want 201 (%s)", shortcode, rec.Code, rec.Body.String())
+		}
+	}
+}
+
+func TestEmojiUpload_RejectsNonImage(t *testing.T) {
+	h := newEmojiHarness(t)
+	// A plain-text body sniffs as text/plain, which is not in the allowlist.
+	rec := h.upload(t, h.ownerToken, "wave", []byte("this is definitely not an image at all"))
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400 (%s)", rec.Code, rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), "PNG") {
+		t.Errorf("message = %q, want the format list", rec.Body.String())
+	}
+}
+
+func TestEmojiUpload_RejectsSVG(t *testing.T) {
+	h := newEmojiHarness(t)
+	svg := []byte(`<?xml version="1.0"?><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16">` +
+		`<script>alert(1)</script></svg>`)
+	rec := h.upload(t, h.ownerToken, "wave", svg)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400 (%s)", rec.Code, rec.Body.String())
+	}
+}
+
+func TestEmojiUpload_RejectsOversizeDimensions(t *testing.T) {
+	h := newEmojiHarness(t)
+	rec := h.upload(t, h.ownerToken, "toobig", pngBytes(t, 129, 64))
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400 (%s)", rec.Code, rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), "128x128") {
+		t.Errorf("message = %q, want the pixel cap", rec.Body.String())
+	}
+	// Same for height, and for a WebP whose header is what carries the size.
+	if rec := h.upload(t, h.ownerToken, "tootall", pngBytes(t, 64, 200)); rec.Code != http.StatusBadRequest {
+		t.Errorf("tall png status = %d, want 400", rec.Code)
+	}
+	if rec := h.upload(t, h.ownerToken, "widewebp", webpVP8LBytes(400, 40)); rec.Code != http.StatusBadRequest {
+		t.Errorf("wide webp status = %d, want 400", rec.Code)
+	}
+}
+
+func TestEmojiUpload_AcceptsExactlyMaxDimension(t *testing.T) {
+	h := newEmojiHarness(t)
+	if rec := h.upload(t, h.ownerToken, "edge", pngBytes(t, 128, 128)); rec.Code != http.StatusCreated {
+		t.Fatalf("status = %d, want 201 (%s)", rec.Code, rec.Body.String())
+	}
+}
+
+func TestEmojiUpload_RejectsOversizeFile(t *testing.T) {
+	h := newEmojiHarness(t)
+	// A 128x128 PNG of pure noise compresses badly enough to blow the 512 KB
+	// budget while staying inside the pixel cap, which is the case the byte
+	// limit exists for.
+	big := make([]byte, 600<<10)
+	copy(big, pngBytes(t, 128, 128))
+	rec := h.upload(t, h.ownerToken, "huge", big)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400 (%s)", rec.Code, rec.Body.String())
+	}
+}
+
+func TestEmojiUpload_RejectsBadShortcode(t *testing.T) {
+	h := newEmojiHarness(t)
+	for _, sc := range []string{"", "a", "has space", "dash-es", strings.Repeat("x", 33)} {
+		rec := h.upload(t, h.ownerToken, sc, pngBytes(t, 32, 32))
+		if rec.Code != http.StatusBadRequest {
+			t.Errorf("shortcode %q: status = %d, want 400 (%s)", sc, rec.Code, rec.Body.String())
+		}
+	}
+}
+
+func TestEmojiUpload_MissingFile(t *testing.T) {
+	h := newEmojiHarness(t)
+	rec := h.upload(t, h.ownerToken, "wave", nil)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400 (%s)", rec.Code, rec.Body.String())
+	}
+}
+
+func TestEmojiUpload_DuplicateShortcodeIsConflict(t *testing.T) {
+	h := newEmojiHarness(t)
+	if rec := h.upload(t, h.ownerToken, "wave", pngBytes(t, 32, 32)); rec.Code != http.StatusCreated {
+		t.Fatalf("first upload status = %d", rec.Code)
+	}
+	rec := h.upload(t, h.ownerToken, "WAVE", pngBytes(t, 32, 32))
+	if rec.Code != http.StatusConflict {
+		t.Fatalf("status = %d, want 409 (%s)", rec.Code, rec.Body.String())
+	}
+	// The losing upload must not leave its bytes behind.
+	list, err := h.database.ListEmoji(context.Background())
+	if err != nil {
+		t.Fatalf("ListEmoji: %v", err)
+	}
+	if len(list) != 1 {
+		t.Fatalf("len(list) = %d, want 1", len(list))
+	}
+}
+
+// ─── GET image ───────────────────────────────────────────────────────────────
+
+func TestEmojiImage_ServesStoredBytes(t *testing.T) {
+	h := newEmojiHarness(t)
+	content := gifBytes(t, 40, 40)
+	rec := h.upload(t, h.ownerToken, "wave", content)
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("upload status = %d (%s)", rec.Code, rec.Body.String())
+	}
+	var created struct {
+		ID  int64  `json:"id"`
+		URL string `json:"url"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &created); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+
+	got := h.do(t, http.MethodGet, created.URL, h.memberToken, nil, "")
+	if got.Code != http.StatusOK {
+		t.Fatalf("image status = %d, want 200", got.Code)
+	}
+	if ct := got.Header().Get("Content-Type"); ct != "image/gif" {
+		t.Errorf("Content-Type = %q, want image/gif", ct)
+	}
+	if got.Header().Get("X-Content-Type-Options") != "nosniff" {
+		t.Errorf("missing nosniff header")
+	}
+	if !bytes.Equal(got.Body.Bytes(), content) {
+		t.Errorf("served %d bytes, want the %d uploaded", got.Body.Len(), len(content))
+	}
+}
+
+func TestEmojiImage_RequiresAuth(t *testing.T) {
+	h := newEmojiHarness(t)
+	rec := h.do(t, http.MethodGet, "/api/v1/emoji/1/image", "", nil, "")
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("status = %d, want 401", rec.Code)
+	}
+}
+
+func TestEmojiImage_UnknownIDIs404(t *testing.T) {
+	h := newEmojiHarness(t)
+	for _, path := range []string{"/api/v1/emoji/999/image", "/api/v1/emoji/abc/image", "/api/v1/emoji/0/image"} {
+		rec := h.do(t, http.MethodGet, path, h.memberToken, nil, "")
+		if rec.Code != http.StatusNotFound {
+			t.Errorf("%s: status = %d, want 404", path, rec.Code)
+		}
+	}
+}
+
+// ─── DELETE ──────────────────────────────────────────────────────────────────
+
+func TestEmojiDelete_RemovesRowFileAndBroadcasts(t *testing.T) {
+	h := newEmojiHarness(t)
+	rec := h.upload(t, h.ownerToken, "wave", pngBytes(t, 32, 32))
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("upload status = %d", rec.Code)
+	}
+	var created struct {
+		ID  int64  `json:"id"`
+		URL string `json:"url"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &created); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	stored, err := h.database.GetEmoji(context.Background(), created.ID)
+	if err != nil || stored == nil {
+		t.Fatalf("GetEmoji = %v, %v", stored, err)
+	}
+
+	del := h.do(t, http.MethodDelete, fmt.Sprintf("/api/v1/emoji/%d", created.ID), h.ownerToken, nil, "")
+	if del.Code != http.StatusNoContent {
+		t.Fatalf("delete status = %d, want 204 (%s)", del.Code, del.Body.String())
+	}
+
+	if row, gErr := h.database.GetEmoji(context.Background(), created.ID); gErr != nil || row != nil {
+		t.Errorf("row still present after delete: %v, %v", row, gErr)
+	}
+	if f, oErr := h.store.Open(stored.StoredAs); oErr == nil {
+		_ = f.Close()
+		t.Errorf("stored file %q survived the delete", stored.StoredAs)
+	}
+	if len(h.broadcaster.calls) != 2 {
+		t.Fatalf("broadcast calls = %d, want 2 (create + delete)", len(h.broadcaster.calls))
+	}
+	if last := h.broadcaster.calls[1]; len(last) != 0 {
+		t.Errorf("post-delete broadcast = %+v, want empty", last)
+	}
+	// The image route follows the row.
+	if img := h.do(t, http.MethodGet, created.URL, h.memberToken, nil, ""); img.Code != http.StatusNotFound {
+		t.Errorf("image after delete = %d, want 404", img.Code)
+	}
+}
+
+func TestEmojiDelete_MemberIsForbidden(t *testing.T) {
+	h := newEmojiHarness(t)
+	rec := h.upload(t, h.ownerToken, "wave", pngBytes(t, 32, 32))
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("upload status = %d", rec.Code)
+	}
+	var created struct {
+		ID int64 `json:"id"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &created); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+
+	del := h.do(t, http.MethodDelete, fmt.Sprintf("/api/v1/emoji/%d", created.ID), h.memberToken, nil, "")
+	if del.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403 (%s)", del.Code, del.Body.String())
+	}
+	if row, err := h.database.GetEmoji(context.Background(), created.ID); err != nil || row == nil {
+		t.Errorf("refused delete removed the row anyway")
+	}
+}
+
+func TestEmojiDelete_UnknownIDIs404(t *testing.T) {
+	h := newEmojiHarness(t)
+	rec := h.do(t, http.MethodDelete, "/api/v1/emoji/999", h.ownerToken, nil, "")
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("status = %d, want 404 (%s)", rec.Code, rec.Body.String())
+	}
+}
+
+func TestEmojiDelete_BadIDIs400(t *testing.T) {
+	h := newEmojiHarness(t)
+	rec := h.do(t, http.MethodDelete, "/api/v1/emoji/not-a-number", h.ownerToken, nil, "")
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400 (%s)", rec.Code, rec.Body.String())
+	}
+}
+
+// ─── WebP header parsing ─────────────────────────────────────────────────────
+
+func TestWebPDimensions_AllChunkFlavours(t *testing.T) {
+	// VP8L is covered by webpVP8LBytes; build a VP8 (lossy) and a VP8X
+	// (extended) container too, since each encodes its size differently.
+	vp8 := make([]byte, 30)
+	copy(vp8[0:4], "RIFF")
+	copy(vp8[8:12], "WEBP")
+	copy(vp8[12:16], "VP8 ")
+	vp8[23], vp8[24], vp8[25] = 0x9d, 0x01, 0x2a
+	binary.LittleEndian.PutUint16(vp8[26:28], 100)
+	binary.LittleEndian.PutUint16(vp8[28:30], 80)
+
+	vp8x := make([]byte, 30)
+	copy(vp8x[0:4], "RIFF")
+	copy(vp8x[8:12], "WEBP")
+	copy(vp8x[12:16], "VP8X")
+	vp8x[24], vp8x[25], vp8x[26] = 0x63, 0x00, 0x00 // width-1 = 99
+	vp8x[27], vp8x[28], vp8x[29] = 0x4F, 0x00, 0x00 // height-1 = 79
+
+	cases := map[string]struct {
+		raw  []byte
+		w, h int
+	}{
+		"lossy (VP8)":     {vp8, 100, 80},
+		"extended (VP8X)": {vp8x, 100, 80},
+		"lossless (VP8L)": {webpVP8LBytes(100, 80), 100, 80},
+	}
+	for name, c := range cases {
+		w, h, err := api.WebPDimensionsForTest(c.raw)
+		if err != nil {
+			t.Errorf("%s: %v", name, err)
+			continue
+		}
+		if w != c.w || h != c.h {
+			t.Errorf("%s: got %dx%d, want %dx%d", name, w, h, c.w, c.h)
+		}
+	}
+}
+
+func TestWebPDimensions_RejectsMalformed(t *testing.T) {
+	bad := [][]byte{
+		nil,
+		[]byte("RIFF"),
+		append([]byte("RIFF0000NOTWVP8L"), make([]byte, 14)...),
+		append([]byte("RIFF0000WEBPXXXX"), make([]byte, 14)...),
+		append([]byte("RIFF0000WEBPVP8L"), make([]byte, 4)...), // truncated
+	}
+	for i, raw := range bad {
+		if _, _, err := api.WebPDimensionsForTest(raw); err == nil {
+			t.Errorf("case %d: want error", i)
+		}
+	}
+}
diff --git a/Server/api/export_test.go b/Server/api/export_test.go
index ecd4bdbf..99008d0e 100644
--- a/Server/api/export_test.go
+++ b/Server/api/export_test.go
@@ -49,6 +49,11 @@ func HandleLiveKitHealthForTest(healthCheck func(context.Context) (bool, error))
 // IsPrivateIPForTest exposes isPrivateIP for use in external tests.
 var IsPrivateIPForTest = isPrivateIP
 
+// WebPDimensionsForTest exposes the hand-rolled WebP header reader. It has no
+// standard-library counterpart to cross-check it against, so the chunk-flavour
+// cases are tested directly rather than only through the upload handler.
+var WebPDimensionsForTest = webpDimensions
+
 // SetGIFUpstreamForTest points the GIF proxy at a stub upstream and returns a
 // restore func. The production transport uses the SSRF-guarded dialer, which
 // refuses loopback addresses, so tests must supply their own client too.
diff --git a/Server/api/image_dimensions_fuzz_test.go b/Server/api/image_dimensions_fuzz_test.go
new file mode 100644
index 00000000..914a3537
--- /dev/null
+++ b/Server/api/image_dimensions_fuzz_test.go
@@ -0,0 +1,149 @@
+package api
+
+import (
+	"bytes"
+	"encoding/binary"
+	"image"
+	"image/color"
+	"image/gif"
+	"image/jpeg"
+	"image/png"
+	"testing"
+	"time"
+)
+
+// fuzzWebPVP8L builds a minimal RIFF/WEBP/VP8L container of the given size.
+func fuzzWebPVP8L(w, h int) []byte {
+	buf := make([]byte, 30)
+	copy(buf[0:4], "RIFF")
+	binary.LittleEndian.PutUint32(buf[4:8], uint32(len(buf)-8))
+	copy(buf[8:12], "WEBP")
+	copy(buf[12:16], "VP8L")
+	binary.LittleEndian.PutUint32(buf[16:20], uint32(len(buf)-20))
+	buf[20] = 0x2F
+	bits := uint32(w-1) | uint32(h-1)<<14
+	binary.LittleEndian.PutUint32(buf[21:25], bits)
+	return buf
+}
+
+// fuzzWebPVP8 builds a minimal RIFF/WEBP/VP8 (lossy) container.
+func fuzzWebPVP8(w, h int) []byte {
+	buf := make([]byte, 30)
+	copy(buf[0:4], "RIFF")
+	copy(buf[8:12], "WEBP")
+	copy(buf[12:16], "VP8 ")
+	buf[23], buf[24], buf[25] = 0x9d, 0x01, 0x2a
+	binary.LittleEndian.PutUint16(buf[26:28], uint16(w)&0x3FFF)
+	binary.LittleEndian.PutUint16(buf[28:30], uint16(h)&0x3FFF)
+	return buf
+}
+
+// fuzzWebPVP8X builds a minimal RIFF/WEBP/VP8X (extended) container.
+func fuzzWebPVP8X(w, h int) []byte {
+	buf := make([]byte, 30)
+	copy(buf[0:4], "RIFF")
+	copy(buf[8:12], "WEBP")
+	copy(buf[12:16], "VP8X")
+	w1, h1 := uint32(w-1), uint32(h-1)
+	buf[24], buf[25], buf[26] = byte(w1), byte(w1>>8), byte(w1>>16)
+	buf[27], buf[28], buf[29] = byte(h1), byte(h1>>8), byte(h1>>16)
+	return buf
+}
+
+func fuzzPNGBytes(w, h int) []byte {
+	img := image.NewRGBA(image.Rect(0, 0, w, h))
+	img.Set(0, 0, color.RGBA{R: 255, A: 255})
+	var buf bytes.Buffer
+	_ = png.Encode(&buf, img)
+	return buf.Bytes()
+}
+
+func fuzzGIFBytes(w, h int) []byte {
+	img := image.NewPaletted(image.Rect(0, 0, w, h), color.Palette{color.Black, color.White})
+	var buf bytes.Buffer
+	_ = gif.Encode(&buf, img, nil)
+	return buf.Bytes()
+}
+
+func fuzzJPEGBytes(w, h int) []byte {
+	img := image.NewRGBA(image.Rect(0, 0, w, h))
+	var buf bytes.Buffer
+	_ = jpeg.Encode(&buf, img, nil)
+	return buf.Bytes()
+}
+
+// FuzzImageDimensions is the prime crash target: hand-rolled and stdlib
+// header parsing over completely untrusted bytes, exactly what a malicious
+// emoji/avatar upload delivers. Every corpus entry is run through all four
+// supported mime types (not just the one it happens to be valid for) so a
+// truncated PNG is also thrown at the JPEG/GIF/WebP paths and vice versa.
+//
+// The only allowed outcomes are: an error, or a (width, height) that is
+// strictly positive. Anything else -- a panic, a hang, or a non-positive
+// dimension slipping past as "success" -- is a bug: the caller in
+// emoji_handler.go trusts a non-error result enough to compare it against
+// maxEmojiDimension without re-validating its sign.
+func FuzzImageDimensions(f *testing.F) {
+	seeds := [][]byte{
+		nil,
+		{},
+		{0},
+		{0, 0, 0, 0},
+		[]byte("RIFF"),
+		[]byte("RIFFxxxxWEBP"),
+		[]byte("RIFFxxxxWEBPVP8 "),
+		[]byte("RIFFxxxxWEBPVP8L"),
+		[]byte("RIFFxxxxWEBPVP8X"),
+		[]byte("RIFFxxxxWEBPXXXX"),
+		fuzzPNGBytes(1, 1),
+		fuzzPNGBytes(128, 128),
+		fuzzGIFBytes(1, 1),
+		fuzzGIFBytes(128, 128),
+		fuzzJPEGBytes(1, 1),
+		fuzzJPEGBytes(128, 128),
+		fuzzWebPVP8(100, 80),
+		fuzzWebPVP8(16383, 16383), // max 14-bit dimension
+		fuzzWebPVP8L(100, 80),
+		fuzzWebPVP8L(16384, 16384), // max 14-bit+1 dimension
+		fuzzWebPVP8X(100, 80),
+		fuzzWebPVP8X(16777216, 16777216), // max 24-bit+1 dimension
+	}
+	// Truncate every seed at each prefix length up to 32 bytes (where every
+	// format's fixed header lives) and then more coarsely beyond that: the
+	// classic "header parser unchecked slice index" crasher lives in exactly
+	// these cuts, but walking every single offset of a 128x128 PNG bloats the
+	// corpus enough to stall the mutation phase for no extra coverage.
+	for _, s := range seeds {
+		f.Add(append([]byte(nil), s...))
+		for cut := 0; cut < len(s) && cut <= 32; cut++ {
+			f.Add(append([]byte(nil), s[:cut]...))
+		}
+		for cut := 40; cut < len(s); cut += 8 {
+			f.Add(append([]byte(nil), s[:cut]...))
+		}
+	}
+
+	mimeTypes := []string{"image/png", "image/jpeg", "image/gif", "image/webp"}
+
+	f.Fuzz(func(t *testing.T, raw []byte) {
+		done := make(chan struct{})
+		go func() {
+			defer close(done)
+			for _, mt := range mimeTypes {
+				w, h, err := imageDimensions(raw, mt)
+				if err == nil && (w <= 0 || h <= 0) {
+					t.Errorf("imageDimensions(%d bytes, %s) returned non-positive size %dx%d with no error", len(raw), mt, w, h)
+				}
+			}
+			w, h, err := webpDimensions(raw)
+			if err == nil && (w <= 0 || h <= 0) {
+				t.Errorf("webpDimensions(%d bytes) returned non-positive size %dx%d with no error", len(raw), w, h)
+			}
+		}()
+		select {
+		case <-done:
+		case <-time.After(5 * time.Second):
+			t.Fatalf("imageDimensions/webpDimensions hung on %d-byte input: %x", len(raw), raw)
+		}
+	})
+}
diff --git a/Server/api/middleware_test.go b/Server/api/middleware_test.go
index 9646fcb7..f74c9c89 100644
--- a/Server/api/middleware_test.go
+++ b/Server/api/middleware_test.go
@@ -1122,7 +1122,10 @@ CREATE TABLE IF NOT EXISTS users (
     banned      INTEGER NOT NULL DEFAULT 0,
     ban_reason  TEXT,
     ban_expires TEXT,
-    identity_public_key TEXT
+    identity_public_key TEXT,
+    display_name TEXT,
+    about TEXT,
+    custom_status TEXT
 );
 
 CREATE TABLE IF NOT EXISTS sessions (
@@ -1185,7 +1188,9 @@ CREATE TABLE IF NOT EXISTS channels (
     voice_max_users  INTEGER NOT NULL DEFAULT 0,
     voice_quality    TEXT,
     mixing_threshold INTEGER,
-    voice_max_video  INTEGER NOT NULL DEFAULT 0
+    voice_max_video  INTEGER NOT NULL DEFAULT 0,
+    nsfw             INTEGER NOT NULL DEFAULT 0,
+    is_group         INTEGER NOT NULL DEFAULT 0
 );
 
 CREATE TABLE IF NOT EXISTS channel_overrides (
@@ -1197,6 +1202,14 @@ CREATE TABLE IF NOT EXISTS channel_overrides (
     UNIQUE(channel_id, role_id)
 );
 
+CREATE TABLE IF NOT EXISTS channel_user_overrides (
+    channel_id INTEGER NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
+    user_id    INTEGER NOT NULL REFERENCES users(id)    ON DELETE CASCADE,
+    allow      INTEGER NOT NULL DEFAULT 0,
+    deny       INTEGER NOT NULL DEFAULT 0,
+    PRIMARY KEY (channel_id, user_id)
+);
+
 CREATE TABLE IF NOT EXISTS messages (
     id         INTEGER PRIMARY KEY AUTOINCREMENT,
     channel_id INTEGER NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
@@ -1206,8 +1219,15 @@ CREATE TABLE IF NOT EXISTS messages (
     edited_at  TEXT,
     deleted    INTEGER NOT NULL DEFAULT 0,
     pinned     INTEGER NOT NULL DEFAULT 0,
-    timestamp  TEXT    NOT NULL DEFAULT (datetime('now'))
+    timestamp  TEXT    NOT NULL DEFAULT (datetime('now')),
+    mentions_everyone INTEGER NOT NULL DEFAULT 0
 );
+CREATE TABLE IF NOT EXISTS message_mentions (
+    message_id        INTEGER NOT NULL REFERENCES messages(id) ON DELETE CASCADE,
+    mentioned_user_id INTEGER NOT NULL REFERENCES users(id)    ON DELETE CASCADE,
+    PRIMARY KEY (message_id, mentioned_user_id)
+);
+
 
 CREATE TABLE IF NOT EXISTS dm_participants (
     channel_id INTEGER NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
diff --git a/Server/api/profile_handler.go b/Server/api/profile_handler.go
index 3106bd79..74f0749b 100644
--- a/Server/api/profile_handler.go
+++ b/Server/api/profile_handler.go
@@ -1,18 +1,25 @@
 package api
 
 import (
+	"bytes"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
+	"io"
+	"log/slog"
 	"net/http"
 	"net/url"
 	"strings"
 	"time"
+	"unicode"
 
 	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
 	"github.com/owncord/server/auth"
 	"github.com/owncord/server/db"
 	"github.com/owncord/server/service"
+	"github.com/owncord/server/storage"
+	"github.com/owncord/server/ws"
 )
 
 // ─── Request / Response types ────────────────────────────────────────────────
@@ -24,6 +31,11 @@ type updateProfileRequest struct {
 	Username          string  `json:"username"`
 	Avatar            *string `json:"avatar"`
 	IdentityPublicKey *string `json:"identity_public_key"`
+	// DisplayName and About are omitted = unchanged, "" = cleared. Both are
+	// sanitized and length-checked in UserService, which is also the path a
+	// non-REST caller would take.
+	DisplayName *string `json:"display_name"`
+	About       *string `json:"about"`
 }
 
 // changePasswordRequest is the JSON body for PUT /api/v1/users/me/password.
@@ -52,12 +64,16 @@ type sessionsListResponse struct {
 // ProfileBroadcaster is the interface the profile handler uses to notify
 // connected WebSocket clients about profile changes.
 type ProfileBroadcaster interface {
-	BroadcastUserUpdate(userID int64, username string, avatar *string, identityPublicKey *string)
+	BroadcastUserUpdate(u ws.UserUpdate)
 }
 
 // MountProfileRoutes registers user profile management endpoints.
 // All routes require authentication. trustedProxies is used for rate limiting.
-func MountProfileRoutes(r chi.Router, database *db.DB, svc *service.Services, limiter *auth.RateLimiter, trustedProxies []string, broadcaster ProfileBroadcaster) {
+//
+// store may be nil, in which case the avatar-upload route is not registered —
+// a server with no storage backend has nowhere to put the bytes, and a route
+// that 500s on every call is worse than one that 404s.
+func MountProfileRoutes(r chi.Router, database *db.DB, svc *service.Services, store *storage.Storage, limiter *auth.RateLimiter, trustedProxies []string, broadcaster ProfileBroadcaster) {
 	r.Route("/api/v1/users/me", func(r chi.Router) {
 		r.Use(AuthMiddleware(database))
 
@@ -67,6 +83,11 @@ func MountProfileRoutes(r chi.Router, database *db.DB, svc *service.Services, li
 		r.With(RateLimitMiddleware(limiter, profilePasswordRateLimitPerMinute, time.Minute, trustedProxies)).
 			Put("/password", handleChangePassword(svc, limiter))
 
+		if store != nil {
+			r.With(MaxBodySize(avatarMaxBodySize)).
+				Post("/avatar", handleUploadAvatar(database, svc, store, limiter, broadcaster))
+		}
+
 		r.Get("/sessions", handleListSessions(svc))
 		r.Delete("/sessions/{id}", handleRevokeSession(svc))
 	})
@@ -109,6 +130,32 @@ func validateAvatarURL(avatar string) error {
 	return nil
 }
 
+// validateDisplayName rejects a nickname that would render as something other
+// than what it says. Length and emptiness are the service's job (empty clears
+// the field); this is the character-class check auth.ValidateUsername applies
+// for the same reason — a display name stands in for a username on every
+// message row, so a bidi override or a control character in one is a spoof.
+func validateDisplayName(name string) error {
+	for _, r := range name {
+		if unicode.IsControl(r) || unicode.In(r, unicode.Cf) {
+			return fmt.Errorf("display_name must not contain control or invisible characters")
+		}
+	}
+	return nil
+}
+
+// allowedAvatarMIME is the set of image types an avatar may be, matched against
+// the type sniffed from the file's own bytes. GIF is absent (an animated
+// avatar in every message row is a distraction the renderer cannot opt out of)
+// and so is SVG, for the same reason emoji refuse it: it is markup with script
+// and external-fetch capability, and an avatar is rendered inline by
+// definition.
+var allowedAvatarMIME = map[string]bool{
+	"image/png":  true,
+	"image/jpeg": true,
+	"image/webp": true,
+}
+
 // ─── Handlers ────────────────────────────────────────────────────────────────
 
 // handleUpdateProfile processes PATCH /api/v1/users/me.
@@ -156,6 +203,19 @@ func handleUpdateProfile(svc *service.Services, broadcaster ProfileBroadcaster)
 			req.Avatar = &trimmed
 		}
 
+		// display_name gets the same username-shaped scrutiny beyond length:
+		// it is rendered wherever a username is, so control characters and
+		// bidi overrides are exactly as unwelcome here. Length, sanitization
+		// and the empty-clears-it rule live in UserService.
+		if req.DisplayName != nil {
+			if err := validateDisplayName(*req.DisplayName); err != nil {
+				writeJSON(w, http.StatusBadRequest, errorResponse{
+					Error: "INVALID_INPUT", Message: err.Error(),
+				})
+				return
+			}
+		}
+
 		// Validate the identity key before any write so the request is
 		// all-or-nothing.
 		if req.IdentityPublicKey != nil {
@@ -169,7 +229,12 @@ func handleUpdateProfile(svc *service.Services, broadcaster ProfileBroadcaster)
 			req.IdentityPublicKey = &trimmed
 		}
 
-		updated, err := svc.Users.UpdateProfile(r.Context(), user.ID, req.Username, req.Avatar)
+		updated, err := svc.Users.UpdateProfile(r.Context(), user.ID, service.ProfilePatch{
+			Username:    req.Username,
+			Avatar:      req.Avatar,
+			DisplayName: req.DisplayName,
+			About:       req.About,
+		})
 		if err != nil {
 			writeServiceError(r.Context(), w, err)
 			return
@@ -183,15 +248,29 @@ func handleUpdateProfile(svc *service.Services, broadcaster ProfileBroadcaster)
 			}
 		}
 
-		// Broadcast profile change to all connected WebSocket clients.
-		if broadcaster != nil {
-			broadcaster.BroadcastUserUpdate(updated.ID, updated.Username, updated.Avatar, updated.IdentityPublicKey)
-		}
+		broadcastUserUpdate(broadcaster, updated)
 
 		writeJSON(w, http.StatusOK, toUserResponse(updated))
 	}
 }
 
+// broadcastUserUpdate pushes a profile snapshot to every connected client.
+// Every profile mutation goes through it so a new one cannot ship half the
+// fields — user_update replaces the client's copy wholesale.
+func broadcastUserUpdate(broadcaster ProfileBroadcaster, u *db.User) {
+	if broadcaster == nil || u == nil {
+		return
+	}
+	broadcaster.BroadcastUserUpdate(ws.UserUpdate{
+		UserID:            u.ID,
+		Username:          u.Username,
+		Avatar:            u.Avatar,
+		DisplayName:       u.DisplayName,
+		About:             u.About,
+		IdentityPublicKey: u.IdentityPublicKey,
+	})
+}
+
 // handleChangePassword processes PUT /api/v1/users/me/password.
 func handleChangePassword(svc *service.Services, limiter *auth.RateLimiter) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
@@ -360,3 +439,158 @@ func handleRevokeSession(svc *service.Services) http.HandlerFunc {
 		w.WriteHeader(http.StatusNoContent)
 	}
 }
+
+// handleUploadAvatar processes POST /api/v1/users/me/avatar (multipart: `file`).
+//
+// The bytes land in the ordinary attachments table with no channel, and the
+// user's avatar column is pointed at /api/v1/files/{id}. That is what makes
+// the picture readable: an unlinked attachment is private to its uploader, and
+// handleServeFile additionally admits one that some user's avatar currently
+// points at — so an avatar is public exactly while it is in use and stops
+// being readable the moment it is replaced.
+//
+// PATCH /users/me still takes an https:// URL; this route is the other way to
+// set the same field, and both end at the same column.
+func handleUploadAvatar(
+	database *db.DB,
+	svc *service.Services,
+	store *storage.Storage,
+	limiter *auth.RateLimiter,
+	broadcaster ProfileBroadcaster,
+) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		user, ok := r.Context().Value(UserKey).(*db.User)
+		if !ok || user == nil {
+			writeJSON(w, http.StatusUnauthorized, errorResponse{
+				Error: "UNAUTHORIZED", Message: "not authenticated",
+			})
+			return
+		}
+
+		if limiter != nil && !limiter.Allow(auth.Key("avatar_upload", user.ID), avatarUploadRateLimitPerMinute, time.Minute) {
+			writeJSON(w, http.StatusTooManyRequests, errorResponse{
+				Error: "RATE_LIMITED", Message: "avatar upload rate limit exceeded, try again later",
+			})
+			return
+		}
+
+		// Bound the body before the multipart parser touches it: the route
+		// carries MaxBodySize too, but the parser is what turns an unbounded
+		// body into heap, so the handler states its own limit.
+		r.Body = http.MaxBytesReader(w, r.Body, avatarMaxBodySize)
+		if err := r.ParseMultipartForm(avatarMultipartMemoryLimit); err != nil {
+			writeJSON(w, http.StatusBadRequest, errorResponse{
+				Error: "BAD_REQUEST", Message: "invalid multipart form",
+			})
+			return
+		}
+
+		file, header, err := r.FormFile("file")
+		if err != nil {
+			writeJSON(w, http.StatusBadRequest, errorResponse{
+				Error: "BAD_REQUEST", Message: "missing file field",
+			})
+			return
+		}
+		defer file.Close() //nolint:errcheck
+
+		// Read one byte past the cap so "exactly at the limit" passes and "one
+		// byte over" is caught, without buffering an unbounded body.
+		raw, err := io.ReadAll(io.LimitReader(file, maxAvatarFileBytes+1))
+		if err != nil {
+			writeJSON(w, http.StatusBadRequest, errorResponse{
+				Error: "BAD_REQUEST", Message: "failed to read uploaded file",
+			})
+			return
+		}
+		if int64(len(raw)) > maxAvatarFileBytes {
+			writeJSON(w, http.StatusBadRequest, errorResponse{
+				Error:   "BAD_REQUEST",
+				Message: fmt.Sprintf("avatar must be at most %d KB", maxAvatarFileBytes>>10),
+			})
+			return
+		}
+
+		// Never trust the client's Content-Type — sniff the bytes.
+		mimeType := http.DetectContentType(raw)
+		if !allowedAvatarMIME[mimeType] {
+			writeJSON(w, http.StatusBadRequest, errorResponse{
+				Error: "BAD_REQUEST", Message: "avatar must be a PNG, JPEG or WebP image",
+			})
+			return
+		}
+
+		width, height, err := imageDimensions(raw, mimeType)
+		if err != nil {
+			writeJSON(w, http.StatusBadRequest, errorResponse{
+				Error: "BAD_REQUEST", Message: "could not read image dimensions",
+			})
+			return
+		}
+		// Measured from the sniffed image, not from anything the client said.
+		// The client crops to a square before uploading; the server does not
+		// re-encode (that would mean decoding and re-compressing every upload
+		// to change nothing a CSS circle mask does not already do), it just
+		// refuses a picture too big to be an avatar.
+		if width <= 0 || height <= 0 || width > maxAvatarDimension || height > maxAvatarDimension {
+			writeJSON(w, http.StatusBadRequest, errorResponse{
+				Error:   "BAD_REQUEST",
+				Message: fmt.Sprintf("avatar must be at most %dx%d pixels (got %dx%d)", maxAvatarDimension, maxAvatarDimension, width, height),
+			})
+			return
+		}
+
+		fileID := uuid.New().String()
+		written, saveErr := store.Save(fileID, bytes.NewReader(raw))
+		if saveErr != nil {
+			slog.Warn("avatar upload rejected by storage", "error", saveErr)
+			writeJSON(w, http.StatusBadRequest, errorResponse{
+				Error: "BAD_REQUEST", Message: fmt.Sprintf("upload rejected: %s", saveErr),
+			})
+			return
+		}
+
+		filename := sanitizeUploadFilename(header.Filename)
+		if err := database.CreateAttachment(r.Context(), fileID, user.ID, filename, fileID, mimeType, written, &width, &height); err != nil {
+			if delErr := store.Delete(fileID); delErr != nil {
+				slog.Error("failed to clean up orphaned avatar file", "stored_as", fileID, "error", delErr)
+			}
+			slog.Error("failed to create avatar attachment record", "error", err)
+			writeJSON(w, http.StatusInternalServerError, errorResponse{
+				Error: "INTERNAL_ERROR", Message: "failed to save avatar",
+			})
+			return
+		}
+
+		avatarURL := service.AvatarFileURL(fileID)
+		updated, err := svc.Users.UpdateProfile(r.Context(), user.ID, service.ProfilePatch{
+			Username: user.Username,
+			Avatar:   &avatarURL,
+		})
+		if err != nil {
+			// The column never moved, so the file and its row are orphans.
+			if delErr := store.Delete(fileID); delErr != nil {
+				slog.Error("failed to clean up orphaned avatar file", "stored_as", fileID, "error", delErr)
+			}
+			writeServiceError(r.Context(), w, err)
+			return
+		}
+
+		// The previous avatar's bytes are deliberately left on disk: a message
+		// that was rendered with it may still be cached client-side, and a
+		// blind delete here would race any request already in flight for it.
+		// Reclaiming them is an operator-side sweep, not a request-path action.
+		broadcastUserUpdate(broadcaster, updated)
+
+		slog.Info("avatar uploaded", "user_id", user.ID, "id", fileID, "size", written, "mime", mimeType)
+		writeJSON(w, http.StatusCreated, uploadResponse{
+			ID:       fileID,
+			Filename: filename,
+			Size:     written,
+			Mime:     mimeType,
+			URL:      avatarURL,
+			Width:    &width,
+			Height:   &height,
+		})
+	}
+}
diff --git a/Server/api/profile_handler_fuzz_test.go b/Server/api/profile_handler_fuzz_test.go
new file mode 100644
index 00000000..6a896284
--- /dev/null
+++ b/Server/api/profile_handler_fuzz_test.go
@@ -0,0 +1,109 @@
+package api
+
+import (
+	"net/url"
+	"strings"
+	"testing"
+	"unicode"
+)
+
+// FuzzValidateAvatarURL checks validateAvatarURL against the rule its doc
+// comment states: avatar must be either empty, or a URL no longer than
+// maxAvatarURLLen characters that parses with scheme "https" and a non-empty
+// host. This is the prime target for an active-content escape — an accepted
+// "avatar" URL that is actually javascript:, data:, or otherwise not a real
+// https:// origin would let a client render/execute it wherever avatars are
+// displayed.
+func FuzzValidateAvatarURL(f *testing.F) {
+	seeds := []string{
+		"",
+		"https://example.com/avatar.png",
+		"https://example.com",
+		"http://example.com/avatar.png",
+		"javascript:alert(1)",
+		"JavaScript:alert(1)",
+		"data:text/html,<script>alert(1)</script>",
+		"data:image/png;base64,iVBORw0KGgo=",
+		"vbscript:msgbox(1)",
+		"https://",
+		"https:///avatar.png",
+		"https:example.com",
+		"  https://example.com/avatar.png",
+		"https://example.com/avatar.png  ",
+		"//example.com/avatar.png",
+		"file:///etc/passwd",
+		"https://user:pass@example.com/avatar.png",
+		"https://例え.com/avatar.png",
+		strings.Repeat("a", 600),
+		"https://" + strings.Repeat("a", 600) + ".com/x.png",
+		"https:// evil.com",
+		"ht!tp://bad url",
+		"https:\t//example.com",
+	}
+	for _, s := range seeds {
+		f.Add(s)
+	}
+
+	f.Fuzz(func(t *testing.T, avatar string) {
+		err := validateAvatarURL(avatar)
+		if err != nil {
+			return
+		}
+		if avatar == "" {
+			return
+		}
+		if len(avatar) > maxAvatarURLLen {
+			t.Fatalf("validateAvatarURL(%q) = nil, but length %d exceeds maxAvatarURLLen %d", avatar, len(avatar), maxAvatarURLLen)
+		}
+		parsed, perr := url.Parse(avatar)
+		if perr != nil {
+			t.Fatalf("validateAvatarURL(%q) = nil, but url.Parse fails: %v", avatar, perr)
+		}
+		if parsed.Scheme != "https" {
+			t.Fatalf("validateAvatarURL(%q) = nil, but parsed scheme is %q, not https (active-content/off-scheme escape)", avatar, parsed.Scheme)
+		}
+		if parsed.Host == "" {
+			t.Fatalf("validateAvatarURL(%q) = nil, but parsed host is empty", avatar)
+		}
+	})
+}
+
+// FuzzValidateDisplayName checks validateDisplayName against the rule its
+// doc comment states: no control characters and no invisible (Cf) formatting
+// characters, since a display name renders wherever a username does and a
+// bidi override or control character there is a spoofing vector.
+func FuzzValidateDisplayName(f *testing.F) {
+	seeds := []string{
+		"",
+		"Normal Name",
+		"emoji😀name",
+		"日本語",
+		"name\x00null",
+		"name\ttab",
+		"name\nnewline",
+		"zero\u200bwidth", // ZERO WIDTH SPACE
+		"bidi\u202eoverride",
+		"\u202ereversed\u202c",
+		strings.Repeat("a", 1000),
+		"\u200bname\u200b",
+		"\u202eevil\u202c",
+	}
+	for _, s := range seeds {
+		f.Add(s)
+	}
+
+	f.Fuzz(func(t *testing.T, name string) {
+		err := validateDisplayName(name)
+		if err != nil {
+			return
+		}
+		for _, r := range name {
+			if unicode.IsControl(r) {
+				t.Fatalf("validateDisplayName(%q) = nil, but contains control rune %q", name, r)
+			}
+			if unicode.In(r, unicode.Cf) {
+				t.Fatalf("validateDisplayName(%q) = nil, but contains invisible (Cf) rune %q", name, r)
+			}
+		}
+	})
+}
diff --git a/Server/api/profile_handler_test.go b/Server/api/profile_handler_test.go
index af6ec30f..76bda2bc 100644
--- a/Server/api/profile_handler_test.go
+++ b/Server/api/profile_handler_test.go
@@ -23,7 +23,7 @@ func buildProfileRouter(database *db.DB) http.Handler {
 	r := chi.NewRouter()
 	limiter := auth.NewRateLimiter()
 	svc := service.New(database, limiter)
-	api.MountProfileRoutes(r, database, svc, limiter, nil, nil)
+	api.MountProfileRoutes(r, database, svc, nil, limiter, nil, nil)
 	return r
 }
 
diff --git a/Server/api/router.go b/Server/api/router.go
index 4222d2ec..567f50fe 100644
--- a/Server/api/router.go
+++ b/Server/api/router.go
@@ -109,8 +109,8 @@ func NewRouter(cfg *config.Config, database *db.DB, ver string, logBuf *admin.Ri
 	// Invite management routes (require MANAGE_INVITES permission).
 	MountInviteRoutes(r, database, svc)
 
-	// Channel and message REST routes.
-	MountChannelRoutes(r, database, svc, limiter, cfg.Server.TrustedProxies)
+	// Channel and message REST routes are mounted after hub creation (below)
+	// so the hub can fan a bulk delete out as one chat_bulk_deleted event.
 
 	// GIF proxy — keeps the Klipy API key server-side. Mounted unconditionally;
 	// with no key configured the endpoints answer 503 GIF_DISABLED so the
@@ -208,12 +208,30 @@ func NewRouter(cfg *config.Config, database *db.DB, ver string, logBuf *admin.Ri
 
 	// Profile routes: update profile, change password, session management.
 	// Mounted after hub creation so the hub can broadcast user_update events.
-	MountProfileRoutes(r, database, svc, limiter, cfg.Server.TrustedProxies, hub)
+	// A storage failure leaves store unusable, so the avatar-upload route is
+	// simply not registered; the rest of the profile surface is unaffected.
+	profileStore := store
+	if storeErr != nil {
+		profileStore = nil
+	}
+	MountProfileRoutes(r, database, svc, profileStore, limiter, cfg.Server.TrustedProxies, hub)
 
 	// DM (direct message) REST routes — mounted after hub creation so the
 	// hub can send real-time dm_channel_close events to WebSocket clients.
 	MountDMRoutes(r, database, svc, hub)
 
+	// Channel and message REST routes — mounted after hub creation so a
+	// message purge can broadcast chat_bulk_deleted to the channel.
+	MountChannelRoutes(r, database, svc, limiter, cfg.Server.TrustedProxies, hub)
+
+	// Custom emoji REST routes — mounted after hub creation so an upload or a
+	// delete can fan the new set out as an emoji_update. Requires the same file
+	// storage the attachment routes use; without it the emoji endpoints are not
+	// mounted at all (a 404 the client reads as "this server has no emoji").
+	if storeErr == nil {
+		MountEmojiRoutes(r, database, svc, store, limiter, hub)
+	}
+
 	// H-8: Connectivity diagnostics restricted to admin users only.
 	// Exposes Go runtime version and LiveKit node IP which aid targeted attacks.
 	r.With(AuthMiddleware(database),
@@ -246,7 +264,7 @@ func NewRouter(cfg *config.Config, database *db.DB, ver string, logBuf *admin.Ri
 	// Admin panel: static files + REST API (Phase 6).
 	// Restrict /admin to configured CIDRs (default: private networks only).
 	u := updater.NewUpdater(ver, cfg.GitHub.Token, cfg.GitHub.Owner, cfg.GitHub.Repo)
-	adminHandler := admin.NewHandler(database, ver, hub, u, logBuf, cfg.Server.AllowedOrigins, svc.Permissions, svc.Moderation,
+	adminHandler := admin.NewHandler(database, ver, hub, u, logBuf, cfg.Server.AllowedOrigins, svc.Permissions, svc.Moderation, svc.Roles,
 		admin.SetupOptions{ConfigPath: config.DefaultPath, RunningCfg: cfg})
 	r.Group(func(r chi.Router) {
 		r.Use(AdminIPRestrict(cfg.Server.AdminAllowedCIDRs, cfg.Server.TrustedProxies))
diff --git a/Server/api/testdata/fuzz/FuzzImageDimensions/08ce89b31b17a283 b/Server/api/testdata/fuzz/FuzzImageDimensions/08ce89b31b17a283
new file mode 100644
index 00000000..6dcf0b42
--- /dev/null
+++ b/Server/api/testdata/fuzz/FuzzImageDimensions/08ce89b31b17a283
@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("GIF87a00\x00\x00000")
diff --git a/Server/api/testdata/fuzz/FuzzImageDimensions/90947704e4047f07 b/Server/api/testdata/fuzz/FuzzImageDimensions/90947704e4047f07
new file mode 100644
index 00000000..dd6b3545
--- /dev/null
+++ b/Server/api/testdata/fuzz/FuzzImageDimensions/90947704e4047f07
@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("RIFF0000WEBPVP8 0000000\x9d\x01*00\x00\x00")
diff --git a/Server/api/testdata/fuzz/FuzzSanitizeUploadFilename/slash-survives-as-path-separator b/Server/api/testdata/fuzz/FuzzSanitizeUploadFilename/slash-survives-as-path-separator
new file mode 100644
index 00000000..e4946606
--- /dev/null
+++ b/Server/api/testdata/fuzz/FuzzSanitizeUploadFilename/slash-survives-as-path-separator
@@ -0,0 +1,2 @@
+go test fuzz v1
+string("/")
diff --git a/Server/api/testdata/fuzz/FuzzSanitizeUploadFilename/truncation-splits-multibyte-rune b/Server/api/testdata/fuzz/FuzzSanitizeUploadFilename/truncation-splits-multibyte-rune
new file mode 100644
index 00000000..8a4b2d0c
--- /dev/null
+++ b/Server/api/testdata/fuzz/FuzzSanitizeUploadFilename/truncation-splits-multibyte-rune
@@ -0,0 +1,2 @@
+go test fuzz v1
+string("éééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééééé")
diff --git a/Server/api/upload_filename_fuzz_test.go b/Server/api/upload_filename_fuzz_test.go
new file mode 100644
index 00000000..76306db0
--- /dev/null
+++ b/Server/api/upload_filename_fuzz_test.go
@@ -0,0 +1,79 @@
+package api
+
+import (
+	"strings"
+	"testing"
+	"unicode"
+	"unicode/utf8"
+)
+
+// FuzzSanitizeUploadFilename hunts for inputs where sanitizeUploadFilename's
+// output violates the safety contract its callers rely on: the returned name
+// is later used both as a display string and pre-filled into a native save
+// dialog on the downloading client, so it must never smuggle a path
+// separator, a control/bidi-override character, or invalid UTF-8 (the byte
+// truncation to maxUploadFilenameLength is the prime suspect for splitting a
+// multibyte rune in half).
+func FuzzSanitizeUploadFilename(f *testing.F) {
+	seeds := []string{
+		"",
+		".",
+		"..",
+		"...",
+		"/",
+		"\\",
+		"a/b/c",
+		"a\\b\\c",
+		"/etc/passwd",
+		"..\\..\\windows\\system32",
+		"C:\\Windows\\System32\\evil.exe",
+		"normal.txt",
+		" leading-space.txt",
+		"trailing-space.txt ",
+		"\t\n\r",
+		"\x00\x01\x02",
+		"file\x00name.txt",
+		"\u202Eexe.txt\u202Cgnp.jpg", // RTL override trick
+		"\u2066\u2069",
+		strings.Repeat("a", 300),
+		strings.Repeat("é", 200),       // 2-byte UTF-8 rune repeated, truncation-prone
+		strings.Repeat("😀", 100),       // 4-byte rune repeated
+		strings.Repeat("a", 254) + "é", // boundary: truncation splits the multibyte rune
+		strings.Repeat("a", 253) + "😀",
+		strings.Repeat("a", 255) + "x",
+		"file/../../etc/passwd",
+		"a" + string(rune(0x202E)) + "b",
+		"\ufeff.txt", // BOM
+	}
+	for _, s := range seeds {
+		f.Add(s)
+	}
+
+	f.Fuzz(func(t *testing.T, name string) {
+		out := sanitizeUploadFilename(name)
+
+		if strings.ContainsAny(out, "/\\") {
+			t.Fatalf("sanitizeUploadFilename(%q) = %q contains a path separator", name, out)
+		}
+		if out == "" {
+			t.Fatalf("sanitizeUploadFilename(%q) = %q is empty", name, out)
+		}
+		if out == "." || out == ".." {
+			t.Fatalf("sanitizeUploadFilename(%q) = %q is a reserved dot-name", name, out)
+		}
+		if !utf8.ValidString(out) {
+			t.Fatalf("sanitizeUploadFilename(%q) = %q is not valid UTF-8 (bytes: %x)", name, out, out)
+		}
+		if len(out) > maxUploadFilenameLength {
+			t.Fatalf("sanitizeUploadFilename(%q) = %q has length %d > max %d", name, out, len(out), maxUploadFilenameLength)
+		}
+		for _, r := range out {
+			if unicode.IsControl(r) {
+				t.Fatalf("sanitizeUploadFilename(%q) = %q contains control char %U", name, out, r)
+			}
+			if unicode.In(r, unicode.Cf) {
+				t.Fatalf("sanitizeUploadFilename(%q) = %q contains bidi/format char %U", name, out, r)
+			}
+		}
+	})
+}
diff --git a/Server/api/upload_handler.go b/Server/api/upload_handler.go
index 41145c3c..066896da 100644
--- a/Server/api/upload_handler.go
+++ b/Server/api/upload_handler.go
@@ -15,6 +15,7 @@ import (
 	"strings"
 	"time"
 	"unicode"
+	"unicode/utf8"
 
 	"github.com/go-chi/chi/v5"
 	"github.com/google/uuid"
@@ -48,7 +49,8 @@ func sanitizeUploadFilename(name string) string {
 	if i := strings.LastIndexByte(name, '\\'); i >= 0 {
 		name = name[i+1:]
 	}
-	// Remove control characters and invisible formatting characters.
+	// Remove control characters, invisible formatting characters, and any
+	// residual forward slash.
 	var sb strings.Builder
 	for _, r := range name {
 		// unicode.Cf covers the bidi overrides (U+202A–U+202E, U+2066–U+2069):
@@ -57,15 +59,26 @@ func sanitizeUploadFilename(name string) string {
 		// member of the channel while really being an executable script — and
 		// the same string is what the native save dialog pre-fills. This is the
 		// rule auth.ValidateUsername already applies to usernames.
-		if unicode.IsControl(r) || unicode.In(r, unicode.Cf) {
+		//
+		// A forward slash is dropped too: filepath.Base("/") returns "/" (root
+		// is its own basename), so an upload literally named "/" would otherwise
+		// slip through the reserved-name check below with a path separator
+		// intact. Any residual '/' is unsafe as a basename, so strip it here.
+		if unicode.IsControl(r) || unicode.In(r, unicode.Cf) || r == '/' {
 			continue
 		}
 		sb.WriteRune(r)
 	}
 	name = strings.TrimSpace(sb.String())
-	// Truncate to 255 characters (filesystem limit).
+	// Truncate to the filesystem limit. Slicing by byte offset can land in the
+	// middle of a multibyte rune, so trim back to the last full rune to keep the
+	// result valid UTF-8 (an invalid name misbehaves in JSON encoding, on disk,
+	// and in the client's download-name handling).
 	if len(name) > maxUploadFilenameLength {
 		name = name[:maxUploadFilenameLength]
+		for len(name) > 0 && !utf8.ValidString(name) {
+			name = name[:len(name)-1]
+		}
 	}
 	if name == "" || name == "." || name == ".." {
 		name = "unnamed"
@@ -257,17 +270,29 @@ func handleServeFile(database *db.DB, store *storage.Storage, allowedOrigins []s
 
 		if !isAdmin {
 			if aa.ChannelID == nil {
+				// An unlinked attachment that some user's avatar points at is
+				// readable by every authenticated user: an avatar has to be
+				// visible to the people who see the messages it sits next to.
+				// The check is by the exact URL the column stores, so the file
+				// stops being public the instant the avatar is replaced.
+				isAvatar, avatarErr := database.IsAvatarFileURL(r.Context(), service.AvatarFileURL(fileID))
+				if avatarErr != nil {
+					slog.Error("failed to check avatar file", "id", fileID, "error", avatarErr)
+				}
+				switch {
+				case isAvatar:
+					// Public while in use — fall through to serving.
 				// Unlinked attachment — only the uploader may access.
 				// M-2: Legacy rows (NULL uploader_id) are now denied rather than
 				// served to any authenticated user.
-				if aa.UploaderID == nil {
+				case aa.UploaderID == nil:
 					slog.Warn("legacy attachment access denied (NULL uploader_id)", "id", fileID)
 					writeJSON(w, http.StatusForbidden, errorResponse{
 						Error:   "FORBIDDEN",
 						Message: "you do not have access to this file",
 					})
 					return
-				} else if user == nil || *aa.UploaderID != user.ID {
+				case user == nil || *aa.UploaderID != user.ID:
 					writeJSON(w, http.StatusForbidden, errorResponse{
 						Error:   "FORBIDDEN",
 						Message: "you do not have access to this file",
diff --git a/Server/api/upload_handler_test.go b/Server/api/upload_handler_test.go
index e3623d50..200a37c5 100644
--- a/Server/api/upload_handler_test.go
+++ b/Server/api/upload_handler_test.go
@@ -64,7 +64,10 @@ CREATE TABLE IF NOT EXISTS users (
     banned      INTEGER NOT NULL DEFAULT 0,
     ban_reason  TEXT,
     ban_expires TEXT,
-    identity_public_key TEXT
+    identity_public_key TEXT,
+    display_name TEXT,
+    about TEXT,
+    custom_status TEXT
 );
 CREATE TABLE IF NOT EXISTS sessions (
     id         INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -88,7 +91,8 @@ CREATE TABLE IF NOT EXISTS channels (
     slow_mode      INTEGER NOT NULL DEFAULT 0,
     archived       INTEGER NOT NULL DEFAULT 0,
     created_at     TEXT    NOT NULL DEFAULT (datetime('now')),
-    voice_max_users INTEGER NOT NULL DEFAULT 0
+    voice_max_users INTEGER NOT NULL DEFAULT 0,
+    is_group        INTEGER NOT NULL DEFAULT 0
 );
 CREATE TABLE IF NOT EXISTS messages (
     id          INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -97,8 +101,15 @@ CREATE TABLE IF NOT EXISTS messages (
     content     TEXT    NOT NULL,
     created_at  TEXT    NOT NULL DEFAULT (datetime('now')),
     edited_at   TEXT,
-    deleted     INTEGER NOT NULL DEFAULT 0
+    deleted     INTEGER NOT NULL DEFAULT 0,
+    mentions_everyone INTEGER NOT NULL DEFAULT 0
 );
+CREATE TABLE IF NOT EXISTS message_mentions (
+    message_id        INTEGER NOT NULL REFERENCES messages(id) ON DELETE CASCADE,
+    mentioned_user_id INTEGER NOT NULL REFERENCES users(id)    ON DELETE CASCADE,
+    PRIMARY KEY (message_id, mentioned_user_id)
+);
+
 CREATE TABLE IF NOT EXISTS attachments (
     id          TEXT    PRIMARY KEY,
     message_id  INTEGER,
@@ -125,6 +136,14 @@ CREATE TABLE IF NOT EXISTS channel_overrides (
     PRIMARY KEY (channel_id, role_id)
 );
 
+CREATE TABLE IF NOT EXISTS channel_user_overrides (
+    channel_id INTEGER NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
+    user_id    INTEGER NOT NULL REFERENCES users(id)    ON DELETE CASCADE,
+    allow      INTEGER NOT NULL DEFAULT 0,
+    deny       INTEGER NOT NULL DEFAULT 0,
+    PRIMARY KEY (channel_id, user_id)
+);
+
 CREATE TABLE IF NOT EXISTS settings (
     key   TEXT PRIMARY KEY,
     value TEXT NOT NULL
diff --git a/Server/auth/helpers_fuzz_test.go b/Server/auth/helpers_fuzz_test.go
new file mode 100644
index 00000000..572a364c
--- /dev/null
+++ b/Server/auth/helpers_fuzz_test.go
@@ -0,0 +1,68 @@
+package auth
+
+import (
+	"strings"
+	"testing"
+	"unicode"
+)
+
+// FuzzValidateUsername checks ValidateUsername against the rules its own doc
+// comment states: length 2-32 runes after trim, no control characters, no
+// zero-width/invisible (Cf) characters, and never inside the reserved
+// "[deleted-…]" namespace (case-insensitively). On success (err == nil) every
+// one of those must hold for the *original* input (ValidateUsername trims
+// internally but the caller passes the raw string).
+func FuzzValidateUsername(f *testing.F) {
+	seeds := []string{
+		"",
+		"a",
+		"ab",
+		strings.Repeat("a", 32),
+		strings.Repeat("a", 33),
+		strings.Repeat("a", 2),
+		"  ab  ",
+		"[deleted-123]",
+		"[DELETED-123]",
+		"[deleted-]",
+		"[deleted-abc]",
+		" [deleted-1] ",
+		"normal_user",
+		"user\x00name",
+		"user\tname",
+		"user\nname",
+		"zero\u200bwidth",    // ZERO WIDTH SPACE (Cf)
+		"bidi\u202eoverride", // RIGHT-TO-LEFT OVERRIDE (Cf)
+		"emoji😀name",
+		"日本語ユーザー",
+		" nbsp ",
+	}
+	for _, s := range seeds {
+		f.Add(s)
+	}
+
+	f.Fuzz(func(t *testing.T, username string) {
+		err := ValidateUsername(username)
+		if err != nil {
+			return
+		}
+
+		trimmed := strings.TrimSpace(username)
+		n := len([]rune(trimmed))
+		if n < minUsernameLength || n > maxUsernameLength {
+			t.Fatalf("ValidateUsername(%q) = nil, but trimmed length %d outside [%d,%d]", username, n, minUsernameLength, maxUsernameLength)
+		}
+
+		if lower := strings.ToLower(trimmed); strings.HasPrefix(lower, "[deleted-") && strings.HasSuffix(lower, "]") {
+			t.Fatalf("ValidateUsername(%q) = nil, but trimmed form %q is in the reserved [deleted-…] namespace", username, trimmed)
+		}
+
+		for _, r := range trimmed {
+			if unicode.IsControl(r) {
+				t.Fatalf("ValidateUsername(%q) = nil, but trimmed form contains control rune %q", username, r)
+			}
+			if unicode.In(r, unicode.Cf) {
+				t.Fatalf("ValidateUsername(%q) = nil, but trimmed form contains invisible (Cf) rune %q", username, r)
+			}
+		}
+	})
+}
diff --git a/Server/auth/password_fuzz_test.go b/Server/auth/password_fuzz_test.go
new file mode 100644
index 00000000..8e93d195
--- /dev/null
+++ b/Server/auth/password_fuzz_test.go
@@ -0,0 +1,40 @@
+package auth
+
+import (
+	"strings"
+	"testing"
+)
+
+// FuzzValidatePasswordStrength checks ValidatePasswordStrength against the
+// rule its doc comment states: length (in bytes, since len() on a Go string
+// is a byte count) between minPassLen and maxPassLen inclusive. On success
+// (err == nil) that bound must hold for the exact input passed in.
+func FuzzValidatePasswordStrength(f *testing.F) {
+	seeds := []string{
+		"",
+		"a",
+		strings.Repeat("a", minPassLen-1),
+		strings.Repeat("a", minPassLen),
+		strings.Repeat("a", maxPassLen),
+		strings.Repeat("a", maxPassLen+1),
+		strings.Repeat("a", maxPassLen*4),
+		strings.Repeat("é", minPassLen), // multi-byte runes
+		strings.Repeat("🔥", minPassLen), // 4-byte runes
+		"password",
+		"        ", // spaces only, exactly minPassLen
+	}
+	for _, s := range seeds {
+		f.Add(s)
+	}
+
+	f.Fuzz(func(t *testing.T, password string) {
+		err := ValidatePasswordStrength(password)
+		if err != nil {
+			return
+		}
+		n := len(password)
+		if n < minPassLen || n > maxPassLen {
+			t.Fatalf("ValidatePasswordStrength(%q) = nil, but byte length %d outside [%d,%d]", password, n, minPassLen, maxPassLen)
+		}
+	})
+}
diff --git a/Server/db/admin_queries.go b/Server/db/admin_queries.go
index 35b2cb24..c6e4a901 100644
--- a/Server/db/admin_queries.go
+++ b/Server/db/admin_queries.go
@@ -141,15 +141,48 @@ func (d *DB) AdminCreateChannel(ctx context.Context, name, chanType, category, t
 	return res.LastInsertId()
 }
 
-// AdminUpdateChannel updates all mutable channel fields.
-func (d *DB) AdminUpdateChannel(ctx context.Context, id int64, name, topic string, slowMode, position int, archived bool) error {
+// ChannelUpdate is the full set of mutable channel fields an admin edit writes.
+//
+// A struct rather than a positional argument list: the update covers nine
+// fields now, four of them ints, and `AdminUpdateChannel(ctx, id, name, topic,
+// category, slowMode, position, archived, nsfw, maxUsers, maxVideo)` invites
+// exactly the silent transposition (slow mode into user limit) that no test
+// would catch. Every field is written unconditionally, so callers must start
+// from the channel's current values — the handler does, which is what makes a
+// partial PATCH body safe.
+type ChannelUpdate struct {
+	Name     string
+	Topic    string
+	Category string
+	SlowMode int
+	Position int
+	Archived bool
+	// NSFW is stored and broadcast only; it drives no server-side content
+	// behaviour (see migration 025).
+	NSFW bool
+	// VoiceMaxUsers / VoiceMaxVideo are the voice capacity limits the ws
+	// voice-join path already enforces (0 = unlimited). They are meaningless
+	// on a text channel but are still written there, because refusing them
+	// would make the value depend on a type that can never change anyway.
+	VoiceMaxUsers int
+	VoiceMaxVideo int
+}
+
+// AdminUpdateChannel updates all mutable channel fields, category included —
+// moving a channel between categories is a rename of free text, not a
+// structural change, so it rides on the ordinary update.
+func (d *DB) AdminUpdateChannel(ctx context.Context, id int64, u ChannelUpdate) error {
 	if err := d.q.AdminUpdateChannel(ctx, dbgen.AdminUpdateChannelParams{
-		Name:     name,
-		Topic:    strToNullPtr(topic),
-		SlowMode: int64(slowMode),
-		Position: int64(position),
-		Archived: b2i64(archived),
-		ID:       id,
+		Name:          u.Name,
+		Topic:         strToNullPtr(u.Topic),
+		Category:      strToNullPtr(u.Category),
+		SlowMode:      int64(u.SlowMode),
+		Position:      int64(u.Position),
+		Archived:      b2i64(u.Archived),
+		Nsfw:          b2i64(u.NSFW),
+		VoiceMaxUsers: int64(u.VoiceMaxUsers),
+		VoiceMaxVideo: int64(u.VoiceMaxVideo),
+		ID:            id,
 	}); err != nil {
 		return fmt.Errorf("AdminUpdateChannel: %w", err)
 	}
diff --git a/Server/db/admin_queries_test.go b/Server/db/admin_queries_test.go
index 57920bee..3b4f2aa3 100644
--- a/Server/db/admin_queries_test.go
+++ b/Server/db/admin_queries_test.go
@@ -27,7 +27,9 @@ CREATE TABLE IF NOT EXISTS channels (
     voice_max_users  INTEGER NOT NULL DEFAULT 0,
     voice_quality    TEXT,
     mixing_threshold INTEGER,
-    voice_max_video  INTEGER NOT NULL DEFAULT 0
+    voice_max_video  INTEGER NOT NULL DEFAULT 0,
+    nsfw             INTEGER NOT NULL DEFAULT 0,
+    is_group         INTEGER NOT NULL DEFAULT 0
 );
 
 CREATE TABLE IF NOT EXISTS messages (
@@ -39,8 +41,15 @@ CREATE TABLE IF NOT EXISTS messages (
     edited_at  TEXT,
     deleted    INTEGER NOT NULL DEFAULT 0,
     pinned     INTEGER NOT NULL DEFAULT 0,
-    timestamp  TEXT    NOT NULL DEFAULT (datetime('now'))
+    timestamp  TEXT    NOT NULL DEFAULT (datetime('now')),
+    mentions_everyone INTEGER NOT NULL DEFAULT 0
 );
+CREATE TABLE IF NOT EXISTS message_mentions (
+    message_id        INTEGER NOT NULL REFERENCES messages(id) ON DELETE CASCADE,
+    mentioned_user_id INTEGER NOT NULL REFERENCES users(id)    ON DELETE CASCADE,
+    PRIMARY KEY (message_id, mentioned_user_id)
+);
+
 
 CREATE TABLE IF NOT EXISTS audit_log (
     id          INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -410,7 +419,17 @@ func TestAdminUpdateChannel(t *testing.T) {
 		t.Fatalf("AdminCreateChannel() error: %v", err)
 	}
 
-	if err := database.AdminUpdateChannel(context.Background(), id, "new-name", "new topic", 5, 2, true); err != nil {
+	if err := database.AdminUpdateChannel(context.Background(), id, db.ChannelUpdate{
+		Name:          "new-name",
+		Topic:         "new topic",
+		Category:      "Moved",
+		SlowMode:      5,
+		Position:      2,
+		Archived:      true,
+		NSFW:          true,
+		VoiceMaxUsers: 7,
+		VoiceMaxVideo: 3,
+	}); err != nil {
 		t.Fatalf("AdminUpdateChannel() error: %v", err)
 	}
 
@@ -433,13 +452,65 @@ func TestAdminUpdateChannel(t *testing.T) {
 	if !ch.Archived {
 		t.Error("Archived = false, want true")
 	}
+	if !ch.NSFW {
+		t.Error("NSFW = false, want true")
+	}
+	if ch.VoiceMaxUsers != 7 {
+		t.Errorf("VoiceMaxUsers = %d, want 7", ch.VoiceMaxUsers)
+	}
+	if ch.VoiceMaxVideo != 3 {
+		t.Errorf("VoiceMaxVideo = %d, want 3", ch.VoiceMaxVideo)
+	}
+}
+
+// TestAdminUpdateChannel_ClearsNSFW proves the flag is a real round-trip in
+// both directions: an update writes every field unconditionally, so a caller
+// that starts from the channel's current values and flips one is the only
+// thing standing between a partial PATCH and a wiped row.
+func TestAdminUpdateChannel_ClearsNSFW(t *testing.T) {
+	database := newAdminTestDB(t)
+
+	id, _ := database.AdminCreateChannel(context.Background(), "nsfw-ch", "text", "", "", 0)
+	if err := database.AdminUpdateChannel(context.Background(), id, db.ChannelUpdate{Name: "nsfw-ch", NSFW: true}); err != nil {
+		t.Fatalf("AdminUpdateChannel() error: %v", err)
+	}
+	ch, _ := database.GetChannel(context.Background(), id)
+	if !ch.NSFW {
+		t.Fatal("NSFW = false after marking, want true")
+	}
+
+	if err := database.AdminUpdateChannel(context.Background(), id, db.ChannelUpdate{Name: "nsfw-ch", NSFW: false}); err != nil {
+		t.Fatalf("AdminUpdateChannel() error: %v", err)
+	}
+	ch, _ = database.GetChannel(context.Background(), id)
+	if ch.NSFW {
+		t.Error("NSFW = true after unmarking, want false")
+	}
+}
+
+// A freshly created channel is not NSFW and carries no voice limits — the
+// migration's defaults, which every client relies on for an unflagged channel.
+func TestAdminCreateChannel_DefaultsNotNSFW(t *testing.T) {
+	database := newAdminTestDB(t)
+
+	id, _ := database.AdminCreateChannel(context.Background(), "plain", "text", "", "", 0)
+	ch, err := database.GetChannel(context.Background(), id)
+	if err != nil {
+		t.Fatalf("GetChannel() error: %v", err)
+	}
+	if ch.NSFW {
+		t.Error("NSFW = true on a new channel, want false")
+	}
+	if ch.VoiceMaxUsers != 0 {
+		t.Errorf("VoiceMaxUsers = %d on a new channel, want 0", ch.VoiceMaxUsers)
+	}
 }
 
 func TestAdminUpdateChannel_Unarchive(t *testing.T) {
 	database := newAdminTestDB(t)
 
 	id, _ := database.AdminCreateChannel(context.Background(), "arch-ch", "text", "", "", 0)
-	_ = database.AdminUpdateChannel(context.Background(), id, "arch-ch", "", 0, 0, true)
+	_ = database.AdminUpdateChannel(context.Background(), id, db.ChannelUpdate{Name: "arch-ch", Archived: true})
 
 	ch, _ := database.GetChannel(context.Background(), id)
 	if !ch.Archived {
@@ -447,7 +518,7 @@ func TestAdminUpdateChannel_Unarchive(t *testing.T) {
 	}
 
 	// Unarchive
-	_ = database.AdminUpdateChannel(context.Background(), id, "arch-ch", "", 0, 0, false)
+	_ = database.AdminUpdateChannel(context.Background(), id, db.ChannelUpdate{Name: "arch-ch", Archived: false})
 	ch, _ = database.GetChannel(context.Background(), id)
 	if ch.Archived {
 		t.Error("Archived = true after unarchiving, want false")
diff --git a/Server/db/auth_queries.go b/Server/db/auth_queries.go
index 6363df3f..e510336f 100644
--- a/Server/db/auth_queries.go
+++ b/Server/db/auth_queries.go
@@ -180,8 +180,10 @@ func (d *DB) UpdateUserIdentityKey(ctx context.Context, id int64, key *string) e
 	return nil
 }
 
-// ResetAllUserStatuses sets all users to "offline". Called on server startup
-// to clear stale statuses from a previous run or crash.
+// ResetAllUserStatuses clears the "online" status left behind by a previous
+// run or crash. Called on server startup. Chosen statuses (idle/dnd/invisible)
+// are left standing — they are what the user picked, not evidence of a session,
+// and the read path already renders a user with no live connection as offline.
 func (d *DB) ResetAllUserStatuses(ctx context.Context) error {
 	if err := d.q.ResetAllUserStatuses(ctx); err != nil {
 		return fmt.Errorf("ResetAllUserStatuses: %w", err)
@@ -189,6 +191,16 @@ func (d *DB) ResetAllUserStatuses(ctx context.Context) error {
 	return nil
 }
 
+// MarkUserDisconnected records that a user's last session went away: last_seen
+// is refreshed and "online" falls back to "offline", while a chosen
+// idle/dnd/invisible is preserved for the next connect to honour.
+func (d *DB) MarkUserDisconnected(ctx context.Context, userID int64) error {
+	if err := d.q.MarkUserDisconnected(ctx, userID); err != nil {
+		return fmt.Errorf("MarkUserDisconnected: %w", err)
+	}
+	return nil
+}
+
 // BanUser marks a user as banned with an optional expiry. Pass nil for a
 // permanent ban.
 func (d *DB) BanUser(ctx context.Context, id int64, reason string, expires *time.Time) error {
@@ -502,6 +514,20 @@ type MemberSummary struct {
 	// (base64), pinned by peers on first sight (F3 TOFU). Omitted when the
 	// user has not published one.
 	IdentityPublicKey *string `json:"identity_public_key,omitempty"`
+	// DisplayName is the nickname to render instead of Username. Null when
+	// unset; clients fall back to Username.
+	DisplayName *string `json:"display_name"`
+	// CustomStatus is the free-text status line shown under the name. Null
+	// when unset.
+	CustomStatus *string `json:"custom_status"`
+}
+
+// ForViewer returns a copy of the summary as viewerID may see it: an invisible
+// member is offline to everyone but themselves. Ready payloads go through this
+// so "who is invisible" is decided in exactly one place.
+func (m MemberSummary) ForViewer(viewerID int64) MemberSummary {
+	m.Status = StatusForViewer(m.Status, m.ID, viewerID)
+	return m
 }
 
 // ListMembers returns non-banned users as lightweight summaries.
@@ -520,6 +546,8 @@ func (d *DB) ListMembers(ctx context.Context) ([]MemberSummary, error) {
 			Status:            r.Status,
 			Role:              r.Lower,
 			IdentityPublicKey: r.IdentityPublicKey,
+			DisplayName:       r.DisplayName,
+			CustomStatus:      r.CustomStatus,
 		})
 	}
 	return members, nil
diff --git a/Server/db/auth_queries_test.go b/Server/db/auth_queries_test.go
index 577f37a8..c04e4b91 100644
--- a/Server/db/auth_queries_test.go
+++ b/Server/db/auth_queries_test.go
@@ -60,7 +60,10 @@ CREATE TABLE IF NOT EXISTS users (
     banned      INTEGER NOT NULL DEFAULT 0,
     ban_reason  TEXT,
     ban_expires TEXT,
-    identity_public_key TEXT
+    identity_public_key TEXT,
+    display_name TEXT,
+    about TEXT,
+    custom_status TEXT
 );
 
 CREATE TABLE IF NOT EXISTS sessions (
@@ -716,8 +719,12 @@ func TestResetAllUserStatuses(t *testing.T) {
 	if u1.Status != "offline" {
 		t.Errorf("user1 status = %q, want 'offline'", u1.Status)
 	}
-	if u2.Status != "offline" {
-		t.Errorf("user2 status = %q, want 'offline'", u2.Status)
+	// A chosen status survives the startup reset: nothing is connected yet, so
+	// "online" is the only value that can be a leftover session. dnd is a
+	// preference, and the read path renders a user with no live connection as
+	// offline regardless of what the column holds.
+	if u2.Status != "dnd" {
+		t.Errorf("user2 status = %q, want 'dnd' (chosen statuses survive the reset)", u2.Status)
 	}
 }
 
diff --git a/Server/db/channel_queries.go b/Server/db/channel_queries.go
index efa22af6..4b9d692c 100644
--- a/Server/db/channel_queries.go
+++ b/Server/db/channel_queries.go
@@ -10,7 +10,7 @@ import (
 	"github.com/owncord/server/db/dbgen"
 )
 
-// channelFields carries the 13 columns shared by GetChannelRow and
+// channelFields carries the 14 columns shared by GetChannelRow and
 // ListChannelsRow; both generated row types are structurally identical, so a
 // single mapper narrows either to the domain Channel model.
 type channelFields struct {
@@ -27,6 +27,10 @@ type channelFields struct {
 	VoiceQuality    *string
 	MixingThreshold *int64
 	VoiceMaxVideo   int64
+	// Nsfw keeps sqlc's spelling, not the domain model's NSFW: the two
+	// generated row types are narrowed by a direct struct conversion, which
+	// requires identical field names.
+	Nsfw int64
 }
 
 func channelFromFields(f channelFields) Channel {
@@ -44,6 +48,7 @@ func channelFromFields(f channelFields) Channel {
 		VoiceQuality:    f.VoiceQuality,
 		MixingThreshold: ptrI64toI(f.MixingThreshold),
 		VoiceMaxVideo:   int(f.VoiceMaxVideo),
+		NSFW:            f.Nsfw != 0,
 	}
 }
 
@@ -147,10 +152,15 @@ func (d *DB) GetChannelPermissions(ctx context.Context, channelID, roleID int64)
 	return r.Allow, r.Deny, nil
 }
 
-// ChannelOverride holds the allow/deny permission bits for a single channel.
+// ChannelOverride holds the resolved override layers for a single channel.
+// Allow/Deny are the ROLE layer (channel_overrides); UserAllow/UserDeny are the
+// per-member layer (channel_user_overrides) applied on top of it. See
+// permissions.EffectiveChannelPerms for the resolution order.
 type ChannelOverride struct {
-	Allow int64
-	Deny  int64
+	Allow     int64
+	Deny      int64
+	UserAllow int64
+	UserDeny  int64
 }
 
 // GetAllChannelPermissionsForRole returns all channel permission overrides for
@@ -194,6 +204,143 @@ func (d *DB) DeleteChannelOverride(ctx context.Context, channelID, roleID int64)
 	return nil
 }
 
+// GetUserChannelPermissions returns the per-user allow/deny override bits for a
+// user on a channel. Returns (0, 0, nil) when no override exists.
+func (d *DB) GetUserChannelPermissions(ctx context.Context, channelID, userID int64) (allow, deny int64, err error) {
+	r, scanErr := d.q.GetChannelUserPermission(ctx, dbgen.GetChannelUserPermissionParams{
+		ChannelID: channelID,
+		UserID:    userID,
+	})
+	if errors.Is(scanErr, sql.ErrNoRows) {
+		return 0, 0, nil
+	}
+	if scanErr != nil {
+		return 0, 0, fmt.Errorf("GetUserChannelPermissions: %w", scanErr)
+	}
+	return r.Allow, r.Deny, nil
+}
+
+// GetAllChannelPermissionsForUser returns every per-user channel override the
+// user carries, keyed by channel ID, in one query. The per-user layer is fetched
+// exactly like the per-role one (GetAllChannelPermissionsForRole) so no call
+// site pays an N+1 for the second layer.
+func (d *DB) GetAllChannelPermissionsForUser(ctx context.Context, userID int64) (map[int64]ChannelOverride, error) {
+	rows, err := d.q.GetUserChannelPermissions(ctx, userID)
+	if err != nil {
+		return nil, fmt.Errorf("GetAllChannelPermissionsForUser: %w", err)
+	}
+	result := make(map[int64]ChannelOverride, len(rows))
+	for _, r := range rows {
+		result[r.ChannelID] = ChannelOverride{UserAllow: r.Allow, UserDeny: r.Deny}
+	}
+	return result, nil
+}
+
+// GetChannelOverridesFor returns the merged role + user override layers for one
+// member, keyed by channel ID: two batch queries, never per channel. It is the
+// single fetch every "what can this member do here" site uses, so the role and
+// user layers can never be loaded by one site and forgotten by another.
+func (d *DB) GetChannelOverridesFor(ctx context.Context, roleID, userID int64) (map[int64]ChannelOverride, error) {
+	merged, err := d.GetAllChannelPermissionsForRole(ctx, roleID)
+	if err != nil {
+		return nil, err
+	}
+	userOv, err := d.GetAllChannelPermissionsForUser(ctx, userID)
+	if err != nil {
+		return nil, err
+	}
+	for chID, o := range userOv {
+		existing := merged[chID]
+		existing.UserAllow = o.UserAllow
+		existing.UserDeny = o.UserDeny
+		merged[chID] = existing
+	}
+	return merged, nil
+}
+
+// UpsertChannelUserOverride inserts or updates the allow/deny permission
+// override for a single user on a channel.
+func (d *DB) UpsertChannelUserOverride(ctx context.Context, channelID, userID, allow, deny int64) error {
+	if err := d.q.UpsertChannelUserPermission(ctx, dbgen.UpsertChannelUserPermissionParams{
+		ChannelID: channelID,
+		UserID:    userID,
+		Allow:     allow,
+		Deny:      deny,
+	}); err != nil {
+		return fmt.Errorf("UpsertChannelUserOverride: %w", err)
+	}
+	return nil
+}
+
+// DeleteChannelUserOverride removes a user's permission override on a channel.
+// Deleting a non-existent override is a no-op.
+func (d *DB) DeleteChannelUserOverride(ctx context.Context, channelID, userID int64) error {
+	if err := d.q.DeleteChannelUserPermission(ctx, dbgen.DeleteChannelUserPermissionParams{
+		ChannelID: channelID,
+		UserID:    userID,
+	}); err != nil {
+		return fmt.Errorf("DeleteChannelUserOverride: %w", err)
+	}
+	return nil
+}
+
+// GetChannelUserOverrides returns every per-user override on a channel, keyed
+// by user id. The per-user reverse (GetAllChannelPermissionsForUser) backs the
+// permission cache; this direction backs the @everyone fan-out and the admin
+// panel's override matrix, which need every member's verdict on one channel.
+func (d *DB) GetChannelUserOverrides(ctx context.Context, channelID int64) (map[int64]ChannelOverride, error) {
+	rows, err := d.q.GetChannelUserOverrides(ctx, channelID)
+	if err != nil {
+		return nil, fmt.Errorf("GetChannelUserOverrides: %w", err)
+	}
+	result := make(map[int64]ChannelOverride, len(rows))
+	for _, r := range rows {
+		result[r.UserID] = ChannelOverride{UserAllow: r.Allow, UserDeny: r.Deny}
+	}
+	return result, nil
+}
+
+// ChannelUserOverride pairs a user with their allow/deny override on a specific
+// channel. Unlike ChannelRoleOverride it lists only users who actually HAVE an
+// override row — every member of a server is not a sensible list to ship.
+type ChannelUserOverride struct {
+	UserID   int64  `json:"user_id"`
+	Username string `json:"username"`
+	RoleID   int64  `json:"role_id"`
+	Allow    int64  `json:"allow"`
+	Deny     int64  `json:"deny"`
+}
+
+// ListChannelUserOverrides returns the per-user overrides on a channel joined
+// with the users' names, ordered by username.
+func (d *DB) ListChannelUserOverrides(ctx context.Context, channelID int64) ([]ChannelUserOverride, error) {
+	rows, err := d.reader.QueryContext(ctx,
+		`SELECT u.id, u.username, u.role_id, o.allow, o.deny
+		 FROM channel_user_overrides o
+		 JOIN users u ON u.id = o.user_id
+		 WHERE o.channel_id = ?
+		 ORDER BY u.username COLLATE NOCASE ASC`,
+		channelID,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("ListChannelUserOverrides: %w", err)
+	}
+	defer rows.Close() //nolint:errcheck
+
+	result := []ChannelUserOverride{}
+	for rows.Next() {
+		var o ChannelUserOverride
+		if scanErr := rows.Scan(&o.UserID, &o.Username, &o.RoleID, &o.Allow, &o.Deny); scanErr != nil {
+			return nil, fmt.Errorf("ListChannelUserOverrides scan: %w", scanErr)
+		}
+		result = append(result, o)
+	}
+	if rows.Err() != nil {
+		return nil, fmt.Errorf("ListChannelUserOverrides rows: %w", rows.Err())
+	}
+	return result, nil
+}
+
 // ChannelRoleOverride pairs a role with its (possibly zero) permission
 // override on a specific channel. Permissions carries the role's base bits so
 // callers can tell which roles bypass overrides via Administrator.
diff --git a/Server/db/channel_user_override_queries_test.go b/Server/db/channel_user_override_queries_test.go
new file mode 100644
index 00000000..eca89e5b
--- /dev/null
+++ b/Server/db/channel_user_override_queries_test.go
@@ -0,0 +1,211 @@
+package db_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/owncord/server/permissions"
+)
+
+// ─── channel_user_overrides ──────────────────────────────────────────────────
+
+func TestChannelUserOverride_UpsertGetDelete(t *testing.T) {
+	database := openMigratedMemory(t)
+	ctx := context.Background()
+
+	chID, err := database.CreateChannel(ctx, "secret", "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+	uid, err := database.CreateUser(ctx, "alice", "hash", int(permissions.MemberRoleID))
+	if err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+
+	// No row yet — a missing override is (0, 0), not an error.
+	allow, deny, err := database.GetUserChannelPermissions(ctx, chID, uid)
+	if err != nil {
+		t.Fatalf("GetUserChannelPermissions (absent): %v", err)
+	}
+	if allow != 0 || deny != 0 {
+		t.Errorf("absent override = (%#x, %#x), want (0, 0)", allow, deny)
+	}
+
+	if err := database.UpsertChannelUserOverride(ctx, chID, uid, permissions.ReadMessages, permissions.SendMessages); err != nil {
+		t.Fatalf("UpsertChannelUserOverride: %v", err)
+	}
+	allow, deny, err = database.GetUserChannelPermissions(ctx, chID, uid)
+	if err != nil {
+		t.Fatalf("GetUserChannelPermissions: %v", err)
+	}
+	if allow != permissions.ReadMessages || deny != permissions.SendMessages {
+		t.Errorf("override = (%#x, %#x)", allow, deny)
+	}
+
+	// Upsert replaces rather than duplicating.
+	if err := database.UpsertChannelUserOverride(ctx, chID, uid, 0, permissions.ReadMessages); err != nil {
+		t.Fatalf("UpsertChannelUserOverride (update): %v", err)
+	}
+	rows, err := database.ListChannelUserOverrides(ctx, chID)
+	if err != nil {
+		t.Fatalf("ListChannelUserOverrides: %v", err)
+	}
+	if len(rows) != 1 {
+		t.Fatalf("rows = %d, want 1", len(rows))
+	}
+	if rows[0].Username != "alice" || rows[0].Allow != 0 || rows[0].Deny != permissions.ReadMessages {
+		t.Errorf("listed row = %+v", rows[0])
+	}
+
+	if err := database.DeleteChannelUserOverride(ctx, chID, uid); err != nil {
+		t.Fatalf("DeleteChannelUserOverride: %v", err)
+	}
+	rows, err = database.ListChannelUserOverrides(ctx, chID)
+	if err != nil {
+		t.Fatalf("ListChannelUserOverrides after delete: %v", err)
+	}
+	if len(rows) != 0 {
+		t.Errorf("rows after delete = %d, want 0", len(rows))
+	}
+	// Deleting again is a no-op.
+	if err := database.DeleteChannelUserOverride(ctx, chID, uid); err != nil {
+		t.Fatalf("second DeleteChannelUserOverride: %v", err)
+	}
+}
+
+// GetChannelOverridesFor is the single merged fetch every visibility site uses.
+// It must carry BOTH layers, and a channel with only one layer set must keep
+// the other at zero.
+func TestGetChannelOverridesFor_MergesBothLayers(t *testing.T) {
+	database := openMigratedMemory(t)
+	ctx := context.Background()
+
+	roleOnly, err := database.CreateChannel(ctx, "role-only", "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+	userOnly, err := database.CreateChannel(ctx, "user-only", "text", "", "", 1)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+	both, err := database.CreateChannel(ctx, "both", "text", "", "", 2)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+	uid, err := database.CreateUser(ctx, "bob", "hash", int(permissions.MemberRoleID))
+	if err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+
+	if err := database.UpsertChannelOverride(ctx, roleOnly, permissions.MemberRoleID, 0, permissions.ReadMessages); err != nil {
+		t.Fatalf("UpsertChannelOverride: %v", err)
+	}
+	if err := database.UpsertChannelUserOverride(ctx, userOnly, uid, permissions.SendMessages, 0); err != nil {
+		t.Fatalf("UpsertChannelUserOverride: %v", err)
+	}
+	if err := database.UpsertChannelOverride(ctx, both, permissions.MemberRoleID, permissions.AttachFiles, 0); err != nil {
+		t.Fatalf("UpsertChannelOverride both: %v", err)
+	}
+	if err := database.UpsertChannelUserOverride(ctx, both, uid, 0, permissions.AttachFiles); err != nil {
+		t.Fatalf("UpsertChannelUserOverride both: %v", err)
+	}
+
+	merged, err := database.GetChannelOverridesFor(ctx, permissions.MemberRoleID, uid)
+	if err != nil {
+		t.Fatalf("GetChannelOverridesFor: %v", err)
+	}
+	if got := merged[roleOnly]; got.Deny != permissions.ReadMessages || got.UserDeny != 0 {
+		t.Errorf("role-only channel = %+v", got)
+	}
+	if got := merged[userOnly]; got.Allow != 0 || got.UserAllow != permissions.SendMessages {
+		t.Errorf("user-only channel = %+v", got)
+	}
+	if got := merged[both]; got.Allow != permissions.AttachFiles || got.UserDeny != permissions.AttachFiles {
+		t.Errorf("both-layers channel = %+v", got)
+	}
+
+	// A different member of the same role sees the role layer only.
+	other, err := database.CreateUser(ctx, "carol", "hash", int(permissions.MemberRoleID))
+	if err != nil {
+		t.Fatalf("CreateUser carol: %v", err)
+	}
+	otherMerged, err := database.GetChannelOverridesFor(ctx, permissions.MemberRoleID, other)
+	if err != nil {
+		t.Fatalf("GetChannelOverridesFor carol: %v", err)
+	}
+	if got := otherMerged[userOnly]; got.UserAllow != 0 {
+		t.Errorf("carol picked up bob's user override: %+v", got)
+	}
+	if got := otherMerged[both]; got.UserDeny != 0 {
+		t.Errorf("carol picked up bob's user deny: %+v", got)
+	}
+}
+
+// Deleting a channel or a user must take its override rows with it — the FKs
+// carry ON DELETE CASCADE precisely so a stale row cannot grant access to a
+// channel id that has been reused.
+func TestChannelUserOverride_CascadesOnChannelDelete(t *testing.T) {
+	database := openMigratedMemory(t)
+	ctx := context.Background()
+
+	chID, err := database.CreateChannel(ctx, "doomed", "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+	uid, err := database.CreateUser(ctx, "dave", "hash", int(permissions.MemberRoleID))
+	if err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+	if err := database.UpsertChannelUserOverride(ctx, chID, uid, permissions.ReadMessages, 0); err != nil {
+		t.Fatalf("UpsertChannelUserOverride: %v", err)
+	}
+	if err := database.DeleteChannel(ctx, chID); err != nil {
+		t.Fatalf("DeleteChannel: %v", err)
+	}
+
+	byUser, err := database.GetAllChannelPermissionsForUser(ctx, uid)
+	if err != nil {
+		t.Fatalf("GetAllChannelPermissionsForUser: %v", err)
+	}
+	if len(byUser) != 0 {
+		t.Errorf("override survived channel delete: %+v", byUser)
+	}
+}
+
+func TestGetChannelUserOverrides_ByChannel(t *testing.T) {
+	database := openMigratedMemory(t)
+	ctx := context.Background()
+
+	chID, err := database.CreateChannel(ctx, "listing", "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+	a, err := database.CreateUser(ctx, "aaa", "hash", int(permissions.MemberRoleID))
+	if err != nil {
+		t.Fatalf("CreateUser aaa: %v", err)
+	}
+	b, err := database.CreateUser(ctx, "bbb", "hash", int(permissions.MemberRoleID))
+	if err != nil {
+		t.Fatalf("CreateUser bbb: %v", err)
+	}
+	if err := database.UpsertChannelUserOverride(ctx, chID, a, permissions.ReadMessages, 0); err != nil {
+		t.Fatalf("UpsertChannelUserOverride a: %v", err)
+	}
+	if err := database.UpsertChannelUserOverride(ctx, chID, b, 0, permissions.ReadMessages); err != nil {
+		t.Fatalf("UpsertChannelUserOverride b: %v", err)
+	}
+
+	byUser, err := database.GetChannelUserOverrides(ctx, chID)
+	if err != nil {
+		t.Fatalf("GetChannelUserOverrides: %v", err)
+	}
+	if len(byUser) != 2 {
+		t.Fatalf("entries = %d, want 2", len(byUser))
+	}
+	if byUser[a].UserAllow != permissions.ReadMessages {
+		t.Errorf("user a = %+v", byUser[a])
+	}
+	if byUser[b].UserDeny != permissions.ReadMessages {
+		t.Errorf("user b = %+v", byUser[b])
+	}
+}
diff --git a/Server/db/coverage_boost_test.go b/Server/db/coverage_boost_test.go
index c4cea5ab..4e0367e3 100644
--- a/Server/db/coverage_boost_test.go
+++ b/Server/db/coverage_boost_test.go
@@ -412,9 +412,14 @@ func TestCreateAttachment_Success(t *testing.T) {
 func TestCreateAttachment_WithDimensions(t *testing.T) {
 	database := openMigratedMemory(t)
 	userID := seedUser(t, database, "att-dim-uploader")
+	chID := seedChannel(t, database, "att-dim-chan")
+	msgID, err := database.CreateMessage(context.Background(), chID, userID, "with dims", nil)
+	if err != nil {
+		t.Fatalf("CreateMessage: %v", err)
+	}
 
 	w, h := 1920, 1080
-	err := database.CreateAttachment(context.Background(), "att-dim", userID, "photo.jpg", "stored-dim.jpg", "image/jpeg", 54321, &w, &h)
+	err = database.CreateAttachment(context.Background(), "att-dim", userID, "photo.jpg", "stored-dim.jpg", "image/jpeg", 54321, &w, &h)
 	if err != nil {
 		t.Fatalf("CreateAttachment with dims: %v", err)
 	}
@@ -423,6 +428,25 @@ func TestCreateAttachment_WithDimensions(t *testing.T) {
 	if att == nil {
 		t.Fatal("expected attachment")
 	}
+
+	if n, linkErr := database.LinkAttachmentsToMessage(context.Background(), msgID, userID, []string{"att-dim"}); linkErr != nil || n != 1 {
+		t.Fatalf("LinkAttachmentsToMessage: n=%d err=%v", n, linkErr)
+	}
+
+	byMsg, err := database.GetAttachmentsByMessageIDs(context.Background(), []int64{msgID})
+	if err != nil {
+		t.Fatalf("GetAttachmentsByMessageIDs: %v", err)
+	}
+	infos := byMsg[msgID]
+	if len(infos) != 1 {
+		t.Fatalf("expected 1 attachment for message, got %d", len(infos))
+	}
+	if infos[0].Width == nil || *infos[0].Width != w {
+		t.Errorf("Width = %v, want %d", infos[0].Width, w)
+	}
+	if infos[0].Height == nil || *infos[0].Height != h {
+		t.Errorf("Height = %v, want %d", infos[0].Height, h)
+	}
 }
 
 // ─── DeleteOrphanedAttachments ──────────────────────────────────────────────
diff --git a/Server/db/dbgen/apitokens.sql.go b/Server/db/dbgen/apitokens.sql.go
index a74ebb5d..10ce9d44 100644
--- a/Server/db/dbgen/apitokens.sql.go
+++ b/Server/db/dbgen/apitokens.sql.go
@@ -60,7 +60,8 @@ func (q *Queries) GetActiveAPIToken(ctx context.Context, tokenHash string) (ApiT
 
 const getOwnerUser = `-- name: GetOwnerUser :one
 SELECT id, username, password, avatar, role_id, totp_secret, status,
-       created_at, last_seen, banned, ban_reason, ban_expires, identity_public_key
+       created_at, last_seen, banned, ban_reason, ban_expires, identity_public_key,
+       display_name, about, custom_status
 FROM users
 ORDER BY (SELECT r.position FROM roles r WHERE r.id = users.role_id) DESC, id ASC
 `
@@ -89,6 +90,9 @@ func (q *Queries) GetOwnerUser(ctx context.Context) (User, error) {
 		&i.BanReason,
 		&i.BanExpires,
 		&i.IdentityPublicKey,
+		&i.DisplayName,
+		&i.About,
+		&i.CustomStatus,
 	)
 	return i, err
 }
diff --git a/Server/db/dbgen/blocks.sql.go b/Server/db/dbgen/blocks.sql.go
index 58e41f7e..6eac4f8d 100644
--- a/Server/db/dbgen/blocks.sql.go
+++ b/Server/db/dbgen/blocks.sql.go
@@ -92,6 +92,33 @@ func (q *Queries) ListBlockedUsers(ctx context.Context, blockerID int64) ([]int6
 	return items, nil
 }
 
+const listBlockersOfUser = `-- name: ListBlockersOfUser :many
+SELECT blocker_id FROM user_blocks WHERE blocked_id = ?
+`
+
+func (q *Queries) ListBlockersOfUser(ctx context.Context, blockedID int64) ([]int64, error) {
+	rows, err := q.db.QueryContext(ctx, listBlockersOfUser, blockedID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []int64{}
+	for rows.Next() {
+		var blocker_id int64
+		if err := rows.Scan(&blocker_id); err != nil {
+			return nil, err
+		}
+		items = append(items, blocker_id)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const unblockUser = `-- name: UnblockUser :exec
 DELETE FROM user_blocks WHERE blocker_id = ? AND blocked_id = ?
 `
diff --git a/Server/db/dbgen/channels.sql.go b/Server/db/dbgen/channels.sql.go
index 7b1e83d1..07a0a43d 100644
--- a/Server/db/dbgen/channels.sql.go
+++ b/Server/db/dbgen/channels.sql.go
@@ -12,26 +12,35 @@ import (
 
 const adminUpdateChannel = `-- name: AdminUpdateChannel :exec
 UPDATE channels
-SET name = ?, topic = ?, slow_mode = ?, position = ?, archived = ?
+SET name = ?, topic = ?, category = ?, slow_mode = ?, position = ?, archived = ?,
+    nsfw = ?, voice_max_users = ?, voice_max_video = ?
 WHERE id = ?
 `
 
 type AdminUpdateChannelParams struct {
-	Name     string  `json:"name"`
-	Topic    *string `json:"topic"`
-	SlowMode int64   `json:"slowMode"`
-	Position int64   `json:"position"`
-	Archived int64   `json:"archived"`
-	ID       int64   `json:"id"`
+	Name          string  `json:"name"`
+	Topic         *string `json:"topic"`
+	Category      *string `json:"category"`
+	SlowMode      int64   `json:"slowMode"`
+	Position      int64   `json:"position"`
+	Archived      int64   `json:"archived"`
+	Nsfw          int64   `json:"nsfw"`
+	VoiceMaxUsers int64   `json:"voiceMaxUsers"`
+	VoiceMaxVideo int64   `json:"voiceMaxVideo"`
+	ID            int64   `json:"id"`
 }
 
 func (q *Queries) AdminUpdateChannel(ctx context.Context, arg AdminUpdateChannelParams) error {
 	_, err := q.db.ExecContext(ctx, adminUpdateChannel,
 		arg.Name,
 		arg.Topic,
+		arg.Category,
 		arg.SlowMode,
 		arg.Position,
 		arg.Archived,
+		arg.Nsfw,
+		arg.VoiceMaxUsers,
+		arg.VoiceMaxVideo,
 		arg.ID,
 	)
 	return err
@@ -82,13 +91,28 @@ func (q *Queries) DeleteChannelPermission(ctx context.Context, arg DeleteChannel
 	return err
 }
 
+const deleteChannelUserPermission = `-- name: DeleteChannelUserPermission :exec
+DELETE FROM channel_user_overrides WHERE channel_id = ? AND user_id = ?
+`
+
+type DeleteChannelUserPermissionParams struct {
+	ChannelID int64 `json:"channelId"`
+	UserID    int64 `json:"userId"`
+}
+
+func (q *Queries) DeleteChannelUserPermission(ctx context.Context, arg DeleteChannelUserPermissionParams) error {
+	_, err := q.db.ExecContext(ctx, deleteChannelUserPermission, arg.ChannelID, arg.UserID)
+	return err
+}
+
 const getChannel = `-- name: GetChannel :one
 SELECT id, name, type, COALESCE(category, '') AS category, COALESCE(topic, '') AS topic,
        position, slow_mode, archived, created_at,
        COALESCE(voice_max_users, 0) AS voice_max_users,
        voice_quality,
        mixing_threshold,
-       COALESCE(voice_max_video, 0) AS voice_max_video
+       COALESCE(voice_max_video, 0) AS voice_max_video,
+       nsfw
 FROM channels WHERE id = ?
 `
 
@@ -106,6 +130,7 @@ type GetChannelRow struct {
 	VoiceQuality    *string `json:"voiceQuality"`
 	MixingThreshold *int64  `json:"mixingThreshold"`
 	VoiceMaxVideo   int64   `json:"voiceMaxVideo"`
+	Nsfw            int64   `json:"nsfw"`
 }
 
 func (q *Queries) GetChannel(ctx context.Context, id int64) (GetChannelRow, error) {
@@ -125,10 +150,44 @@ func (q *Queries) GetChannel(ctx context.Context, id int64) (GetChannelRow, erro
 		&i.VoiceQuality,
 		&i.MixingThreshold,
 		&i.VoiceMaxVideo,
+		&i.Nsfw,
 	)
 	return i, err
 }
 
+const getChannelOverrides = `-- name: GetChannelOverrides :many
+SELECT role_id, allow, deny FROM channel_overrides WHERE channel_id = ?
+`
+
+type GetChannelOverridesRow struct {
+	RoleID int64 `json:"roleId"`
+	Allow  int64 `json:"allow"`
+	Deny   int64 `json:"deny"`
+}
+
+func (q *Queries) GetChannelOverrides(ctx context.Context, channelID int64) ([]GetChannelOverridesRow, error) {
+	rows, err := q.db.QueryContext(ctx, getChannelOverrides, channelID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []GetChannelOverridesRow{}
+	for rows.Next() {
+		var i GetChannelOverridesRow
+		if err := rows.Scan(&i.RoleID, &i.Allow, &i.Deny); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const getChannelPermission = `-- name: GetChannelPermission :one
 SELECT allow, deny FROM channel_overrides WHERE channel_id = ? AND role_id = ?
 `
@@ -150,6 +209,60 @@ func (q *Queries) GetChannelPermission(ctx context.Context, arg GetChannelPermis
 	return i, err
 }
 
+const getChannelUserOverrides = `-- name: GetChannelUserOverrides :many
+SELECT user_id, allow, deny FROM channel_user_overrides WHERE channel_id = ?
+`
+
+type GetChannelUserOverridesRow struct {
+	UserID int64 `json:"userId"`
+	Allow  int64 `json:"allow"`
+	Deny   int64 `json:"deny"`
+}
+
+func (q *Queries) GetChannelUserOverrides(ctx context.Context, channelID int64) ([]GetChannelUserOverridesRow, error) {
+	rows, err := q.db.QueryContext(ctx, getChannelUserOverrides, channelID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []GetChannelUserOverridesRow{}
+	for rows.Next() {
+		var i GetChannelUserOverridesRow
+		if err := rows.Scan(&i.UserID, &i.Allow, &i.Deny); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const getChannelUserPermission = `-- name: GetChannelUserPermission :one
+SELECT allow, deny FROM channel_user_overrides WHERE channel_id = ? AND user_id = ?
+`
+
+type GetChannelUserPermissionParams struct {
+	ChannelID int64 `json:"channelId"`
+	UserID    int64 `json:"userId"`
+}
+
+type GetChannelUserPermissionRow struct {
+	Allow int64 `json:"allow"`
+	Deny  int64 `json:"deny"`
+}
+
+func (q *Queries) GetChannelUserPermission(ctx context.Context, arg GetChannelUserPermissionParams) (GetChannelUserPermissionRow, error) {
+	row := q.db.QueryRowContext(ctx, getChannelUserPermission, arg.ChannelID, arg.UserID)
+	var i GetChannelUserPermissionRow
+	err := row.Scan(&i.Allow, &i.Deny)
+	return i, err
+}
+
 const getRoleChannelPermissions = `-- name: GetRoleChannelPermissions :many
 SELECT channel_id, allow, deny FROM channel_overrides WHERE role_id = ?
 `
@@ -183,13 +296,47 @@ func (q *Queries) GetRoleChannelPermissions(ctx context.Context, roleID int64) (
 	return items, nil
 }
 
+const getUserChannelPermissions = `-- name: GetUserChannelPermissions :many
+SELECT channel_id, allow, deny FROM channel_user_overrides WHERE user_id = ?
+`
+
+type GetUserChannelPermissionsRow struct {
+	ChannelID int64 `json:"channelId"`
+	Allow     int64 `json:"allow"`
+	Deny      int64 `json:"deny"`
+}
+
+func (q *Queries) GetUserChannelPermissions(ctx context.Context, userID int64) ([]GetUserChannelPermissionsRow, error) {
+	rows, err := q.db.QueryContext(ctx, getUserChannelPermissions, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []GetUserChannelPermissionsRow{}
+	for rows.Next() {
+		var i GetUserChannelPermissionsRow
+		if err := rows.Scan(&i.ChannelID, &i.Allow, &i.Deny); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const listChannels = `-- name: ListChannels :many
 SELECT id, name, type, COALESCE(category, '') AS category, COALESCE(topic, '') AS topic,
        position, slow_mode, archived, created_at,
        COALESCE(voice_max_users, 0) AS voice_max_users,
        voice_quality,
        mixing_threshold,
-       COALESCE(voice_max_video, 0) AS voice_max_video
+       COALESCE(voice_max_video, 0) AS voice_max_video,
+       nsfw
 FROM channels ORDER BY position ASC, id ASC
 `
 
@@ -207,6 +354,7 @@ type ListChannelsRow struct {
 	VoiceQuality    *string `json:"voiceQuality"`
 	MixingThreshold *int64  `json:"mixingThreshold"`
 	VoiceMaxVideo   int64   `json:"voiceMaxVideo"`
+	Nsfw            int64   `json:"nsfw"`
 }
 
 func (q *Queries) ListChannels(ctx context.Context) ([]ListChannelsRow, error) {
@@ -232,6 +380,7 @@ func (q *Queries) ListChannels(ctx context.Context) ([]ListChannelsRow, error) {
 			&i.VoiceQuality,
 			&i.MixingThreshold,
 			&i.VoiceMaxVideo,
+			&i.Nsfw,
 		); err != nil {
 			return nil, err
 		}
@@ -319,3 +468,28 @@ func (q *Queries) UpsertChannelPermission(ctx context.Context, arg UpsertChannel
 	)
 	return err
 }
+
+const upsertChannelUserPermission = `-- name: UpsertChannelUserPermission :exec
+INSERT INTO channel_user_overrides (channel_id, user_id, allow, deny)
+VALUES (?, ?, ?, ?)
+ON CONFLICT(channel_id, user_id) DO UPDATE SET
+    allow = excluded.allow,
+    deny  = excluded.deny
+`
+
+type UpsertChannelUserPermissionParams struct {
+	ChannelID int64 `json:"channelId"`
+	UserID    int64 `json:"userId"`
+	Allow     int64 `json:"allow"`
+	Deny      int64 `json:"deny"`
+}
+
+func (q *Queries) UpsertChannelUserPermission(ctx context.Context, arg UpsertChannelUserPermissionParams) error {
+	_, err := q.db.ExecContext(ctx, upsertChannelUserPermission,
+		arg.ChannelID,
+		arg.UserID,
+		arg.Allow,
+		arg.Deny,
+	)
+	return err
+}
diff --git a/Server/db/dbgen/dm.sql.go b/Server/db/dbgen/dm.sql.go
index 3394d246..d8063da4 100644
--- a/Server/db/dbgen/dm.sql.go
+++ b/Server/db/dbgen/dm.sql.go
@@ -23,6 +23,17 @@ func (q *Queries) CloseDM(ctx context.Context, arg CloseDMParams) error {
 	return err
 }
 
+const countDMParticipants = `-- name: CountDMParticipants :one
+SELECT COUNT(*) FROM dm_participants WHERE channel_id = ?
+`
+
+func (q *Queries) CountDMParticipants(ctx context.Context, channelID int64) (int64, error) {
+	row := q.db.QueryRowContext(ctx, countDMParticipants, channelID)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
 const getDMParticipantIDs = `-- name: GetDMParticipantIDs :many
 SELECT user_id FROM dm_participants WHERE channel_id = ?
 `
@@ -50,6 +61,113 @@ func (q *Queries) GetDMParticipantIDs(ctx context.Context, channelID int64) ([]i
 	return items, nil
 }
 
+const getDMParticipants = `-- name: GetDMParticipants :many
+SELECT
+    u.id                                      AS id,
+    u.username                                AS username,
+    COALESCE(u.display_name, '')              AS display_name,
+    COALESCE(u.avatar, '')                    AS avatar,
+    u.status                                  AS status
+FROM dm_participants dp
+JOIN users u ON u.id = dp.user_id
+WHERE dp.channel_id = ?
+ORDER BY u.id ASC
+`
+
+type GetDMParticipantsRow struct {
+	ID          int64  `json:"id"`
+	Username    string `json:"username"`
+	DisplayName string `json:"displayName"`
+	Avatar      string `json:"avatar"`
+	Status      string `json:"status"`
+}
+
+func (q *Queries) GetDMParticipants(ctx context.Context, channelID int64) ([]GetDMParticipantsRow, error) {
+	rows, err := q.db.QueryContext(ctx, getDMParticipants, channelID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []GetDMParticipantsRow{}
+	for rows.Next() {
+		var i GetDMParticipantsRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.Username,
+			&i.DisplayName,
+			&i.Avatar,
+			&i.Status,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const getDMParticipantsForUser = `-- name: GetDMParticipantsForUser :many
+SELECT
+    dp.channel_id                                 AS channel_id,
+    u.id                                          AS id,
+    u.username                                    AS username,
+    COALESCE(u.display_name, '')                  AS display_name,
+    COALESCE(u.avatar, '')                        AS avatar,
+    u.status                                      AS status
+FROM dm_open_state dos
+JOIN dm_participants dp ON dp.channel_id = dos.channel_id
+JOIN users u            ON u.id = dp.user_id
+WHERE dos.user_id = ?
+ORDER BY dp.channel_id ASC, u.id ASC
+`
+
+type GetDMParticipantsForUserRow struct {
+	ChannelID   int64  `json:"channelId"`
+	ID          int64  `json:"id"`
+	Username    string `json:"username"`
+	DisplayName string `json:"displayName"`
+	Avatar      string `json:"avatar"`
+	Status      string `json:"status"`
+}
+
+// Every participant of every DM the user has open, in one pass. Includes the
+// user themselves so a caller can tell "group of three" from "group of three
+// others"; the Go layer filters when it needs the others.
+func (q *Queries) GetDMParticipantsForUser(ctx context.Context, userID int64) ([]GetDMParticipantsForUserRow, error) {
+	rows, err := q.db.QueryContext(ctx, getDMParticipantsForUser, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []GetDMParticipantsForUserRow{}
+	for rows.Next() {
+		var i GetDMParticipantsForUserRow
+		if err := rows.Scan(
+			&i.ChannelID,
+			&i.ID,
+			&i.Username,
+			&i.DisplayName,
+			&i.Avatar,
+			&i.Status,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const getUserDMChannelIDs = `-- name: GetUserDMChannelIDs :many
 SELECT channel_id FROM dm_open_state WHERE user_id = ?
 `
@@ -80,10 +198,8 @@ func (q *Queries) GetUserDMChannelIDs(ctx context.Context, userID int64) ([]int6
 const getUserDMChannels = `-- name: GetUserDMChannels :many
 SELECT
     c.id                                          AS channel_id,
-    u.id                                          AS recipient_id,
-    u.username                                    AS recipient_username,
-    COALESCE(u.avatar, '')                        AS recipient_avatar,
-    u.status                                      AS recipient_status,
+    c.name                                        AS name,
+    c.is_group                                    AS is_group,
     lm.id                                         AS last_message_id,
     COALESCE(lm.content, '')                      AS last_message,
     COALESCE(lm.timestamp, '')                    AS last_message_at,
@@ -94,8 +210,6 @@ SELECT
     ) AS unread_count
 FROM dm_open_state dos
 JOIN channels c          ON c.id = dos.channel_id AND c.type = 'dm'
-JOIN dm_participants dp  ON dp.channel_id = c.id AND dp.user_id != ?
-JOIN users u             ON u.id = dp.user_id
 LEFT JOIN messages lm    ON lm.id = (
     SELECT MAX(id) FROM messages WHERE channel_id = c.id AND deleted = 0
 )
@@ -103,25 +217,22 @@ WHERE dos.user_id = ?
 ORDER BY COALESCE(lm.timestamp, dos.opened_at) DESC
 `
 
-type GetUserDMChannelsParams struct {
-	UserID   int64 `json:"userId"`
-	UserID_2 int64 `json:"userId2"`
-}
-
 type GetUserDMChannelsRow struct {
-	ChannelID         int64  `json:"channelId"`
-	RecipientID       int64  `json:"recipientId"`
-	RecipientUsername string `json:"recipientUsername"`
-	RecipientAvatar   string `json:"recipientAvatar"`
-	RecipientStatus   string `json:"recipientStatus"`
-	LastMessageID     *int64 `json:"lastMessageId"`
-	LastMessage       string `json:"lastMessage"`
-	LastMessageAt     string `json:"lastMessageAt"`
-	UnreadCount       int64  `json:"unreadCount"`
+	ChannelID     int64  `json:"channelId"`
+	Name          string `json:"name"`
+	IsGroup       int64  `json:"isGroup"`
+	LastMessageID *int64 `json:"lastMessageId"`
+	LastMessage   string `json:"lastMessage"`
+	LastMessageAt string `json:"lastMessageAt"`
+	UnreadCount   int64  `json:"unreadCount"`
 }
 
-func (q *Queries) GetUserDMChannels(ctx context.Context, arg GetUserDMChannelsParams) ([]GetUserDMChannelsRow, error) {
-	rows, err := q.db.QueryContext(ctx, getUserDMChannels, arg.UserID, arg.UserID_2)
+// A DM row carries no recipient any more: dm_participants holds N users, so
+// "the other one" is only well defined for a two-person DM. The participant
+// set comes from GetDMParticipantsForUser below, one extra query for the whole
+// list rather than one per channel, and the Go layer stitches them together.
+func (q *Queries) GetUserDMChannels(ctx context.Context, userID int64) ([]GetUserDMChannelsRow, error) {
+	rows, err := q.db.QueryContext(ctx, getUserDMChannels, userID)
 	if err != nil {
 		return nil, err
 	}
@@ -131,10 +242,8 @@ func (q *Queries) GetUserDMChannels(ctx context.Context, arg GetUserDMChannelsPa
 		var i GetUserDMChannelsRow
 		if err := rows.Scan(
 			&i.ChannelID,
-			&i.RecipientID,
-			&i.RecipientUsername,
-			&i.RecipientAvatar,
-			&i.RecipientStatus,
+			&i.Name,
+			&i.IsGroup,
 			&i.LastMessageID,
 			&i.LastMessage,
 			&i.LastMessageAt,
@@ -169,6 +278,17 @@ func (q *Queries) IsDMParticipant(ctx context.Context, arg IsDMParticipantParams
 	return user_id, err
 }
 
+const isGroupDM = `-- name: IsGroupDM :one
+SELECT is_group FROM channels WHERE id = ? AND type = 'dm'
+`
+
+func (q *Queries) IsGroupDM(ctx context.Context, id int64) (int64, error) {
+	row := q.db.QueryRowContext(ctx, isGroupDM, id)
+	var is_group int64
+	err := row.Scan(&is_group)
+	return is_group, err
+}
+
 const openDM = `-- name: OpenDM :exec
 INSERT OR IGNORE INTO dm_open_state (user_id, channel_id) VALUES (?, ?)
 `
@@ -182,3 +302,31 @@ func (q *Queries) OpenDM(ctx context.Context, arg OpenDMParams) error {
 	_, err := q.db.ExecContext(ctx, openDM, arg.UserID, arg.ChannelID)
 	return err
 }
+
+const removeDMParticipant = `-- name: RemoveDMParticipant :exec
+DELETE FROM dm_participants WHERE channel_id = ? AND user_id = ?
+`
+
+type RemoveDMParticipantParams struct {
+	ChannelID int64 `json:"channelId"`
+	UserID    int64 `json:"userId"`
+}
+
+func (q *Queries) RemoveDMParticipant(ctx context.Context, arg RemoveDMParticipantParams) error {
+	_, err := q.db.ExecContext(ctx, removeDMParticipant, arg.ChannelID, arg.UserID)
+	return err
+}
+
+const setDMChannelName = `-- name: SetDMChannelName :exec
+UPDATE channels SET name = ? WHERE id = ? AND type = 'dm'
+`
+
+type SetDMChannelNameParams struct {
+	Name string `json:"name"`
+	ID   int64  `json:"id"`
+}
+
+func (q *Queries) SetDMChannelName(ctx context.Context, arg SetDMChannelNameParams) error {
+	_, err := q.db.ExecContext(ctx, setDMChannelName, arg.Name, arg.ID)
+	return err
+}
diff --git a/Server/db/dbgen/emoji.sql.go b/Server/db/dbgen/emoji.sql.go
new file mode 100644
index 00000000..375ab3c2
--- /dev/null
+++ b/Server/db/dbgen/emoji.sql.go
@@ -0,0 +1,160 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.30.0
+// source: emoji.sql
+
+package dbgen
+
+import (
+	"context"
+	"database/sql"
+)
+
+const createEmoji = `-- name: CreateEmoji :one
+INSERT INTO emoji (shortcode, filename, mime_type, uploaded_by)
+VALUES (?, ?, ?, ?)
+RETURNING id, shortcode, filename, mime_type, uploaded_by, created_at
+`
+
+type CreateEmojiParams struct {
+	Shortcode  string `json:"shortcode"`
+	Filename   string `json:"filename"`
+	MimeType   string `json:"mimeType"`
+	UploadedBy int64  `json:"uploadedBy"`
+}
+
+type CreateEmojiRow struct {
+	ID         int64  `json:"id"`
+	Shortcode  string `json:"shortcode"`
+	Filename   string `json:"filename"`
+	MimeType   string `json:"mimeType"`
+	UploadedBy int64  `json:"uploadedBy"`
+	CreatedAt  string `json:"createdAt"`
+}
+
+func (q *Queries) CreateEmoji(ctx context.Context, arg CreateEmojiParams) (CreateEmojiRow, error) {
+	row := q.db.QueryRowContext(ctx, createEmoji,
+		arg.Shortcode,
+		arg.Filename,
+		arg.MimeType,
+		arg.UploadedBy,
+	)
+	var i CreateEmojiRow
+	err := row.Scan(
+		&i.ID,
+		&i.Shortcode,
+		&i.Filename,
+		&i.MimeType,
+		&i.UploadedBy,
+		&i.CreatedAt,
+	)
+	return i, err
+}
+
+const deleteEmoji = `-- name: DeleteEmoji :execresult
+DELETE FROM emoji WHERE id = ?
+`
+
+func (q *Queries) DeleteEmoji(ctx context.Context, id int64) (sql.Result, error) {
+	return q.db.ExecContext(ctx, deleteEmoji, id)
+}
+
+const getEmojiByID = `-- name: GetEmojiByID :one
+SELECT id, shortcode, filename, mime_type, uploaded_by, created_at
+FROM emoji WHERE id = ?
+`
+
+type GetEmojiByIDRow struct {
+	ID         int64  `json:"id"`
+	Shortcode  string `json:"shortcode"`
+	Filename   string `json:"filename"`
+	MimeType   string `json:"mimeType"`
+	UploadedBy int64  `json:"uploadedBy"`
+	CreatedAt  string `json:"createdAt"`
+}
+
+func (q *Queries) GetEmojiByID(ctx context.Context, id int64) (GetEmojiByIDRow, error) {
+	row := q.db.QueryRowContext(ctx, getEmojiByID, id)
+	var i GetEmojiByIDRow
+	err := row.Scan(
+		&i.ID,
+		&i.Shortcode,
+		&i.Filename,
+		&i.MimeType,
+		&i.UploadedBy,
+		&i.CreatedAt,
+	)
+	return i, err
+}
+
+const getEmojiByShortcode = `-- name: GetEmojiByShortcode :one
+SELECT id, shortcode, filename, mime_type, uploaded_by, created_at
+FROM emoji WHERE shortcode = ?
+`
+
+type GetEmojiByShortcodeRow struct {
+	ID         int64  `json:"id"`
+	Shortcode  string `json:"shortcode"`
+	Filename   string `json:"filename"`
+	MimeType   string `json:"mimeType"`
+	UploadedBy int64  `json:"uploadedBy"`
+	CreatedAt  string `json:"createdAt"`
+}
+
+func (q *Queries) GetEmojiByShortcode(ctx context.Context, shortcode string) (GetEmojiByShortcodeRow, error) {
+	row := q.db.QueryRowContext(ctx, getEmojiByShortcode, shortcode)
+	var i GetEmojiByShortcodeRow
+	err := row.Scan(
+		&i.ID,
+		&i.Shortcode,
+		&i.Filename,
+		&i.MimeType,
+		&i.UploadedBy,
+		&i.CreatedAt,
+	)
+	return i, err
+}
+
+const listEmoji = `-- name: ListEmoji :many
+SELECT id, shortcode, filename, mime_type, uploaded_by, created_at
+FROM emoji ORDER BY shortcode ASC
+`
+
+type ListEmojiRow struct {
+	ID         int64  `json:"id"`
+	Shortcode  string `json:"shortcode"`
+	Filename   string `json:"filename"`
+	MimeType   string `json:"mimeType"`
+	UploadedBy int64  `json:"uploadedBy"`
+	CreatedAt  string `json:"createdAt"`
+}
+
+func (q *Queries) ListEmoji(ctx context.Context) ([]ListEmojiRow, error) {
+	rows, err := q.db.QueryContext(ctx, listEmoji)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListEmojiRow{}
+	for rows.Next() {
+		var i ListEmojiRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.Shortcode,
+			&i.Filename,
+			&i.MimeType,
+			&i.UploadedBy,
+			&i.CreatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
diff --git a/Server/db/dbgen/messages.sql.go b/Server/db/dbgen/messages.sql.go
index 9ad36dd1..9495fb1b 100644
--- a/Server/db/dbgen/messages.sql.go
+++ b/Server/db/dbgen/messages.sql.go
@@ -12,7 +12,8 @@ import (
 
 const createMessage = `-- name: CreateMessage :one
 INSERT INTO messages (channel_id, user_id, content, reply_to) VALUES (?, ?, ?, ?)
-RETURNING id, channel_id, user_id, content, reply_to, edited_at, deleted, pinned, timestamp
+RETURNING id, channel_id, user_id, content, reply_to, edited_at, deleted, pinned, timestamp,
+          mentions_everyone
 `
 
 type CreateMessageParams struct {
@@ -40,13 +41,15 @@ func (q *Queries) CreateMessage(ctx context.Context, arg CreateMessageParams) (M
 		&i.Deleted,
 		&i.Pinned,
 		&i.Timestamp,
+		&i.MentionsEveryone,
 	)
 	return i, err
 }
 
 const editMessageContent = `-- name: EditMessageContent :one
 UPDATE messages SET content = ?, edited_at = datetime('now') WHERE id = ?
-RETURNING id, channel_id, user_id, content, reply_to, edited_at, deleted, pinned, timestamp
+RETURNING id, channel_id, user_id, content, reply_to, edited_at, deleted, pinned, timestamp,
+          mentions_everyone
 `
 
 type EditMessageContentParams struct {
@@ -67,6 +70,7 @@ func (q *Queries) EditMessageContent(ctx context.Context, arg EditMessageContent
 		&i.Deleted,
 		&i.Pinned,
 		&i.Timestamp,
+		&i.MentionsEveryone,
 	)
 	return i, err
 }
@@ -78,19 +82,30 @@ SELECT c.id,
        (SELECT COUNT(*) FROM messages m
          WHERE m.channel_id = c.id AND m.deleted = 0
            AND m.id > COALESCE((SELECT rs.last_message_id FROM read_states rs
-                                 WHERE rs.channel_id = c.id AND rs.user_id = ?), 0)) AS unread
+                                 WHERE rs.channel_id = c.id AND rs.user_id = ?), 0)) AS unread,
+       COALESCE((SELECT rs.mention_count FROM read_states rs
+                  WHERE rs.channel_id = c.id AND rs.user_id = ?), 0) AS mentions
 FROM channels c
 WHERE c.type IN ('text', 'announcement')
+   OR (c.type = 'dm' AND EXISTS (SELECT 1 FROM dm_participants dp
+                                  WHERE dp.channel_id = c.id AND dp.user_id = ?))
 `
 
+type GetChannelUnreadCountsParams struct {
+	UserID   int64 `json:"userId"`
+	UserID_2 int64 `json:"userId2"`
+	UserID_3 int64 `json:"userId3"`
+}
+
 type GetChannelUnreadCountsRow struct {
 	ID        int64       `json:"id"`
 	LastMsgID interface{} `json:"lastMsgId"`
 	Unread    int64       `json:"unread"`
+	Mentions  interface{} `json:"mentions"`
 }
 
-func (q *Queries) GetChannelUnreadCounts(ctx context.Context, userID int64) ([]GetChannelUnreadCountsRow, error) {
-	rows, err := q.db.QueryContext(ctx, getChannelUnreadCounts, userID)
+func (q *Queries) GetChannelUnreadCounts(ctx context.Context, arg GetChannelUnreadCountsParams) ([]GetChannelUnreadCountsRow, error) {
+	rows, err := q.db.QueryContext(ctx, getChannelUnreadCounts, arg.UserID, arg.UserID_2, arg.UserID_3)
 	if err != nil {
 		return nil, err
 	}
@@ -98,7 +113,12 @@ func (q *Queries) GetChannelUnreadCounts(ctx context.Context, userID int64) ([]G
 	items := []GetChannelUnreadCountsRow{}
 	for rows.Next() {
 		var i GetChannelUnreadCountsRow
-		if err := rows.Scan(&i.ID, &i.LastMsgID, &i.Unread); err != nil {
+		if err := rows.Scan(
+			&i.ID,
+			&i.LastMsgID,
+			&i.Unread,
+			&i.Mentions,
+		); err != nil {
 			return nil, err
 		}
 		items = append(items, i)
@@ -124,7 +144,8 @@ func (q *Queries) GetLatestMessageID(ctx context.Context, channelID int64) (inte
 }
 
 const getMessage = `-- name: GetMessage :one
-SELECT id, channel_id, user_id, content, reply_to, edited_at, deleted, pinned, timestamp
+SELECT id, channel_id, user_id, content, reply_to, edited_at, deleted, pinned, timestamp,
+       mentions_everyone
 FROM messages WHERE id = ?
 `
 
@@ -141,6 +162,7 @@ func (q *Queries) GetMessage(ctx context.Context, id int64) (Message, error) {
 		&i.Deleted,
 		&i.Pinned,
 		&i.Timestamp,
+		&i.MentionsEveryone,
 	)
 	return i, err
 }
@@ -230,9 +252,11 @@ func (q *Queries) SoftDeleteMessage(ctx context.Context, id int64) error {
 }
 
 const updateReadState = `-- name: UpdateReadState :exec
-INSERT INTO read_states (user_id, channel_id, last_message_id)
-VALUES (?, ?, ?)
-ON CONFLICT(user_id, channel_id) DO UPDATE SET last_message_id = excluded.last_message_id
+INSERT INTO read_states (user_id, channel_id, last_message_id, mention_count)
+VALUES (?, ?, ?, 0)
+ON CONFLICT(user_id, channel_id) DO UPDATE SET
+    last_message_id = excluded.last_message_id,
+    mention_count = 0
 `
 
 type UpdateReadStateParams struct {
@@ -241,6 +265,8 @@ type UpdateReadStateParams struct {
 	LastMessageID int64 `json:"lastMessageId"`
 }
 
+// Marking a channel read also clears its mention badge: channel_focus is the
+// only caller, and a focused channel has no outstanding mentions by definition.
 func (q *Queries) UpdateReadState(ctx context.Context, arg UpdateReadStateParams) error {
 	_, err := q.db.ExecContext(ctx, updateReadState, arg.UserID, arg.ChannelID, arg.LastMessageID)
 	return err
diff --git a/Server/db/dbgen/models.go b/Server/db/dbgen/models.go
index 88799c5d..608c8535 100644
--- a/Server/db/dbgen/models.go
+++ b/Server/db/dbgen/models.go
@@ -56,6 +56,8 @@ type Channel struct {
 	VoiceQuality    *string `json:"voiceQuality"`
 	MixingThreshold *int64  `json:"mixingThreshold"`
 	VoiceMaxVideo   int64   `json:"voiceMaxVideo"`
+	Nsfw            int64   `json:"nsfw"`
+	IsGroup         int64   `json:"isGroup"`
 }
 
 type ChannelOverride struct {
@@ -66,6 +68,13 @@ type ChannelOverride struct {
 	Deny      int64 `json:"deny"`
 }
 
+type ChannelUserOverride struct {
+	ChannelID int64 `json:"channelId"`
+	UserID    int64 `json:"userId"`
+	Allow     int64 `json:"allow"`
+	Deny      int64 `json:"deny"`
+}
+
 type DmOpenState struct {
 	UserID    int64  `json:"userId"`
 	ChannelID int64  `json:"channelId"`
@@ -83,6 +92,7 @@ type Emoji struct {
 	Filename   string `json:"filename"`
 	UploadedBy int64  `json:"uploadedBy"`
 	CreatedAt  string `json:"createdAt"`
+	MimeType   string `json:"mimeType"`
 }
 
 type Event struct {
@@ -114,15 +124,21 @@ type LoginAttempt struct {
 }
 
 type Message struct {
-	ID        int64   `json:"id"`
-	ChannelID int64   `json:"channelId"`
-	UserID    int64   `json:"userId"`
-	Content   string  `json:"content"`
-	ReplyTo   *int64  `json:"replyTo"`
-	EditedAt  *string `json:"editedAt"`
-	Deleted   int64   `json:"deleted"`
-	Pinned    int64   `json:"pinned"`
-	Timestamp string  `json:"timestamp"`
+	ID               int64   `json:"id"`
+	ChannelID        int64   `json:"channelId"`
+	UserID           int64   `json:"userId"`
+	Content          string  `json:"content"`
+	ReplyTo          *int64  `json:"replyTo"`
+	EditedAt         *string `json:"editedAt"`
+	Deleted          int64   `json:"deleted"`
+	Pinned           int64   `json:"pinned"`
+	Timestamp        string  `json:"timestamp"`
+	MentionsEveryone int64   `json:"mentionsEveryone"`
+}
+
+type MessageMention struct {
+	MessageID       int64 `json:"messageId"`
+	MentionedUserID int64 `json:"mentionedUserId"`
 }
 
 type MessagesFt struct {
@@ -211,6 +227,9 @@ type User struct {
 	BanReason         *string `json:"banReason"`
 	BanExpires        *string `json:"banExpires"`
 	IdentityPublicKey *string `json:"identityPublicKey"`
+	DisplayName       *string `json:"displayName"`
+	About             *string `json:"about"`
+	CustomStatus      *string `json:"customStatus"`
 }
 
 type UserBlock struct {
@@ -220,12 +239,14 @@ type UserBlock struct {
 }
 
 type VoiceState struct {
-	UserID      int64  `json:"userId"`
-	ChannelID   int64  `json:"channelId"`
-	Muted       int64  `json:"muted"`
-	Deafened    int64  `json:"deafened"`
-	Speaking    int64  `json:"speaking"`
-	JoinedAt    string `json:"joinedAt"`
-	Camera      int64  `json:"camera"`
-	Screenshare int64  `json:"screenshare"`
+	UserID         int64  `json:"userId"`
+	ChannelID      int64  `json:"channelId"`
+	Muted          int64  `json:"muted"`
+	Deafened       int64  `json:"deafened"`
+	Speaking       int64  `json:"speaking"`
+	JoinedAt       string `json:"joinedAt"`
+	Camera         int64  `json:"camera"`
+	Screenshare    int64  `json:"screenshare"`
+	ServerMuted    int64  `json:"serverMuted"`
+	ServerDeafened int64  `json:"serverDeafened"`
 }
diff --git a/Server/db/dbgen/profile.sql.go b/Server/db/dbgen/profile.sql.go
index a993396c..4770c378 100644
--- a/Server/db/dbgen/profile.sql.go
+++ b/Server/db/dbgen/profile.sql.go
@@ -10,6 +10,37 @@ import (
 	"database/sql"
 )
 
+const countUsersWithAvatar = `-- name: CountUsersWithAvatar :one
+SELECT COUNT(*) FROM users WHERE avatar = ?
+`
+
+// Authorization probe for the file route: an unlinked attachment is readable by
+// everyone exactly while some user's avatar points at it. Covered by the
+// partial index on users(avatar) added in migration 027.
+func (q *Queries) CountUsersWithAvatar(ctx context.Context, avatar *string) (int64, error) {
+	row := q.db.QueryRowContext(ctx, countUsersWithAvatar, avatar)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const updateUserCustomStatus = `-- name: UpdateUserCustomStatus :exec
+UPDATE users SET custom_status = ? WHERE id = ?
+`
+
+type UpdateUserCustomStatusParams struct {
+	CustomStatus *string `json:"customStatus"`
+	ID           int64   `json:"id"`
+}
+
+// Separate from UpdateUserProfile because a custom status arrives over the
+// WebSocket presence path, not the REST profile PATCH, and must not be able to
+// clobber the username/avatar of a profile edit racing it.
+func (q *Queries) UpdateUserCustomStatus(ctx context.Context, arg UpdateUserCustomStatusParams) error {
+	_, err := q.db.ExecContext(ctx, updateUserCustomStatus, arg.CustomStatus, arg.ID)
+	return err
+}
+
 const updateUserPassword = `-- name: UpdateUserPassword :exec
 UPDATE users SET password = ? WHERE id = ?
 `
@@ -25,15 +56,25 @@ func (q *Queries) UpdateUserPassword(ctx context.Context, arg UpdateUserPassword
 }
 
 const updateUserProfile = `-- name: UpdateUserProfile :execresult
-UPDATE users SET username = ?, avatar = ? WHERE id = ?
+UPDATE users
+SET username = ?, avatar = ?, display_name = ?, about = ?
+WHERE id = ?
 `
 
 type UpdateUserProfileParams struct {
-	Username string  `json:"username"`
-	Avatar   *string `json:"avatar"`
-	ID       int64   `json:"id"`
+	Username    string  `json:"username"`
+	Avatar      *string `json:"avatar"`
+	DisplayName *string `json:"displayName"`
+	About       *string `json:"about"`
+	ID          int64   `json:"id"`
 }
 
 func (q *Queries) UpdateUserProfile(ctx context.Context, arg UpdateUserProfileParams) (sql.Result, error) {
-	return q.db.ExecContext(ctx, updateUserProfile, arg.Username, arg.Avatar, arg.ID)
+	return q.db.ExecContext(ctx, updateUserProfile,
+		arg.Username,
+		arg.Avatar,
+		arg.DisplayName,
+		arg.About,
+		arg.ID,
+	)
 }
diff --git a/Server/db/dbgen/querier.go b/Server/db/dbgen/querier.go
index 00e25015..de3f3b26 100644
--- a/Server/db/dbgen/querier.go
+++ b/Server/db/dbgen/querier.go
@@ -13,30 +13,45 @@ import (
 type Querier interface {
 	AddReaction(ctx context.Context, arg AddReactionParams) error
 	AdminUpdateChannel(ctx context.Context, arg AdminUpdateChannelParams) error
+	ApplyVoiceServerDeafen(ctx context.Context, userID int64) error
+	ApplyVoiceServerMute(ctx context.Context, userID int64) error
 	BanUser(ctx context.Context, arg BanUserParams) error
 	BlockUser(ctx context.Context, arg BlockUserParams) error
 	CleanupExpiredLockouts(ctx context.Context, expiresAt string) error
 	ClearAllVoiceStates(ctx context.Context) error
+	ClearVoiceServerDeafen(ctx context.Context, userID int64) error
+	ClearVoiceServerMute(ctx context.Context, userID int64) error
 	ClearVoiceState(ctx context.Context, userID int64) error
 	CloseDM(ctx context.Context, arg CloseDMParams) error
 	CountActiveCameras(ctx context.Context, channelID int64) (int64, error)
 	CountActiveInvites(ctx context.Context) (int64, error)
 	CountActiveMessages(ctx context.Context) (int64, error)
 	CountChannels(ctx context.Context) (int64, error)
+	CountDMParticipants(ctx context.Context, channelID int64) (int64, error)
+	CountRoleMembers(ctx context.Context) ([]CountRoleMembersRow, error)
 	CountUsers(ctx context.Context) (int64, error)
+	// Authorization probe for the file route: an unlinked attachment is readable by
+	// everyone exactly while some user's avatar points at it. Covered by the
+	// partial index on users(avatar) added in migration 027.
+	CountUsersWithAvatar(ctx context.Context, avatar *string) (int64, error)
 	CountUsersWithoutTOTP(ctx context.Context) (int64, error)
 	CreateAPIToken(ctx context.Context, arg CreateAPITokenParams) (sql.Result, error)
 	CreateAttachment(ctx context.Context, arg CreateAttachmentParams) error
 	CreateChannel(ctx context.Context, arg CreateChannelParams) (sql.Result, error)
+	CreateEmoji(ctx context.Context, arg CreateEmojiParams) (CreateEmojiRow, error)
 	CreateInvite(ctx context.Context, arg CreateInviteParams) error
 	CreateMessage(ctx context.Context, arg CreateMessageParams) (Message, error)
+	CreateRole(ctx context.Context, arg CreateRoleParams) (Role, error)
 	CreateUser(ctx context.Context, arg CreateUserParams) (sql.Result, error)
 	DeleteChannel(ctx context.Context, id int64) error
 	DeleteChannelPermission(ctx context.Context, arg DeleteChannelPermissionParams) error
+	DeleteChannelUserPermission(ctx context.Context, arg DeleteChannelUserPermissionParams) error
+	DeleteEmoji(ctx context.Context, id int64) (sql.Result, error)
 	DeleteExpiredSessions(ctx context.Context) error
 	DeleteLockout(ctx context.Context, key string) error
 	DeleteOrphanedAttachments(ctx context.Context, uploadedAt string) ([]string, error)
 	DeleteOtherSessions(ctx context.Context, arg DeleteOtherSessionsParams) (sql.Result, error)
+	DeleteRole(ctx context.Context, id int64) error
 	DeleteSessionByID(ctx context.Context, arg DeleteSessionByIDParams) (sql.Result, error)
 	DeleteSessionByToken(ctx context.Context, token string) error
 	DisablePlugin(ctx context.Context, id int64) error
@@ -55,10 +70,23 @@ type Querier interface {
 	GetAttachmentWithChannel(ctx context.Context, id string) (GetAttachmentWithChannelRow, error)
 	GetAuditLog(ctx context.Context, arg GetAuditLogParams) ([]GetAuditLogRow, error)
 	GetChannel(ctx context.Context, id int64) (GetChannelRow, error)
+	GetChannelOverrides(ctx context.Context, channelID int64) ([]GetChannelOverridesRow, error)
 	GetChannelPermission(ctx context.Context, arg GetChannelPermissionParams) (GetChannelPermissionRow, error)
-	GetChannelUnreadCounts(ctx context.Context, userID int64) ([]GetChannelUnreadCountsRow, error)
+	GetChannelUnreadCounts(ctx context.Context, arg GetChannelUnreadCountsParams) ([]GetChannelUnreadCountsRow, error)
+	GetChannelUserOverrides(ctx context.Context, channelID int64) ([]GetChannelUserOverridesRow, error)
+	GetChannelUserPermission(ctx context.Context, arg GetChannelUserPermissionParams) (GetChannelUserPermissionRow, error)
 	GetChannelVoiceStates(ctx context.Context, channelID int64) ([]GetChannelVoiceStatesRow, error)
 	GetDMParticipantIDs(ctx context.Context, channelID int64) ([]int64, error)
+	GetDMParticipants(ctx context.Context, channelID int64) ([]GetDMParticipantsRow, error)
+	// Every participant of every DM the user has open, in one pass. Includes the
+	// user themselves so a caller can tell "group of three" from "group of three
+	// others"; the Go layer filters when it needs the others.
+	GetDMParticipantsForUser(ctx context.Context, userID int64) ([]GetDMParticipantsForUserRow, error)
+	// The fallback role every member lands on when their role is deleted. Highest
+	// position wins if a database somehow carries more than one default.
+	GetDefaultRole(ctx context.Context) (Role, error)
+	GetEmojiByID(ctx context.Context, id int64) (GetEmojiByIDRow, error)
+	GetEmojiByShortcode(ctx context.Context, shortcode string) (GetEmojiByShortcodeRow, error)
 	GetEventsSince(ctx context.Context, arg GetEventsSinceParams) ([]GetEventsSinceRow, error)
 	GetInvite(ctx context.Context, code string) (GetInviteRow, error)
 	GetLatestMessageID(ctx context.Context, channelID int64) (interface{}, error)
@@ -74,7 +102,13 @@ type Querier interface {
 	// highest-position role first, so that first row is the owner.
 	GetOwnerUser(ctx context.Context) (User, error)
 	GetReactionCounts(ctx context.Context, messageID int64) ([]GetReactionCountsRow, error)
+	// Reactors for one (message, emoji) pair, oldest reaction first. The reactions
+	// table has no timestamp column, so the autoincrement id carries the order.
+	GetReactionUsers(ctx context.Context, arg GetReactionUsersParams) ([]GetReactionUsersRow, error)
 	GetRoleByID(ctx context.Context, id int64) (Role, error)
+	// Case-insensitive by design: migration 023 enforces uniqueness under the same
+	// collation, so this is the lookup that agrees with the constraint.
+	GetRoleByName(ctx context.Context, name string) (Role, error)
 	GetRoleChannelPermissions(ctx context.Context, roleID int64) ([]GetRoleChannelPermissionsRow, error)
 	GetRoleForUser(ctx context.Context, id int64) (Role, error)
 	GetSessionByTokenHash(ctx context.Context, token string) (Session, error)
@@ -82,8 +116,13 @@ type Querier interface {
 	GetSetting(ctx context.Context, key string) (string, error)
 	GetUserByID(ctx context.Context, id int64) (User, error)
 	GetUserByUsername(ctx context.Context, username string) (User, error)
+	GetUserChannelPermissions(ctx context.Context, userID int64) ([]GetUserChannelPermissionsRow, error)
 	GetUserDMChannelIDs(ctx context.Context, userID int64) ([]int64, error)
-	GetUserDMChannels(ctx context.Context, arg GetUserDMChannelsParams) ([]GetUserDMChannelsRow, error)
+	// A DM row carries no recipient any more: dm_participants holds N users, so
+	// "the other one" is only well defined for a two-person DM. The participant
+	// set comes from GetDMParticipantsForUser below, one extra query for the whole
+	// list rather than one per channel, and the Go layer stitches them together.
+	GetUserDMChannels(ctx context.Context, userID int64) ([]GetUserDMChannelsRow, error)
 	GetUserSessions(ctx context.Context, userID int64) ([]Session, error)
 	GetUserVoiceState(ctx context.Context, userID int64) (GetUserVoiceStateRow, error)
 	GetUserWithRole(ctx context.Context, id int64) (GetUserWithRoleRow, error)
@@ -92,6 +131,11 @@ type Querier interface {
 	IsBlocked(ctx context.Context, arg IsBlockedParams) (int64, error)
 	IsDMParticipant(ctx context.Context, arg IsDMParticipantParams) (int64, error)
 	IsEitherBlocked(ctx context.Context, arg IsEitherBlockedParams) (int64, error)
+	IsGroupDM(ctx context.Context, id int64) (int64, error)
+	// server_muted / server_deafened are deliberately absent from both upserts'
+	// reset lists: a moderator-imposed mute must survive a channel switch, which
+	// reaches the ON CONFLICT branch. It is scoped to the voice session:
+	// leaving voice deletes the row, so a rejoin starts clean.
 	JoinVoiceChannel(ctx context.Context, arg JoinVoiceChannelParams) error
 	JoinVoiceChannelIfCapacity(ctx context.Context, arg JoinVoiceChannelIfCapacityParams) (sql.Result, error)
 	LeaveVoiceChannel(ctx context.Context, userID int64) error
@@ -101,14 +145,31 @@ type Querier interface {
 	ListAPITokens(ctx context.Context) ([]ListAPITokensRow, error)
 	ListAllUsers(ctx context.Context, arg ListAllUsersParams) ([]ListAllUsersRow, error)
 	ListBlockedUsers(ctx context.Context, blockerID int64) ([]int64, error)
+	ListBlockersOfUser(ctx context.Context, blockedID int64) ([]int64, error)
 	ListChannels(ctx context.Context) ([]ListChannelsRow, error)
+	ListEmoji(ctx context.Context) ([]ListEmojiRow, error)
 	ListInvites(ctx context.Context) ([]ListInvitesRow, error)
 	ListMembers(ctx context.Context) ([]ListMembersRow, error)
 	ListPlugins(ctx context.Context) ([]Plugin, error)
+	// Highest rank first. Positions are only "unique enough": reorder normalizes
+	// them, but creating a role inserts just below the actor and may tie with an
+	// existing role, so id is a tiebreaker. Without it SQLite may return tied rows
+	// in any order, and the admin panel derives its reorder payload from this
+	// order, so a single move-up would silently shuffle the tied roles.
+	// NOTE: keep comments in this file ASCII-only. sqlc mixes byte and rune
+	// offsets when stripping them, so a non-ASCII character here truncates the
+	// generated SQL of THIS and every following query by the byte/rune delta.
 	ListRoles(ctx context.Context) ([]Role, error)
+	ListUserIDsByRole(ctx context.Context, roleID int64) ([]int64, error)
 	ListUserSessions(ctx context.Context, userID int64) ([]Session, error)
 	LoadActiveLockouts(ctx context.Context, expiresAt string) ([]RateLockout, error)
 	LogAudit(ctx context.Context, arg LogAuditParams) error
+	// Disconnect bookkeeping. It clears only 'online', which is the one status
+	// that means "has a live session"; idle, dnd and invisible are choices the
+	// user made and are what the next connect reads instead of stamping online
+	// (db.ConnectStatus). A stale choice never renders as "present" because the
+	// read path treats a member with no live connection as offline regardless.
+	MarkUserDisconnected(ctx context.Context, id int64) error
 	OpenDM(ctx context.Context, arg OpenDMParams) error
 	// seq is supplied by the hub so the row seq matches the wrapped-payload seq.
 	PersistEvent(ctx context.Context, arg PersistEventParams) error
@@ -116,14 +177,20 @@ type Querier interface {
 	PluginKVGet(ctx context.Context, arg PluginKVGetParams) ([]byte, error)
 	PluginKVSet(ctx context.Context, arg PluginKVSetParams) error
 	PruneEventsOlderThan(ctx context.Context, createdAt time.Time) (int64, error)
+	RemoveDMParticipant(ctx context.Context, arg RemoveDMParticipantParams) error
 	RemoveReaction(ctx context.Context, arg RemoveReactionParams) (sql.Result, error)
+	// Startup reset: nothing is connected yet, so every 'online' is a leftover
+	// from the previous process. Chosen statuses survive for the same reason they
+	// survive a disconnect.
 	ResetAllUserStatuses(ctx context.Context) error
 	RevokeAPIToken(ctx context.Context, id int64) (sql.Result, error)
 	RevokeAPITokenByLabel(ctx context.Context, label string) (sql.Result, error)
 	RevokeInvite(ctx context.Context, code string) error
 	SetChannelSlowMode(ctx context.Context, arg SetChannelSlowModeParams) error
 	SetChannelVoiceMaxUsers(ctx context.Context, arg SetChannelVoiceMaxUsersParams) error
+	SetDMChannelName(ctx context.Context, arg SetDMChannelNameParams) error
 	SetMessagePinned(ctx context.Context, arg SetMessagePinnedParams) (sql.Result, error)
+	SetRolePosition(ctx context.Context, arg SetRolePositionParams) error
 	SetSetting(ctx context.Context, arg SetSettingParams) error
 	SoftDeleteMessage(ctx context.Context, id int64) error
 	TouchAPIToken(ctx context.Context, tokenHash string) error
@@ -132,7 +199,14 @@ type Querier interface {
 	UnblockUser(ctx context.Context, arg UnblockUserParams) error
 	UninstallPlugin(ctx context.Context, id int64) error
 	UpdateChannel(ctx context.Context, arg UpdateChannelParams) error
+	// Marking a channel read also clears its mention badge: channel_focus is the
+	// only caller, and a focused channel has no outstanding mentions by definition.
 	UpdateReadState(ctx context.Context, arg UpdateReadStateParams) error
+	UpdateRole(ctx context.Context, arg UpdateRoleParams) error
+	// Separate from UpdateUserProfile because a custom status arrives over the
+	// WebSocket presence path, not the REST profile PATCH, and must not be able to
+	// clobber the username/avatar of a profile edit racing it.
+	UpdateUserCustomStatus(ctx context.Context, arg UpdateUserCustomStatusParams) error
 	UpdateUserIdentityKey(ctx context.Context, arg UpdateUserIdentityKeyParams) error
 	UpdateUserPassword(ctx context.Context, arg UpdateUserPasswordParams) error
 	UpdateUserProfile(ctx context.Context, arg UpdateUserProfileParams) (sql.Result, error)
@@ -144,6 +218,7 @@ type Querier interface {
 	UpdateVoiceMute(ctx context.Context, arg UpdateVoiceMuteParams) error
 	UpdateVoiceScreenshare(ctx context.Context, arg UpdateVoiceScreenshareParams) error
 	UpsertChannelPermission(ctx context.Context, arg UpsertChannelPermissionParams) error
+	UpsertChannelUserPermission(ctx context.Context, arg UpsertChannelUserPermissionParams) error
 	UpsertLockout(ctx context.Context, arg UpsertLockoutParams) error
 	UseInviteAtomic(ctx context.Context, code string) (sql.Result, error)
 	UserCount(ctx context.Context) (int64, error)
diff --git a/Server/db/dbgen/reactions.sql.go b/Server/db/dbgen/reactions.sql.go
index 92daf3b8..ee01840e 100644
--- a/Server/db/dbgen/reactions.sql.go
+++ b/Server/db/dbgen/reactions.sql.go
@@ -59,6 +59,52 @@ func (q *Queries) GetReactionCounts(ctx context.Context, messageID int64) ([]Get
 	return items, nil
 }
 
+const getReactionUsers = `-- name: GetReactionUsers :many
+SELECT u.id, u.username, COALESCE(u.avatar, '') AS avatar
+FROM reactions r
+JOIN users u ON u.id = r.user_id
+WHERE r.message_id = ? AND r.emoji = ?
+ORDER BY r.id
+LIMIT ?
+`
+
+type GetReactionUsersParams struct {
+	MessageID int64  `json:"messageId"`
+	Emoji     string `json:"emoji"`
+	Limit     int64  `json:"limit"`
+}
+
+type GetReactionUsersRow struct {
+	ID       int64  `json:"id"`
+	Username string `json:"username"`
+	Avatar   string `json:"avatar"`
+}
+
+// Reactors for one (message, emoji) pair, oldest reaction first. The reactions
+// table has no timestamp column, so the autoincrement id carries the order.
+func (q *Queries) GetReactionUsers(ctx context.Context, arg GetReactionUsersParams) ([]GetReactionUsersRow, error) {
+	rows, err := q.db.QueryContext(ctx, getReactionUsers, arg.MessageID, arg.Emoji, arg.Limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []GetReactionUsersRow{}
+	for rows.Next() {
+		var i GetReactionUsersRow
+		if err := rows.Scan(&i.ID, &i.Username, &i.Avatar); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const removeReaction = `-- name: RemoveReaction :execresult
 DELETE FROM reactions WHERE message_id = ? AND user_id = ? AND emoji = ?
 `
diff --git a/Server/db/dbgen/roles.sql.go b/Server/db/dbgen/roles.sql.go
index f615c782..47dcce7d 100644
--- a/Server/db/dbgen/roles.sql.go
+++ b/Server/db/dbgen/roles.sql.go
@@ -9,6 +9,100 @@ import (
 	"context"
 )
 
+const countRoleMembers = `-- name: CountRoleMembers :many
+SELECT role_id, COUNT(*) AS member_count FROM users GROUP BY role_id
+`
+
+type CountRoleMembersRow struct {
+	RoleID      int64 `json:"roleId"`
+	MemberCount int64 `json:"memberCount"`
+}
+
+func (q *Queries) CountRoleMembers(ctx context.Context) ([]CountRoleMembersRow, error) {
+	rows, err := q.db.QueryContext(ctx, countRoleMembers)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []CountRoleMembersRow{}
+	for rows.Next() {
+		var i CountRoleMembersRow
+		if err := rows.Scan(&i.RoleID, &i.MemberCount); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const createRole = `-- name: CreateRole :one
+INSERT INTO roles (name, color, permissions, position, is_default)
+VALUES (?, ?, ?, ?, 0)
+RETURNING id, name, color, permissions, position, is_default
+`
+
+type CreateRoleParams struct {
+	Name        string  `json:"name"`
+	Color       *string `json:"color"`
+	Permissions int64   `json:"permissions"`
+	Position    int64   `json:"position"`
+}
+
+func (q *Queries) CreateRole(ctx context.Context, arg CreateRoleParams) (Role, error) {
+	row := q.db.QueryRowContext(ctx, createRole,
+		arg.Name,
+		arg.Color,
+		arg.Permissions,
+		arg.Position,
+	)
+	var i Role
+	err := row.Scan(
+		&i.ID,
+		&i.Name,
+		&i.Color,
+		&i.Permissions,
+		&i.Position,
+		&i.IsDefault,
+	)
+	return i, err
+}
+
+const deleteRole = `-- name: DeleteRole :exec
+DELETE FROM roles WHERE id = ?
+`
+
+func (q *Queries) DeleteRole(ctx context.Context, id int64) error {
+	_, err := q.db.ExecContext(ctx, deleteRole, id)
+	return err
+}
+
+const getDefaultRole = `-- name: GetDefaultRole :one
+SELECT id, name, color, permissions, position, is_default
+FROM roles WHERE is_default = 1 ORDER BY position DESC, id ASC LIMIT 1
+`
+
+// The fallback role every member lands on when their role is deleted. Highest
+// position wins if a database somehow carries more than one default.
+func (q *Queries) GetDefaultRole(ctx context.Context) (Role, error) {
+	row := q.db.QueryRowContext(ctx, getDefaultRole)
+	var i Role
+	err := row.Scan(
+		&i.ID,
+		&i.Name,
+		&i.Color,
+		&i.Permissions,
+		&i.Position,
+		&i.IsDefault,
+	)
+	return i, err
+}
+
 const getRoleByID = `-- name: GetRoleByID :one
 SELECT id, name, color, permissions, position, is_default
 FROM roles WHERE id = ?
@@ -28,6 +122,27 @@ func (q *Queries) GetRoleByID(ctx context.Context, id int64) (Role, error) {
 	return i, err
 }
 
+const getRoleByName = `-- name: GetRoleByName :one
+SELECT id, name, color, permissions, position, is_default
+FROM roles WHERE name = ? COLLATE NOCASE
+`
+
+// Case-insensitive by design: migration 023 enforces uniqueness under the same
+// collation, so this is the lookup that agrees with the constraint.
+func (q *Queries) GetRoleByName(ctx context.Context, name string) (Role, error) {
+	row := q.db.QueryRowContext(ctx, getRoleByName, name)
+	var i Role
+	err := row.Scan(
+		&i.ID,
+		&i.Name,
+		&i.Color,
+		&i.Permissions,
+		&i.Position,
+		&i.IsDefault,
+	)
+	return i, err
+}
+
 const getRoleForUser = `-- name: GetRoleForUser :one
 SELECT r.id, r.name, r.color, r.permissions, r.position, r.is_default
 FROM users u
@@ -108,9 +223,17 @@ func (q *Queries) GetUserWithRole(ctx context.Context, id int64) (GetUserWithRol
 
 const listRoles = `-- name: ListRoles :many
 SELECT id, name, color, permissions, position, is_default
-FROM roles ORDER BY position DESC
+FROM roles ORDER BY position DESC, id ASC
 `
 
+// Highest rank first. Positions are only "unique enough": reorder normalizes
+// them, but creating a role inserts just below the actor and may tie with an
+// existing role, so id is a tiebreaker. Without it SQLite may return tied rows
+// in any order, and the admin panel derives its reorder payload from this
+// order, so a single move-up would silently shuffle the tied roles.
+// NOTE: keep comments in this file ASCII-only. sqlc mixes byte and rune
+// offsets when stripping them, so a non-ASCII character here truncates the
+// generated SQL of THIS and every following query by the byte/rune delta.
 func (q *Queries) ListRoles(ctx context.Context) ([]Role, error) {
 	rows, err := q.db.QueryContext(ctx, listRoles)
 	if err != nil {
@@ -140,3 +263,67 @@ func (q *Queries) ListRoles(ctx context.Context) ([]Role, error) {
 	}
 	return items, nil
 }
+
+const listUserIDsByRole = `-- name: ListUserIDsByRole :many
+SELECT id FROM users WHERE role_id = ?
+`
+
+func (q *Queries) ListUserIDsByRole(ctx context.Context, roleID int64) ([]int64, error) {
+	rows, err := q.db.QueryContext(ctx, listUserIDsByRole, roleID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []int64{}
+	for rows.Next() {
+		var id int64
+		if err := rows.Scan(&id); err != nil {
+			return nil, err
+		}
+		items = append(items, id)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const setRolePosition = `-- name: SetRolePosition :exec
+UPDATE roles SET position = ? WHERE id = ?
+`
+
+type SetRolePositionParams struct {
+	Position int64 `json:"position"`
+	ID       int64 `json:"id"`
+}
+
+func (q *Queries) SetRolePosition(ctx context.Context, arg SetRolePositionParams) error {
+	_, err := q.db.ExecContext(ctx, setRolePosition, arg.Position, arg.ID)
+	return err
+}
+
+const updateRole = `-- name: UpdateRole :exec
+UPDATE roles SET name = ?, color = ?, permissions = ?, position = ? WHERE id = ?
+`
+
+type UpdateRoleParams struct {
+	Name        string  `json:"name"`
+	Color       *string `json:"color"`
+	Permissions int64   `json:"permissions"`
+	Position    int64   `json:"position"`
+	ID          int64   `json:"id"`
+}
+
+func (q *Queries) UpdateRole(ctx context.Context, arg UpdateRoleParams) error {
+	_, err := q.db.ExecContext(ctx, updateRole,
+		arg.Name,
+		arg.Color,
+		arg.Permissions,
+		arg.Position,
+		arg.ID,
+	)
+	return err
+}
diff --git a/Server/db/dbgen/users.sql.go b/Server/db/dbgen/users.sql.go
index a54c95ce..d351bdd0 100644
--- a/Server/db/dbgen/users.sql.go
+++ b/Server/db/dbgen/users.sql.go
@@ -63,7 +63,8 @@ func (q *Queries) CreateUser(ctx context.Context, arg CreateUserParams) (sql.Res
 
 const getUserByID = `-- name: GetUserByID :one
 SELECT id, username, password, avatar, role_id, totp_secret, status,
-       created_at, last_seen, banned, ban_reason, ban_expires, identity_public_key
+       created_at, last_seen, banned, ban_reason, ban_expires, identity_public_key,
+       display_name, about, custom_status
 FROM users WHERE id = ?
 `
 
@@ -84,13 +85,17 @@ func (q *Queries) GetUserByID(ctx context.Context, id int64) (User, error) {
 		&i.BanReason,
 		&i.BanExpires,
 		&i.IdentityPublicKey,
+		&i.DisplayName,
+		&i.About,
+		&i.CustomStatus,
 	)
 	return i, err
 }
 
 const getUserByUsername = `-- name: GetUserByUsername :one
 SELECT id, username, password, avatar, role_id, totp_secret, status,
-       created_at, last_seen, banned, ban_reason, ban_expires, identity_public_key
+       created_at, last_seen, banned, ban_reason, ban_expires, identity_public_key,
+       display_name, about, custom_status
 FROM users WHERE username = ? COLLATE NOCASE
 `
 
@@ -111,12 +116,16 @@ func (q *Queries) GetUserByUsername(ctx context.Context, username string) (User,
 		&i.BanReason,
 		&i.BanExpires,
 		&i.IdentityPublicKey,
+		&i.DisplayName,
+		&i.About,
+		&i.CustomStatus,
 	)
 	return i, err
 }
 
 const listMembers = `-- name: ListMembers :many
-SELECT u.id, u.username, u.avatar, u.status, LOWER(r.name), u.identity_public_key
+SELECT u.id, u.username, u.avatar, u.status, LOWER(r.name), u.identity_public_key,
+       u.display_name, u.custom_status
 FROM users u
 JOIN roles r ON u.role_id = r.id
 WHERE u.banned = 0
@@ -131,6 +140,8 @@ type ListMembersRow struct {
 	Status            string  `json:"status"`
 	Lower             string  `json:"lower"`
 	IdentityPublicKey *string `json:"identityPublicKey"`
+	DisplayName       *string `json:"displayName"`
+	CustomStatus      *string `json:"customStatus"`
 }
 
 func (q *Queries) ListMembers(ctx context.Context) ([]ListMembersRow, error) {
@@ -149,6 +160,8 @@ func (q *Queries) ListMembers(ctx context.Context) ([]ListMembersRow, error) {
 			&i.Status,
 			&i.Lower,
 			&i.IdentityPublicKey,
+			&i.DisplayName,
+			&i.CustomStatus,
 		); err != nil {
 			return nil, err
 		}
@@ -163,10 +176,30 @@ func (q *Queries) ListMembers(ctx context.Context) ([]ListMembersRow, error) {
 	return items, nil
 }
 
-const resetAllUserStatuses = `-- name: ResetAllUserStatuses :exec
-UPDATE users SET status = 'offline' WHERE status != 'offline'
+const markUserDisconnected = `-- name: MarkUserDisconnected :exec
+UPDATE users
+SET status = CASE WHEN status = 'online' THEN 'offline' ELSE status END,
+    last_seen = datetime('now')
+WHERE id = ?
 `
 
+// Disconnect bookkeeping. It clears only 'online', which is the one status
+// that means "has a live session"; idle, dnd and invisible are choices the
+// user made and are what the next connect reads instead of stamping online
+// (db.ConnectStatus). A stale choice never renders as "present" because the
+// read path treats a member with no live connection as offline regardless.
+func (q *Queries) MarkUserDisconnected(ctx context.Context, id int64) error {
+	_, err := q.db.ExecContext(ctx, markUserDisconnected, id)
+	return err
+}
+
+const resetAllUserStatuses = `-- name: ResetAllUserStatuses :exec
+UPDATE users SET status = 'offline' WHERE status = 'online'
+`
+
+// Startup reset: nothing is connected yet, so every 'online' is a leftover
+// from the previous process. Chosen statuses survive for the same reason they
+// survive a disconnect.
 func (q *Queries) ResetAllUserStatuses(ctx context.Context) error {
 	_, err := q.db.ExecContext(ctx, resetAllUserStatuses)
 	return err
diff --git a/Server/db/dbgen/voice.sql.go b/Server/db/dbgen/voice.sql.go
index 4db305ab..bd334081 100644
--- a/Server/db/dbgen/voice.sql.go
+++ b/Server/db/dbgen/voice.sql.go
@@ -10,6 +10,24 @@ import (
 	"database/sql"
 )
 
+const applyVoiceServerDeafen = `-- name: ApplyVoiceServerDeafen :exec
+UPDATE voice_states SET server_deafened = 1, deafened = 1 WHERE user_id = ?
+`
+
+func (q *Queries) ApplyVoiceServerDeafen(ctx context.Context, userID int64) error {
+	_, err := q.db.ExecContext(ctx, applyVoiceServerDeafen, userID)
+	return err
+}
+
+const applyVoiceServerMute = `-- name: ApplyVoiceServerMute :exec
+UPDATE voice_states SET server_muted = 1, muted = 1 WHERE user_id = ?
+`
+
+func (q *Queries) ApplyVoiceServerMute(ctx context.Context, userID int64) error {
+	_, err := q.db.ExecContext(ctx, applyVoiceServerMute, userID)
+	return err
+}
+
 const clearAllVoiceStates = `-- name: ClearAllVoiceStates :exec
 DELETE FROM voice_states
 `
@@ -19,6 +37,24 @@ func (q *Queries) ClearAllVoiceStates(ctx context.Context) error {
 	return err
 }
 
+const clearVoiceServerDeafen = `-- name: ClearVoiceServerDeafen :exec
+UPDATE voice_states SET server_deafened = 0 WHERE user_id = ?
+`
+
+func (q *Queries) ClearVoiceServerDeafen(ctx context.Context, userID int64) error {
+	_, err := q.db.ExecContext(ctx, clearVoiceServerDeafen, userID)
+	return err
+}
+
+const clearVoiceServerMute = `-- name: ClearVoiceServerMute :exec
+UPDATE voice_states SET server_muted = 0 WHERE user_id = ?
+`
+
+func (q *Queries) ClearVoiceServerMute(ctx context.Context, userID int64) error {
+	_, err := q.db.ExecContext(ctx, clearVoiceServerMute, userID)
+	return err
+}
+
 const clearVoiceState = `-- name: ClearVoiceState :exec
 DELETE FROM voice_states WHERE user_id = ?
 `
@@ -64,22 +100,25 @@ func (q *Queries) EnableCameraIfUnderLimit(ctx context.Context, arg EnableCamera
 const getAllVoiceStates = `-- name: GetAllVoiceStates :many
 SELECT vs.user_id, vs.channel_id, u.username,
        vs.muted, vs.deafened, vs.speaking,
-       vs.camera, vs.screenshare, vs.joined_at
+       vs.camera, vs.screenshare,
+       vs.server_muted, vs.server_deafened, vs.joined_at
 FROM voice_states vs
 JOIN users u ON u.id = vs.user_id
 ORDER BY vs.channel_id, vs.joined_at ASC
 `
 
 type GetAllVoiceStatesRow struct {
-	UserID      int64  `json:"userId"`
-	ChannelID   int64  `json:"channelId"`
-	Username    string `json:"username"`
-	Muted       int64  `json:"muted"`
-	Deafened    int64  `json:"deafened"`
-	Speaking    int64  `json:"speaking"`
-	Camera      int64  `json:"camera"`
-	Screenshare int64  `json:"screenshare"`
-	JoinedAt    string `json:"joinedAt"`
+	UserID         int64  `json:"userId"`
+	ChannelID      int64  `json:"channelId"`
+	Username       string `json:"username"`
+	Muted          int64  `json:"muted"`
+	Deafened       int64  `json:"deafened"`
+	Speaking       int64  `json:"speaking"`
+	Camera         int64  `json:"camera"`
+	Screenshare    int64  `json:"screenshare"`
+	ServerMuted    int64  `json:"serverMuted"`
+	ServerDeafened int64  `json:"serverDeafened"`
+	JoinedAt       string `json:"joinedAt"`
 }
 
 func (q *Queries) GetAllVoiceStates(ctx context.Context) ([]GetAllVoiceStatesRow, error) {
@@ -100,6 +139,8 @@ func (q *Queries) GetAllVoiceStates(ctx context.Context) ([]GetAllVoiceStatesRow
 			&i.Speaking,
 			&i.Camera,
 			&i.Screenshare,
+			&i.ServerMuted,
+			&i.ServerDeafened,
 			&i.JoinedAt,
 		); err != nil {
 			return nil, err
@@ -118,7 +159,8 @@ func (q *Queries) GetAllVoiceStates(ctx context.Context) ([]GetAllVoiceStatesRow
 const getChannelVoiceStates = `-- name: GetChannelVoiceStates :many
 SELECT vs.user_id, vs.channel_id, u.username,
        vs.muted, vs.deafened, vs.speaking,
-       vs.camera, vs.screenshare, vs.joined_at
+       vs.camera, vs.screenshare,
+       vs.server_muted, vs.server_deafened, vs.joined_at
 FROM voice_states vs
 JOIN users u ON u.id = vs.user_id
 WHERE vs.channel_id = ?
@@ -126,15 +168,17 @@ ORDER BY vs.joined_at ASC
 `
 
 type GetChannelVoiceStatesRow struct {
-	UserID      int64  `json:"userId"`
-	ChannelID   int64  `json:"channelId"`
-	Username    string `json:"username"`
-	Muted       int64  `json:"muted"`
-	Deafened    int64  `json:"deafened"`
-	Speaking    int64  `json:"speaking"`
-	Camera      int64  `json:"camera"`
-	Screenshare int64  `json:"screenshare"`
-	JoinedAt    string `json:"joinedAt"`
+	UserID         int64  `json:"userId"`
+	ChannelID      int64  `json:"channelId"`
+	Username       string `json:"username"`
+	Muted          int64  `json:"muted"`
+	Deafened       int64  `json:"deafened"`
+	Speaking       int64  `json:"speaking"`
+	Camera         int64  `json:"camera"`
+	Screenshare    int64  `json:"screenshare"`
+	ServerMuted    int64  `json:"serverMuted"`
+	ServerDeafened int64  `json:"serverDeafened"`
+	JoinedAt       string `json:"joinedAt"`
 }
 
 func (q *Queries) GetChannelVoiceStates(ctx context.Context, channelID int64) ([]GetChannelVoiceStatesRow, error) {
@@ -155,6 +199,8 @@ func (q *Queries) GetChannelVoiceStates(ctx context.Context, channelID int64) ([
 			&i.Speaking,
 			&i.Camera,
 			&i.Screenshare,
+			&i.ServerMuted,
+			&i.ServerDeafened,
 			&i.JoinedAt,
 		); err != nil {
 			return nil, err
@@ -173,22 +219,25 @@ func (q *Queries) GetChannelVoiceStates(ctx context.Context, channelID int64) ([
 const getUserVoiceState = `-- name: GetUserVoiceState :one
 SELECT vs.user_id, vs.channel_id, u.username,
        vs.muted, vs.deafened, vs.speaking,
-       vs.camera, vs.screenshare, vs.joined_at
+       vs.camera, vs.screenshare,
+       vs.server_muted, vs.server_deafened, vs.joined_at
 FROM voice_states vs
 JOIN users u ON u.id = vs.user_id
 WHERE vs.user_id = ?
 `
 
 type GetUserVoiceStateRow struct {
-	UserID      int64  `json:"userId"`
-	ChannelID   int64  `json:"channelId"`
-	Username    string `json:"username"`
-	Muted       int64  `json:"muted"`
-	Deafened    int64  `json:"deafened"`
-	Speaking    int64  `json:"speaking"`
-	Camera      int64  `json:"camera"`
-	Screenshare int64  `json:"screenshare"`
-	JoinedAt    string `json:"joinedAt"`
+	UserID         int64  `json:"userId"`
+	ChannelID      int64  `json:"channelId"`
+	Username       string `json:"username"`
+	Muted          int64  `json:"muted"`
+	Deafened       int64  `json:"deafened"`
+	Speaking       int64  `json:"speaking"`
+	Camera         int64  `json:"camera"`
+	Screenshare    int64  `json:"screenshare"`
+	ServerMuted    int64  `json:"serverMuted"`
+	ServerDeafened int64  `json:"serverDeafened"`
+	JoinedAt       string `json:"joinedAt"`
 }
 
 func (q *Queries) GetUserVoiceState(ctx context.Context, userID int64) (GetUserVoiceStateRow, error) {
@@ -203,12 +252,15 @@ func (q *Queries) GetUserVoiceState(ctx context.Context, userID int64) (GetUserV
 		&i.Speaking,
 		&i.Camera,
 		&i.Screenshare,
+		&i.ServerMuted,
+		&i.ServerDeafened,
 		&i.JoinedAt,
 	)
 	return i, err
 }
 
 const joinVoiceChannel = `-- name: JoinVoiceChannel :exec
+
 INSERT INTO voice_states (user_id, channel_id, muted, deafened, speaking, camera, screenshare, joined_at)
 VALUES (?, ?, 0, 0, 0, 0, 0, ?)
 ON CONFLICT(user_id) DO UPDATE SET
@@ -227,6 +279,10 @@ type JoinVoiceChannelParams struct {
 	JoinedAt  string `json:"joinedAt"`
 }
 
+// server_muted / server_deafened are deliberately absent from both upserts'
+// reset lists: a moderator-imposed mute must survive a channel switch, which
+// reaches the ON CONFLICT branch. It is scoped to the voice session:
+// leaving voice deletes the row, so a rejoin starts clean.
 func (q *Queries) JoinVoiceChannel(ctx context.Context, arg JoinVoiceChannelParams) error {
 	_, err := q.db.ExecContext(ctx, joinVoiceChannel, arg.UserID, arg.ChannelID, arg.JoinedAt)
 	return err
diff --git a/Server/db/dm_group_queries_test.go b/Server/db/dm_group_queries_test.go
new file mode 100644
index 00000000..0fa656c4
--- /dev/null
+++ b/Server/db/dm_group_queries_test.go
@@ -0,0 +1,214 @@
+package db_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/owncord/server/db"
+)
+
+// groupDMFixture returns a migrated database with three users (ids 1..3).
+func groupDMFixture(t *testing.T) *db.DB {
+	t.Helper()
+	database := openMigratedMemory(t)
+	for i, name := range []string{"ga", "gb", "gc"} {
+		if got := seedUser(t, database, name); got != int64(i+1) {
+			t.Fatalf("seedUser %s: expected id %d, got %d", name, i+1, got)
+		}
+	}
+	return database
+}
+
+func TestCreateGroupDMChannel_OpensForEveryone(t *testing.T) {
+	database := groupDMFixture(t)
+	ctx := context.Background()
+
+	ch, err := database.CreateGroupDMChannel(ctx, "Crew", []int64{1, 2, 3})
+	if err != nil {
+		t.Fatalf("CreateGroupDMChannel: %v", err)
+	}
+	if ch.Name != "Crew" {
+		t.Errorf("expected name Crew, got %q", ch.Name)
+	}
+
+	isGroup, err := database.IsGroupDM(ctx, ch.ID)
+	if err != nil || !isGroup {
+		t.Errorf("expected is_group=true, got %v (err=%v)", isGroup, err)
+	}
+
+	for _, uid := range []int64{1, 2, 3} {
+		dms, listErr := database.GetUserDMChannels(ctx, uid)
+		if listErr != nil {
+			t.Fatalf("GetUserDMChannels(%d): %v", uid, listErr)
+		}
+		if len(dms) != 1 {
+			t.Fatalf("user %d: expected 1 open DM, got %d", uid, len(dms))
+		}
+		if !dms[0].IsGroup || dms[0].Name != "Crew" {
+			t.Errorf("user %d: expected the group, got %+v", uid, dms[0])
+		}
+		if len(dms[0].Recipients) != 2 {
+			t.Errorf("user %d: expected 2 others, got %d", uid, len(dms[0].Recipients))
+		}
+		for _, r := range dms[0].Recipients {
+			if r.ID == uid {
+				t.Errorf("user %d appears in their own recipients list", uid)
+			}
+		}
+	}
+}
+
+func TestCreateGroupDMChannel_RefusesUnderThree(t *testing.T) {
+	database := groupDMFixture(t)
+	if _, err := database.CreateGroupDMChannel(context.Background(), "", []int64{1, 2}); err == nil {
+		t.Fatal("expected an error creating a 2-person group DM")
+	}
+}
+
+// The 1:1 lookup must never return a group DM, even one whose membership has
+// shrunk to exactly the two users being looked up.
+func TestGetOrCreateDMChannel_IgnoresShrunkGroup(t *testing.T) {
+	database := groupDMFixture(t)
+	ctx := context.Background()
+
+	group, err := database.CreateGroupDMChannel(ctx, "Shrinking", []int64{1, 2, 3})
+	if err != nil {
+		t.Fatalf("CreateGroupDMChannel: %v", err)
+	}
+	if _, err = database.LeaveGroupDM(ctx, 3, group.ID); err != nil {
+		t.Fatalf("LeaveGroupDM: %v", err)
+	}
+
+	ch, created, err := database.GetOrCreateDMChannel(ctx, 1, 2)
+	if err != nil {
+		t.Fatalf("GetOrCreateDMChannel: %v", err)
+	}
+	if !created {
+		t.Error("expected a brand-new 1:1 DM, not a reused channel")
+	}
+	if ch.ID == group.ID {
+		t.Fatal("the 1:1 lookup returned the shrunk group DM")
+	}
+}
+
+func TestLeaveGroupDM_DeletesChannelOnLastLeave(t *testing.T) {
+	database := groupDMFixture(t)
+	ctx := context.Background()
+
+	group, err := database.CreateGroupDMChannel(ctx, "Ephemeral", []int64{1, 2, 3})
+	if err != nil {
+		t.Fatalf("CreateGroupDMChannel: %v", err)
+	}
+
+	for i, uid := range []int64{1, 2, 3} {
+		deleted, leaveErr := database.LeaveGroupDM(ctx, uid, group.ID)
+		if leaveErr != nil {
+			t.Fatalf("LeaveGroupDM(%d): %v", uid, leaveErr)
+		}
+		wantDeleted := i == 2
+		if deleted != wantDeleted {
+			t.Errorf("leave %d: deleted=%v, want %v", uid, deleted, wantDeleted)
+		}
+	}
+
+	ch, err := database.GetChannel(ctx, group.ID)
+	if err != nil {
+		t.Fatalf("GetChannel: %v", err)
+	}
+	if ch != nil {
+		t.Error("channel survived the last participant leaving")
+	}
+}
+
+func TestSetDMChannelName_RefusesNonDM(t *testing.T) {
+	database := groupDMFixture(t)
+	ctx := context.Background()
+
+	textID, err := database.CreateChannel(ctx, "general", "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+	if err := database.SetDMChannelName(ctx, textID, "hijacked"); err != nil {
+		t.Fatalf("SetDMChannelName: %v", err)
+	}
+
+	ch, err := database.GetChannel(ctx, textID)
+	if err != nil {
+		t.Fatalf("GetChannel: %v", err)
+	}
+	if ch.Name != "general" {
+		t.Errorf("a text channel was renamed through the DM route: %q", ch.Name)
+	}
+}
+
+// An invisible participant must read as offline to everyone but themselves,
+// on the DM list exactly as everywhere else.
+func TestGetDMParticipants_CollapsesInvisible(t *testing.T) {
+	database := groupDMFixture(t)
+	ctx := context.Background()
+
+	group, err := database.CreateGroupDMChannel(ctx, "Ghosts", []int64{1, 2, 3})
+	if err != nil {
+		t.Fatalf("CreateGroupDMChannel: %v", err)
+	}
+	if err := database.UpdateUserStatus(ctx, 2, db.StatusInvisible); err != nil {
+		t.Fatalf("UpdateUserStatus: %v", err)
+	}
+
+	others, err := database.GetDMParticipants(ctx, group.ID, 1)
+	if err != nil {
+		t.Fatalf("GetDMParticipants: %v", err)
+	}
+	for _, p := range others {
+		if p.ID == 2 && p.Status != db.StatusOffline {
+			t.Errorf("invisible user leaked as %q to another participant", p.Status)
+		}
+	}
+
+	self, err := database.GetDMParticipants(ctx, group.ID, 2)
+	if err != nil {
+		t.Fatalf("GetDMParticipants: %v", err)
+	}
+	for _, p := range self {
+		if p.ID == 2 && p.Status != db.StatusInvisible {
+			t.Errorf("the owner of an invisible status sees %q, want invisible", p.Status)
+		}
+	}
+}
+
+func TestNewDMChannelInfo_ExcludesViewerAndPicksRecipient(t *testing.T) {
+	participants := []db.DMUser{
+		{ID: 1, Username: "a"},
+		{ID: 2, Username: "b"},
+		{ID: 3, Username: "c"},
+	}
+	info := db.NewDMChannelInfo(7, "Trio", true, participants, 2)
+
+	if info.ChannelID != 7 || info.Name != "Trio" || !info.IsGroup {
+		t.Errorf("unexpected header fields: %+v", info)
+	}
+	if len(info.Recipients) != 2 {
+		t.Fatalf("expected 2 recipients, got %d", len(info.Recipients))
+	}
+	for _, r := range info.Recipients {
+		if r.ID == 2 {
+			t.Error("the viewer is in their own recipients list")
+		}
+	}
+	// Backward compat: a pre-group client reads `recipient` alone.
+	if info.Recipient.ID != 1 {
+		t.Errorf("expected the first other participant as the compat recipient, got %d", info.Recipient.ID)
+	}
+}
+
+// A DM with no other participants (the moment before the row is cleaned up)
+// must produce an empty list, not a nil one — clients iterate it directly.
+func TestNewDMChannelInfo_EmptyRecipientsIsNotNil(t *testing.T) {
+	info := db.NewDMChannelInfo(9, "", false, []db.DMUser{{ID: 5}}, 5)
+	if info.Recipients == nil {
+		t.Fatal("recipients must be an empty slice, not nil")
+	}
+	if len(info.Recipients) != 0 {
+		t.Errorf("expected no recipients, got %d", len(info.Recipients))
+	}
+}
diff --git a/Server/db/dm_queries.go b/Server/db/dm_queries.go
index a92c73d4..4e02f940 100644
--- a/Server/db/dm_queries.go
+++ b/Server/db/dm_queries.go
@@ -11,14 +11,37 @@ import (
 
 // ─── DM Models ──────────────────────────────────────────────────────────────
 
+// MaxGroupDMParticipants is the total participant ceiling for a group DM,
+// creator included. Discord's is 10; matching it keeps the fan-out per message
+// bounded and keeps a "group DM" from becoming an unmoderated guild.
+const MaxGroupDMParticipants = 10
+
 // DMChannelInfo holds a DM channel summary for the channel list.
 type DMChannelInfo struct {
-	ChannelID     int64  `json:"channel_id"`
-	Recipient     DMUser `json:"recipient"`
+	ChannelID int64 `json:"channel_id"`
+	// Recipient is the OTHER participant of a two-person DM. It is retained
+	// for backward compatibility with clients that predate group DMs and is
+	// only meaningful when IsGroup is false; for a group it carries the
+	// lowest-id other participant so such a client still renders something.
+	Recipient DMUser `json:"recipient"`
+	// Recipients is every participant except the viewer. This is the field
+	// group-aware clients read; for a 1:1 DM it holds exactly Recipient.
+	Recipients []DMUser `json:"recipients"`
+	// Name is the optional group name (channels.name). Always "" for a 1:1 DM
+	// — a two-person DM is named by who is in it, not by a title.
+	Name string `json:"name"`
+	// IsGroup is channels.is_group: decided once when the DM is created and
+	// never recomputed from the live participant count, so a group that people
+	// have left stays a group (see migration 028).
+	IsGroup       bool   `json:"is_group"`
 	LastMessageID *int64 `json:"last_message_id"`
 	LastMessage   string `json:"last_message"`
 	LastMessageAt string `json:"last_message_at"`
 	UnreadCount   int    `json:"unread_count"`
+	// MentionCount is read_states.mention_count for this DM. It is not part of
+	// the GetUserDMChannels query — buildReady fills it from the unread map so
+	// a DM mention badge survives a reconnect.
+	MentionCount int `json:"mention_count"`
 }
 
 // DMUser is the public-facing shape for a DM participant.
@@ -27,6 +50,37 @@ type DMUser struct {
 	Username string `json:"username"`
 	Avatar   string `json:"avatar"`
 	Status   string `json:"status"`
+	// DisplayName is the participant's chosen nickname, "" when unset. Clients
+	// fall back to Username, exactly as they do everywhere else.
+	DisplayName string `json:"display_name"`
+}
+
+// NewDMChannelInfo assembles the payload shape for one DM from its channel id,
+// optional group name, group flag and full participant list (the viewer
+// included), as seen by viewerID.
+//
+// It is the single place that answers "which of these is the recipient", so
+// the REST list, the ready payload and the dm_channel_open event cannot
+// disagree about a channel — a disagreement that would show up as a DM whose
+// name changes depending on which event drew it.
+func NewDMChannelInfo(channelID int64, name string, isGroup bool, participants []DMUser, viewerID int64) DMChannelInfo {
+	others := make([]DMUser, 0, len(participants))
+	for i := range participants {
+		if participants[i].ID == viewerID {
+			continue
+		}
+		others = append(others, participants[i])
+	}
+	info := DMChannelInfo{
+		ChannelID:  channelID,
+		Recipients: others,
+		Name:       name,
+		IsGroup:    isGroup,
+	}
+	if len(others) > 0 {
+		info.Recipient = others[0]
+	}
+	return info
 }
 
 // ─── GetOrCreateDMChannel ───────────────────────────────────────────────────
@@ -45,12 +99,19 @@ func (d *DB) GetOrCreateDMChannel(ctx context.Context, user1ID, user2ID int64) (
 	}
 
 	// Check for an existing DM channel inside the transaction.
+	//
+	// The is_group clause is what keeps group DMs out of this lookup. Without
+	// it a group that happens to contain both users matches the join, and
+	// "message Bob" would silently drop the message into a five-person group.
+	// It is the stored flag rather than a live participant count because a
+	// group people have left can have exactly two members and must still not
+	// answer "the DM between these two".
 	var existingID int64
 	err = tx.QueryRow(
 		`SELECT dp1.channel_id FROM dm_participants dp1
 		 JOIN dm_participants dp2 ON dp1.channel_id = dp2.channel_id
 		 JOIN channels c ON c.id = dp1.channel_id
-		 WHERE dp1.user_id = ? AND dp2.user_id = ? AND c.type = 'dm'
+		 WHERE dp1.user_id = ? AND dp2.user_id = ? AND c.type = 'dm' AND c.is_group = 0
 		 LIMIT 1`,
 		user1ID, user2ID,
 	).Scan(&existingID)
@@ -129,81 +190,223 @@ func (d *DB) GetOrCreateDMChannel(ctx context.Context, user1ID, user2ID int64) (
 
 // ─── GetUserDMChannels ──────────────────────────────────────────────────────
 
-// GetUserDMChannels returns all open DM channels for a user with recipient info,
-// last message preview, and unread count. Ordered by most recent activity.
+// GetUserDMChannels returns all open DM channels for a user with the full
+// participant list, last message preview, and unread count. Ordered by most
+// recent activity.
 //
-// Note: the SQL JOIN on dm_open_state already restricts results to DM channels
+// It is two queries, not one: dm_participants holds N users per channel, so a
+// single joined query returns one row per (channel, participant) pair and the
+// caller has to de-duplicate anyway. Fetching the participants for every open
+// DM in one extra pass keeps the cost at O(1) queries rather than the O(n) a
+// per-channel participant lookup would cost.
+//
+// Note: the JOIN on dm_open_state already restricts results to DM channels
 // (dm_open_state only contains rows for DM channels), and the explicit
-// "c.type = 'dm'" predicate in the JOIN provides a defensive second check.
-// No additional channel-type validation is needed at the Go layer.
-//
-// The unread count is a correlated subquery range-scanning
-// idx_messages_channel per DM, replacing the old LEFT JOIN messages fan-out
-// that touched every message row in every open DM.
+// "c.type = 'dm'" predicate provides a defensive second check.
 func (d *DB) GetUserDMChannels(ctx context.Context, userID int64) ([]DMChannelInfo, error) {
-	rows, err := d.reader.QueryContext(ctx,
-		`SELECT
-		    c.id                                          AS channel_id,
-		    u.id                                          AS recipient_id,
-		    u.username                                    AS recipient_username,
-		    COALESCE(u.avatar, '')                        AS recipient_avatar,
-		    u.status                                      AS recipient_status,
-		    lm.id                                         AS last_message_id,
-		    COALESCE(lm.content, '')                      AS last_message,
-		    COALESCE(lm.timestamp, '')                    AS last_message_at,
-		    (SELECT COUNT(*) FROM messages mu
-		      WHERE mu.channel_id = c.id AND mu.deleted = 0
-		        AND mu.id > COALESCE((SELECT rs.last_message_id FROM read_states rs
-		                               WHERE rs.channel_id = c.id AND rs.user_id = dos.user_id), 0)
-		    ) AS unread_count
-		 FROM dm_open_state dos
-		 JOIN channels c          ON c.id = dos.channel_id AND c.type = 'dm'
-		 JOIN dm_participants dp  ON dp.channel_id = c.id AND dp.user_id != ?
-		 JOIN users u             ON u.id = dp.user_id
-		 LEFT JOIN messages lm    ON lm.id = (
-		     SELECT MAX(id) FROM messages WHERE channel_id = c.id AND deleted = 0
-		 )
-		 WHERE dos.user_id = ?
-		 ORDER BY COALESCE(lm.timestamp, dos.opened_at) DESC`,
-		userID, userID,
-	)
+	rows, err := d.q.GetUserDMChannels(ctx, userID)
 	if err != nil {
 		return nil, fmt.Errorf("GetUserDMChannels: %w", err)
 	}
-	defer rows.Close() //nolint:errcheck
 
-	var result []DMChannelInfo
-	for rows.Next() {
-		var info DMChannelInfo
-		var lastMsgID sql.NullInt64
-		if scanErr := rows.Scan(
-			&info.ChannelID,
-			&info.Recipient.ID,
-			&info.Recipient.Username,
-			&info.Recipient.Avatar,
-			&info.Recipient.Status,
-			&lastMsgID,
-			&info.LastMessage,
-			&info.LastMessageAt,
-			&info.UnreadCount,
-		); scanErr != nil {
-			return nil, fmt.Errorf("GetUserDMChannels scan: %w", scanErr)
+	parts, err := d.q.GetDMParticipantsForUser(ctx, userID)
+	if err != nil {
+		return nil, fmt.Errorf("GetUserDMChannels participants: %w", err)
+	}
+	byChannel := make(map[int64][]DMUser, len(rows))
+	for i := range parts {
+		if parts[i].ID == userID {
+			continue
 		}
-		if lastMsgID.Valid {
-			id := lastMsgID.Int64
-			info.LastMessageID = &id
+		byChannel[parts[i].ChannelID] = append(byChannel[parts[i].ChannelID], DMUser{
+			ID:          parts[i].ID,
+			Username:    parts[i].Username,
+			Avatar:      parts[i].Avatar,
+			Status:      StatusForViewer(parts[i].Status, parts[i].ID, userID),
+			DisplayName: parts[i].DisplayName,
+		})
+	}
+
+	result := make([]DMChannelInfo, 0, len(rows))
+	for i := range rows {
+		recipients := byChannel[rows[i].ChannelID]
+		if recipients == nil {
+			recipients = []DMUser{}
+		}
+		info := DMChannelInfo{
+			ChannelID:     rows[i].ChannelID,
+			Recipients:    recipients,
+			Name:          rows[i].Name,
+			IsGroup:       rows[i].IsGroup != 0,
+			LastMessageID: rows[i].LastMessageID,
+			LastMessage:   rows[i].LastMessage,
+			LastMessageAt: rows[i].LastMessageAt,
+			UnreadCount:   int(rows[i].UnreadCount),
+		}
+		if len(recipients) > 0 {
+			info.Recipient = recipients[0]
 		}
 		result = append(result, info)
 	}
-	if rows.Err() != nil {
-		return nil, fmt.Errorf("GetUserDMChannels rows: %w", rows.Err())
-	}
-	if result == nil {
-		result = []DMChannelInfo{}
-	}
 	return result, nil
 }
 
+// ─── Group DM mutation ──────────────────────────────────────────────────────
+
+// CreateGroupDMChannel creates a new group DM channel with the given
+// participants (creator included in participantIDs) and opens it for all of
+// them. It always creates: unlike a 1:1 DM there is no canonical "the DM
+// between these people", because the same set of people may reasonably want
+// two separate groups.
+//
+// The whole insert runs in one transaction so a crash cannot leave a channel
+// with no participants — which would be an unreachable, undeletable row.
+func (d *DB) CreateGroupDMChannel(ctx context.Context, name string, participantIDs []int64) (*Channel, error) {
+	if len(participantIDs) < 3 {
+		return nil, fmt.Errorf("CreateGroupDMChannel: need at least 3 participants, got %d", len(participantIDs))
+	}
+	tx, err := d.writer.BeginTx(ctx, &sql.TxOptions{Isolation: sql.LevelSerializable})
+	if err != nil {
+		return nil, fmt.Errorf("CreateGroupDMChannel begin tx: %w", err)
+	}
+	defer func() { _ = tx.Rollback() }() //nolint:errcheck // no-op after a successful Commit
+
+	res, err := tx.ExecContext(ctx, `INSERT INTO channels (name, type, is_group) VALUES (?, 'dm', 1)`, name)
+	if err != nil {
+		return nil, fmt.Errorf("CreateGroupDMChannel insert channel: %w", err)
+	}
+	channelID, err := res.LastInsertId()
+	if err != nil {
+		return nil, fmt.Errorf("CreateGroupDMChannel last insert id: %w", err)
+	}
+
+	for _, pid := range participantIDs {
+		if _, err = tx.ExecContext(ctx,
+			`INSERT OR IGNORE INTO dm_participants (channel_id, user_id) VALUES (?, ?)`,
+			channelID, pid,
+		); err != nil {
+			return nil, fmt.Errorf("CreateGroupDMChannel insert participant: %w", err)
+		}
+		if _, err = tx.ExecContext(ctx,
+			`INSERT OR IGNORE INTO dm_open_state (user_id, channel_id) VALUES (?, ?)`,
+			pid, channelID,
+		); err != nil {
+			return nil, fmt.Errorf("CreateGroupDMChannel open dm: %w", err)
+		}
+	}
+
+	if err = tx.Commit(); err != nil {
+		return nil, fmt.Errorf("CreateGroupDMChannel commit: %w", err)
+	}
+
+	ch, err := d.GetChannel(ctx, channelID)
+	if err != nil {
+		return nil, fmt.Errorf("CreateGroupDMChannel fetch new: %w", err)
+	}
+	return ch, nil
+}
+
+// LeaveGroupDM removes userID from a group DM's participant list and from
+// their open list, and reports whether that emptied the channel.
+//
+// When the last participant leaves, the channel row is deleted: a DM channel
+// with no participants is reachable by nobody and would sit in the database
+// forever, and its messages/attachments cascade off the channels row. Leaving
+// is therefore destructive for the last leaver only — everyone else's leave is
+// just a removal.
+func (d *DB) LeaveGroupDM(ctx context.Context, userID, channelID int64) (deleted bool, err error) {
+	tx, err := d.writer.BeginTx(ctx, &sql.TxOptions{Isolation: sql.LevelSerializable})
+	if err != nil {
+		return false, fmt.Errorf("LeaveGroupDM begin tx: %w", err)
+	}
+	defer func() { _ = tx.Rollback() }() //nolint:errcheck // no-op after a successful Commit
+
+	if _, err = tx.ExecContext(ctx,
+		`DELETE FROM dm_participants WHERE channel_id = ? AND user_id = ?`, channelID, userID,
+	); err != nil {
+		return false, fmt.Errorf("LeaveGroupDM remove participant: %w", err)
+	}
+	if _, err = tx.ExecContext(ctx,
+		`DELETE FROM dm_open_state WHERE channel_id = ? AND user_id = ?`, channelID, userID,
+	); err != nil {
+		return false, fmt.Errorf("LeaveGroupDM close dm: %w", err)
+	}
+
+	var remaining int
+	if err = tx.QueryRowContext(ctx,
+		`SELECT COUNT(*) FROM dm_participants WHERE channel_id = ?`, channelID,
+	).Scan(&remaining); err != nil {
+		return false, fmt.Errorf("LeaveGroupDM count: %w", err)
+	}
+	if remaining == 0 {
+		if _, err = tx.ExecContext(ctx, `DELETE FROM channels WHERE id = ?`, channelID); err != nil {
+			return false, fmt.Errorf("LeaveGroupDM delete channel: %w", err)
+		}
+		deleted = true
+	}
+
+	if err = tx.Commit(); err != nil {
+		return false, fmt.Errorf("LeaveGroupDM commit: %w", err)
+	}
+	return deleted, nil
+}
+
+// CountDMParticipants returns how many users are in a DM channel.
+func (d *DB) CountDMParticipants(ctx context.Context, channelID int64) (int, error) {
+	n, err := d.q.CountDMParticipants(ctx, channelID)
+	if err != nil {
+		return 0, fmt.Errorf("CountDMParticipants: %w", err)
+	}
+	return int(n), nil
+}
+
+// IsGroupDM reports whether a DM channel was created as a group. False for a
+// non-existent channel and for anything that is not a DM, which is what every
+// caller wants: "treat it as a 1:1" is the conservative answer.
+func (d *DB) IsGroupDM(ctx context.Context, channelID int64) (bool, error) {
+	flag, err := d.q.IsGroupDM(ctx, channelID)
+	if errors.Is(err, sql.ErrNoRows) {
+		return false, nil
+	}
+	if err != nil {
+		return false, fmt.Errorf("IsGroupDM: %w", err)
+	}
+	return flag != 0, nil
+}
+
+// SetDMChannelName sets the optional group name on a DM channel. The type
+// predicate lives in the SQL so a stray channel id cannot rename a guild
+// channel through the DM route.
+func (d *DB) SetDMChannelName(ctx context.Context, channelID int64, name string) error {
+	if err := d.q.SetDMChannelName(ctx, dbgen.SetDMChannelNameParams{
+		Name: name,
+		ID:   channelID,
+	}); err != nil {
+		return fmt.Errorf("SetDMChannelName: %w", err)
+	}
+	return nil
+}
+
+// GetDMParticipants returns every participant of a DM channel, viewer-adjusted
+// (an invisible participant reads as offline to anyone but themselves).
+func (d *DB) GetDMParticipants(ctx context.Context, channelID, viewerID int64) ([]DMUser, error) {
+	rows, err := d.q.GetDMParticipants(ctx, channelID)
+	if err != nil {
+		return nil, fmt.Errorf("GetDMParticipants: %w", err)
+	}
+	out := make([]DMUser, 0, len(rows))
+	for i := range rows {
+		out = append(out, DMUser{
+			ID:          rows[i].ID,
+			Username:    rows[i].Username,
+			Avatar:      rows[i].Avatar,
+			Status:      StatusForViewer(rows[i].Status, rows[i].ID, viewerID),
+			DisplayName: rows[i].DisplayName,
+		})
+	}
+	return out, nil
+}
+
 // ─── OpenDM / CloseDM ──────────────────────────────────────────────────────
 
 // OpenDM adds a DM channel to a user's open list (idempotent).
diff --git a/Server/db/emoji_queries.go b/Server/db/emoji_queries.go
new file mode 100644
index 00000000..6388cf15
--- /dev/null
+++ b/Server/db/emoji_queries.go
@@ -0,0 +1,110 @@
+package db
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+
+	"github.com/owncord/server/db/dbgen"
+)
+
+// GetEmoji returns the emoji with the given id, or (nil, nil) when no such row
+// exists. A missing row is not an error: DELETE races and stale client ids are
+// ordinary, and the caller turns the nil into a 404.
+func (d *DB) GetEmoji(ctx context.Context, id int64) (*Emoji, error) {
+	row, err := d.q.GetEmojiByID(ctx, id)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("GetEmoji: %w", err)
+	}
+	return &Emoji{
+		ID:         row.ID,
+		Shortcode:  row.Shortcode,
+		StoredAs:   row.Filename,
+		MimeType:   row.MimeType,
+		UploadedBy: row.UploadedBy,
+		CreatedAt:  row.CreatedAt,
+	}, nil
+}
+
+// GetEmojiByShortcode returns the emoji owning `shortcode`, or (nil, nil).
+// Shortcodes are stored lowercase, so the caller must normalize before calling
+// -- this is the uniqueness check behind CreateEmoji.
+func (d *DB) GetEmojiByShortcode(ctx context.Context, shortcode string) (*Emoji, error) {
+	row, err := d.q.GetEmojiByShortcode(ctx, shortcode)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("GetEmojiByShortcode: %w", err)
+	}
+	return &Emoji{
+		ID:         row.ID,
+		Shortcode:  row.Shortcode,
+		StoredAs:   row.Filename,
+		MimeType:   row.MimeType,
+		UploadedBy: row.UploadedBy,
+		CreatedAt:  row.CreatedAt,
+	}, nil
+}
+
+// ListEmoji returns every custom emoji, ordered by shortcode.
+func (d *DB) ListEmoji(ctx context.Context) ([]*Emoji, error) {
+	rows, err := d.q.ListEmoji(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("ListEmoji: %w", err)
+	}
+	out := make([]*Emoji, 0, len(rows))
+	for _, row := range rows {
+		out = append(out, &Emoji{
+			ID:         row.ID,
+			Shortcode:  row.Shortcode,
+			StoredAs:   row.Filename,
+			MimeType:   row.MimeType,
+			UploadedBy: row.UploadedBy,
+			CreatedAt:  row.CreatedAt,
+		})
+	}
+	return out, nil
+}
+
+// CreateEmoji inserts a custom emoji and returns the stored row. storedAs is
+// the storage-layer UUID the bytes were written under; mimeType is the type
+// sniffed from those bytes, never a client-supplied header.
+func (d *DB) CreateEmoji(ctx context.Context, shortcode, storedAs, mimeType string, uploadedBy int64) (*Emoji, error) {
+	row, err := d.q.CreateEmoji(ctx, dbgen.CreateEmojiParams{
+		Shortcode:  shortcode,
+		Filename:   storedAs,
+		MimeType:   mimeType,
+		UploadedBy: uploadedBy,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("CreateEmoji: %w", err)
+	}
+	return &Emoji{
+		ID:         row.ID,
+		Shortcode:  row.Shortcode,
+		StoredAs:   row.Filename,
+		MimeType:   row.MimeType,
+		UploadedBy: row.UploadedBy,
+		CreatedAt:  row.CreatedAt,
+	}, nil
+}
+
+// DeleteEmoji removes the emoji row and reports whether a row was actually
+// deleted, so a concurrent double-delete answers 404 rather than pretending to
+// have removed the same emoji twice.
+func (d *DB) DeleteEmoji(ctx context.Context, id int64) (bool, error) {
+	res, err := d.q.DeleteEmoji(ctx, id)
+	if err != nil {
+		return false, fmt.Errorf("DeleteEmoji: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return false, fmt.Errorf("DeleteEmoji rows affected: %w", err)
+	}
+	return n > 0, nil
+}
diff --git a/Server/db/emoji_queries_test.go b/Server/db/emoji_queries_test.go
new file mode 100644
index 00000000..7a940f71
--- /dev/null
+++ b/Server/db/emoji_queries_test.go
@@ -0,0 +1,149 @@
+package db_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/owncord/server/db"
+)
+
+// seedEmojiUploader inserts the user row the emoji.uploaded_by foreign key
+// needs, and returns its id.
+func seedEmojiUploader(t *testing.T, database *db.DB) int64 {
+	t.Helper()
+	res, err := database.ExecContext(context.Background(),
+		`INSERT INTO users (username, password) VALUES ('emoji-uploader', 'x')`)
+	if err != nil {
+		t.Fatalf("seed uploader: %v", err)
+	}
+	id, err := res.LastInsertId()
+	if err != nil {
+		t.Fatalf("LastInsertId: %v", err)
+	}
+	return id
+}
+
+// These run against the real embedded migration set: migration 026 is what
+// adds the mime_type column these queries select, so the inline test schema
+// would not carry it.
+
+func TestEmojiCRUDRoundTrip(t *testing.T) {
+	database := newMigratedTestDB(t)
+	ctx := context.Background()
+	uploader := seedEmojiUploader(t, database)
+
+	created, err := database.CreateEmoji(ctx, "wave", "uuid-wave", "image/png", uploader)
+	if err != nil {
+		t.Fatalf("CreateEmoji: %v", err)
+	}
+	if created.ID == 0 {
+		t.Fatalf("CreateEmoji returned id 0")
+	}
+	if created.Shortcode != "wave" || created.StoredAs != "uuid-wave" || created.MimeType != "image/png" {
+		t.Errorf("created = %+v, want wave/uuid-wave/image/png", created)
+	}
+	if created.CreatedAt == "" {
+		t.Errorf("created_at is empty")
+	}
+
+	byID, err := database.GetEmoji(ctx, created.ID)
+	if err != nil || byID == nil {
+		t.Fatalf("GetEmoji = %v, %v", byID, err)
+	}
+	if byID.StoredAs != "uuid-wave" {
+		t.Errorf("GetEmoji.StoredAs = %q, want uuid-wave", byID.StoredAs)
+	}
+
+	byCode, err := database.GetEmojiByShortcode(ctx, "wave")
+	if err != nil || byCode == nil {
+		t.Fatalf("GetEmojiByShortcode = %v, %v", byCode, err)
+	}
+	if byCode.ID != created.ID {
+		t.Errorf("GetEmojiByShortcode.ID = %d, want %d", byCode.ID, created.ID)
+	}
+
+	deleted, err := database.DeleteEmoji(ctx, created.ID)
+	if err != nil {
+		t.Fatalf("DeleteEmoji: %v", err)
+	}
+	if !deleted {
+		t.Errorf("DeleteEmoji reported no row removed")
+	}
+	// A second delete of the same id must report false rather than pretending.
+	again, err := database.DeleteEmoji(ctx, created.ID)
+	if err != nil {
+		t.Fatalf("second DeleteEmoji: %v", err)
+	}
+	if again {
+		t.Errorf("second DeleteEmoji reported a removal")
+	}
+}
+
+func TestEmojiMissingRowsAreNilNotError(t *testing.T) {
+	database := newMigratedTestDB(t)
+	ctx := context.Background()
+
+	e, err := database.GetEmoji(ctx, 999)
+	if err != nil {
+		t.Fatalf("GetEmoji(missing): %v", err)
+	}
+	if e != nil {
+		t.Errorf("GetEmoji(missing) = %v, want nil", e)
+	}
+
+	e, err = database.GetEmojiByShortcode(ctx, "nosuch")
+	if err != nil {
+		t.Fatalf("GetEmojiByShortcode(missing): %v", err)
+	}
+	if e != nil {
+		t.Errorf("GetEmojiByShortcode(missing) = %v, want nil", e)
+	}
+}
+
+func TestListEmojiIsOrderedAndEmptySliceWhenNone(t *testing.T) {
+	database := newMigratedTestDB(t)
+	ctx := context.Background()
+	uploader := seedEmojiUploader(t, database)
+
+	list, err := database.ListEmoji(ctx)
+	if err != nil {
+		t.Fatalf("ListEmoji: %v", err)
+	}
+	if list == nil || len(list) != 0 {
+		t.Fatalf("ListEmoji on an empty table = %v, want an empty slice", list)
+	}
+
+	for _, sc := range []string{"zulu", "alpha", "mike"} {
+		if _, err := database.CreateEmoji(ctx, sc, "uuid-"+sc, "image/png", uploader); err != nil {
+			t.Fatalf("CreateEmoji(%s): %v", sc, err)
+		}
+	}
+	list, err = database.ListEmoji(ctx)
+	if err != nil {
+		t.Fatalf("ListEmoji: %v", err)
+	}
+	want := []string{"alpha", "mike", "zulu"}
+	if len(list) != len(want) {
+		t.Fatalf("len(list) = %d, want %d", len(list), len(want))
+	}
+	for i, sc := range want {
+		if list[i].Shortcode != sc {
+			t.Errorf("list[%d] = %q, want %q", i, list[i].Shortcode, sc)
+		}
+	}
+}
+
+func TestCreateEmojiRejectsDuplicateShortcode(t *testing.T) {
+	database := newMigratedTestDB(t)
+	ctx := context.Background()
+	uploader := seedEmojiUploader(t, database)
+
+	if _, err := database.CreateEmoji(ctx, "wave", "uuid-a", "image/png", uploader); err != nil {
+		t.Fatalf("first CreateEmoji: %v", err)
+	}
+	// The table's UNIQUE index is the backstop behind the service's own
+	// pre-check, so a lost race still cannot produce two :wave: rows.
+	if _, err := database.CreateEmoji(ctx, "wave", "uuid-b", "image/gif", uploader); err == nil {
+		t.Fatalf("duplicate CreateEmoji succeeded, want a uniqueness error")
+	}
+}
diff --git a/Server/db/mappers.go b/Server/db/mappers.go
index d8a403fa..63931c13 100644
--- a/Server/db/mappers.go
+++ b/Server/db/mappers.go
@@ -72,6 +72,9 @@ func userFromGen(u dbgen.User) *User {
 		BanReason:         u.BanReason,
 		BanExpires:        u.BanExpires,
 		IdentityPublicKey: u.IdentityPublicKey,
+		DisplayName:       u.DisplayName,
+		About:             u.About,
+		CustomStatus:      u.CustomStatus,
 	}
 }
 
diff --git a/Server/db/mention_queries.go b/Server/db/mention_queries.go
new file mode 100644
index 00000000..8c8156be
--- /dev/null
+++ b/Server/db/mention_queries.go
@@ -0,0 +1,369 @@
+package db
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"strings"
+)
+
+// mentionExecer is the subset of *sql.Tx insertMentionRows needs, so the same
+// row-writing loop serves both the insert and the edit transaction.
+type mentionExecer interface {
+	ExecContext(ctx context.Context, query string, args ...any) (sql.Result, error)
+}
+
+// maxMentionsPerMessage bounds how many resolved mentions a single message may
+// store. The service caps its resolution at the same number; this is the
+// storage-side backstop so a caller cannot widen the fan-out.
+const maxMentionsPerMessage = 20
+
+// MentionTarget is a candidate recipient of a mention fan-out: the user id, the
+// presence status @here filters on, and the role the user holds (so the caller
+// can apply the ADMINISTRATOR bypass when a per-user channel override would
+// otherwise drop them).
+type MentionTarget struct {
+	UserID int64
+	Status string
+	RoleID int64
+}
+
+// CreateMessageWithMentions inserts a message and its resolved mentions in one
+// writer transaction, so a reader can never observe a message whose mention set
+// is still half-written. mentionedUserIDs is truncated to
+// maxMentionsPerMessage and duplicates are ignored.
+func (d *DB) CreateMessageWithMentions(ctx context.Context, channelID, userID int64, content string, replyTo *int64, mentionedUserIDs []int64, mentionsEveryone bool) (*Message, error) {
+	tx, err := d.writer.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, fmt.Errorf("CreateMessageWithMentions begin tx: %w", err)
+	}
+	defer tx.Rollback() //nolint:errcheck
+
+	var m Message
+	var deleted, pinned, everyone int64
+	if scanErr := tx.QueryRowContext(ctx,
+		`INSERT INTO messages (channel_id, user_id, content, reply_to, mentions_everyone)
+		 VALUES (?, ?, ?, ?, ?)
+		 RETURNING id, channel_id, user_id, content, reply_to, edited_at, deleted, pinned,
+		           timestamp, mentions_everyone`,
+		channelID, userID, content, replyTo, b2i64(mentionsEveryone),
+	).Scan(&m.ID, &m.ChannelID, &m.UserID, &m.Content, &m.ReplyTo, &m.EditedAt,
+		&deleted, &pinned, &m.Timestamp, &everyone); scanErr != nil {
+		return nil, fmt.Errorf("CreateMessageWithMentions insert: %w", scanErr)
+	}
+	m.Deleted = deleted != 0
+	m.Pinned = pinned != 0
+	m.MentionsEveryone = everyone != 0
+
+	if err := insertMentionRows(ctx, tx, m.ID, mentionedUserIDs); err != nil {
+		return nil, err
+	}
+	if err := tx.Commit(); err != nil {
+		return nil, fmt.Errorf("CreateMessageWithMentions commit: %w", err)
+	}
+	return &m, nil
+}
+
+// ReplaceMessageMentions rewrites a message's mention set and its
+// mentions_everyone flag in one writer transaction. Used by edits, which
+// re-resolve mentions from the new content.
+func (d *DB) ReplaceMessageMentions(ctx context.Context, messageID int64, mentionedUserIDs []int64, mentionsEveryone bool) error {
+	tx, err := d.writer.BeginTx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("ReplaceMessageMentions begin tx: %w", err)
+	}
+	defer tx.Rollback() //nolint:errcheck
+
+	if _, err := tx.ExecContext(ctx, `DELETE FROM message_mentions WHERE message_id = ?`, messageID); err != nil {
+		return fmt.Errorf("ReplaceMessageMentions delete: %w", err)
+	}
+	// Guarded so an edit that does not change the flag skips the write — an
+	// UPDATE on messages re-indexes the row through the messages_fts triggers.
+	if _, err := tx.ExecContext(ctx,
+		`UPDATE messages SET mentions_everyone = ? WHERE id = ? AND mentions_everyone != ?`,
+		b2i64(mentionsEveryone), messageID, b2i64(mentionsEveryone),
+	); err != nil {
+		return fmt.Errorf("ReplaceMessageMentions flag: %w", err)
+	}
+	if err := insertMentionRows(ctx, tx, messageID, mentionedUserIDs); err != nil {
+		return err
+	}
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("ReplaceMessageMentions commit: %w", err)
+	}
+	return nil
+}
+
+// insertMentionRows writes the mention rows for one message inside tx.
+// Self-mentions are stored like any other: the fan-out, not storage, is what
+// excludes the author.
+func insertMentionRows(ctx context.Context, tx mentionExecer, messageID int64, mentionedUserIDs []int64) error {
+	if len(mentionedUserIDs) > maxMentionsPerMessage {
+		mentionedUserIDs = mentionedUserIDs[:maxMentionsPerMessage]
+	}
+	for _, uid := range mentionedUserIDs {
+		if _, err := tx.ExecContext(ctx,
+			`INSERT OR IGNORE INTO message_mentions (message_id, mentioned_user_id) VALUES (?, ?)`,
+			messageID, uid,
+		); err != nil {
+			return fmt.Errorf("insertMentionRows: %w", err)
+		}
+	}
+	return nil
+}
+
+// GetMentionsByMessageIDs returns the mentioned user ids per message id.
+// Messages with no mentions are absent from the map.
+func (d *DB) GetMentionsByMessageIDs(ctx context.Context, msgIDs []int64) (map[int64][]int64, error) {
+	result := make(map[int64][]int64)
+	if len(msgIDs) == 0 {
+		return result, nil
+	}
+
+	placeholders := make([]string, len(msgIDs))
+	args := make([]any, len(msgIDs))
+	for i, id := range msgIDs {
+		placeholders[i] = "?"
+		args[i] = id
+	}
+
+	rows, err := d.reader.QueryContext(ctx,
+		fmt.Sprintf( //nolint:gosec // G201: placeholder interpolation, not user input
+			`SELECT message_id, mentioned_user_id FROM message_mentions
+			 WHERE message_id IN (%s) ORDER BY message_id, mentioned_user_id`,
+			strings.Join(placeholders, ",")),
+		args...,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("GetMentionsByMessageIDs: %w", err)
+	}
+	defer rows.Close() //nolint:errcheck
+
+	for rows.Next() {
+		var msgID, userID int64
+		if scanErr := rows.Scan(&msgID, &userID); scanErr != nil {
+			return nil, fmt.Errorf("GetMentionsByMessageIDs scan: %w", scanErr)
+		}
+		result[msgID] = append(result[msgID], userID)
+	}
+	if rows.Err() != nil {
+		return nil, fmt.Errorf("GetMentionsByMessageIDs rows: %w", rows.Err())
+	}
+	return result, nil
+}
+
+// mentionCountChunkSize bounds how many recipients IncrementMentionCounts
+// upserts in a single multi-row INSERT, keeping the per-exec bound-parameter
+// count (2 per row) far below SQLite's limit. Mirrors the IN-list chunking in
+// GetSessionsWithBanStatusBatch.
+const mentionCountChunkSize = 500
+
+// IncrementMentionCounts bumps read_states.mention_count by one for each user
+// in a channel, creating the read-state row when the user has none yet.
+// last_message_id stays 0 for a created row: the user has read nothing, and the
+// mention they were just given is unread by definition.
+//
+// Batched into one multi-row INSERT per chunk of mentionCountChunkSize
+// recipients instead of one exec per recipient: an @everyone mention fans out
+// to every reader of a channel, and the writer txn used to pay one round trip
+// per reader for that. The caller has already excluded the author, so
+// semantics are unchanged — each listed user id still gets exactly one
+// increment (or a fresh row seeded at 1).
+func (d *DB) IncrementMentionCounts(ctx context.Context, channelID int64, userIDs []int64) error {
+	if len(userIDs) == 0 {
+		return nil
+	}
+	tx, err := d.writer.BeginTx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("IncrementMentionCounts begin tx: %w", err)
+	}
+	defer tx.Rollback() //nolint:errcheck
+
+	for start := 0; start < len(userIDs); start += mentionCountChunkSize {
+		chunk := userIDs[start:min(start+mentionCountChunkSize, len(userIDs))]
+
+		rowPlaceholders := make([]string, len(chunk))
+		args := make([]any, 0, len(chunk)*2)
+		for i, uid := range chunk {
+			rowPlaceholders[i] = "(?, ?, 0, 1)"
+			args = append(args, uid, channelID)
+		}
+
+		query := fmt.Sprintf( //nolint:gosec // G201: placeholder interpolation, not user input
+			`INSERT INTO read_states (user_id, channel_id, last_message_id, mention_count)
+			 VALUES %s
+			 ON CONFLICT(user_id, channel_id) DO UPDATE SET
+			     mention_count = mention_count + 1`,
+			strings.Join(rowPlaceholders, ","),
+		)
+		if _, err := tx.ExecContext(ctx, query, args...); err != nil {
+			return fmt.Errorf("IncrementMentionCounts: %w", err)
+		}
+	}
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("IncrementMentionCounts commit: %w", err)
+	}
+	return nil
+}
+
+// GetMentionCount returns the unread mention count for a user in a channel.
+func (d *DB) GetMentionCount(ctx context.Context, userID, channelID int64) (int, error) {
+	var count int
+	err := d.reader.QueryRowContext(ctx,
+		`SELECT COALESCE((SELECT mention_count FROM read_states
+		                   WHERE user_id = ? AND channel_id = ?), 0)`,
+		userID, channelID,
+	).Scan(&count)
+	if err != nil {
+		return 0, fmt.Errorf("GetMentionCount: %w", err)
+	}
+	return count, nil
+}
+
+// GetUserIDsByUsernames resolves usernames to ids, keyed by the lowercased
+// username. Matching is case-insensitive because users.username is UNIQUE
+// COLLATE NOCASE, which makes the column's comparisons case-insensitive too.
+func (d *DB) GetUserIDsByUsernames(ctx context.Context, usernames []string) (map[string]int64, error) {
+	result := make(map[string]int64)
+	if len(usernames) == 0 {
+		return result, nil
+	}
+
+	placeholders := make([]string, len(usernames))
+	args := make([]any, len(usernames))
+	for i, name := range usernames {
+		placeholders[i] = "?"
+		args[i] = name
+	}
+
+	rows, err := d.reader.QueryContext(ctx,
+		fmt.Sprintf( //nolint:gosec // G201: placeholder interpolation, not user input
+			`SELECT id, username FROM users WHERE banned = 0 AND username IN (%s)`,
+			strings.Join(placeholders, ",")),
+		args...,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("GetUserIDsByUsernames: %w", err)
+	}
+	defer rows.Close() //nolint:errcheck
+
+	for rows.Next() {
+		var id int64
+		var name string
+		if scanErr := rows.Scan(&id, &name); scanErr != nil {
+			return nil, fmt.Errorf("GetUserIDsByUsernames scan: %w", scanErr)
+		}
+		result[strings.ToLower(name)] = id
+	}
+	if rows.Err() != nil {
+		return nil, fmt.Errorf("GetUserIDsByUsernames rows: %w", rows.Err())
+	}
+	return result, nil
+}
+
+// ListMentionTargetsByRoles returns non-banned users holding any of the given
+// roles, with the presence status @here filters on.
+func (d *DB) ListMentionTargetsByRoles(ctx context.Context, roleIDs []int64) ([]MentionTarget, error) {
+	if len(roleIDs) == 0 {
+		return []MentionTarget{}, nil
+	}
+
+	placeholders := make([]string, len(roleIDs))
+	args := make([]any, len(roleIDs))
+	for i, id := range roleIDs {
+		placeholders[i] = "?"
+		args[i] = id
+	}
+
+	rows, err := d.reader.QueryContext(ctx,
+		fmt.Sprintf( //nolint:gosec // G201: placeholder interpolation, not user input
+			`SELECT id, status, role_id FROM users WHERE banned = 0 AND role_id IN (%s)`,
+			strings.Join(placeholders, ",")),
+		args...,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("ListMentionTargetsByRoles: %w", err)
+	}
+	defer rows.Close() //nolint:errcheck
+
+	targets := []MentionTarget{}
+	for rows.Next() {
+		var t MentionTarget
+		if scanErr := rows.Scan(&t.UserID, &t.Status, &t.RoleID); scanErr != nil {
+			return nil, fmt.Errorf("ListMentionTargetsByRoles scan: %w", scanErr)
+		}
+		targets = append(targets, t)
+	}
+	if rows.Err() != nil {
+		return nil, fmt.Errorf("ListMentionTargetsByRoles rows: %w", rows.Err())
+	}
+	return targets, nil
+}
+
+// ListMentionTargetsByUserIDs returns non-banned users by explicit id, with the
+// same fields ListMentionTargetsByRoles returns. It backs the additive half of
+// the per-user channel override layer: a member whose user override ALLOWs
+// READ_MESSAGES can read a channel their role cannot, so the role walk alone
+// would leave them out of an @everyone fan-out they are entitled to.
+func (d *DB) ListMentionTargetsByUserIDs(ctx context.Context, userIDs []int64) ([]MentionTarget, error) {
+	if len(userIDs) == 0 {
+		return []MentionTarget{}, nil
+	}
+
+	placeholders := make([]string, len(userIDs))
+	args := make([]any, len(userIDs))
+	for i, id := range userIDs {
+		placeholders[i] = "?"
+		args[i] = id
+	}
+
+	rows, err := d.reader.QueryContext(ctx,
+		fmt.Sprintf( //nolint:gosec // G201: placeholder interpolation, not user input
+			`SELECT id, status, role_id FROM users WHERE banned = 0 AND id IN (%s)`,
+			strings.Join(placeholders, ",")),
+		args...,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("ListMentionTargetsByUserIDs: %w", err)
+	}
+	defer rows.Close() //nolint:errcheck
+
+	targets := []MentionTarget{}
+	for rows.Next() {
+		var t MentionTarget
+		if scanErr := rows.Scan(&t.UserID, &t.Status, &t.RoleID); scanErr != nil {
+			return nil, fmt.Errorf("ListMentionTargetsByUserIDs scan: %w", scanErr)
+		}
+		targets = append(targets, t)
+	}
+	if rows.Err() != nil {
+		return nil, fmt.Errorf("ListMentionTargetsByUserIDs rows: %w", rows.Err())
+	}
+	return targets, nil
+}
+
+// ListBlockersOf returns the ids of users who have blocked the given user.
+// A mention from a blocked user must not raise the blocker's mention badge.
+func (d *DB) ListBlockersOf(ctx context.Context, blockedID int64) ([]int64, error) {
+	ids, err := d.q.ListBlockersOfUser(ctx, blockedID)
+	if err != nil {
+		return nil, fmt.Errorf("ListBlockersOf: %w", err)
+	}
+	return ids, nil
+}
+
+// GetChannelOverrides returns every role override on a channel, keyed by role
+// id. The per-role reverse (GetAllChannelPermissionsForRole) backs the
+// per-user permission cache; this direction backs the @everyone fan-out, which
+// needs every role's verdict on one channel.
+func (d *DB) GetChannelOverrides(ctx context.Context, channelID int64) (map[int64]ChannelOverride, error) {
+	rows, err := d.q.GetChannelOverrides(ctx, channelID)
+	if err != nil {
+		return nil, fmt.Errorf("GetChannelOverrides: %w", err)
+	}
+	result := make(map[int64]ChannelOverride, len(rows))
+	for _, r := range rows {
+		result[r.RoleID] = ChannelOverride{Allow: r.Allow, Deny: r.Deny}
+	}
+	return result, nil
+}
diff --git a/Server/db/mention_queries_test.go b/Server/db/mention_queries_test.go
new file mode 100644
index 00000000..cfe5d34d
--- /dev/null
+++ b/Server/db/mention_queries_test.go
@@ -0,0 +1,327 @@
+package db_test
+
+import (
+	"context"
+	"strconv"
+	"testing"
+
+	"github.com/owncord/server/db"
+)
+
+// storageMentionCap mirrors the package-internal maxMentionsPerMessage backstop.
+const storageMentionCap = 20
+
+// seedMentionFixture creates two users and a text channel for mention tests.
+func seedMentionFixture(t *testing.T, database *db.DB) {
+	t.Helper()
+	ctx := context.Background()
+	for _, name := range []string{"alice", "bob", "Carol"} {
+		if _, err := database.CreateUser(ctx, name, "hash", 4); err != nil {
+			t.Fatalf("CreateUser(%s): %v", name, err)
+		}
+	}
+	if _, err := database.CreateChannel(ctx, "general", "text", "", "", 0); err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+}
+
+func TestCreateMessageWithMentions_StoresRowsAndFlag(t *testing.T) {
+	database := newMigratedTestDB(t)
+	seedMentionFixture(t, database)
+	ctx := context.Background()
+
+	msg, err := database.CreateMessageWithMentions(ctx, 1, 1, "hi @bob", nil, []int64{2}, true)
+	if err != nil {
+		t.Fatalf("CreateMessageWithMentions: %v", err)
+	}
+	if !msg.MentionsEveryone {
+		t.Error("MentionsEveryone = false, want true")
+	}
+
+	got, err := database.GetMentionsByMessageIDs(ctx, []int64{msg.ID})
+	if err != nil {
+		t.Fatalf("GetMentionsByMessageIDs: %v", err)
+	}
+	if len(got[msg.ID]) != 1 || got[msg.ID][0] != 2 {
+		t.Errorf("mentions = %v, want [2]", got[msg.ID])
+	}
+
+	// The flag must survive a re-read through the ordinary message getter.
+	reread, err := database.GetMessage(ctx, msg.ID)
+	if err != nil || reread == nil {
+		t.Fatalf("GetMessage: %v", err)
+	}
+	if !reread.MentionsEveryone {
+		t.Error("re-read MentionsEveryone = false, want true")
+	}
+}
+
+// TestCreateMessageWithMentions_CapsStoredRows locks the storage-side backstop:
+// a caller cannot widen the fan-out past storageMentionCap.
+func TestCreateMessageWithMentions_CapsStoredRows(t *testing.T) {
+	database := newMigratedTestDB(t)
+	seedMentionFixture(t, database)
+	ctx := context.Background()
+
+	ids := make([]int64, 0, storageMentionCap+5)
+	for i := range storageMentionCap + 5 {
+		uid, err := database.CreateUser(ctx, "capped"+string(rune('a'+i)), "hash", 4)
+		if err != nil {
+			t.Fatalf("CreateUser: %v", err)
+		}
+		ids = append(ids, uid)
+	}
+
+	msg, err := database.CreateMessageWithMentions(ctx, 1, 1, "spam", nil, ids, false)
+	if err != nil {
+		t.Fatalf("CreateMessageWithMentions: %v", err)
+	}
+	got, err := database.GetMentionsByMessageIDs(ctx, []int64{msg.ID})
+	if err != nil {
+		t.Fatalf("GetMentionsByMessageIDs: %v", err)
+	}
+	if len(got[msg.ID]) != storageMentionCap {
+		t.Errorf("stored = %d, want %d", len(got[msg.ID]), storageMentionCap)
+	}
+}
+
+func TestReplaceMessageMentions(t *testing.T) {
+	database := newMigratedTestDB(t)
+	seedMentionFixture(t, database)
+	ctx := context.Background()
+
+	msg, err := database.CreateMessageWithMentions(ctx, 1, 1, "hi @bob", nil, []int64{2}, true)
+	if err != nil {
+		t.Fatalf("CreateMessageWithMentions: %v", err)
+	}
+	if err := database.ReplaceMessageMentions(ctx, msg.ID, []int64{3}, false); err != nil {
+		t.Fatalf("ReplaceMessageMentions: %v", err)
+	}
+
+	got, err := database.GetMentionsByMessageIDs(ctx, []int64{msg.ID})
+	if err != nil {
+		t.Fatalf("GetMentionsByMessageIDs: %v", err)
+	}
+	if len(got[msg.ID]) != 1 || got[msg.ID][0] != 3 {
+		t.Errorf("mentions = %v, want [3]", got[msg.ID])
+	}
+	reread, err := database.GetMessage(ctx, msg.ID)
+	if err != nil || reread == nil {
+		t.Fatalf("GetMessage: %v", err)
+	}
+	if reread.MentionsEveryone {
+		t.Error("MentionsEveryone = true, want false after replace")
+	}
+}
+
+func TestIncrementMentionCounts_AndReadStateClear(t *testing.T) {
+	database := newMigratedTestDB(t)
+	seedMentionFixture(t, database)
+	ctx := context.Background()
+
+	if err := database.IncrementMentionCounts(ctx, 1, []int64{2, 3}); err != nil {
+		t.Fatalf("IncrementMentionCounts: %v", err)
+	}
+	if err := database.IncrementMentionCounts(ctx, 1, []int64{2}); err != nil {
+		t.Fatalf("IncrementMentionCounts: %v", err)
+	}
+
+	if n, _ := database.GetMentionCount(ctx, 2, 1); n != 2 {
+		t.Errorf("user 2 mention_count = %d, want 2", n)
+	}
+	if n, _ := database.GetMentionCount(ctx, 3, 1); n != 1 {
+		t.Errorf("user 3 mention_count = %d, want 1", n)
+	}
+
+	// Marking the channel read clears the badge, and only for that user.
+	if err := database.UpdateReadState(ctx, 2, 1, 99); err != nil {
+		t.Fatalf("UpdateReadState: %v", err)
+	}
+	if n, _ := database.GetMentionCount(ctx, 2, 1); n != 0 {
+		t.Errorf("after read state, user 2 mention_count = %d, want 0", n)
+	}
+	if n, _ := database.GetMentionCount(ctx, 3, 1); n != 1 {
+		t.Errorf("user 3 mention_count = %d, want 1", n)
+	}
+}
+
+// TestIncrementMentionCounts_BatchesAcrossChunkBoundary exercises the
+// multi-row upsert with a recipient count that spans more than one exec
+// chunk (mentionCountChunkSize=500), pinning that every recipient still gets
+// exactly one increment (or a freshly seeded row) regardless of which chunk
+// it landed in — the batching must not drop or double-count a row at the
+// boundary.
+func TestIncrementMentionCounts_BatchesAcrossChunkBoundary(t *testing.T) {
+	database := newMigratedTestDB(t)
+	ctx := context.Background()
+	if _, err := database.CreateChannel(ctx, "everyone-chan", "text", "", "", 0); err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+
+	const n = 520 // > one 500-row chunk, so the run crosses a chunk boundary.
+	ids := make([]int64, 0, n)
+	for i := range n {
+		uid, err := database.CreateUser(ctx, "batchuser"+strconv.Itoa(i), "hash", 4)
+		if err != nil {
+			t.Fatalf("CreateUser: %v", err)
+		}
+		ids = append(ids, uid)
+	}
+
+	if err := database.IncrementMentionCounts(ctx, 1, ids); err != nil {
+		t.Fatalf("IncrementMentionCounts: %v", err)
+	}
+
+	for _, uid := range []int64{ids[0], ids[499], ids[500], ids[n-1]} {
+		if got, err := database.GetMentionCount(ctx, uid, 1); err != nil || got != 1 {
+			t.Errorf("user %d mention_count = %d (err=%v), want 1", uid, got, err)
+		}
+	}
+
+	// A second pass bumps every one of them again, chunk boundary included.
+	if err := database.IncrementMentionCounts(ctx, 1, ids); err != nil {
+		t.Fatalf("IncrementMentionCounts (second pass): %v", err)
+	}
+	for _, uid := range []int64{ids[0], ids[499], ids[500], ids[n-1]} {
+		if got, err := database.GetMentionCount(ctx, uid, 1); err != nil || got != 2 {
+			t.Errorf("user %d mention_count after second pass = %d (err=%v), want 2", uid, got, err)
+		}
+	}
+}
+
+func TestIncrementMentionCounts_EmptyIsNoop(t *testing.T) {
+	database := newMigratedTestDB(t)
+	seedMentionFixture(t, database)
+	if err := database.IncrementMentionCounts(context.Background(), 1, nil); err != nil {
+		t.Fatalf("IncrementMentionCounts(nil): %v", err)
+	}
+}
+
+func TestGetUserIDsByUsernames_CaseInsensitive(t *testing.T) {
+	database := newMigratedTestDB(t)
+	seedMentionFixture(t, database)
+
+	got, err := database.GetUserIDsByUsernames(context.Background(), []string{"BOB", "carol", "ghost"})
+	if err != nil {
+		t.Fatalf("GetUserIDsByUsernames: %v", err)
+	}
+	if got["bob"] != 2 {
+		t.Errorf("bob = %d, want 2", got["bob"])
+	}
+	if got["carol"] != 3 {
+		t.Errorf("carol = %d, want 3 (stored as \"Carol\")", got["carol"])
+	}
+	if _, ok := got["ghost"]; ok {
+		t.Error("unknown username must not resolve")
+	}
+}
+
+func TestListMentionTargetsByRoles(t *testing.T) {
+	database := newMigratedTestDB(t)
+	seedMentionFixture(t, database)
+	ctx := context.Background()
+
+	if err := database.UpdateUserStatus(ctx, 2, "online"); err != nil {
+		t.Fatalf("UpdateUserStatus: %v", err)
+	}
+
+	targets, err := database.ListMentionTargetsByRoles(ctx, []int64{4})
+	if err != nil {
+		t.Fatalf("ListMentionTargetsByRoles: %v", err)
+	}
+	if len(targets) != 3 {
+		t.Fatalf("targets = %d, want 3", len(targets))
+	}
+	for _, tgt := range targets {
+		if tgt.UserID == 2 && tgt.Status != "online" {
+			t.Errorf("user 2 status = %q, want online", tgt.Status)
+		}
+	}
+
+	empty, err := database.ListMentionTargetsByRoles(ctx, nil)
+	if err != nil || len(empty) != 0 {
+		t.Errorf("no roles must yield no targets: %v %v", empty, err)
+	}
+}
+
+func TestListBlockersOf(t *testing.T) {
+	database := newMigratedTestDB(t)
+	seedMentionFixture(t, database)
+	ctx := context.Background()
+
+	if err := database.BlockUser(ctx, 2, 1); err != nil {
+		t.Fatalf("BlockUser: %v", err)
+	}
+	blockers, err := database.ListBlockersOf(ctx, 1)
+	if err != nil {
+		t.Fatalf("ListBlockersOf: %v", err)
+	}
+	if len(blockers) != 1 || blockers[0] != 2 {
+		t.Errorf("blockers = %v, want [2]", blockers)
+	}
+}
+
+func TestGetChannelOverrides(t *testing.T) {
+	database := newMigratedTestDB(t)
+	seedMentionFixture(t, database)
+	ctx := context.Background()
+
+	if err := database.UpsertChannelOverride(ctx, 1, 4, 0, 2); err != nil {
+		t.Fatalf("UpsertChannelOverride: %v", err)
+	}
+	got, err := database.GetChannelOverrides(ctx, 1)
+	if err != nil {
+		t.Fatalf("GetChannelOverrides: %v", err)
+	}
+	if o, ok := got[4]; !ok || o.Deny != 2 {
+		t.Errorf("override for role 4 = %+v, want deny=2", o)
+	}
+}
+
+// TestMessagesForAPI_CarryMentions locks that REST history hands back the
+// resolved mention list and the everyone flag.
+func TestMessagesForAPI_CarryMentions(t *testing.T) {
+	database := newMigratedTestDB(t)
+	seedMentionFixture(t, database)
+	ctx := context.Background()
+
+	if _, err := database.CreateMessageWithMentions(ctx, 1, 1, "hi @bob", nil, []int64{2}, true); err != nil {
+		t.Fatalf("CreateMessageWithMentions: %v", err)
+	}
+	msgs, err := database.GetMessagesForAPI(ctx, 1, 0, 10, 1)
+	if err != nil {
+		t.Fatalf("GetMessagesForAPI: %v", err)
+	}
+	if len(msgs) != 1 {
+		t.Fatalf("messages = %d, want 1", len(msgs))
+	}
+	if len(msgs[0].Mentions) != 1 || msgs[0].Mentions[0] != 2 {
+		t.Errorf("mentions = %v, want [2]", msgs[0].Mentions)
+	}
+	if !msgs[0].MentionsEveryone {
+		t.Error("mentions_everyone = false, want true")
+	}
+}
+
+func TestSearchMessages_CarryMentions(t *testing.T) {
+	database := newMigratedTestDB(t)
+	seedMentionFixture(t, database)
+	ctx := context.Background()
+
+	if _, err := database.CreateMessageWithMentions(ctx, 1, 1, "deployment notes", nil, []int64{2}, false); err != nil {
+		t.Fatalf("CreateMessageWithMentions: %v", err)
+	}
+	results, err := database.SearchMessages(ctx, "deployment", nil, 10)
+	if err != nil {
+		t.Fatalf("SearchMessages: %v", err)
+	}
+	if len(results) != 1 {
+		t.Fatalf("results = %d, want 1", len(results))
+	}
+	if len(results[0].Mentions) != 1 || results[0].Mentions[0] != 2 {
+		t.Errorf("mentions = %v, want [2]", results[0].Mentions)
+	}
+	if results[0].MentionsEveryone {
+		t.Error("mentions_everyone = true, want false")
+	}
+}
diff --git a/Server/db/message_queries.go b/Server/db/message_queries.go
index a6d3d74a..ee8b956c 100644
--- a/Server/db/message_queries.go
+++ b/Server/db/message_queries.go
@@ -14,15 +14,16 @@ import (
 // messageFromGen maps a generated message row to the domain Message model.
 func messageFromGen(m dbgen.Message) *Message {
 	return &Message{
-		ID:        m.ID,
-		ChannelID: m.ChannelID,
-		UserID:    m.UserID,
-		Content:   m.Content,
-		ReplyTo:   m.ReplyTo,
-		EditedAt:  m.EditedAt,
-		Deleted:   m.Deleted != 0,
-		Pinned:    m.Pinned != 0,
-		Timestamp: m.Timestamp,
+		ID:               m.ID,
+		ChannelID:        m.ChannelID,
+		UserID:           m.UserID,
+		Content:          m.Content,
+		ReplyTo:          m.ReplyTo,
+		EditedAt:         m.EditedAt,
+		Deleted:          m.Deleted != 0,
+		Pinned:           m.Pinned != 0,
+		Timestamp:        m.Timestamp,
+		MentionsEveryone: m.MentionsEveryone != 0,
 	}
 }
 
@@ -179,6 +180,74 @@ func (d *DB) DeleteMessage(ctx context.Context, id, userID int64, ismod bool) er
 	return nil
 }
 
+// PurgeChannelMessages soft-deletes the newest limit non-deleted messages in a
+// channel and returns their IDs, newest first. When before > 0 only messages
+// with id < before are considered.
+//
+// Rows are marked deleted=1 and otherwise left intact, so the tombstones every
+// reader already renders (and the reply_to targets pointing at them) survive a
+// purge exactly as they do a single delete. Selection and update run in one
+// writer transaction so a concurrent single delete cannot make the reported id
+// set diverge from what was actually written.
+func (d *DB) PurgeChannelMessages(ctx context.Context, channelID, before int64, limit int) ([]int64, error) {
+	if limit < 1 {
+		return []int64{}, nil
+	}
+
+	tx, err := d.writer.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, fmt.Errorf("PurgeChannelMessages begin tx: %w", err)
+	}
+	defer tx.Rollback() //nolint:errcheck
+
+	sel := `SELECT id FROM messages WHERE channel_id = ? AND deleted = 0 ORDER BY id DESC LIMIT ?`
+	args := []any{channelID, limit}
+	if before > 0 {
+		sel = `SELECT id FROM messages WHERE channel_id = ? AND id < ? AND deleted = 0 ORDER BY id DESC LIMIT ?`
+		args = []any{channelID, before, limit}
+	}
+
+	rows, err := tx.QueryContext(ctx, sel, args...)
+	if err != nil {
+		return nil, fmt.Errorf("PurgeChannelMessages select: %w", err)
+	}
+	var ids []int64
+	for rows.Next() {
+		var id int64
+		if scanErr := rows.Scan(&id); scanErr != nil {
+			rows.Close() //nolint:errcheck
+			return nil, fmt.Errorf("PurgeChannelMessages scan: %w", scanErr)
+		}
+		ids = append(ids, id)
+	}
+	rows.Close() //nolint:errcheck
+	if rows.Err() != nil {
+		return nil, fmt.Errorf("PurgeChannelMessages rows: %w", rows.Err())
+	}
+	if len(ids) == 0 {
+		return []int64{}, nil
+	}
+
+	placeholders := make([]string, len(ids))
+	updateArgs := make([]any, 0, len(ids))
+	for i, id := range ids {
+		placeholders[i] = "?"
+		updateArgs = append(updateArgs, id)
+	}
+	if _, err := tx.ExecContext(ctx,
+		fmt.Sprintf(`UPDATE messages SET deleted = 1 WHERE id IN (%s)`, //nolint:gosec // G201: placeholder interpolation, not user input
+			strings.Join(placeholders, ",")),
+		updateArgs...,
+	); err != nil {
+		return nil, fmt.Errorf("PurgeChannelMessages update: %w", err)
+	}
+
+	if err := tx.Commit(); err != nil {
+		return nil, fmt.Errorf("PurgeChannelMessages commit: %w", err)
+	}
+	return ids, nil
+}
+
 // AddReaction inserts a reaction. Returns an error on duplicate (same user+emoji+message).
 func (d *DB) AddReaction(ctx context.Context, messageID, userID int64, emoji string) error {
 	if err := d.q.AddReaction(ctx, dbgen.AddReactionParams{
@@ -222,6 +291,32 @@ func (d *DB) GetReactions(ctx context.Context, messageID int64) ([]ReactionCount
 	return counts, nil
 }
 
+// MaxReactionUsers bounds the who-reacted list. A reaction pill can carry
+// thousands of reactors; the tooltip only ever names a handful, so the query is
+// capped rather than paginated.
+const MaxReactionUsers = 100
+
+// GetReactionUsers returns up to limit reactors for one (message, emoji) pair,
+// oldest reaction first. limit is clamped to MaxReactionUsers.
+func (d *DB) GetReactionUsers(ctx context.Context, messageID int64, emoji string, limit int) ([]ReactionUser, error) {
+	if limit <= 0 || limit > MaxReactionUsers {
+		limit = MaxReactionUsers
+	}
+	rows, err := d.q.GetReactionUsers(ctx, dbgen.GetReactionUsersParams{
+		MessageID: messageID,
+		Emoji:     emoji,
+		Limit:     int64(limit),
+	})
+	if err != nil {
+		return nil, fmt.Errorf("GetReactionUsers: %w", err)
+	}
+	users := make([]ReactionUser, 0, len(rows))
+	for _, r := range rows {
+		users = append(users, ReactionUser{ID: r.ID, Username: r.Username, Avatar: r.Avatar})
+	}
+	return users, nil
+}
+
 // SearchMessages performs a full-text search against the messages_fts virtual table.
 // When channelID is non-nil the search is scoped to that channel.
 // Deleted messages are excluded from results.
@@ -244,7 +339,8 @@ func (d *DB) SearchMessages(ctx context.Context, query string, channelID *int64,
 
 	if channelID != nil {
 		rows, err = d.reader.QueryContext(ctx,
-			`SELECT m.id, m.channel_id, c.name, u.id, u.username, u.avatar, m.content, m.timestamp
+			`SELECT m.id, m.channel_id, c.name, u.id, u.username, u.avatar, m.content,
+			        m.timestamp, m.mentions_everyone
 			 FROM messages_fts f
 			 JOIN messages m ON f.rowid = m.id
 			 JOIN channels c ON m.channel_id = c.id
@@ -255,7 +351,8 @@ func (d *DB) SearchMessages(ctx context.Context, query string, channelID *int64,
 		)
 	} else {
 		rows, err = d.reader.QueryContext(ctx,
-			`SELECT m.id, m.channel_id, c.name, u.id, u.username, u.avatar, m.content, m.timestamp
+			`SELECT m.id, m.channel_id, c.name, u.id, u.username, u.avatar, m.content,
+			        m.timestamp, m.mentions_everyone
 			 FROM messages_fts f
 			 JOIN messages m ON f.rowid = m.id
 			 JOIN channels c ON m.channel_id = c.id
@@ -270,23 +367,11 @@ func (d *DB) SearchMessages(ctx context.Context, query string, channelID *int64,
 	}
 	defer rows.Close() //nolint:errcheck
 
-	var results []MessageSearchResult
-	for rows.Next() {
-		var r MessageSearchResult
-		if scanErr := rows.Scan(&r.MessageID, &r.ChannelID, &r.ChannelName,
-			&r.User.ID, &r.User.Username, &r.User.Avatar,
-			&r.Content, &r.Timestamp); scanErr != nil {
-			return nil, fmt.Errorf("SearchMessages scan: %w", scanErr)
-		}
-		results = append(results, r)
+	results, err := scanSearchResults(rows, "SearchMessages")
+	if err != nil {
+		return nil, err
 	}
-	if rows.Err() != nil {
-		return nil, fmt.Errorf("SearchMessages rows: %w", rows.Err())
-	}
-	if results == nil {
-		results = []MessageSearchResult{}
-	}
-	return results, nil
+	return d.attachSearchMentions(ctx, results)
 }
 
 // SearchMessagesInChannels performs a full-text search scoped to the given
@@ -316,7 +401,8 @@ func (d *DB) SearchMessagesInChannels(ctx context.Context, query string, channel
 
 	rows, err := d.reader.QueryContext(ctx,
 		fmt.Sprintf(
-			`SELECT m.id, m.channel_id, c.name, u.id, u.username, u.avatar, m.content, m.timestamp
+			`SELECT m.id, m.channel_id, c.name, u.id, u.username, u.avatar, m.content,
+			        m.timestamp, m.mentions_everyone
 			 FROM messages_fts f
 			 JOIN messages m ON f.rowid = m.id
 			 JOIN channels c ON m.channel_id = c.id
@@ -331,23 +417,11 @@ func (d *DB) SearchMessagesInChannels(ctx context.Context, query string, channel
 	}
 	defer rows.Close() //nolint:errcheck
 
-	var results []MessageSearchResult
-	for rows.Next() {
-		var r MessageSearchResult
-		if scanErr := rows.Scan(&r.MessageID, &r.ChannelID, &r.ChannelName,
-			&r.User.ID, &r.User.Username, &r.User.Avatar,
-			&r.Content, &r.Timestamp); scanErr != nil {
-			return nil, fmt.Errorf("SearchMessagesInChannels scan: %w", scanErr)
-		}
-		results = append(results, r)
+	results, err := scanSearchResults(rows, "SearchMessagesInChannels")
+	if err != nil {
+		return nil, err
 	}
-	if rows.Err() != nil {
-		return nil, fmt.Errorf("SearchMessagesInChannels rows: %w", rows.Err())
-	}
-	if results == nil {
-		results = []MessageSearchResult{}
-	}
-	return results, nil
+	return d.attachSearchMentions(ctx, results)
 }
 
 // GetMessagesForAPI returns messages in the API.md response shape, including
@@ -360,7 +434,8 @@ func (d *DB) GetMessagesForAPI(ctx context.Context, channelID, before int64, lim
 	if before > 0 {
 		rows, err = d.reader.QueryContext(ctx,
 			`SELECT m.id, m.channel_id, m.user_id, u.username, u.avatar,
-			        m.content, m.reply_to, m.edited_at, m.deleted, m.pinned, m.timestamp
+			        m.content, m.reply_to, m.edited_at, m.deleted, m.pinned, m.timestamp,
+			        m.mentions_everyone
 			 FROM messages m JOIN users u ON m.user_id = u.id
 			 WHERE m.channel_id = ? AND m.id < ? AND m.deleted = 0
 			 ORDER BY m.id DESC LIMIT ?`,
@@ -369,7 +444,8 @@ func (d *DB) GetMessagesForAPI(ctx context.Context, channelID, before int64, lim
 	} else {
 		rows, err = d.reader.QueryContext(ctx,
 			`SELECT m.id, m.channel_id, m.user_id, u.username, u.avatar,
-			        m.content, m.reply_to, m.edited_at, m.deleted, m.pinned, m.timestamp
+			        m.content, m.reply_to, m.edited_at, m.deleted, m.pinned, m.timestamp,
+			        m.mentions_everyone
 			 FROM messages m JOIN users u ON m.user_id = u.id
 			 WHERE m.channel_id = ? AND m.deleted = 0
 			 ORDER BY m.id DESC LIMIT ?`,
@@ -384,6 +460,53 @@ func (d *DB) GetMessagesForAPI(ctx context.Context, channelID, before int64, lim
 	return d.scanAndEnrichMessages(ctx, rows, requestingUserID)
 }
 
+// GetMessagesAroundForAPI returns a window of messages centred on centerID in
+// the API response shape, ordered oldest-first: up to beforeCount messages
+// older than the centre, the centre itself, and up to afterCount newer ones.
+//
+// Callers that need to know whether the channel holds more history on either
+// side pass one extra on each count and inspect the returned slice — this
+// query does no probing of its own.
+func (d *DB) GetMessagesAroundForAPI(ctx context.Context, channelID, centerID int64, beforeCount, afterCount int, requestingUserID int64) ([]MessageAPIResponse, error) {
+	if beforeCount < 0 {
+		beforeCount = 0
+	}
+	if afterCount < 0 {
+		afterCount = 0
+	}
+	// SQLite forbids ORDER BY/LIMIT on a compound-SELECT operand, so each half
+	// of the window is a nested subquery. The older half includes the centre
+	// row itself, hence beforeCount+1.
+	rows, err := d.reader.QueryContext(ctx,
+		`SELECT m.id, m.channel_id, m.user_id, u.username, u.avatar,
+		        m.content, m.reply_to, m.edited_at, m.deleted, m.pinned, m.timestamp,
+		        m.mentions_everyone
+		 FROM messages m JOIN users u ON m.user_id = u.id
+		 WHERE m.id IN (
+		     SELECT id FROM (
+		         SELECT id FROM messages
+		          WHERE channel_id = ? AND deleted = 0 AND id <= ?
+		          ORDER BY id DESC LIMIT ?
+		     )
+		     UNION ALL
+		     SELECT id FROM (
+		         SELECT id FROM messages
+		          WHERE channel_id = ? AND deleted = 0 AND id > ?
+		          ORDER BY id ASC LIMIT ?
+		     )
+		 )
+		 ORDER BY m.id ASC`,
+		channelID, centerID, beforeCount+1,
+		channelID, centerID, afterCount,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("GetMessagesAroundForAPI: %w", err)
+	}
+	defer rows.Close() //nolint:errcheck
+
+	return d.scanAndEnrichMessages(ctx, rows, requestingUserID)
+}
+
 // getReactionsBatch returns aggregated reactions for multiple messages.
 func (d *DB) getReactionsBatch(ctx context.Context, msgIDs []int64, requestingUserID int64) (map[int64][]ReactionInfo, error) {
 	if len(msgIDs) == 0 {
@@ -436,7 +559,8 @@ func (d *DB) getReactionsBatch(ctx context.Context, msgIDs []int64, requestingUs
 	return result, nil
 }
 
-// UpdateReadState upserts the read state for a user in a channel.
+// UpdateReadState upserts the read state for a user in a channel and clears
+// its mention badge — marking a channel read consumes its mentions.
 func (d *DB) UpdateReadState(ctx context.Context, userID, channelID, lastReadMessageID int64) error {
 	if err := d.q.UpdateReadState(ctx, dbgen.UpdateReadStateParams{
 		UserID:        userID,
@@ -450,9 +574,12 @@ func (d *DB) UpdateReadState(ctx context.Context, userID, channelID, lastReadMes
 
 // GetChannelUnreadCounts returns per-channel unread counts and last message IDs
 // for a given user. Text and announcement channels are included, with 0,0 for
-// channels that have no messages. Correlated subqueries range-scan
-// idx_messages_channel per channel instead of the old LEFT JOIN fan-out that
-// touched every message row on every WS connect.
+// channels that have no messages. DM channels are included too, but only the
+// ones this user participates in — without them the ready payload carried no
+// mention_count for DMs, so a DM mention badge silently reset on every
+// reconnect. Correlated subqueries range-scan idx_messages_channel per channel
+// instead of the old LEFT JOIN fan-out that touched every message row on every
+// WS connect; the DM predicate hits idx_dm_participants_user.
 func (d *DB) GetChannelUnreadCounts(ctx context.Context, userID int64) (map[int64]ChannelUnread, error) {
 	rows, err := d.reader.QueryContext(ctx,
 		`SELECT c.id,
@@ -461,10 +588,14 @@ func (d *DB) GetChannelUnreadCounts(ctx context.Context, userID int64) (map[int6
 		        (SELECT COUNT(*) FROM messages m
 		          WHERE m.channel_id = c.id AND m.deleted = 0
 		            AND m.id > COALESCE((SELECT rs.last_message_id FROM read_states rs
-		                                  WHERE rs.channel_id = c.id AND rs.user_id = ?), 0)) AS unread
+		                                  WHERE rs.channel_id = c.id AND rs.user_id = ?), 0)) AS unread,
+		        COALESCE((SELECT rs.mention_count FROM read_states rs
+		                   WHERE rs.channel_id = c.id AND rs.user_id = ?), 0) AS mentions
 		 FROM channels c
-		 WHERE c.type IN ('text', 'announcement')`,
-		userID,
+		 WHERE c.type IN ('text', 'announcement')
+		    OR (c.type = 'dm' AND EXISTS (SELECT 1 FROM dm_participants dp
+		                                   WHERE dp.channel_id = c.id AND dp.user_id = ?))`,
+		userID, userID, userID,
 	)
 	if err != nil {
 		return nil, fmt.Errorf("GetChannelUnreadCounts: %w", err)
@@ -475,7 +606,7 @@ func (d *DB) GetChannelUnreadCounts(ctx context.Context, userID int64) (map[int6
 	for rows.Next() {
 		var chID int64
 		var cu ChannelUnread
-		if scanErr := rows.Scan(&chID, &cu.LastMessageID, &cu.UnreadCount); scanErr != nil {
+		if scanErr := rows.Scan(&chID, &cu.LastMessageID, &cu.UnreadCount, &cu.MentionCount); scanErr != nil {
 			return nil, fmt.Errorf("GetChannelUnreadCounts scan: %w", scanErr)
 		}
 		result[chID] = cu
@@ -504,7 +635,8 @@ func (d *DB) GetLatestMessageID(ctx context.Context, channelID int64) (int64, er
 func (d *DB) GetPinnedMessages(ctx context.Context, channelID int64, requestingUserID int64) ([]MessageAPIResponse, error) {
 	rows, err := d.reader.QueryContext(ctx,
 		`SELECT m.id, m.channel_id, m.user_id, u.username, u.avatar,
-		        m.content, m.reply_to, m.edited_at, m.deleted, m.pinned, m.timestamp
+		        m.content, m.reply_to, m.edited_at, m.deleted, m.pinned, m.timestamp,
+		        m.mentions_everyone
 		 FROM messages m JOIN users u ON m.user_id = u.id
 		 WHERE m.channel_id = ? AND m.pinned = 1 AND m.deleted = 0
 		 ORDER BY m.id DESC`,
@@ -525,17 +657,20 @@ func (d *DB) scanAndEnrichMessages(ctx context.Context, rows *sql.Rows, requesti
 	var msgIDs []int64
 	for rows.Next() {
 		var m MessageAPIResponse
-		var deleted, pinned int
+		var deleted, pinned, everyone int
 		if scanErr := rows.Scan(
 			&m.ID, &m.ChannelID, &m.User.ID, &m.User.Username, &m.User.Avatar,
 			&m.Content, &m.ReplyTo, &m.EditedAt, &deleted, &pinned, &m.Timestamp,
+			&everyone,
 		); scanErr != nil {
 			return nil, fmt.Errorf("scanAndEnrichMessages scan: %w", scanErr)
 		}
 		m.Deleted = deleted != 0
 		m.Pinned = pinned != 0
+		m.MentionsEveryone = everyone != 0
 		m.Attachments = []AttachmentInfo{}
 		m.Reactions = []ReactionInfo{}
+		m.Mentions = []int64{}
 		msgs = append(msgs, m)
 		msgIDs = append(msgIDs, m.ID)
 	}
@@ -568,6 +703,17 @@ func (d *DB) scanAndEnrichMessages(ctx context.Context, rows *sql.Rows, requesti
 		}
 	}
 
+	// Batch-fetch resolved mentions for all message IDs.
+	mentionMap, err := d.GetMentionsByMessageIDs(ctx, msgIDs)
+	if err != nil {
+		return nil, fmt.Errorf("scanAndEnrichMessages mentions: %w", err)
+	}
+	for i := range msgs {
+		if mIDs, ok := mentionMap[msgs[i].ID]; ok {
+			msgs[i].Mentions = mIDs
+		}
+	}
+
 	return msgs, nil
 }
 
@@ -590,6 +736,50 @@ func (d *DB) SetMessagePinned(ctx context.Context, id int64, pinned bool) error
 
 // ─── helpers ──────────────────────────────────────────────────────────────────
 
+// scanSearchResults scans FTS search rows. label names the calling query in
+// error messages. Never returns a nil slice.
+func scanSearchResults(rows *sql.Rows, label string) ([]MessageSearchResult, error) {
+	results := []MessageSearchResult{}
+	for rows.Next() {
+		var r MessageSearchResult
+		var everyone int
+		if scanErr := rows.Scan(&r.MessageID, &r.ChannelID, &r.ChannelName,
+			&r.User.ID, &r.User.Username, &r.User.Avatar,
+			&r.Content, &r.Timestamp, &everyone); scanErr != nil {
+			return nil, fmt.Errorf("%s scan: %w", label, scanErr)
+		}
+		r.MentionsEveryone = everyone != 0
+		r.Mentions = []int64{}
+		results = append(results, r)
+	}
+	if rows.Err() != nil {
+		return nil, fmt.Errorf("%s rows: %w", label, rows.Err())
+	}
+	return results, nil
+}
+
+// attachSearchMentions fills in the resolved mention ids for search hits in one
+// batch query, mirroring how scanAndEnrichMessages enriches history rows.
+func (d *DB) attachSearchMentions(ctx context.Context, results []MessageSearchResult) ([]MessageSearchResult, error) {
+	if len(results) == 0 {
+		return results, nil
+	}
+	ids := make([]int64, len(results))
+	for i := range results {
+		ids[i] = results[i].MessageID
+	}
+	mentionMap, err := d.GetMentionsByMessageIDs(ctx, ids)
+	if err != nil {
+		return nil, fmt.Errorf("attachSearchMentions: %w", err)
+	}
+	for i := range results {
+		if m, ok := mentionMap[results[i].MessageID]; ok {
+			results[i].Mentions = m
+		}
+	}
+	return results, nil
+}
+
 // scanMessageWithUser scans a MessageWithUser from *sql.Rows.
 func scanMessageWithUser(rows *sql.Rows) (MessageWithUser, error) {
 	var mwu MessageWithUser
diff --git a/Server/db/message_queries_test.go b/Server/db/message_queries_test.go
index 07e49910..42ce5f83 100644
--- a/Server/db/message_queries_test.go
+++ b/Server/db/message_queries_test.go
@@ -2,6 +2,8 @@ package db_test
 
 import (
 	"context"
+	"slices"
+	"strconv"
 	"testing"
 
 	"github.com/owncord/server/db"
@@ -335,6 +337,149 @@ func TestDeleteMessage_NotFound(t *testing.T) {
 	}
 }
 
+// ─── PurgeChannelMessages ─────────────────────────────────────────────────────
+
+// purgeSeed inserts n messages into a fresh channel and returns the database,
+// the channel id, and the message ids in insertion (oldest-first) order.
+func purgeSeed(t *testing.T, n int) (*db.DB, int64, []int64) {
+	t.Helper()
+	database := openMigratedMemory(t)
+	userID := seedUser(t, database, "purger")
+	chID := seedChannel(t, database, "purge-ch")
+	ids := make([]int64, 0, n)
+	for i := range n {
+		id, err := database.CreateMessage(context.Background(), chID, userID,
+			"msg"+strconv.Itoa(i), nil)
+		if err != nil {
+			t.Fatalf("CreateMessage %d: %v", i, err)
+		}
+		ids = append(ids, id)
+	}
+	return database, chID, ids
+}
+
+func TestPurgeChannelMessages_DeletesNewestFirst(t *testing.T) {
+	database, chID, ids := purgeSeed(t, 5)
+
+	got, err := database.PurgeChannelMessages(context.Background(), chID, 0, 2)
+	if err != nil {
+		t.Fatalf("PurgeChannelMessages: %v", err)
+	}
+	want := []int64{ids[4], ids[3]}
+	if !slices.Equal(got, want) {
+		t.Fatalf("purged ids = %v, want %v", got, want)
+	}
+	for _, id := range want {
+		msg, _ := database.GetMessage(context.Background(), id)
+		if msg == nil || !msg.Deleted {
+			t.Errorf("message %d should be soft-deleted", id)
+		}
+	}
+	for _, id := range ids[:3] {
+		msg, _ := database.GetMessage(context.Background(), id)
+		if msg == nil || msg.Deleted {
+			t.Errorf("message %d should be untouched", id)
+		}
+	}
+}
+
+func TestPurgeChannelMessages_PreservesTombstones(t *testing.T) {
+	database, chID, ids := purgeSeed(t, 3)
+
+	if _, err := database.PurgeChannelMessages(context.Background(), chID, 0, 3); err != nil {
+		t.Fatalf("PurgeChannelMessages: %v", err)
+	}
+
+	// The rows must survive with their content, so tombstones render and
+	// reply_to targets still resolve — exactly as a single soft delete.
+	for _, id := range ids {
+		msg, err := database.GetMessage(context.Background(), id)
+		if err != nil {
+			t.Fatalf("GetMessage(%d): %v", id, err)
+		}
+		if msg == nil {
+			t.Fatalf("message %d was hard-deleted", id)
+		}
+		if !msg.Deleted {
+			t.Errorf("message %d not marked deleted", id)
+		}
+		if msg.Content == "" {
+			t.Errorf("message %d lost its content", id)
+		}
+	}
+}
+
+func TestPurgeChannelMessages_SkipsAlreadyDeleted(t *testing.T) {
+	database, chID, ids := purgeSeed(t, 4)
+	if _, err := database.PurgeChannelMessages(context.Background(), chID, 0, 1); err != nil {
+		t.Fatalf("first purge: %v", err)
+	}
+
+	got, err := database.PurgeChannelMessages(context.Background(), chID, 0, 10)
+	if err != nil {
+		t.Fatalf("second purge: %v", err)
+	}
+	want := []int64{ids[2], ids[1], ids[0]}
+	if !slices.Equal(got, want) {
+		t.Fatalf("second purge ids = %v, want %v", got, want)
+	}
+}
+
+func TestPurgeChannelMessages_BeforeCursor(t *testing.T) {
+	database, chID, ids := purgeSeed(t, 5)
+
+	got, err := database.PurgeChannelMessages(context.Background(), chID, ids[2], 10)
+	if err != nil {
+		t.Fatalf("PurgeChannelMessages: %v", err)
+	}
+	want := []int64{ids[1], ids[0]}
+	if !slices.Equal(got, want) {
+		t.Fatalf("purged ids = %v, want %v", got, want)
+	}
+	for _, id := range ids[2:] {
+		msg, _ := database.GetMessage(context.Background(), id)
+		if msg.Deleted {
+			t.Errorf("message %d at/after the cursor should be untouched", id)
+		}
+	}
+}
+
+func TestPurgeChannelMessages_OtherChannelsUntouched(t *testing.T) {
+	database, chID, ids := purgeSeed(t, 2)
+	otherCh := seedChannel(t, database, "other")
+	otherID, _ := database.CreateMessage(context.Background(), otherCh, ids[0], "keep", nil)
+
+	if _, err := database.PurgeChannelMessages(context.Background(), chID, 0, 100); err != nil {
+		t.Fatalf("PurgeChannelMessages: %v", err)
+	}
+
+	msg, _ := database.GetMessage(context.Background(), otherID)
+	if msg == nil || msg.Deleted {
+		t.Error("a message in another channel was purged")
+	}
+}
+
+func TestPurgeChannelMessages_EmptyChannelAndZeroLimit(t *testing.T) {
+	database, chID, _ := purgeSeed(t, 1)
+
+	got, err := database.PurgeChannelMessages(context.Background(), chID, 0, 0)
+	if err != nil {
+		t.Fatalf("zero limit: %v", err)
+	}
+	if len(got) != 0 {
+		t.Fatalf("zero limit purged %v, want none", got)
+	}
+
+	emptyCh := seedChannel(t, database, "empty")
+	got, err = database.PurgeChannelMessages(context.Background(), emptyCh, 0, 50)
+	if err != nil {
+		t.Fatalf("empty channel: %v", err)
+	}
+	if got == nil || len(got) != 0 {
+		t.Fatalf("empty channel returned %v, want empty non-nil slice", got)
+	}
+}
+
 // ─── Reactions ────────────────────────────────────────────────────────────────
 
 func TestAddReaction_Success(t *testing.T) {
@@ -681,6 +826,147 @@ func TestGetMessagesForAPI_ExcludesDeleted(t *testing.T) {
 	}
 }
 
+// ─── GetMessagesAroundForAPI ────────────────────────────────────────────────
+
+// seedAroundMessages fills a channel with n messages and returns their ids in
+// ascending order.
+func seedAroundMessages(t *testing.T, database *db.DB, chID, userID int64, n int) []int64 {
+	t.Helper()
+	ids := make([]int64, 0, n)
+	for i := range n {
+		id, err := database.CreateMessage(context.Background(), chID, userID, "m"+strconv.Itoa(i), nil)
+		if err != nil {
+			t.Fatalf("CreateMessage %d: %v", i, err)
+		}
+		ids = append(ids, id)
+	}
+	return ids
+}
+
+func TestGetMessagesAroundForAPI_CentersAndOrdersAscending(t *testing.T) {
+	database := openMigratedMemory(t)
+	userID := seedUser(t, database, "aroundu1")
+	chID := seedChannel(t, database, "aroundc1")
+	ids := seedAroundMessages(t, database, chID, userID, 20)
+
+	msgs, err := database.GetMessagesAroundForAPI(context.Background(), chID, ids[10], 3, 2, userID)
+	if err != nil {
+		t.Fatalf("GetMessagesAroundForAPI: %v", err)
+	}
+	// 3 older + centre + 2 newer.
+	want := []int64{ids[7], ids[8], ids[9], ids[10], ids[11], ids[12]}
+	got := make([]int64, 0, len(msgs))
+	for _, m := range msgs {
+		got = append(got, m.ID)
+	}
+	if !slices.Equal(got, want) {
+		t.Errorf("window = %v, want %v", got, want)
+	}
+}
+
+func TestGetMessagesAroundForAPI_ClampsAtChannelEdges(t *testing.T) {
+	database := openMigratedMemory(t)
+	userID := seedUser(t, database, "aroundu2")
+	chID := seedChannel(t, database, "aroundc2")
+	ids := seedAroundMessages(t, database, chID, userID, 4)
+
+	first, err := database.GetMessagesAroundForAPI(context.Background(), chID, ids[0], 10, 10, userID)
+	if err != nil {
+		t.Fatalf("GetMessagesAroundForAPI(first): %v", err)
+	}
+	if len(first) != 4 || first[0].ID != ids[0] {
+		t.Errorf("window at the first message = %d entries starting at %d, want 4 starting at %d",
+			len(first), first[0].ID, ids[0])
+	}
+
+	last, err := database.GetMessagesAroundForAPI(context.Background(), chID, ids[3], 10, 10, userID)
+	if err != nil {
+		t.Fatalf("GetMessagesAroundForAPI(last): %v", err)
+	}
+	if len(last) != 4 || last[len(last)-1].ID != ids[3] {
+		t.Errorf("window at the last message = %d entries ending at %d, want 4 ending at %d",
+			len(last), last[len(last)-1].ID, ids[3])
+	}
+}
+
+func TestGetMessagesAroundForAPI_ExcludesDeleted(t *testing.T) {
+	database := openMigratedMemory(t)
+	userID := seedUser(t, database, "aroundu3")
+	chID := seedChannel(t, database, "aroundc3")
+	ids := seedAroundMessages(t, database, chID, userID, 5)
+	if err := database.DeleteMessage(context.Background(), ids[1], userID, false); err != nil {
+		t.Fatalf("DeleteMessage: %v", err)
+	}
+
+	msgs, err := database.GetMessagesAroundForAPI(context.Background(), chID, ids[2], 5, 5, userID)
+	if err != nil {
+		t.Fatalf("GetMessagesAroundForAPI: %v", err)
+	}
+	for _, m := range msgs {
+		if m.ID == ids[1] {
+			t.Fatalf("deleted message %d present in the window", ids[1])
+		}
+	}
+	if len(msgs) != 4 {
+		t.Errorf("window size = %d, want 4", len(msgs))
+	}
+}
+
+func TestGetMessagesAroundForAPI_ScopedToChannel(t *testing.T) {
+	database := openMigratedMemory(t)
+	userID := seedUser(t, database, "aroundu4")
+	chA := seedChannel(t, database, "aroundc4a")
+	chB := seedChannel(t, database, "aroundc4b")
+	idsA := seedAroundMessages(t, database, chA, userID, 3)
+	seedAroundMessages(t, database, chB, userID, 3)
+
+	msgs, err := database.GetMessagesAroundForAPI(context.Background(), chA, idsA[1], 10, 10, userID)
+	if err != nil {
+		t.Fatalf("GetMessagesAroundForAPI: %v", err)
+	}
+	if len(msgs) != 3 {
+		t.Fatalf("window size = %d, want the 3 messages of channel A only", len(msgs))
+	}
+	for _, m := range msgs {
+		if m.ChannelID != chA {
+			t.Errorf("message %d belongs to channel %d, not %d", m.ID, m.ChannelID, chA)
+		}
+	}
+}
+
+func TestGetMessagesAroundForAPI_NegativeCountsClampToZero(t *testing.T) {
+	database := openMigratedMemory(t)
+	userID := seedUser(t, database, "aroundu5")
+	chID := seedChannel(t, database, "aroundc5")
+	ids := seedAroundMessages(t, database, chID, userID, 5)
+
+	// A negative count must not become a negative SQL LIMIT (which SQLite
+	// reads as "no limit" and would silently return the whole channel).
+	msgs, err := database.GetMessagesAroundForAPI(context.Background(), chID, ids[2], -4, -4, userID)
+	if err != nil {
+		t.Fatalf("GetMessagesAroundForAPI: %v", err)
+	}
+	if len(msgs) != 1 || msgs[0].ID != ids[2] {
+		t.Errorf("window = %d entries, want just the centre %d", len(msgs), ids[2])
+	}
+}
+
+func TestGetMessagesAroundForAPI_UnknownCentreIsEmpty(t *testing.T) {
+	database := openMigratedMemory(t)
+	userID := seedUser(t, database, "aroundu6")
+	chID := seedChannel(t, database, "aroundc6")
+	seedAroundMessages(t, database, chID, userID, 3)
+
+	msgs, err := database.GetMessagesAroundForAPI(context.Background(), chID, 999999, 5, 5, userID)
+	if err != nil {
+		t.Fatalf("GetMessagesAroundForAPI: %v", err)
+	}
+	// Nothing is <= the centre in this channel below it, and nothing above it.
+	if len(msgs) != 3 {
+		t.Errorf("window size = %d; an out-of-range centre should still be bounded by the channel", len(msgs))
+	}
+}
+
 // ─── GetChannelUnreadCounts ─────────────────────────────────────────────────
 
 func TestGetChannelUnreadCounts_NoMessages(t *testing.T) {
@@ -852,3 +1138,166 @@ func TestGetLatestMessageID_ExcludesDeleted(t *testing.T) {
 		t.Errorf("GetLatestMessageID = %d, want %d (deleted excluded)", latestID, id1)
 	}
 }
+
+// ─── GetReactionUsers ───────────────────────────────────────────────────────
+
+func TestGetReactionUsers_ReturnsReactorsInReactionOrder(t *testing.T) {
+	database := openMigratedMemory(t)
+	chID := seedChannel(t, database, "reactusers")
+	author := seedUser(t, database, "reactauthor")
+	first := seedUser(t, database, "reactfirst")
+	second := seedUser(t, database, "reactsecond")
+	msgID, _ := database.CreateMessage(context.Background(), chID, author, "react to me", nil)
+
+	// second reacts before first, so reaction order (not user id) decides.
+	if err := database.AddReaction(context.Background(), msgID, second, "👍"); err != nil {
+		t.Fatalf("AddReaction(second): %v", err)
+	}
+	if err := database.AddReaction(context.Background(), msgID, first, "👍"); err != nil {
+		t.Fatalf("AddReaction(first): %v", err)
+	}
+	// A different emoji on the same message must not leak in.
+	if err := database.AddReaction(context.Background(), msgID, author, "🎉"); err != nil {
+		t.Fatalf("AddReaction(other emoji): %v", err)
+	}
+
+	users, err := database.GetReactionUsers(context.Background(), msgID, "👍", 100)
+	if err != nil {
+		t.Fatalf("GetReactionUsers: %v", err)
+	}
+	if len(users) != 2 {
+		t.Fatalf("len(users) = %d, want 2 (%+v)", len(users), users)
+	}
+	if users[0].Username != "reactsecond" || users[1].Username != "reactfirst" {
+		t.Errorf("order = [%s %s], want [reactsecond reactfirst]", users[0].Username, users[1].Username)
+	}
+	if users[0].ID != second {
+		t.Errorf("users[0].ID = %d, want %d", users[0].ID, second)
+	}
+}
+
+func TestGetReactionUsers_UnknownEmojiIsEmptyNotError(t *testing.T) {
+	database := openMigratedMemory(t)
+	chID := seedChannel(t, database, "reactempty")
+	userID := seedUser(t, database, "reactnone")
+	msgID, _ := database.CreateMessage(context.Background(), chID, userID, "hi", nil)
+
+	users, err := database.GetReactionUsers(context.Background(), msgID, "🐉", 100)
+	if err != nil {
+		t.Fatalf("GetReactionUsers: %v", err)
+	}
+	if len(users) != 0 {
+		t.Errorf("len(users) = %d, want 0", len(users))
+	}
+}
+
+func TestGetReactionUsers_ClampsLimitToMax(t *testing.T) {
+	database := openMigratedMemory(t)
+	chID := seedChannel(t, database, "reactclamp")
+	author := seedUser(t, database, "clampauthor")
+	msgID, _ := database.CreateMessage(context.Background(), chID, author, "many", nil)
+
+	const reactors = db.MaxReactionUsers + 5
+	for i := range reactors {
+		uid := seedUser(t, database, "clamper"+strconv.Itoa(i))
+		if err := database.AddReaction(context.Background(), msgID, uid, "👍"); err != nil {
+			t.Fatalf("AddReaction(%d): %v", i, err)
+		}
+	}
+
+	// A caller asking for more than the cap still gets at most the cap.
+	users, err := database.GetReactionUsers(context.Background(), msgID, "👍", 10_000)
+	if err != nil {
+		t.Fatalf("GetReactionUsers: %v", err)
+	}
+	if len(users) != db.MaxReactionUsers {
+		t.Errorf("len(users) = %d, want %d", len(users), db.MaxReactionUsers)
+	}
+
+	// A non-positive limit means "the cap", not "nothing".
+	users, err = database.GetReactionUsers(context.Background(), msgID, "👍", 0)
+	if err != nil {
+		t.Fatalf("GetReactionUsers(0): %v", err)
+	}
+	if len(users) != db.MaxReactionUsers {
+		t.Errorf("len(users) with limit 0 = %d, want %d", len(users), db.MaxReactionUsers)
+	}
+}
+
+func TestGetReactionUsers_RespectsSmallerLimit(t *testing.T) {
+	database := openMigratedMemory(t)
+	chID := seedChannel(t, database, "reactsmall")
+	author := seedUser(t, database, "smallauthor")
+	msgID, _ := database.CreateMessage(context.Background(), chID, author, "some", nil)
+	for i := range 5 {
+		uid := seedUser(t, database, "smaller"+strconv.Itoa(i))
+		_ = database.AddReaction(context.Background(), msgID, uid, "👍")
+	}
+
+	users, err := database.GetReactionUsers(context.Background(), msgID, "👍", 2)
+	if err != nil {
+		t.Fatalf("GetReactionUsers: %v", err)
+	}
+	if len(users) != 2 {
+		t.Errorf("len(users) = %d, want 2", len(users))
+	}
+}
+
+// ─── GetChannelUnreadCounts: DM rows ────────────────────────────────────────
+
+// DM channels the user participates in must appear, so the ready payload can
+// ship a real mention_count for them instead of resetting the badge to 0 on
+// every reconnect.
+func TestGetChannelUnreadCounts_IncludesParticipatingDMs(t *testing.T) {
+	database := openMigratedMemory(t)
+	alice := seedUser(t, database, "dmunreadalice")
+	bob := seedUser(t, database, "dmunreadbob")
+
+	ch, _, err := database.GetOrCreateDMChannel(context.Background(), alice, bob)
+	if err != nil {
+		t.Fatalf("GetOrCreateDMChannel: %v", err)
+	}
+	msgID, _ := database.CreateMessage(context.Background(), ch.ID, bob, "hey", nil)
+	if err := database.IncrementMentionCounts(context.Background(), ch.ID, []int64{alice}); err != nil {
+		t.Fatalf("IncrementMentionCounts: %v", err)
+	}
+
+	counts, err := database.GetChannelUnreadCounts(context.Background(), alice)
+	if err != nil {
+		t.Fatalf("GetChannelUnreadCounts: %v", err)
+	}
+	cu, ok := counts[ch.ID]
+	if !ok {
+		t.Fatalf("DM channel %d missing from unread counts for a participant", ch.ID)
+	}
+	if cu.LastMessageID != msgID {
+		t.Errorf("LastMessageID = %d, want %d", cu.LastMessageID, msgID)
+	}
+	if cu.UnreadCount != 1 {
+		t.Errorf("UnreadCount = %d, want 1", cu.UnreadCount)
+	}
+	if cu.MentionCount != 1 {
+		t.Errorf("MentionCount = %d, want 1", cu.MentionCount)
+	}
+}
+
+func TestGetChannelUnreadCounts_ExcludesForeignDMs(t *testing.T) {
+	database := openMigratedMemory(t)
+	alice := seedUser(t, database, "dmforeignalice")
+	bob := seedUser(t, database, "dmforeignbob")
+	outsider := seedUser(t, database, "dmforeignoutsider")
+
+	ch, _, err := database.GetOrCreateDMChannel(context.Background(), alice, bob)
+	if err != nil {
+		t.Fatalf("GetOrCreateDMChannel: %v", err)
+	}
+	_, _ = database.CreateMessage(context.Background(), ch.ID, bob, "private", nil)
+
+	counts, err := database.GetChannelUnreadCounts(context.Background(), outsider)
+	if err != nil {
+		t.Fatalf("GetChannelUnreadCounts: %v", err)
+	}
+	if _, ok := counts[ch.ID]; ok {
+		t.Errorf("DM channel %d leaked into a non-participant's unread counts", ch.ID)
+	}
+}
diff --git a/Server/db/migrate_test.go b/Server/db/migrate_test.go
index f3529284..2509a3ee 100644
--- a/Server/db/migrate_test.go
+++ b/Server/db/migrate_test.go
@@ -694,3 +694,54 @@ func TestMigrate_LargeNumberOfMigrations(t *testing.T) {
 		t.Errorf("schema_versions has %d rows, want %d", got, n)
 	}
 }
+
+// TestMigrate_022SeedsMentionEveryone locks migration 022: the privileged
+// seeded roles gain MENTION_EVERYONE (bit 21) and the plain Member role does
+// not, so @everyone stays gated after an upgrade of an existing database.
+func TestMigrate_022SeedsMentionEveryone(t *testing.T) {
+	database := openMemory(t)
+	if err := db.Migrate(database); err != nil {
+		t.Fatalf("Migrate() error: %v", err)
+	}
+
+	const mentionEveryone = int64(0x200000)
+	for _, tc := range []struct {
+		roleID int64
+		name   string
+		want   bool
+	}{
+		{1, "Owner", true},
+		{2, "Admin", true},
+		{3, "Moderator", true},
+		{4, "Member", false},
+	} {
+		var perms int64
+		if err := database.QueryRowContext(context.Background(),
+			`SELECT permissions FROM roles WHERE id = ?`, tc.roleID).Scan(&perms); err != nil {
+			t.Fatalf("read role %s: %v", tc.name, err)
+		}
+		if got := perms&mentionEveryone != 0; got != tc.want {
+			t.Errorf("%s MENTION_EVERYONE = %v, want %v (perms=0x%X)", tc.name, got, tc.want, perms)
+		}
+	}
+}
+
+// TestMigrate_022CreatesMentionSchema locks the storage phase 3 relies on.
+func TestMigrate_022CreatesMentionSchema(t *testing.T) {
+	database := openMemory(t)
+	if err := db.Migrate(database); err != nil {
+		t.Fatalf("Migrate() error: %v", err)
+	}
+	if !tableExists(t, database, "message_mentions") {
+		t.Error("message_mentions table not created")
+	}
+	var n int
+	if err := database.QueryRowContext(context.Background(),
+		`SELECT COUNT(*) FROM pragma_table_info('messages') WHERE name = 'mentions_everyone'`,
+	).Scan(&n); err != nil {
+		t.Fatalf("pragma_table_info: %v", err)
+	}
+	if n != 1 {
+		t.Error("messages.mentions_everyone column not added")
+	}
+}
diff --git a/Server/db/migrate_upgrade_test.go b/Server/db/migrate_upgrade_test.go
new file mode 100644
index 00000000..d1e93932
--- /dev/null
+++ b/Server/db/migrate_upgrade_test.go
@@ -0,0 +1,311 @@
+package db_test
+
+// migrate_upgrade_test.go — schema-coherence and upgrade round-trip tests for
+// the tracked migration system. These extend migrate_test.go (which locks
+// MigrateFS's tracking mechanics) with two higher-level guarantees:
+//
+//  1. The full embedded migration chain produces a coherent end schema: every
+//     table/column added by phases 2-6 exists, and the MENTION_EVERYONE bit
+//     seeded by migration 022 lands on the privileged roles only.
+//  2. A database that was created at an older schema point (migrations
+//     001..019 only, before any of the phase 2-6 additions) and already has
+//     data in it can be upgraded by applying the remaining migrations
+//     (020..028) without error, and every pre-existing row survives with sane
+//     defaults for the newly added columns.
+//
+// TestMigrate_022SeedsMentionEveryone and TestMigrate_022CreatesMentionSchema
+// in migrate_test.go already lock the mention-specific pieces in isolation;
+// this file's TestMigrate_FullChainSchemaIsCoherent asserts the same facts as
+// part of one end-to-end pass over the whole chain rather than duplicating
+// those tests.
+
+import (
+	"context"
+	"io/fs"
+	"testing"
+
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/migrations"
+)
+
+// migrationCutoffFS presents a filtered view of an underlying migrations FS
+// that only exposes files sorting lexicographically before cutoff. Migration
+// filenames are zero-padded ("019_perf_indexes.sql", "020_..."), so a string
+// cutoff of "020_" exposes exactly 001..019 and hides 020 and everything
+// after it. It implements fs.ReadDirFS and fs.ReadFileFS directly so
+// fs.ReadDir/fs.ReadFile use the filtered listing without needing Open to be
+// exercised.
+type migrationCutoffFS struct {
+	underlying fs.FS
+	cutoff     string
+}
+
+func (m migrationCutoffFS) included(name string) bool {
+	return name < m.cutoff
+}
+
+func (m migrationCutoffFS) Open(name string) (fs.File, error) {
+	if name != "." && !m.included(name) {
+		return nil, &fs.PathError{Op: "open", Path: name, Err: fs.ErrNotExist}
+	}
+	return m.underlying.Open(name)
+}
+
+func (m migrationCutoffFS) ReadDir(name string) ([]fs.DirEntry, error) {
+	entries, err := fs.ReadDir(m.underlying, name)
+	if err != nil {
+		return nil, err
+	}
+	out := make([]fs.DirEntry, 0, len(entries))
+	for _, e := range entries {
+		if m.included(e.Name()) {
+			out = append(out, e)
+		}
+	}
+	return out, nil
+}
+
+func (m migrationCutoffFS) ReadFile(name string) ([]byte, error) {
+	if !m.included(name) {
+		return nil, &fs.PathError{Op: "open", Path: name, Err: fs.ErrNotExist}
+	}
+	return fs.ReadFile(m.underlying, name)
+}
+
+// columnExists reports whether a table has a column with the given name,
+// using pragma_table_info so it works for columns added by ALTER TABLE ADD
+// COLUMN as well as ones present since CREATE TABLE.
+func columnExists(t *testing.T, database *db.DB, table, column string) bool {
+	t.Helper()
+	var n int
+	err := database.QueryRowContext(context.Background(),
+		`SELECT COUNT(*) FROM pragma_table_info(?) WHERE name = ?`, table, column,
+	).Scan(&n)
+	if err != nil {
+		t.Fatalf("pragma_table_info(%s) for column %s: %v", table, column, err)
+	}
+	return n > 0
+}
+
+// TestMigrate_FullChainSchemaIsCoherent applies the full embedded migration
+// chain to a fresh in-memory database and asserts that every table/column
+// added across phases 2-6 exists, and that the MENTION_EVERYONE permission
+// bit landed on exactly the privileged seeded roles.
+func TestMigrate_FullChainSchemaIsCoherent(t *testing.T) {
+	database := openMemory(t)
+	if err := db.Migrate(database); err != nil {
+		t.Fatalf("Migrate() error: %v", err)
+	}
+
+	for _, tbl := range []string{"message_mentions", "channel_user_overrides"} {
+		if !tableExists(t, database, tbl) {
+			t.Errorf("table %q not created by the full migration chain", tbl)
+		}
+	}
+
+	type colCheck struct{ table, column string }
+	for _, c := range []colCheck{
+		{"channels", "nsfw"},
+		{"channels", "is_group"},
+		{"users", "display_name"},
+		{"users", "about"},
+		{"users", "custom_status"},
+		{"voice_states", "server_muted"},
+		{"voice_states", "server_deafened"},
+		{"emoji", "mime_type"},
+		{"messages", "mentions_everyone"},
+	} {
+		if !columnExists(t, database, c.table, c.column) {
+			t.Errorf("column %s.%s not added by the full migration chain", c.table, c.column)
+		}
+	}
+
+	const mentionEveryone = int64(0x200000)
+	for _, tc := range []struct {
+		roleID int64
+		name   string
+		want   bool
+	}{
+		{1, "Owner", true},
+		{2, "Admin", true},
+		{3, "Moderator", true},
+		{4, "Member", false},
+	} {
+		var perms int64
+		if err := database.QueryRowContext(context.Background(),
+			`SELECT permissions FROM roles WHERE id = ?`, tc.roleID).Scan(&perms); err != nil {
+			t.Fatalf("read role %s: %v", tc.name, err)
+		}
+		if got := perms&mentionEveryone != 0; got != tc.want {
+			t.Errorf("%s MENTION_EVERYONE = %v, want %v (perms=0x%X)", tc.name, got, tc.want, perms)
+		}
+	}
+}
+
+// TestMigrate_UpgradeFromMigration019PreservesData simulates upgrading a
+// database that was last migrated at 019_perf_indexes.sql: it builds that
+// schema via a filtered view of the real embedded migrations, inserts a row
+// each into users/roles/channels/messages/voice_states/emoji (the tables the
+// 020..028 migrations touch), then applies the full chain and asserts:
+//
+//   - the upgrade completes without error,
+//   - the pre-existing rows are all still present (by primary key), and
+//   - the new columns those rows gained have the migration's stated defaults
+//     (0/NULL), not some other value — i.e. old data is not silently
+//     backfilled with something other than the documented default.
+func TestMigrate_UpgradeFromMigration019PreservesData(t *testing.T) {
+	database := openMemory(t)
+	ctx := context.Background()
+
+	oldFS := migrationCutoffFS{underlying: migrations.FS, cutoff: "020_"}
+	if err := db.MigrateFS(database, oldFS); err != nil {
+		t.Fatalf("MigrateFS() building pre-020 schema: %v", err)
+	}
+
+	// Sanity: none of the phase 2-6 additions exist yet.
+	for _, tbl := range []string{"message_mentions", "channel_user_overrides"} {
+		if tableExists(t, database, tbl) {
+			t.Fatalf("table %q already exists before migration 020+ ran — cutoff FS leaked later migrations", tbl)
+		}
+	}
+	if columnExists(t, database, "channels", "nsfw") {
+		t.Fatal("channels.nsfw already exists before migration 025 ran — cutoff FS leaked later migrations")
+	}
+
+	// Seed rows on the pre-upgrade schema. The default seeded roles (1-4) and
+	// their permission masks already exist from 001; add one custom role,
+	// one user, one channel, and one message referencing them, plus a
+	// voice_states row and an emoji row so every 020..028-touched table has a
+	// pre-existing row to check survival on.
+	if _, err := database.ExecContext(ctx,
+		`INSERT INTO roles (id, name, color, permissions, position, is_default)
+		 VALUES (5, 'Veteran', '#00FF00', 0x00000663, 50, 0)`); err != nil {
+		t.Fatalf("seed role: %v", err)
+	}
+	if _, err := database.ExecContext(ctx,
+		`INSERT INTO users (id, username, password, role_id) VALUES (1, 'alice', 'hash', 5)`); err != nil {
+		t.Fatalf("seed user: %v", err)
+	}
+	if _, err := database.ExecContext(ctx,
+		`INSERT INTO channels (id, name, type) VALUES (1, 'general', 'text')`); err != nil {
+		t.Fatalf("seed channel: %v", err)
+	}
+	if _, err := database.ExecContext(ctx,
+		`INSERT INTO messages (id, channel_id, user_id, content) VALUES (1, 1, 1, 'hello from before the upgrade')`); err != nil {
+		t.Fatalf("seed message: %v", err)
+	}
+	if _, err := database.ExecContext(ctx,
+		`INSERT INTO voice_states (user_id, channel_id, muted, deafened) VALUES (1, 1, 1, 0)`); err != nil {
+		t.Fatalf("seed voice_states: %v", err)
+	}
+	if _, err := database.ExecContext(ctx,
+		`INSERT INTO emoji (id, shortcode, filename, uploaded_by) VALUES (1, 'partyparrot', 'stored-uuid', 1)`); err != nil {
+		t.Fatalf("seed emoji: %v", err)
+	}
+
+	// Apply the remaining migrations (020..028) via the real production path.
+	if err := db.Migrate(database); err != nil {
+		t.Fatalf("Migrate() upgrading from 019 to head: %v", err)
+	}
+
+	// Every pre-existing row must still be present.
+	for _, tc := range []struct {
+		query string
+		args  []any
+		desc  string
+	}{
+		{"SELECT 1 FROM roles WHERE id = ?", []any{5}, "custom role"},
+		{"SELECT 1 FROM users WHERE id = ?", []any{1}, "user"},
+		{"SELECT 1 FROM channels WHERE id = ?", []any{1}, "channel"},
+		{"SELECT 1 FROM messages WHERE id = ?", []any{1}, "message"},
+		{"SELECT 1 FROM voice_states WHERE user_id = ?", []any{1}, "voice_states"},
+		{"SELECT 1 FROM emoji WHERE id = ?", []any{1}, "emoji"},
+	} {
+		var one int
+		if err := database.QueryRowContext(ctx, tc.query, tc.args...).Scan(&one); err != nil {
+			t.Errorf("%s row did not survive the upgrade: %v", tc.desc, err)
+		}
+	}
+
+	// New columns on the surviving rows must carry the documented defaults,
+	// not be silently backfilled with something else.
+	var nsfw, isGroup int
+	if err := database.QueryRowContext(ctx,
+		`SELECT nsfw, is_group FROM channels WHERE id = 1`).Scan(&nsfw, &isGroup); err != nil {
+		t.Fatalf("reading upgraded channel: %v", err)
+	}
+	if nsfw != 0 {
+		t.Errorf("channels.nsfw = %d for pre-existing channel, want 0", nsfw)
+	}
+	if isGroup != 0 {
+		t.Errorf("channels.is_group = %d for pre-existing channel, want 0", isGroup)
+	}
+
+	var displayName, about, customStatus *string
+	if err := database.QueryRowContext(ctx,
+		`SELECT display_name, about, custom_status FROM users WHERE id = 1`).Scan(&displayName, &about, &customStatus); err != nil {
+		t.Fatalf("reading upgraded user: %v", err)
+	}
+	if displayName != nil || about != nil || customStatus != nil {
+		t.Errorf("upgraded user gained non-NULL profile fields: display_name=%v about=%v custom_status=%v",
+			displayName, about, customStatus)
+	}
+
+	var serverMuted, serverDeafened int
+	if err := database.QueryRowContext(ctx,
+		`SELECT server_muted, server_deafened FROM voice_states WHERE user_id = 1`).Scan(&serverMuted, &serverDeafened); err != nil {
+		t.Fatalf("reading upgraded voice_states: %v", err)
+	}
+	if serverMuted != 0 || serverDeafened != 0 {
+		t.Errorf("voice_states gained non-zero server_muted/server_deafened: %d/%d", serverMuted, serverDeafened)
+	}
+
+	var mimeType string
+	if err := database.QueryRowContext(ctx,
+		`SELECT mime_type FROM emoji WHERE id = 1`).Scan(&mimeType); err != nil {
+		t.Fatalf("reading upgraded emoji: %v", err)
+	}
+	if mimeType != "image/png" {
+		t.Errorf("emoji.mime_type = %q for pre-existing row, want the migration's documented default %q", mimeType, "image/png")
+	}
+
+	var mentionsEveryone int
+	if err := database.QueryRowContext(ctx,
+		`SELECT mentions_everyone FROM messages WHERE id = 1`).Scan(&mentionsEveryone); err != nil {
+		t.Fatalf("reading upgraded message: %v", err)
+	}
+	if mentionsEveryone != 0 {
+		t.Errorf("messages.mentions_everyone = %d for pre-existing message, want 0", mentionsEveryone)
+	}
+
+	// The custom role (id 5, not in the seeded 1-3 set) must NOT have gained
+	// MENTION_EVERYONE — migration 022 only updates roles 1-3.
+	const mentionEveryone = int64(0x200000)
+	var perms int64
+	if err := database.QueryRowContext(ctx, `SELECT permissions FROM roles WHERE id = 5`).Scan(&perms); err != nil {
+		t.Fatalf("reading upgraded custom role: %v", err)
+	}
+	if perms&mentionEveryone != 0 {
+		t.Errorf("custom role id=5 gained MENTION_EVERYONE from the upgrade (perms=0x%X), want unchanged", perms)
+	}
+
+	// New tables introduced by 022/024 must now exist and be queryable.
+	for _, tbl := range []string{"message_mentions", "channel_user_overrides"} {
+		if !tableExists(t, database, tbl) {
+			t.Errorf("table %q missing after upgrade", tbl)
+		}
+	}
+
+	// Every migration file, old and new, must be recorded — this is the
+	// upgrade path's real contract: 001..019 came from the seed/normal path
+	// during the first MigrateFS call, 020..028 from the second.
+	all, err := fs.ReadDir(migrations.FS, ".")
+	if err != nil {
+		t.Fatalf("reading embedded migrations dir: %v", err)
+	}
+	for _, e := range all {
+		if !hasVersion(t, database, e.Name()) {
+			t.Errorf("migration %q not recorded in schema_versions after upgrade", e.Name())
+		}
+	}
+}
diff --git a/Server/db/models.go b/Server/db/models.go
index 5dc9f6e6..70eaf387 100644
--- a/Server/db/models.go
+++ b/Server/db/models.go
@@ -20,6 +20,28 @@ type User struct {
 	// ECDSA P-256) used for TOFU pinning of voice E2EE announces. Nil = not
 	// published (legacy client).
 	IdentityPublicKey *string
+	// DisplayName is the optional nickname shown instead of Username. Nil =
+	// unset, and every renderer falls back to Username. Mentions still resolve
+	// against Username alone — it is the unique key.
+	DisplayName *string
+	// About is the optional profile bio shown in the profile popup. Nil = unset.
+	About *string
+	// CustomStatus is the optional free-text status line shown under the name.
+	// Nil = unset. Set over the WebSocket presence path and cleared on logout.
+	CustomStatus *string
+}
+
+// EffectiveDisplayName returns the name to render for the user: the display
+// name when set and non-empty, the username otherwise. Every payload builder
+// goes through this so the fallback cannot be spelled three different ways.
+func (u *User) EffectiveDisplayName() string {
+	if u == nil {
+		return ""
+	}
+	if u.DisplayName != nil && *u.DisplayName != "" {
+		return *u.DisplayName
+	}
+	return u.Username
 }
 
 // Session represents a row in the sessions table.
@@ -98,6 +120,11 @@ type Channel struct {
 	VoiceQuality    *string `json:"voice_quality,omitempty"`
 	MixingThreshold *int    `json:"mixing_threshold,omitempty"`
 	VoiceMaxVideo   int     `json:"voice_max_video"`
+	// NSFW marks the channel as possibly carrying sensitive content. It is
+	// metadata only: the server stores, ships and audits it but imposes no
+	// content behaviour of its own (see migration 025). Clients decide what
+	// to do with it — the desktop client shows a per-session age gate.
+	NSFW bool `json:"nsfw"`
 }
 
 // Message represents a row in the messages table.
@@ -111,6 +138,10 @@ type Message struct {
 	Deleted   bool
 	Pinned    bool
 	Timestamp string
+	// MentionsEveryone is set when the message resolved an @everyone or @here
+	// token and the author held MENTION_EVERYONE. Per-user mentions live in
+	// message_mentions.
+	MentionsEveryone bool
 }
 
 // MessageWithUser joins a Message with the author's public fields.
@@ -129,12 +160,14 @@ type ReactionCount struct {
 
 // MessageSearchResult is a row returned by the FTS5 message search.
 type MessageSearchResult struct {
-	MessageID   int64      `json:"message_id"`
-	ChannelID   int64      `json:"channel_id"`
-	ChannelName string     `json:"channel_name"`
-	User        UserPublic `json:"user"`
-	Content     string     `json:"content"`
-	Timestamp   string     `json:"timestamp"`
+	MessageID        int64      `json:"message_id"`
+	ChannelID        int64      `json:"channel_id"`
+	ChannelName      string     `json:"channel_name"`
+	User             UserPublic `json:"user"`
+	Content          string     `json:"content"`
+	Timestamp        string     `json:"timestamp"`
+	Mentions         []int64    `json:"mentions"`
+	MentionsEveryone bool       `json:"mentions_everyone"`
 }
 
 // UserPublic is the public-facing user shape for API responses.
@@ -157,6 +190,10 @@ type MessageAPIResponse struct {
 	EditedAt    *string          `json:"edited_at"`
 	Deleted     bool             `json:"deleted"`
 	Timestamp   string           `json:"timestamp"`
+	// Mentions is the resolved user ids the message mentions (never nil);
+	// MentionsEveryone reports an authorized @everyone/@here.
+	Mentions         []int64 `json:"mentions"`
+	MentionsEveryone bool    `json:"mentions_everyone"`
 }
 
 // AttachmentInfo is the attachment shape in API responses.
@@ -177,24 +214,45 @@ type ReactionInfo struct {
 	Me    bool   `json:"me"`
 }
 
+// ReactionUser is one reactor in the who-reacted list returned by
+// GET /channels/{id}/messages/{messageId}/reactions/{emoji}/users. Avatar is a
+// plain string ("" = none) rather than UserPublic's pointer: the tooltip that
+// consumes this never distinguishes null from empty.
+type ReactionUser struct {
+	ID       int64  `json:"id"`
+	Username string `json:"username"`
+	Avatar   string `json:"avatar"`
+}
+
 // VoiceState represents a row in the voice_states table.
 // It tracks which voice channel a user is in and their current audio state.
+//
+// ServerMuted/ServerDeafened are moderator-imposed and, unlike Muted/Deafened,
+// the user cannot clear them: while set, their own voice_mute/voice_deafen
+// unmute attempts are refused. They are scoped to the voice session — the row
+// is deleted on leave — but survive a channel switch.
 type VoiceState struct {
-	UserID      int64  `json:"user_id"`
-	ChannelID   int64  `json:"channel_id"`
-	Username    string `json:"username"`
-	Muted       bool   `json:"muted"`
-	Deafened    bool   `json:"deafened"`
-	Speaking    bool   `json:"speaking"`
-	Camera      bool   `json:"camera"`
-	Screenshare bool   `json:"screenshare"`
-	JoinedAt    string `json:"-"`
+	UserID         int64  `json:"user_id"`
+	ChannelID      int64  `json:"channel_id"`
+	Username       string `json:"username"`
+	Muted          bool   `json:"muted"`
+	Deafened       bool   `json:"deafened"`
+	Speaking       bool   `json:"speaking"`
+	Camera         bool   `json:"camera"`
+	Screenshare    bool   `json:"screenshare"`
+	ServerMuted    bool   `json:"server_muted"`
+	ServerDeafened bool   `json:"server_deafened"`
+	JoinedAt       string `json:"-"`
 }
 
 // ChannelUnread holds per-user unread data for a single channel.
 type ChannelUnread struct {
 	LastMessageID int64 `json:"last_message_id"`
 	UnreadCount   int   `json:"unread_count"`
+	// MentionCount is read_states.mention_count: unread messages that mention
+	// this user directly or via an authorized @everyone/@here. Zeroed by
+	// channel_focus, never advanced by an edit.
+	MentionCount int `json:"mention_count"`
 }
 
 // ServerStats contains aggregate counts for the admin dashboard.
@@ -226,5 +284,21 @@ type AuditEntry struct {
 	CreatedAt  string `json:"created_at"`
 }
 
+// Emoji represents a row in the emoji table: one server-wide custom emoji.
+//
+// StoredAs is the storage-layer UUID the image bytes live under (the table's
+// legacy column name is `filename`); it is never shown to a user and never
+// derived from anything the uploader sent. Shortcode is always lowercase --
+// the only spelling the validator admits -- which is what makes the table's
+// plain UNIQUE index a case-insensitive one.
+type Emoji struct {
+	ID         int64  `json:"id"`
+	Shortcode  string `json:"shortcode"`
+	StoredAs   string `json:"-"`
+	MimeType   string `json:"-"`
+	UploadedBy int64  `json:"uploaded_by"`
+	CreatedAt  string `json:"created_at"`
+}
+
 // sessionTTL is the duration a session remains valid after creation.
 const sessionTTL = 30 * 24 * time.Hour
diff --git a/Server/db/profile_queries.go b/Server/db/profile_queries.go
index 9310a9f0..b2188c04 100644
--- a/Server/db/profile_queries.go
+++ b/Server/db/profile_queries.go
@@ -7,14 +7,18 @@ import (
 	"github.com/owncord/server/db/dbgen"
 )
 
-// UpdateUserProfile updates the username and avatar for the given user.
+// UpdateUserProfile updates the username, avatar, display name and about text
+// for the given user. All four are written unconditionally, so the caller is
+// responsible for merging a partial PATCH against the current row.
 // Returns ErrNotFound if the user does not exist. Returns an error wrapping
 // a UNIQUE constraint violation if the username is already taken.
-func (d *DB) UpdateUserProfile(ctx context.Context, userID int64, username string, avatar *string) error {
+func (d *DB) UpdateUserProfile(ctx context.Context, userID int64, username string, avatar, displayName, about *string) error {
 	result, err := d.q.UpdateUserProfile(ctx, dbgen.UpdateUserProfileParams{
-		Username: username,
-		Avatar:   avatar,
-		ID:       userID,
+		Username:    username,
+		Avatar:      avatar,
+		DisplayName: displayName,
+		About:       about,
+		ID:          userID,
 	})
 	if err != nil {
 		return fmt.Errorf("UpdateUserProfile: %w", err)
@@ -29,6 +33,31 @@ func (d *DB) UpdateUserProfile(ctx context.Context, userID int64, username strin
 	return nil
 }
 
+// UpdateUserCustomStatus sets (or clears, with nil) the user's custom status
+// line. Kept separate from UpdateUserProfile because it arrives on the
+// presence path and must not overwrite a concurrent profile edit.
+func (d *DB) UpdateUserCustomStatus(ctx context.Context, userID int64, customStatus *string) error {
+	if err := d.q.UpdateUserCustomStatus(ctx, dbgen.UpdateUserCustomStatusParams{
+		CustomStatus: customStatus,
+		ID:           userID,
+	}); err != nil {
+		return fmt.Errorf("UpdateUserCustomStatus: %w", err)
+	}
+	return nil
+}
+
+// IsAvatarFileURL reports whether url is currently some user's avatar. It is
+// the authorization check that lets an uploaded avatar — an attachment with no
+// channel, and therefore private to its uploader by default — be served to
+// every authenticated user for exactly as long as it is in use.
+func (d *DB) IsAvatarFileURL(ctx context.Context, url string) (bool, error) {
+	n, err := d.q.CountUsersWithAvatar(ctx, &url)
+	if err != nil {
+		return false, fmt.Errorf("IsAvatarFileURL: %w", err)
+	}
+	return n > 0, nil
+}
+
 // UpdateUserPassword sets a new password hash for the given user.
 func (d *DB) UpdateUserPassword(ctx context.Context, userID int64, newPasswordHash string) error {
 	if err := d.q.UpdateUserPassword(ctx, dbgen.UpdateUserPasswordParams{
diff --git a/Server/db/profile_queries_test.go b/Server/db/profile_queries_test.go
index 8ba2f669..ae6a9be3 100644
--- a/Server/db/profile_queries_test.go
+++ b/Server/db/profile_queries_test.go
@@ -15,7 +15,7 @@ func TestUpdateUserProfile_UsernameAndAvatar(t *testing.T) {
 	}
 
 	avatar := "https://example.com/avatar.png"
-	if err := database.UpdateUserProfile(context.Background(), id, "newname", &avatar); err != nil {
+	if err := database.UpdateUserProfile(context.Background(), id, "newname", &avatar, nil, nil); err != nil {
 		t.Fatalf("UpdateUserProfile: %v", err)
 	}
 
@@ -35,7 +35,7 @@ func TestUpdateUserProfile_UsernameOnly(t *testing.T) {
 	database := newTestDB(t)
 	id, _ := database.CreateUser(context.Background(), "keepavatar", "hash", 4)
 
-	if err := database.UpdateUserProfile(context.Background(), id, "renamed", nil); err != nil {
+	if err := database.UpdateUserProfile(context.Background(), id, "renamed", nil, nil, nil); err != nil {
 		t.Fatalf("UpdateUserProfile: %v", err)
 	}
 
@@ -53,7 +53,7 @@ func TestUpdateUserProfile_DuplicateUsername(t *testing.T) {
 	database.CreateUser(context.Background(), "existing", "hash", 4)
 	id2, _ := database.CreateUser(context.Background(), "changeme", "hash", 4)
 
-	err := database.UpdateUserProfile(context.Background(), id2, "existing", nil)
+	err := database.UpdateUserProfile(context.Background(), id2, "existing", nil, nil, nil)
 	if err == nil {
 		t.Error("UpdateUserProfile with duplicate username should return error")
 	}
@@ -61,7 +61,7 @@ func TestUpdateUserProfile_DuplicateUsername(t *testing.T) {
 
 func TestUpdateUserProfile_NonExistentUser(t *testing.T) {
 	database := newTestDB(t)
-	err := database.UpdateUserProfile(context.Background(), 99999, "ghost", nil)
+	err := database.UpdateUserProfile(context.Background(), 99999, "ghost", nil, nil, nil)
 	if err == nil {
 		t.Error("UpdateUserProfile for non-existent user should return error")
 	}
diff --git a/Server/db/queries/sqlite/apitokens.sql b/Server/db/queries/sqlite/apitokens.sql
index c82357d7..0197be5e 100644
--- a/Server/db/queries/sqlite/apitokens.sql
+++ b/Server/db/queries/sqlite/apitokens.sql
@@ -42,6 +42,7 @@ UPDATE api_tokens SET last_used_at = datetime('now') WHERE token_hash = ?;
 -- (and an explicit LIMIT 1 is mis-emitted by sqlc here). ORDER BY puts the
 -- highest-position role first, so that first row is the owner.
 SELECT id, username, password, avatar, role_id, totp_secret, status,
-       created_at, last_seen, banned, ban_reason, ban_expires, identity_public_key
+       created_at, last_seen, banned, ban_reason, ban_expires, identity_public_key,
+       display_name, about, custom_status
 FROM users
 ORDER BY (SELECT r.position FROM roles r WHERE r.id = users.role_id) DESC, id ASC;
diff --git a/Server/db/queries/sqlite/blocks.sql b/Server/db/queries/sqlite/blocks.sql
index 3944b0fc..214038a1 100644
--- a/Server/db/queries/sqlite/blocks.sql
+++ b/Server/db/queries/sqlite/blocks.sql
@@ -15,3 +15,6 @@ LIMIT 1;
 
 -- name: ListBlockedUsers :many
 SELECT blocked_id FROM user_blocks WHERE blocker_id = ? ORDER BY created_at DESC;
+
+-- name: ListBlockersOfUser :many
+SELECT blocker_id FROM user_blocks WHERE blocked_id = ?;
diff --git a/Server/db/queries/sqlite/channels.sql b/Server/db/queries/sqlite/channels.sql
index 67f3ed12..ce4c6134 100644
--- a/Server/db/queries/sqlite/channels.sql
+++ b/Server/db/queries/sqlite/channels.sql
@@ -4,7 +4,8 @@ SELECT id, name, type, COALESCE(category, '') AS category, COALESCE(topic, '') A
        COALESCE(voice_max_users, 0) AS voice_max_users,
        voice_quality,
        mixing_threshold,
-       COALESCE(voice_max_video, 0) AS voice_max_video
+       COALESCE(voice_max_video, 0) AS voice_max_video,
+       nsfw
 FROM channels ORDER BY position ASC, id ASC;
 
 -- name: GetChannel :one
@@ -13,7 +14,8 @@ SELECT id, name, type, COALESCE(category, '') AS category, COALESCE(topic, '') A
        COALESCE(voice_max_users, 0) AS voice_max_users,
        voice_quality,
        mixing_threshold,
-       COALESCE(voice_max_video, 0) AS voice_max_video
+       COALESCE(voice_max_video, 0) AS voice_max_video,
+       nsfw
 FROM channels WHERE id = ?;
 
 -- name: CreateChannel :execresult
@@ -33,7 +35,8 @@ DELETE FROM channels WHERE id = ?;
 
 -- name: AdminUpdateChannel :exec
 UPDATE channels
-SET name = ?, topic = ?, slow_mode = ?, position = ?, archived = ?
+SET name = ?, topic = ?, category = ?, slow_mode = ?, position = ?, archived = ?,
+    nsfw = ?, voice_max_users = ?, voice_max_video = ?
 WHERE id = ?;
 
 -- name: UpsertChannelPermission :exec
@@ -46,8 +49,30 @@ ON CONFLICT(channel_id, role_id) DO UPDATE SET
 -- name: GetChannelPermission :one
 SELECT allow, deny FROM channel_overrides WHERE channel_id = ? AND role_id = ?;
 
+-- name: GetChannelOverrides :many
+SELECT role_id, allow, deny FROM channel_overrides WHERE channel_id = ?;
+
 -- name: GetRoleChannelPermissions :many
 SELECT channel_id, allow, deny FROM channel_overrides WHERE role_id = ?;
 
 -- name: DeleteChannelPermission :exec
 DELETE FROM channel_overrides WHERE channel_id = ? AND role_id = ?;
+
+-- name: UpsertChannelUserPermission :exec
+INSERT INTO channel_user_overrides (channel_id, user_id, allow, deny)
+VALUES (?, ?, ?, ?)
+ON CONFLICT(channel_id, user_id) DO UPDATE SET
+    allow = excluded.allow,
+    deny  = excluded.deny;
+
+-- name: GetChannelUserPermission :one
+SELECT allow, deny FROM channel_user_overrides WHERE channel_id = ? AND user_id = ?;
+
+-- name: GetChannelUserOverrides :many
+SELECT user_id, allow, deny FROM channel_user_overrides WHERE channel_id = ?;
+
+-- name: GetUserChannelPermissions :many
+SELECT channel_id, allow, deny FROM channel_user_overrides WHERE user_id = ?;
+
+-- name: DeleteChannelUserPermission :exec
+DELETE FROM channel_user_overrides WHERE channel_id = ? AND user_id = ?;
diff --git a/Server/db/queries/sqlite/dm.sql b/Server/db/queries/sqlite/dm.sql
index 752c56e3..6ef376d9 100644
--- a/Server/db/queries/sqlite/dm.sql
+++ b/Server/db/queries/sqlite/dm.sql
@@ -10,16 +10,42 @@ SELECT user_id FROM dm_participants WHERE user_id = ? AND channel_id = ?;
 -- name: GetDMParticipantIDs :many
 SELECT user_id FROM dm_participants WHERE channel_id = ?;
 
+-- name: CountDMParticipants :one
+SELECT COUNT(*) FROM dm_participants WHERE channel_id = ?;
+
+-- name: IsGroupDM :one
+SELECT is_group FROM channels WHERE id = ? AND type = 'dm';
+
+-- name: RemoveDMParticipant :exec
+DELETE FROM dm_participants WHERE channel_id = ? AND user_id = ?;
+
+-- name: SetDMChannelName :exec
+UPDATE channels SET name = ? WHERE id = ? AND type = 'dm';
+
+-- name: GetDMParticipants :many
+SELECT
+    u.id                                      AS id,
+    u.username                                AS username,
+    COALESCE(u.display_name, '')              AS display_name,
+    COALESCE(u.avatar, '')                    AS avatar,
+    u.status                                  AS status
+FROM dm_participants dp
+JOIN users u ON u.id = dp.user_id
+WHERE dp.channel_id = ?
+ORDER BY u.id ASC;
+
 -- name: GetUserDMChannelIDs :many
 SELECT channel_id FROM dm_open_state WHERE user_id = ?;
 
+-- A DM row carries no recipient any more: dm_participants holds N users, so
+-- "the other one" is only well defined for a two-person DM. The participant
+-- set comes from GetDMParticipantsForUser below, one extra query for the whole
+-- list rather than one per channel, and the Go layer stitches them together.
 -- name: GetUserDMChannels :many
 SELECT
     c.id                                          AS channel_id,
-    u.id                                          AS recipient_id,
-    u.username                                    AS recipient_username,
-    COALESCE(u.avatar, '')                        AS recipient_avatar,
-    u.status                                      AS recipient_status,
+    c.name                                        AS name,
+    c.is_group                                    AS is_group,
     lm.id                                         AS last_message_id,
     COALESCE(lm.content, '')                      AS last_message,
     COALESCE(lm.timestamp, '')                    AS last_message_at,
@@ -30,10 +56,25 @@ SELECT
     ) AS unread_count
 FROM dm_open_state dos
 JOIN channels c          ON c.id = dos.channel_id AND c.type = 'dm'
-JOIN dm_participants dp  ON dp.channel_id = c.id AND dp.user_id != ?
-JOIN users u             ON u.id = dp.user_id
 LEFT JOIN messages lm    ON lm.id = (
     SELECT MAX(id) FROM messages WHERE channel_id = c.id AND deleted = 0
 )
 WHERE dos.user_id = ?
 ORDER BY COALESCE(lm.timestamp, dos.opened_at) DESC;
+
+-- Every participant of every DM the user has open, in one pass. Includes the
+-- user themselves so a caller can tell "group of three" from "group of three
+-- others"; the Go layer filters when it needs the others.
+-- name: GetDMParticipantsForUser :many
+SELECT
+    dp.channel_id                                 AS channel_id,
+    u.id                                          AS id,
+    u.username                                    AS username,
+    COALESCE(u.display_name, '')                  AS display_name,
+    COALESCE(u.avatar, '')                        AS avatar,
+    u.status                                      AS status
+FROM dm_open_state dos
+JOIN dm_participants dp ON dp.channel_id = dos.channel_id
+JOIN users u            ON u.id = dp.user_id
+WHERE dos.user_id = ?
+ORDER BY dp.channel_id ASC, u.id ASC;
diff --git a/Server/db/queries/sqlite/emoji.sql b/Server/db/queries/sqlite/emoji.sql
new file mode 100644
index 00000000..6ffdbe09
--- /dev/null
+++ b/Server/db/queries/sqlite/emoji.sql
@@ -0,0 +1,19 @@
+-- name: ListEmoji :many
+SELECT id, shortcode, filename, mime_type, uploaded_by, created_at
+FROM emoji ORDER BY shortcode ASC;
+
+-- name: GetEmojiByID :one
+SELECT id, shortcode, filename, mime_type, uploaded_by, created_at
+FROM emoji WHERE id = ?;
+
+-- name: GetEmojiByShortcode :one
+SELECT id, shortcode, filename, mime_type, uploaded_by, created_at
+FROM emoji WHERE shortcode = ?;
+
+-- name: CreateEmoji :one
+INSERT INTO emoji (shortcode, filename, mime_type, uploaded_by)
+VALUES (?, ?, ?, ?)
+RETURNING id, shortcode, filename, mime_type, uploaded_by, created_at;
+
+-- name: DeleteEmoji :execresult
+DELETE FROM emoji WHERE id = ?;
diff --git a/Server/db/queries/sqlite/messages.sql b/Server/db/queries/sqlite/messages.sql
index f0ca8187..bdc81a96 100644
--- a/Server/db/queries/sqlite/messages.sql
+++ b/Server/db/queries/sqlite/messages.sql
@@ -1,9 +1,11 @@
 -- name: CreateMessage :one
 INSERT INTO messages (channel_id, user_id, content, reply_to) VALUES (?, ?, ?, ?)
-RETURNING id, channel_id, user_id, content, reply_to, edited_at, deleted, pinned, timestamp;
+RETURNING id, channel_id, user_id, content, reply_to, edited_at, deleted, pinned, timestamp,
+          mentions_everyone;
 
 -- name: GetMessage :one
-SELECT id, channel_id, user_id, content, reply_to, edited_at, deleted, pinned, timestamp
+SELECT id, channel_id, user_id, content, reply_to, edited_at, deleted, pinned, timestamp,
+       mentions_everyone
 FROM messages WHERE id = ?;
 
 -- name: GetMessagesForAPI :many
@@ -15,7 +17,8 @@ ORDER BY m.id DESC LIMIT ?;
 
 -- name: EditMessageContent :one
 UPDATE messages SET content = ?, edited_at = datetime('now') WHERE id = ?
-RETURNING id, channel_id, user_id, content, reply_to, edited_at, deleted, pinned, timestamp;
+RETURNING id, channel_id, user_id, content, reply_to, edited_at, deleted, pinned, timestamp,
+          mentions_everyone;
 
 -- name: SoftDeleteMessage :exec
 UPDATE messages SET deleted = 1 WHERE id = ?;
@@ -27,9 +30,13 @@ UPDATE messages SET pinned = ? WHERE id = ? AND deleted = 0;
 SELECT COALESCE(MAX(id), 0) FROM messages WHERE channel_id = ? AND deleted = 0;
 
 -- name: UpdateReadState :exec
-INSERT INTO read_states (user_id, channel_id, last_message_id)
-VALUES (?, ?, ?)
-ON CONFLICT(user_id, channel_id) DO UPDATE SET last_message_id = excluded.last_message_id;
+-- Marking a channel read also clears its mention badge: channel_focus is the
+-- only caller, and a focused channel has no outstanding mentions by definition.
+INSERT INTO read_states (user_id, channel_id, last_message_id, mention_count)
+VALUES (?, ?, ?, 0)
+ON CONFLICT(user_id, channel_id) DO UPDATE SET
+    last_message_id = excluded.last_message_id,
+    mention_count = 0;
 
 -- name: GetChannelUnreadCounts :many
 SELECT c.id,
@@ -38,9 +45,13 @@ SELECT c.id,
        (SELECT COUNT(*) FROM messages m
          WHERE m.channel_id = c.id AND m.deleted = 0
            AND m.id > COALESCE((SELECT rs.last_message_id FROM read_states rs
-                                 WHERE rs.channel_id = c.id AND rs.user_id = ?), 0)) AS unread
+                                 WHERE rs.channel_id = c.id AND rs.user_id = ?), 0)) AS unread,
+       COALESCE((SELECT rs.mention_count FROM read_states rs
+                  WHERE rs.channel_id = c.id AND rs.user_id = ?), 0) AS mentions
 FROM channels c
-WHERE c.type IN ('text', 'announcement');
+WHERE c.type IN ('text', 'announcement')
+   OR (c.type = 'dm' AND EXISTS (SELECT 1 FROM dm_participants dp
+                                  WHERE dp.channel_id = c.id AND dp.user_id = ?));
 
 -- SearchMessages and SearchMessagesInChannel use the messages_fts FTS5 virtual
 -- table which sqlc cannot introspect. Those queries remain as hand-written Go
diff --git a/Server/db/queries/sqlite/profile.sql b/Server/db/queries/sqlite/profile.sql
index dee1708e..9215bb7f 100644
--- a/Server/db/queries/sqlite/profile.sql
+++ b/Server/db/queries/sqlite/profile.sql
@@ -1,5 +1,19 @@
 -- name: UpdateUserProfile :execresult
-UPDATE users SET username = ?, avatar = ? WHERE id = ?;
+UPDATE users
+SET username = ?, avatar = ?, display_name = ?, about = ?
+WHERE id = ?;
 
 -- name: UpdateUserPassword :exec
 UPDATE users SET password = ? WHERE id = ?;
+
+-- name: UpdateUserCustomStatus :exec
+-- Separate from UpdateUserProfile because a custom status arrives over the
+-- WebSocket presence path, not the REST profile PATCH, and must not be able to
+-- clobber the username/avatar of a profile edit racing it.
+UPDATE users SET custom_status = ? WHERE id = ?;
+
+-- name: CountUsersWithAvatar :one
+-- Authorization probe for the file route: an unlinked attachment is readable by
+-- everyone exactly while some user's avatar points at it. Covered by the
+-- partial index on users(avatar) added in migration 027.
+SELECT COUNT(*) FROM users WHERE avatar = ?;
diff --git a/Server/db/queries/sqlite/reactions.sql b/Server/db/queries/sqlite/reactions.sql
index f9e7b3ff..c18c590c 100644
--- a/Server/db/queries/sqlite/reactions.sql
+++ b/Server/db/queries/sqlite/reactions.sql
@@ -8,3 +8,13 @@ DELETE FROM reactions WHERE message_id = ? AND user_id = ? AND emoji = ?;
 SELECT emoji, COUNT(*) AS count
 FROM reactions WHERE message_id = ?
 GROUP BY emoji;
+
+-- name: GetReactionUsers :many
+-- Reactors for one (message, emoji) pair, oldest reaction first. The reactions
+-- table has no timestamp column, so the autoincrement id carries the order.
+SELECT u.id, u.username, COALESCE(u.avatar, '') AS avatar
+FROM reactions r
+JOIN users u ON u.id = r.user_id
+WHERE r.message_id = ? AND r.emoji = ?
+ORDER BY r.id
+LIMIT ?;
diff --git a/Server/db/queries/sqlite/roles.sql b/Server/db/queries/sqlite/roles.sql
index 194f42bf..2007907e 100644
--- a/Server/db/queries/sqlite/roles.sql
+++ b/Server/db/queries/sqlite/roles.sql
@@ -3,8 +3,16 @@ SELECT id, name, color, permissions, position, is_default
 FROM roles WHERE id = ?;
 
 -- name: ListRoles :many
+-- Highest rank first. Positions are only "unique enough": reorder normalizes
+-- them, but creating a role inserts just below the actor and may tie with an
+-- existing role, so id is a tiebreaker. Without it SQLite may return tied rows
+-- in any order, and the admin panel derives its reorder payload from this
+-- order, so a single move-up would silently shuffle the tied roles.
+-- NOTE: keep comments in this file ASCII-only. sqlc mixes byte and rune
+-- offsets when stripping them, so a non-ASCII character here truncates the
+-- generated SQL of THIS and every following query by the byte/rune delta.
 SELECT id, name, color, permissions, position, is_default
-FROM roles ORDER BY position DESC;
+FROM roles ORDER BY position DESC, id ASC;
 
 -- name: GetRoleForUser :one
 SELECT r.id, r.name, r.color, r.permissions, r.position, r.is_default
@@ -21,3 +29,35 @@ FROM users u
 JOIN roles r ON r.id = u.role_id
 WHERE u.id = ?;
 
+-- name: GetRoleByName :one
+-- Case-insensitive by design: migration 023 enforces uniqueness under the same
+-- collation, so this is the lookup that agrees with the constraint.
+SELECT id, name, color, permissions, position, is_default
+FROM roles WHERE name = ? COLLATE NOCASE;
+
+-- name: GetDefaultRole :one
+-- The fallback role every member lands on when their role is deleted. Highest
+-- position wins if a database somehow carries more than one default.
+SELECT id, name, color, permissions, position, is_default
+FROM roles WHERE is_default = 1 ORDER BY position DESC, id ASC LIMIT 1;
+
+-- name: CreateRole :one
+INSERT INTO roles (name, color, permissions, position, is_default)
+VALUES (?, ?, ?, ?, 0)
+RETURNING id, name, color, permissions, position, is_default;
+
+-- name: UpdateRole :exec
+UPDATE roles SET name = ?, color = ?, permissions = ?, position = ? WHERE id = ?;
+
+-- name: SetRolePosition :exec
+UPDATE roles SET position = ? WHERE id = ?;
+
+-- name: DeleteRole :exec
+DELETE FROM roles WHERE id = ?;
+
+-- name: CountRoleMembers :many
+SELECT role_id, COUNT(*) AS member_count FROM users GROUP BY role_id;
+
+-- name: ListUserIDsByRole :many
+SELECT id FROM users WHERE role_id = ?;
+
diff --git a/Server/db/queries/sqlite/users.sql b/Server/db/queries/sqlite/users.sql
index 4dd800fe..147ff156 100644
--- a/Server/db/queries/sqlite/users.sql
+++ b/Server/db/queries/sqlite/users.sql
@@ -1,11 +1,13 @@
 -- name: GetUserByUsername :one
 SELECT id, username, password, avatar, role_id, totp_secret, status,
-       created_at, last_seen, banned, ban_reason, ban_expires, identity_public_key
+       created_at, last_seen, banned, ban_reason, ban_expires, identity_public_key,
+       display_name, about, custom_status
 FROM users WHERE username = ? COLLATE NOCASE;
 
 -- name: GetUserByID :one
 SELECT id, username, password, avatar, role_id, totp_secret, status,
-       created_at, last_seen, banned, ban_reason, ban_expires, identity_public_key
+       created_at, last_seen, banned, ban_reason, ban_expires, identity_public_key,
+       display_name, about, custom_status
 FROM users WHERE id = ?;
 
 -- name: CreateUser :execresult
@@ -20,8 +22,22 @@ UPDATE users SET totp_secret = ? WHERE id = ?;
 -- name: UpdateUserIdentityKey :exec
 UPDATE users SET identity_public_key = ? WHERE id = ?;
 
+-- name: MarkUserDisconnected :exec
+-- Disconnect bookkeeping. It clears only 'online', which is the one status
+-- that means "has a live session"; idle, dnd and invisible are choices the
+-- user made and are what the next connect reads instead of stamping online
+-- (db.ConnectStatus). A stale choice never renders as "present" because the
+-- read path treats a member with no live connection as offline regardless.
+UPDATE users
+SET status = CASE WHEN status = 'online' THEN 'offline' ELSE status END,
+    last_seen = datetime('now')
+WHERE id = ?;
+
 -- name: ResetAllUserStatuses :exec
-UPDATE users SET status = 'offline' WHERE status != 'offline';
+-- Startup reset: nothing is connected yet, so every 'online' is a leftover
+-- from the previous process. Chosen statuses survive for the same reason they
+-- survive a disconnect.
+UPDATE users SET status = 'offline' WHERE status = 'online';
 
 -- name: BanUser :exec
 UPDATE users SET banned = 1, ban_reason = ?, ban_expires = ? WHERE id = ?;
@@ -30,7 +46,8 @@ UPDATE users SET banned = 1, ban_reason = ?, ban_expires = ? WHERE id = ?;
 UPDATE users SET banned = 0, ban_reason = NULL, ban_expires = NULL WHERE id = ?;
 
 -- name: ListMembers :many
-SELECT u.id, u.username, u.avatar, u.status, LOWER(r.name), u.identity_public_key
+SELECT u.id, u.username, u.avatar, u.status, LOWER(r.name), u.identity_public_key,
+       u.display_name, u.custom_status
 FROM users u
 JOIN roles r ON u.role_id = r.id
 WHERE u.banned = 0
diff --git a/Server/db/queries/sqlite/voice.sql b/Server/db/queries/sqlite/voice.sql
index 60fdff85..06b8ec26 100644
--- a/Server/db/queries/sqlite/voice.sql
+++ b/Server/db/queries/sqlite/voice.sql
@@ -1,3 +1,8 @@
+-- server_muted / server_deafened are deliberately absent from both upserts'
+-- reset lists: a moderator-imposed mute must survive a channel switch, which
+-- reaches the ON CONFLICT branch. It is scoped to the voice session:
+-- leaving voice deletes the row, so a rejoin starts clean.
+
 -- name: JoinVoiceChannel :exec
 INSERT INTO voice_states (user_id, channel_id, muted, deafened, speaking, camera, screenshare, joined_at)
 VALUES (?, ?, 0, 0, 0, 0, 0, ?)
@@ -32,7 +37,8 @@ DELETE FROM voice_states WHERE user_id = ? AND channel_id = ? AND joined_at = ?;
 -- name: GetUserVoiceState :one
 SELECT vs.user_id, vs.channel_id, u.username,
        vs.muted, vs.deafened, vs.speaking,
-       vs.camera, vs.screenshare, vs.joined_at
+       vs.camera, vs.screenshare,
+       vs.server_muted, vs.server_deafened, vs.joined_at
 FROM voice_states vs
 JOIN users u ON u.id = vs.user_id
 WHERE vs.user_id = ?;
@@ -40,7 +46,8 @@ WHERE vs.user_id = ?;
 -- name: GetChannelVoiceStates :many
 SELECT vs.user_id, vs.channel_id, u.username,
        vs.muted, vs.deafened, vs.speaking,
-       vs.camera, vs.screenshare, vs.joined_at
+       vs.camera, vs.screenshare,
+       vs.server_muted, vs.server_deafened, vs.joined_at
 FROM voice_states vs
 JOIN users u ON u.id = vs.user_id
 WHERE vs.channel_id = ?
@@ -49,7 +56,8 @@ ORDER BY vs.joined_at ASC;
 -- name: GetAllVoiceStates :many
 SELECT vs.user_id, vs.channel_id, u.username,
        vs.muted, vs.deafened, vs.speaking,
-       vs.camera, vs.screenshare, vs.joined_at
+       vs.camera, vs.screenshare,
+       vs.server_muted, vs.server_deafened, vs.joined_at
 FROM voice_states vs
 JOIN users u ON u.id = vs.user_id
 ORDER BY vs.channel_id, vs.joined_at ASC;
@@ -66,6 +74,18 @@ UPDATE voice_states SET camera = ? WHERE user_id = ?;
 -- name: UpdateVoiceScreenshare :exec
 UPDATE voice_states SET screenshare = ? WHERE user_id = ?;
 
+-- name: ApplyVoiceServerMute :exec
+UPDATE voice_states SET server_muted = 1, muted = 1 WHERE user_id = ?;
+
+-- name: ClearVoiceServerMute :exec
+UPDATE voice_states SET server_muted = 0 WHERE user_id = ?;
+
+-- name: ApplyVoiceServerDeafen :exec
+UPDATE voice_states SET server_deafened = 1, deafened = 1 WHERE user_id = ?;
+
+-- name: ClearVoiceServerDeafen :exec
+UPDATE voice_states SET server_deafened = 0 WHERE user_id = ?;
+
 -- name: EnableCameraIfUnderLimit :execresult
 UPDATE voice_states SET camera = 1
 WHERE voice_states.user_id = ? AND voice_states.channel_id = ?
diff --git a/Server/db/queries_ascii_test.go b/Server/db/queries_ascii_test.go
new file mode 100644
index 00000000..0f7eb1c5
--- /dev/null
+++ b/Server/db/queries_ascii_test.go
@@ -0,0 +1,62 @@
+package db_test
+
+import (
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"unicode/utf8"
+)
+
+// sqlc mixes byte and rune offsets when it strips the `-- name:` comments from
+// a query file, so a single non-ASCII character in a comment silently
+// truncates the generated SQL of that query and every query after it in the
+// file by the byte/rune delta. The damage is invisible at review time (the
+// .sql reads fine) and only shows up as a runtime "SQL logic error" from
+// whichever query happened to lose its tail.
+//
+// An em-dash in a comment cost `ORDER BY ... id ASC` its `ASC` and left the
+// next query as a spliced fragment of two others. Keeping these files ASCII is
+// the cheapest way to make that class of corruption impossible.
+func TestQueryFilesAreASCIIOnly(t *testing.T) {
+	root := "queries"
+	if _, err := os.Stat(root); err != nil {
+		t.Skipf("no %s directory: %v", root, err)
+	}
+
+	var checked int
+	err := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if d.IsDir() || !strings.HasSuffix(d.Name(), ".sql") {
+			return nil
+		}
+		checked++
+		content, readErr := os.ReadFile(path)
+		if readErr != nil {
+			t.Errorf("read %s: %v", path, readErr)
+			return nil
+		}
+		for lineNo, line := range strings.Split(string(content), "\n") {
+			if utf8.RuneCountInString(line) == len(line) {
+				continue
+			}
+			for _, r := range line {
+				if r > 127 {
+					t.Errorf("%s:%d contains non-ASCII %q (U+%04X); sqlc truncates generated SQL on non-ASCII. Use ASCII (e.g. \"-\" for an em-dash).",
+						path, lineNo+1, r, r)
+					break
+				}
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("walk %s: %v", root, err)
+	}
+	if checked == 0 {
+		t.Fatalf("no .sql files found under %s; the guard would pass vacuously", root)
+	}
+}
diff --git a/Server/db/role_crud_queries_test.go b/Server/db/role_crud_queries_test.go
new file mode 100644
index 00000000..b3888d4d
--- /dev/null
+++ b/Server/db/role_crud_queries_test.go
@@ -0,0 +1,264 @@
+package db_test
+
+import (
+	"context"
+	"testing"
+)
+
+// These run against the real embedded migration set (newMigratedTestDB) rather
+// than the inline subset: migration 023 adds the case-insensitive name index
+// and the delete path touches channel_overrides, neither of which the inline
+// schema carries. The migrations seed Owner(1)/Admin(2)/Moderator(3)/Member(4,
+// default).
+
+func TestGetRoleByName_IsCaseInsensitive(t *testing.T) {
+	database := newMigratedTestDB(t)
+
+	for _, name := range []string{"Member", "member", "MEMBER"} {
+		role, err := database.GetRoleByName(context.Background(), name)
+		if err != nil {
+			t.Fatalf("GetRoleByName(%q): %v", name, err)
+		}
+		if role == nil || role.ID != 4 {
+			t.Errorf("GetRoleByName(%q) = %v, want the Member role", name, role)
+		}
+	}
+	role, err := database.GetRoleByName(context.Background(), "nobody")
+	if err != nil {
+		t.Fatalf("GetRoleByName(missing): %v", err)
+	}
+	if role != nil {
+		t.Errorf("GetRoleByName(missing) = %v, want nil", role)
+	}
+}
+
+func TestRoleNameUniquenessIsEnforcedCaseInsensitively(t *testing.T) {
+	database := newMigratedTestDB(t)
+
+	// Migration 023's index is what makes "moderator" and "Moderator" the same
+	// name — without it the two roles would coexist and the client's
+	// case-insensitive lookup would pick one arbitrarily.
+	_, err := database.ExecContext(context.Background(),
+		`INSERT INTO roles (name, permissions, position, is_default) VALUES ('moderator', 0, 5, 0)`)
+	if err == nil {
+		t.Fatal("inserting a case-colliding role name succeeded, want a UNIQUE violation")
+	}
+}
+
+func TestGetDefaultRole(t *testing.T) {
+	database := newMigratedTestDB(t)
+
+	role, err := database.GetDefaultRole(context.Background())
+	if err != nil {
+		t.Fatalf("GetDefaultRole: %v", err)
+	}
+	if role == nil || role.ID != 4 || !role.IsDefault {
+		t.Fatalf("GetDefaultRole = %v, want the seeded Member role", role)
+	}
+}
+
+func TestCreateAndUpdateRole(t *testing.T) {
+	database := newMigratedTestDB(t)
+	ctx := context.Background()
+
+	color := "#ABCDEF"
+	created, err := database.CreateRole(ctx, "Helper", &color, 0x3, 55)
+	if err != nil {
+		t.Fatalf("CreateRole: %v", err)
+	}
+	if created.ID == 0 || created.Name != "Helper" || created.Position != 55 {
+		t.Fatalf("created = %+v", created)
+	}
+	if created.IsDefault {
+		t.Error("CreateRole must never produce a default role")
+	}
+
+	if err := database.UpdateRole(ctx, created.ID, "Helpers", nil, 0x7, 56); err != nil {
+		t.Fatalf("UpdateRole: %v", err)
+	}
+	got, err := database.GetRoleByID(ctx, created.ID)
+	if err != nil || got == nil {
+		t.Fatalf("GetRoleByID: %v", err)
+	}
+	if got.Name != "Helpers" || got.Color != nil || got.Permissions != 0x7 || got.Position != 56 {
+		t.Errorf("updated role = %+v", got)
+	}
+}
+
+func TestSetRolePositions(t *testing.T) {
+	database := newMigratedTestDB(t)
+	ctx := context.Background()
+
+	if err := database.SetRolePositions(ctx, map[int64]int{2: 3, 3: 2, 4: 1}); err != nil {
+		t.Fatalf("SetRolePositions: %v", err)
+	}
+	for id, want := range map[int64]int{1: 100, 2: 3, 3: 2, 4: 1} {
+		role, err := database.GetRoleByID(ctx, id)
+		if err != nil || role == nil {
+			t.Fatalf("GetRoleByID(%d): %v", id, err)
+		}
+		if role.Position != want {
+			t.Errorf("role %d position = %d, want %d", id, role.Position, want)
+		}
+	}
+	// An empty map is a no-op rather than an empty transaction.
+	if err := database.SetRolePositions(ctx, nil); err != nil {
+		t.Errorf("SetRolePositions(nil): %v", err)
+	}
+}
+
+func TestListRoles_OrdersByPositionThenIDDeterministically(t *testing.T) {
+	database := newMigratedTestDB(t)
+	ctx := context.Background()
+
+	// Positions are only "unique enough": reorder normalizes them, but creating
+	// a role inserts just below the actor and may tie with an existing role. A
+	// tie must still order deterministically — the admin panel derives its
+	// reorder payload from this order, so an unstable one would make a single
+	// move-up silently shuffle the tied roles among themselves.
+	tied := []string{"Tie-A", "Tie-B", "Tie-C"}
+	created := make([]int64, 0, len(tied))
+	for _, name := range tied {
+		role, err := database.CreateRole(ctx, name, nil, 0, 30)
+		if err != nil {
+			t.Fatalf("CreateRole %s: %v", name, err)
+		}
+		created = append(created, role.ID)
+	}
+
+	var lastOrder []int64
+	for range 5 {
+		roles, err := database.ListRoles(ctx)
+		if err != nil {
+			t.Fatalf("ListRoles: %v", err)
+		}
+		order := make([]int64, 0, len(roles))
+		var prev = -1
+		for _, r := range roles {
+			if prev >= 0 && r.Position > prev {
+				t.Fatalf("ListRoles is not position-descending: %d after %d", r.Position, prev)
+			}
+			prev = r.Position
+			if r.Position == 30 {
+				order = append(order, r.ID)
+			}
+		}
+		// Ties come back in ascending id order, every time.
+		if len(order) != len(created) {
+			t.Fatalf("found %d roles at position 30, want %d", len(order), len(created))
+		}
+		for i, id := range created {
+			if order[i] != id {
+				t.Errorf("tied role %d = id %d, want %d (order %v)", i, order[i], id, order)
+			}
+		}
+		if lastOrder != nil {
+			for i := range order {
+				if order[i] != lastOrder[i] {
+					t.Fatalf("tied ordering is unstable across calls: %v then %v", lastOrder, order)
+				}
+			}
+		}
+		lastOrder = order
+	}
+}
+
+func TestCountRoleMembersAndListUserIDsByRole(t *testing.T) {
+	database := newMigratedTestDB(t)
+	ctx := context.Background()
+
+	a, err := database.CreateUser(ctx, "counta", "hash", 4)
+	if err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+	if _, err := database.CreateUser(ctx, "countb", "hash", 4); err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+	if _, err := database.CreateUser(ctx, "countc", "hash", 3); err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+
+	counts, err := database.CountRoleMembers(ctx)
+	if err != nil {
+		t.Fatalf("CountRoleMembers: %v", err)
+	}
+	if counts[4] != 2 || counts[3] != 1 {
+		t.Errorf("counts = %v, want 2 members on role 4 and 1 on role 3", counts)
+	}
+	// A role nobody holds is absent rather than present with a zero.
+	if _, present := counts[1]; present {
+		t.Errorf("counts carries an entry for the memberless owner role: %v", counts)
+	}
+
+	ids, err := database.ListUserIDsByRole(ctx, 4)
+	if err != nil {
+		t.Fatalf("ListUserIDsByRole: %v", err)
+	}
+	if len(ids) != 2 {
+		t.Fatalf("ListUserIDsByRole = %v, want 2 ids", ids)
+	}
+	found := false
+	for _, id := range ids {
+		if id == a {
+			found = true
+		}
+	}
+	if !found {
+		t.Errorf("ListUserIDsByRole = %v, missing user %d", ids, a)
+	}
+}
+
+func TestDeleteRoleReassigning(t *testing.T) {
+	database := newMigratedTestDB(t)
+	ctx := context.Background()
+
+	role, err := database.CreateRole(ctx, "Temp", nil, 0x3, 50)
+	if err != nil {
+		t.Fatalf("CreateRole: %v", err)
+	}
+	moved, err := database.CreateUser(ctx, "tempuser", "hash", int(role.ID))
+	if err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+	stayer, err := database.CreateUser(ctx, "stayer", "hash", 3)
+	if err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+	chID, err := database.CreateChannel(ctx, "general", "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+	if err := database.UpsertChannelOverride(ctx, chID, role.ID, 0, 0x2); err != nil {
+		t.Fatalf("UpsertChannelOverride: %v", err)
+	}
+
+	ids, err := database.DeleteRoleReassigning(ctx, role.ID, 4)
+	if err != nil {
+		t.Fatalf("DeleteRoleReassigning: %v", err)
+	}
+	if len(ids) != 1 || ids[0] != moved {
+		t.Fatalf("reassigned ids = %v, want [%d]", ids, moved)
+	}
+
+	user, err := database.GetUserByID(ctx, moved)
+	if err != nil || user == nil {
+		t.Fatalf("GetUserByID: %v", err)
+	}
+	if user.RoleID != 4 {
+		t.Errorf("moved user role = %d, want the fallback 4", user.RoleID)
+	}
+	other, _ := database.GetUserByID(ctx, stayer)
+	if other.RoleID != 3 {
+		t.Errorf("unrelated user role = %d, want 3 — the UPDATE must be scoped", other.RoleID)
+	}
+	if gone, err := database.GetRoleByID(ctx, role.ID); err != nil || gone != nil {
+		t.Errorf("role survived the delete: %v, %v", gone, err)
+	}
+	overrides, err := database.GetChannelOverrides(ctx, chID)
+	if err != nil {
+		t.Fatalf("GetChannelOverrides: %v", err)
+	}
+	if _, present := overrides[role.ID]; present {
+		t.Error("the deleted role's channel_overrides row survived")
+	}
+}
diff --git a/Server/db/role_queries.go b/Server/db/role_queries.go
index 4d500903..be5a9dce 100644
--- a/Server/db/role_queries.go
+++ b/Server/db/role_queries.go
@@ -5,6 +5,8 @@ import (
 	"database/sql"
 	"errors"
 	"fmt"
+	"maps"
+	"slices"
 
 	"github.com/owncord/server/db/dbgen"
 )
@@ -63,6 +65,164 @@ func (d *DB) GetRoleForUser(ctx context.Context, userID int64) (*Role, error) {
 	return roleFromGen(r), nil
 }
 
+// GetRoleByName returns the role whose name matches name case-insensitively,
+// or nil if there is none. Case-insensitive because migration 023 enforces
+// uniqueness under the same collation — the lookup and the constraint must
+// agree, or "Moderator" and "moderator" become two roles the client (which
+// matches names case-insensitively) cannot tell apart.
+func (d *DB) GetRoleByName(ctx context.Context, name string) (*Role, error) {
+	r, err := d.q.GetRoleByName(ctx, name)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("GetRoleByName: %w", err)
+	}
+	return roleFromGen(r), nil
+}
+
+// GetDefaultRole returns the role new members are created with and deleted
+// roles' members fall back to. Returns (nil, nil) when no role is flagged
+// default — callers must treat that as a configuration error, not a licence to
+// leave members pointing at a deleted role.
+func (d *DB) GetDefaultRole(ctx context.Context) (*Role, error) {
+	r, err := d.q.GetDefaultRole(ctx)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("GetDefaultRole: %w", err)
+	}
+	return roleFromGen(r), nil
+}
+
+// CreateRole inserts a role and returns it. is_default is always 0: exactly one
+// role is the default and it is seeded, never created through the API.
+func (d *DB) CreateRole(ctx context.Context, name string, color *string, perms int64, position int) (*Role, error) {
+	r, err := d.q.CreateRole(ctx, dbgen.CreateRoleParams{
+		Name:        name,
+		Color:       color,
+		Permissions: perms,
+		Position:    int64(position),
+	})
+	if err != nil {
+		return nil, fmt.Errorf("CreateRole: %w", err)
+	}
+	return roleFromGen(r), nil
+}
+
+// UpdateRole overwrites a role's mutable columns. is_default is deliberately
+// not writable: which role is the fallback is a schema decision.
+func (d *DB) UpdateRole(ctx context.Context, id int64, name string, color *string, perms int64, position int) error {
+	if err := d.q.UpdateRole(ctx, dbgen.UpdateRoleParams{
+		Name:        name,
+		Color:       color,
+		Permissions: perms,
+		Position:    int64(position),
+		ID:          id,
+	}); err != nil {
+		return fmt.Errorf("UpdateRole: %w", err)
+	}
+	return nil
+}
+
+// ListUserIDsByRole returns the ids of every user currently holding roleID.
+// Used to invalidate exactly the permission-cache entries a role change
+// affects instead of dropping the whole cache.
+func (d *DB) ListUserIDsByRole(ctx context.Context, roleID int64) ([]int64, error) {
+	ids, err := d.q.ListUserIDsByRole(ctx, roleID)
+	if err != nil {
+		return nil, fmt.Errorf("ListUserIDsByRole: %w", err)
+	}
+	return ids, nil
+}
+
+// CountRoleMembers returns member counts keyed by role id. Roles with no
+// members are absent from the map rather than present with a zero.
+func (d *DB) CountRoleMembers(ctx context.Context) (map[int64]int, error) {
+	rows, err := d.q.CountRoleMembers(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("CountRoleMembers: %w", err)
+	}
+	counts := make(map[int64]int, len(rows))
+	for _, row := range rows {
+		counts[row.RoleID] = int(row.MemberCount)
+	}
+	return counts, nil
+}
+
+// SetRolePositions writes new positions for several roles in one writer
+// transaction, so a reader can never observe a half-applied reorder (which
+// would briefly duplicate or invert the hierarchy the permission checks read).
+func (d *DB) SetRolePositions(ctx context.Context, positions map[int64]int) error {
+	if len(positions) == 0 {
+		return nil
+	}
+	tx, err := d.writer.BeginTx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("SetRolePositions begin tx: %w", err)
+	}
+	defer tx.Rollback() //nolint:errcheck
+
+	q := d.q.WithTx(tx)
+	// Sorted so concurrent reorders always take the rows in the same order.
+	for _, id := range slices.Sorted(maps.Keys(positions)) {
+		if err := q.SetRolePosition(ctx, dbgen.SetRolePositionParams{
+			Position: int64(positions[id]),
+			ID:       id,
+		}); err != nil {
+			return fmt.Errorf("SetRolePositions update %d: %w", id, err)
+		}
+	}
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("SetRolePositions commit: %w", err)
+	}
+	return nil
+}
+
+// DeleteRoleReassigning deletes roleID after moving every member onto
+// fallbackRoleID and dropping the role's channel_overrides rows, all in one
+// writer transaction: a member must never be observable pointing at a role row
+// that no longer exists, and a stale override would silently apply to whichever
+// role reused the id.
+//
+// Returns the ids of the reassigned members so the caller can invalidate their
+// cached permissions and re-sync their clients.
+func (d *DB) DeleteRoleReassigning(ctx context.Context, roleID, fallbackRoleID int64) ([]int64, error) {
+	tx, err := d.writer.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, fmt.Errorf("DeleteRoleReassigning begin tx: %w", err)
+	}
+	defer tx.Rollback() //nolint:errcheck
+
+	q := d.q.WithTx(tx)
+	moved, err := q.ListUserIDsByRole(ctx, roleID)
+	if err != nil {
+		return nil, fmt.Errorf("DeleteRoleReassigning list members: %w", err)
+	}
+	// One UPDATE for every member, not one per member.
+	if _, err := tx.ExecContext(ctx,
+		`UPDATE users SET role_id = ? WHERE role_id = ?`, fallbackRoleID, roleID,
+	); err != nil {
+		return nil, fmt.Errorf("DeleteRoleReassigning reassign: %w", err)
+	}
+	// channel_overrides cascades on delete in the production schema, but the
+	// delete is explicit so the behaviour does not depend on the foreign-key
+	// pragma being on for this connection.
+	if _, err := tx.ExecContext(ctx,
+		`DELETE FROM channel_overrides WHERE role_id = ?`, roleID,
+	); err != nil {
+		return nil, fmt.Errorf("DeleteRoleReassigning drop overrides: %w", err)
+	}
+	if err := q.DeleteRole(ctx, roleID); err != nil {
+		return nil, fmt.Errorf("DeleteRoleReassigning delete: %w", err)
+	}
+	if err := tx.Commit(); err != nil {
+		return nil, fmt.Errorf("DeleteRoleReassigning commit: %w", err)
+	}
+	return moved, nil
+}
+
 // GetUserWithRole returns the user and their role in a single query.
 // Returns (nil, nil, nil) when the user is not found.
 func (d *DB) GetUserWithRole(ctx context.Context, userID int64) (*User, *Role, error) {
diff --git a/Server/db/sanitize_fuzz_test.go b/Server/db/sanitize_fuzz_test.go
new file mode 100644
index 00000000..55e2860c
--- /dev/null
+++ b/Server/db/sanitize_fuzz_test.go
@@ -0,0 +1,101 @@
+package db
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"unicode"
+	"unicode/utf8"
+)
+
+// fuzzTestHelper is the slice of *testing.T / *testing.F that
+// fuzzOpenMigratedMemory needs; both embed testing.common and satisfy it.
+type fuzzTestHelper interface {
+	Helper()
+	Fatalf(format string, args ...any)
+	Cleanup(func())
+}
+
+// fuzzOpenMigratedMemory opens an in-memory DB with the full schema (including
+// messages_fts) applied, so the fuzz target can run sanitizeFTSQuery's output
+// through a real FTS5 MATCH and catch anything that still makes SQLite choke
+// -- not just anything that looks dangerous on paper.
+func fuzzOpenMigratedMemory(t fuzzTestHelper) *DB {
+	t.Helper()
+	database, err := Open(":memory:")
+	if err != nil {
+		t.Fatalf("Open(':memory:'): %v", err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	if err := Migrate(database); err != nil {
+		t.Fatalf("Migrate: %v", err)
+	}
+	return database
+}
+
+// FuzzSanitizeFTSQuery guards BUG-090 (byte-boundary truncation producing
+// invalid UTF-8) against regressions and checks the broader contract: the
+// output is always valid UTF-8, built only from the documented charset, at
+// most 200 runes, and never makes messages_fts MATCH return a syntax error.
+func FuzzSanitizeFTSQuery(f *testing.F) {
+	seeds := []string{
+		"",
+		"hello world",
+		`hello "world" AND (test) NOT foo*`,
+		"foo NEAR bar",
+		"foo NEAR/2 bar",
+		"content:foo",
+		"*",
+		"**",
+		"((()))",
+		"-",
+		"- - -",
+		"AND",
+		"OR",
+		"NOT",
+		"NEAR",
+		"a OR b AND c",
+		strings.Repeat("漢", 199) + "x", // 200 runes, 3-byte each: right at the boundary
+		strings.Repeat("漢", 200),       // exactly 200 CJK runes
+		strings.Repeat("漢", 210),       // BUG-090: truncation used to split a rune
+		strings.Repeat("a", 199) + "漢", // ASCII run then one multi-byte rune at the cut
+		strings.Repeat("😀", 210),       // 4-byte runes (surrogate-pair range)
+		strings.Repeat("a-b ", 100),
+		"col1:foo col2:bar",
+		"\"unterminated quote",
+		"a\x00b",
+	}
+	for _, s := range seeds {
+		f.Add(s)
+	}
+
+	database := fuzzOpenMigratedMemory(f)
+
+	f.Fuzz(func(t *testing.T, q string) {
+		got := sanitizeFTSQuery(q)
+
+		if !utf8.ValidString(got) {
+			t.Fatalf("sanitizeFTSQuery(%q) produced invalid UTF-8: %q", q, got)
+		}
+		if n := utf8.RuneCountInString(got); n > 200 {
+			t.Fatalf("sanitizeFTSQuery(%q) returned %d runes, want <= 200", q, n)
+		}
+		for _, r := range got {
+			if !unicode.IsLetter(r) && !unicode.IsDigit(r) && r != ' ' && r != '-' {
+				t.Fatalf("sanitizeFTSQuery(%q) kept disallowed rune %q in %q", q, r, got)
+			}
+		}
+		// NOTE: the 200-rune truncation happens AFTER the TrimSpace call, so
+		// truncated output may legitimately end in whitespace (or, more
+		// interestingly, a lone trailing "-") -- that is not itself a
+		// contract violation as long as FTS5 still accepts it below.
+
+		// The real contract: whatever comes out must not make FTS5 choke on
+		// the MATCH clause. A "no rows" result is fine; a query-syntax error
+		// is the bug (an FTS5 operator keyword or bare "-" slipping through
+		// unescaped).
+		if _, err := database.SearchMessages(context.Background(), got, nil, 10); err != nil {
+			t.Fatalf("SearchMessages with sanitized query %q (from %q) errored: %v", got, q, err)
+		}
+	})
+}
diff --git a/Server/db/status.go b/Server/db/status.go
new file mode 100644
index 00000000..2f8ed0e1
--- /dev/null
+++ b/Server/db/status.go
@@ -0,0 +1,79 @@
+package db
+
+// ─── Presence status vocabulary ─────────────────────────────────────────────
+//
+// `users.status` stores the status the user actually chose. "invisible" is one
+// of those choices and is stored as itself — it is deliberately NOT collapsed
+// to "offline" at the write, because the server has to be able to tell "chose
+// to appear offline" from "is not connected" on the next connect (the first
+// must survive a reconnect, the second must not).
+//
+// The collapse happens at every read that another user can see:
+// BroadcastStatus maps invisible -> offline, and the owner's own payloads keep
+// the true value. That split is the whole "real invisible" model — one place
+// decides what others see, so a new payload cannot accidentally leak it.
+
+const (
+	// StatusOnline is the default presence for a connected session.
+	StatusOnline = "online"
+	// StatusIdle is set manually or by the client's inactivity timer.
+	StatusIdle = "idle"
+	// StatusDND suppresses desktop notifications client-side.
+	StatusDND = "dnd"
+	// StatusInvisible means "connected, but shown to everyone else as offline".
+	StatusInvisible = "invisible"
+	// StatusOffline means "not connected". It is no longer a status a user can
+	// pick — StatusInvisible replaced that — but it is still what disconnect
+	// writes and what BroadcastStatus maps invisible to.
+	StatusOffline = "offline"
+)
+
+// ValidStatuses is the set a client may set via presence_update. "offline" is
+// still accepted so an older client that sends it (the pre-invisible spelling
+// of "appear offline") is not answered with an error; it is treated as the
+// plain offline it says.
+var ValidStatuses = map[string]bool{
+	StatusOnline:    true,
+	StatusIdle:      true,
+	StatusDND:       true,
+	StatusInvisible: true,
+	StatusOffline:   true,
+}
+
+// BroadcastStatus maps a stored status to what OTHER users may see. Only
+// invisible is rewritten; everything else is already public.
+func BroadcastStatus(status string) string {
+	if status == StatusInvisible {
+		return StatusOffline
+	}
+	return status
+}
+
+// StatusForViewer returns the status `subjectID` should appear as to
+// `viewerID`. The owner of a status always sees its true value — a client that
+// was told it was offline would render its own picker wrong and re-send
+// "online" on the next reconnect, which is exactly the flash-online bug real
+// invisible exists to kill.
+func StatusForViewer(status string, subjectID, viewerID int64) string {
+	if subjectID == viewerID {
+		return status
+	}
+	return BroadcastStatus(status)
+}
+
+// ConnectStatus returns the status a session should come online as, given the
+// status saved from the user's last session.
+//
+// idle, dnd and invisible are deliberate choices and survive a reconnect;
+// anything else (online, offline, or an unknown legacy value) becomes online.
+// "offline" cannot be honoured here because it is also what a disconnect
+// writes, so it carries no intent — that ambiguity is why invisible is its own
+// value rather than a flag on offline.
+func ConnectStatus(saved string) string {
+	switch saved {
+	case StatusIdle, StatusDND, StatusInvisible:
+		return saved
+	default:
+		return StatusOnline
+	}
+}
diff --git a/Server/db/status_test.go b/Server/db/status_test.go
new file mode 100644
index 00000000..bc629464
--- /dev/null
+++ b/Server/db/status_test.go
@@ -0,0 +1,236 @@
+package db_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/owncord/server/db"
+)
+
+// The invisible model lives in three tiny pure functions, and every payload
+// builder on the server delegates to one of them. Locking their behaviour here
+// is what makes "an invisible user never leaks" a property of the codebase
+// rather than of each individual call site.
+
+func TestBroadcastStatus_MapsOnlyInvisible(t *testing.T) {
+	cases := map[string]string{
+		db.StatusOnline:    db.StatusOnline,
+		db.StatusIdle:      db.StatusIdle,
+		db.StatusDND:       db.StatusDND,
+		db.StatusOffline:   db.StatusOffline,
+		db.StatusInvisible: db.StatusOffline,
+	}
+	for in, want := range cases {
+		if got := db.BroadcastStatus(in); got != want {
+			t.Errorf("BroadcastStatus(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestStatusForViewer_OwnerSeesTruthOthersSeeOffline(t *testing.T) {
+	const subject int64 = 7
+	if got := db.StatusForViewer(db.StatusInvisible, subject, subject); got != db.StatusInvisible {
+		t.Errorf("owner view = %q, want invisible", got)
+	}
+	if got := db.StatusForViewer(db.StatusInvisible, subject, 8); got != db.StatusOffline {
+		t.Errorf("other view = %q, want offline", got)
+	}
+	// A non-invisible status is identical for both.
+	if got := db.StatusForViewer(db.StatusDND, subject, 8); got != db.StatusDND {
+		t.Errorf("other view of dnd = %q, want dnd", got)
+	}
+}
+
+func TestConnectStatus_HonoursChoicesAndDefaultsOnline(t *testing.T) {
+	cases := map[string]string{
+		db.StatusIdle:      db.StatusIdle,
+		db.StatusDND:       db.StatusDND,
+		db.StatusInvisible: db.StatusInvisible,
+		// offline carries no intent (it is also what a disconnect writes), so
+		// it cannot mean "appear offline" — that is what invisible is for.
+		db.StatusOffline: db.StatusOnline,
+		db.StatusOnline:  db.StatusOnline,
+		"":               db.StatusOnline,
+		"bogus":          db.StatusOnline,
+	}
+	for in, want := range cases {
+		if got := db.ConnectStatus(in); got != want {
+			t.Errorf("ConnectStatus(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestValidStatuses_AcceptsInvisible(t *testing.T) {
+	if !db.ValidStatuses[db.StatusInvisible] {
+		t.Error("invisible must be a settable status")
+	}
+	if db.ValidStatuses["afk"] {
+		t.Error("unknown statuses must not be settable")
+	}
+}
+
+func TestMemberSummary_ForViewer(t *testing.T) {
+	m := db.MemberSummary{ID: 3, Username: "ghost", Status: db.StatusInvisible}
+	if got := m.ForViewer(3).Status; got != db.StatusInvisible {
+		t.Errorf("self view = %q, want invisible", got)
+	}
+	if got := m.ForViewer(4).Status; got != db.StatusOffline {
+		t.Errorf("other view = %q, want offline", got)
+	}
+	// ForViewer must not mutate the receiver — it is called in a loop over a
+	// shared slice.
+	if m.Status != db.StatusInvisible {
+		t.Errorf("receiver mutated to %q", m.Status)
+	}
+}
+
+func TestMarkUserDisconnected_PreservesChosenStatus(t *testing.T) {
+	database := newTestDB(t)
+	ctx := context.Background()
+
+	onlineID, err := database.CreateUser(ctx, "went_online", "hash", 4)
+	if err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+	dndID, err := database.CreateUser(ctx, "went_dnd", "hash", 4)
+	if err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+	invisID, err := database.CreateUser(ctx, "went_invisible", "hash", 4)
+	if err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+	_ = database.UpdateUserStatus(ctx, onlineID, db.StatusOnline)
+	_ = database.UpdateUserStatus(ctx, dndID, db.StatusDND)
+	_ = database.UpdateUserStatus(ctx, invisID, db.StatusInvisible)
+
+	for _, id := range []int64{onlineID, dndID, invisID} {
+		if err := database.MarkUserDisconnected(ctx, id); err != nil {
+			t.Fatalf("MarkUserDisconnected(%d): %v", id, err)
+		}
+	}
+
+	got := func(id int64) string {
+		u, err := database.GetUserByID(ctx, id)
+		if err != nil || u == nil {
+			t.Fatalf("GetUserByID(%d): %v", id, err)
+		}
+		return u.Status
+	}
+	if s := got(onlineID); s != db.StatusOffline {
+		t.Errorf("online -> %q, want offline", s)
+	}
+	// The whole point: the next connect reads this column, so a chosen status
+	// has to still be there.
+	if s := got(dndID); s != db.StatusDND {
+		t.Errorf("dnd -> %q, want dnd preserved", s)
+	}
+	if s := got(invisID); s != db.StatusInvisible {
+		t.Errorf("invisible -> %q, want invisible preserved", s)
+	}
+}
+
+func TestUpdateUserCustomStatus_RoundTripAndClear(t *testing.T) {
+	database := newTestDB(t)
+	ctx := context.Background()
+	id, err := database.CreateUser(ctx, "statusy", "hash", 4)
+	if err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+
+	text := "shipping phase 6"
+	if err := database.UpdateUserCustomStatus(ctx, id, &text); err != nil {
+		t.Fatalf("UpdateUserCustomStatus: %v", err)
+	}
+	u, _ := database.GetUserByID(ctx, id)
+	if u.CustomStatus == nil || *u.CustomStatus != text {
+		t.Fatalf("custom status = %v, want %q", u.CustomStatus, text)
+	}
+
+	if err := database.UpdateUserCustomStatus(ctx, id, nil); err != nil {
+		t.Fatalf("clear: %v", err)
+	}
+	u, _ = database.GetUserByID(ctx, id)
+	if u.CustomStatus != nil {
+		t.Fatalf("custom status = %v, want nil after clear", *u.CustomStatus)
+	}
+}
+
+func TestIsAvatarFileURL(t *testing.T) {
+	database := newTestDB(t)
+	ctx := context.Background()
+	id, err := database.CreateUser(ctx, "pfp", "hash", 4)
+	if err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+
+	const url = "/api/v1/files/abc-123"
+	if inUse, err := database.IsAvatarFileURL(ctx, url); err != nil || inUse {
+		t.Fatalf("IsAvatarFileURL before = %v, %v; want false, nil", inUse, err)
+	}
+
+	avatar := url
+	if err := database.UpdateUserProfile(ctx, id, "pfp", &avatar, nil, nil); err != nil {
+		t.Fatalf("UpdateUserProfile: %v", err)
+	}
+	if inUse, err := database.IsAvatarFileURL(ctx, url); err != nil || !inUse {
+		t.Fatalf("IsAvatarFileURL in use = %v, %v; want true, nil", inUse, err)
+	}
+
+	// Replacing the avatar revokes the old file's public readability.
+	other := "/api/v1/files/def-456"
+	if err := database.UpdateUserProfile(ctx, id, "pfp", &other, nil, nil); err != nil {
+		t.Fatalf("UpdateUserProfile: %v", err)
+	}
+	if inUse, _ := database.IsAvatarFileURL(ctx, url); inUse {
+		t.Error("replaced avatar must stop being publicly readable")
+	}
+}
+
+func TestEffectiveDisplayName(t *testing.T) {
+	name := "Ada L."
+	empty := ""
+	cases := []struct {
+		user *db.User
+		want string
+	}{
+		{&db.User{Username: "ada", DisplayName: &name}, "Ada L."},
+		{&db.User{Username: "ada"}, "ada"},
+		{&db.User{Username: "ada", DisplayName: &empty}, "ada"},
+		{nil, ""},
+	}
+	for _, c := range cases {
+		if got := c.user.EffectiveDisplayName(); got != c.want {
+			t.Errorf("EffectiveDisplayName() = %q, want %q", got, c.want)
+		}
+	}
+}
+
+func TestUpdateUserProfile_WritesDisplayNameAndAbout(t *testing.T) {
+	database := newTestDB(t)
+	ctx := context.Background()
+	id, err := database.CreateUser(ctx, "bio", "hash", 4)
+	if err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+
+	name, about := "Bio Person", "likes long walks"
+	if err := database.UpdateUserProfile(ctx, id, "bio", nil, &name, &about); err != nil {
+		t.Fatalf("UpdateUserProfile: %v", err)
+	}
+	u, _ := database.GetUserByID(ctx, id)
+	if u.DisplayName == nil || *u.DisplayName != name {
+		t.Errorf("display_name = %v, want %q", u.DisplayName, name)
+	}
+	if u.About == nil || *u.About != about {
+		t.Errorf("about = %v, want %q", u.About, about)
+	}
+
+	if err := database.UpdateUserProfile(ctx, id, "bio", nil, nil, nil); err != nil {
+		t.Fatalf("clear: %v", err)
+	}
+	u, _ = database.GetUserByID(ctx, id)
+	if u.DisplayName != nil || u.About != nil {
+		t.Errorf("expected both cleared, got %v / %v", u.DisplayName, u.About)
+	}
+}
diff --git a/Server/db/voice_queries.go b/Server/db/voice_queries.go
index 2d5aa46f..f695b5fa 100644
--- a/Server/db/voice_queries.go
+++ b/Server/db/voice_queries.go
@@ -97,15 +97,17 @@ func (d *DB) GetVoiceState(ctx context.Context, userID int64) (*VoiceState, erro
 		return nil, fmt.Errorf("GetVoiceState: %w", err)
 	}
 	vs := VoiceState{
-		UserID:      r.UserID,
-		ChannelID:   r.ChannelID,
-		Username:    r.Username,
-		Muted:       r.Muted != 0,
-		Deafened:    r.Deafened != 0,
-		Speaking:    r.Speaking != 0,
-		Camera:      r.Camera != 0,
-		Screenshare: r.Screenshare != 0,
-		JoinedAt:    r.JoinedAt,
+		UserID:         r.UserID,
+		ChannelID:      r.ChannelID,
+		Username:       r.Username,
+		Muted:          r.Muted != 0,
+		Deafened:       r.Deafened != 0,
+		Speaking:       r.Speaking != 0,
+		Camera:         r.Camera != 0,
+		Screenshare:    r.Screenshare != 0,
+		ServerMuted:    r.ServerMuted != 0,
+		ServerDeafened: r.ServerDeafened != 0,
+		JoinedAt:       r.JoinedAt,
 	}
 	return &vs, nil
 }
@@ -120,15 +122,17 @@ func (d *DB) GetChannelVoiceStates(ctx context.Context, channelID int64) ([]Voic
 	states := make([]VoiceState, 0, len(rows))
 	for _, r := range rows {
 		states = append(states, VoiceState{
-			UserID:      r.UserID,
-			ChannelID:   r.ChannelID,
-			Username:    r.Username,
-			Muted:       r.Muted != 0,
-			Deafened:    r.Deafened != 0,
-			Speaking:    r.Speaking != 0,
-			Camera:      r.Camera != 0,
-			Screenshare: r.Screenshare != 0,
-			JoinedAt:    r.JoinedAt,
+			UserID:         r.UserID,
+			ChannelID:      r.ChannelID,
+			Username:       r.Username,
+			Muted:          r.Muted != 0,
+			Deafened:       r.Deafened != 0,
+			Speaking:       r.Speaking != 0,
+			Camera:         r.Camera != 0,
+			Screenshare:    r.Screenshare != 0,
+			ServerMuted:    r.ServerMuted != 0,
+			ServerDeafened: r.ServerDeafened != 0,
+			JoinedAt:       r.JoinedAt,
 		})
 	}
 	return states, nil
@@ -144,15 +148,17 @@ func (d *DB) GetAllVoiceStates(ctx context.Context) ([]VoiceState, error) {
 	states := make([]VoiceState, 0, len(rows))
 	for _, r := range rows {
 		states = append(states, VoiceState{
-			UserID:      r.UserID,
-			ChannelID:   r.ChannelID,
-			Username:    r.Username,
-			Muted:       r.Muted != 0,
-			Deafened:    r.Deafened != 0,
-			Speaking:    r.Speaking != 0,
-			Camera:      r.Camera != 0,
-			Screenshare: r.Screenshare != 0,
-			JoinedAt:    r.JoinedAt,
+			UserID:         r.UserID,
+			ChannelID:      r.ChannelID,
+			Username:       r.Username,
+			Muted:          r.Muted != 0,
+			Deafened:       r.Deafened != 0,
+			Speaking:       r.Speaking != 0,
+			Camera:         r.Camera != 0,
+			Screenshare:    r.Screenshare != 0,
+			ServerMuted:    r.ServerMuted != 0,
+			ServerDeafened: r.ServerDeafened != 0,
+			JoinedAt:       r.JoinedAt,
 		})
 	}
 	return states, nil
@@ -182,6 +188,38 @@ func (d *DB) UpdateVoiceDeafen(ctx context.Context, userID int64, deafened bool)
 	return nil
 }
 
+// SetVoiceServerMute applies or clears the moderator-imposed mute. Applying it
+// also sets muted so the client state matches immediately; clearing it leaves
+// muted alone, so a user who was muted before the moderator acted stays muted
+// until they unmute themselves.
+func (d *DB) SetVoiceServerMute(ctx context.Context, userID int64, serverMuted bool) error {
+	var err error
+	if serverMuted {
+		err = d.q.ApplyVoiceServerMute(ctx, userID)
+	} else {
+		err = d.q.ClearVoiceServerMute(ctx, userID)
+	}
+	if err != nil {
+		return fmt.Errorf("SetVoiceServerMute: %w", err)
+	}
+	return nil
+}
+
+// SetVoiceServerDeafen applies or clears the moderator-imposed deafen.
+// Mirrors SetVoiceServerMute, including the asymmetric handling of deafened.
+func (d *DB) SetVoiceServerDeafen(ctx context.Context, userID int64, serverDeafened bool) error {
+	var err error
+	if serverDeafened {
+		err = d.q.ApplyVoiceServerDeafen(ctx, userID)
+	} else {
+		err = d.q.ClearVoiceServerDeafen(ctx, userID)
+	}
+	if err != nil {
+		return fmt.Errorf("SetVoiceServerDeafen: %w", err)
+	}
+	return nil
+}
+
 // ClearVoiceState removes a user's voice state on disconnect.
 // Equivalent to LeaveVoiceChannel but named to clarify the disconnect use case.
 func (d *DB) ClearVoiceState(ctx context.Context, userID int64) error {
diff --git a/Server/db/voice_queries_test.go b/Server/db/voice_queries_test.go
index 7fc94d3b..7cfa0963 100644
--- a/Server/db/voice_queries_test.go
+++ b/Server/db/voice_queries_test.go
@@ -22,7 +22,9 @@ CREATE TABLE IF NOT EXISTS channels (
     voice_max_users INTEGER NOT NULL DEFAULT 0,
     voice_quality   TEXT,
     mixing_threshold INTEGER,
-    voice_max_video INTEGER NOT NULL DEFAULT 10
+    voice_max_video INTEGER NOT NULL DEFAULT 10,
+    nsfw            INTEGER NOT NULL DEFAULT 0,
+    is_group         INTEGER NOT NULL DEFAULT 0
 );
 `)
 
@@ -47,6 +49,8 @@ CREATE TABLE IF NOT EXISTS voice_states (
     speaking    INTEGER NOT NULL DEFAULT 0,
     camera      INTEGER NOT NULL DEFAULT 0,
     screenshare INTEGER NOT NULL DEFAULT 0,
+    server_muted    INTEGER NOT NULL DEFAULT 0,
+    server_deafened INTEGER NOT NULL DEFAULT 0,
     joined_at   TEXT    NOT NULL DEFAULT (datetime('now'))
 );
 CREATE INDEX IF NOT EXISTS idx_voice_states_channel ON voice_states(channel_id);
diff --git a/Server/migrations/021_voice_server_moderation.sql b/Server/migrations/021_voice_server_moderation.sql
new file mode 100644
index 00000000..0706a7b9
--- /dev/null
+++ b/Server/migrations/021_voice_server_moderation.sql
@@ -0,0 +1,6 @@
+-- Phase 2 (moderation depth): moderator-imposed voice state.
+-- server_muted / server_deafened are distinct from the self-service muted /
+-- deafened columns: only a MUTE_MEMBERS holder may clear them, and while set
+-- the user's own voice_mute / voice_deafen unmute attempts are refused.
+ALTER TABLE voice_states ADD COLUMN server_muted INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE voice_states ADD COLUMN server_deafened INTEGER NOT NULL DEFAULT 0;
diff --git a/Server/migrations/022_message_mentions.sql b/Server/migrations/022_message_mentions.sql
new file mode 100644
index 00000000..932f4711
--- /dev/null
+++ b/Server/migrations/022_message_mentions.sql
@@ -0,0 +1,21 @@
+-- Phase 3 (mentions): resolved mention storage and the MENTION_EVERYONE bit.
+--
+-- message_mentions holds user-id mentions only. @everyone/@here is a per-message
+-- boolean rather than a sentinel row, so the mention list never carries an id
+-- that is not a real user. Both are rewritten wholesale when a message is edited.
+CREATE TABLE IF NOT EXISTS message_mentions (
+    message_id        INTEGER NOT NULL REFERENCES messages(id) ON DELETE CASCADE,
+    mentioned_user_id INTEGER NOT NULL REFERENCES users(id)    ON DELETE CASCADE,
+    PRIMARY KEY (message_id, mentioned_user_id)
+);
+
+-- The primary key already covers the per-message direction. This index backs
+-- the per-user "which messages mention me" direction.
+CREATE INDEX IF NOT EXISTS idx_message_mentions_user ON message_mentions(mentioned_user_id);
+
+ALTER TABLE messages ADD COLUMN mentions_everyone INTEGER NOT NULL DEFAULT 0;
+
+-- MENTION_EVERYONE (bit 21, 0x200000) for the seeded privileged roles. Owner
+-- (0x7FFFFFFF) and Admin (0x3FFFFFFF) already hold every bit below 30. The
+-- Moderator mask (0x000FFFFF) stops at bit 19, so this is the bit it gains.
+UPDATE roles SET permissions = permissions | 0x200000 WHERE id IN (1, 2, 3);
diff --git a/Server/migrations/023_role_management.sql b/Server/migrations/023_role_management.sql
new file mode 100644
index 00000000..cb2a4ad8
--- /dev/null
+++ b/Server/migrations/023_role_management.sql
@@ -0,0 +1,14 @@
+-- Phase 5 (role management): make role names case-insensitively unique.
+--
+-- roles.name already carries a UNIQUE constraint, but with SQLite's default
+-- BINARY collation — so "Moderator" and "moderator" were two distinct roles.
+-- Role CRUD resolves names case-insensitively (the client matches role names
+-- case-insensitively too, see getRoleIdByName), so the uniqueness rule has to
+-- agree with the lookup rule or two roles could shadow each other.
+--
+-- A partial rebuild of the table to change the column collation would rewrite
+-- every FK-referencing row, while a second unique index costs one B-tree and is
+-- exactly as strong. Creating it fails loudly if an existing database already
+-- holds a case-colliding pair, which is the correct outcome — the operator has
+-- to rename one before role management can be trusted.
+CREATE UNIQUE INDEX IF NOT EXISTS idx_roles_name_nocase ON roles(name COLLATE NOCASE);
diff --git a/Server/migrations/024_channel_user_overrides.sql b/Server/migrations/024_channel_user_overrides.sql
new file mode 100644
index 00000000..cd81cfb3
--- /dev/null
+++ b/Server/migrations/024_channel_user_overrides.sql
@@ -0,0 +1,28 @@
+-- Phase 5 (channel management): per-user channel permission overrides.
+--
+-- channel_overrides answers "what may this ROLE do here". Discord's resolution
+-- order has a second, narrower layer on top of it — a single member can be
+-- granted or refused a bit in one channel without minting a role for them:
+--
+--     base role permissions -> role override -> user override
+--
+-- with the user layer applied last, so a user deny beats a role allow and a
+-- user allow beats a user deny (ADMINISTRATOR still bypasses everything).
+--
+-- The shape mirrors channel_overrides exactly (allow/deny masks, cascade on
+-- both parents) so the two layers can be fetched and merged by the same code
+-- paths. The PRIMARY KEY replaces channel_overrides' surrogate id plus UNIQUE
+-- pair because nothing references an override row by id.
+CREATE TABLE IF NOT EXISTS channel_user_overrides (
+    channel_id INTEGER NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
+    user_id    INTEGER NOT NULL REFERENCES users(id)    ON DELETE CASCADE,
+    allow      INTEGER NOT NULL DEFAULT 0,
+    deny       INTEGER NOT NULL DEFAULT 0,
+    PRIMARY KEY (channel_id, user_id)
+);
+
+-- The per-user direction ("every override this user carries") is the one the
+-- permission cache populates from on every connect. The PK only covers the
+-- per-channel direction.
+CREATE INDEX IF NOT EXISTS idx_channel_user_overrides_user
+    ON channel_user_overrides(user_id);
diff --git a/Server/migrations/025_channel_nsfw.sql b/Server/migrations/025_channel_nsfw.sql
new file mode 100644
index 00000000..1ae08510
--- /dev/null
+++ b/Server/migrations/025_channel_nsfw.sql
@@ -0,0 +1,13 @@
+-- Phase 5 (channel management): the per-channel NSFW / age-gate flag.
+--
+-- The flag is metadata and nothing else. The server stores it, ships it in
+-- `ready` and in the channel_create/channel_update broadcasts, and audits the
+-- edit — it deliberately imposes NO content behaviour of its own: no filtering,
+-- no age check, no restriction on who may read or post. Every client is free
+-- to decide what to do with it (the desktop client shows a one-time-per-session
+-- "may contain sensitive content" gate and marks the sidebar row), which is the
+-- only honest contract on a self-hosted server that knows nobody's age.
+--
+-- Stored as INTEGER 0/1 to match `archived` — SQLite has no boolean type, and
+-- every other flag column on this table already uses that shape.
+ALTER TABLE channels ADD COLUMN nsfw INTEGER NOT NULL DEFAULT 0;
diff --git a/Server/migrations/026_emoji_mime.sql b/Server/migrations/026_emoji_mime.sql
new file mode 100644
index 00000000..a8772db0
--- /dev/null
+++ b/Server/migrations/026_emoji_mime.sql
@@ -0,0 +1,15 @@
+-- Phase 6 (custom emoji): give the long-dormant `emoji` table the one column it
+-- was missing to be servable.
+--
+-- The table has existed since 001 with (shortcode, filename, uploaded_by) and
+-- no server code at all. `filename` now holds the storage UUID the file was
+-- written under (same convention as attachments.stored_as), which is enough to
+-- find the bytes but not enough to serve them: the emoji image route has to
+-- send a Content-Type, and re-sniffing the file on every GET would mean opening
+-- and reading it before ServeContent does the same again.
+--
+-- The sniffed type is decided once at upload (png/jpeg/gif/webp only, from the
+-- magic bytes, never from the client's header) and recorded here. The DEFAULT
+-- exists only so the ALTER is legal on a table that in practice has no rows --
+-- nothing has ever written to it.
+ALTER TABLE emoji ADD COLUMN mime_type TEXT NOT NULL DEFAULT 'image/png';
diff --git a/Server/migrations/027_user_profile_fields.sql b/Server/migrations/027_user_profile_fields.sql
new file mode 100644
index 00000000..808966e0
--- /dev/null
+++ b/Server/migrations/027_user_profile_fields.sql
@@ -0,0 +1,28 @@
+-- Phase 6 (profiles & presence depth): the three profile columns the users
+-- table never had, plus the index that makes avatar-file authorization cheap.
+--
+-- display_name is a *display* handle only. It is nullable and falls back to
+-- username everywhere, and mentions keep resolving against username alone --
+-- username is the unique, case-insensitive key, so making @mentions look at a
+-- non-unique nickname would make "@alice" ambiguous the moment two people pick
+-- the same one.
+--
+-- Bounds (1-32 for display_name, 300 for about, 128 for custom_status) are
+-- enforced in the service layer, which is where the sanitizer runs and where a
+-- violation can answer 400 instead of a constraint error. The columns are
+-- plain TEXT so a future bound change is not a table rebuild.
+ALTER TABLE users ADD COLUMN display_name TEXT;
+ALTER TABLE users ADD COLUMN about TEXT;
+ALTER TABLE users ADD COLUMN custom_status TEXT;
+
+-- Avatars uploaded through POST /api/v1/users/me/avatar land in the attachments
+-- table with no channel, and an unlinked attachment is readable only by its
+-- uploader -- which would make every avatar invisible to everyone but its
+-- owner. The file route therefore also admits an unlinked attachment that some
+-- user's avatar column currently points at: an avatar is readable exactly while
+-- it is somebody's avatar, and stops being readable the moment it is replaced.
+--
+-- That check is an equality lookup on users.avatar on every avatar fetch, so it
+-- gets an index. Partial (avatar IS NOT NULL) because the rows that matter are
+-- the ones with a value and the default is NULL.
+CREATE INDEX IF NOT EXISTS idx_users_avatar ON users(avatar) WHERE avatar IS NOT NULL;
diff --git a/Server/migrations/028_group_dms.sql b/Server/migrations/028_group_dms.sql
new file mode 100644
index 00000000..18499c4e
--- /dev/null
+++ b/Server/migrations/028_group_dms.sql
@@ -0,0 +1,29 @@
+-- Migration 028 (phase 6, group DMs): mark which DM channels are groups.
+--
+-- dm_participants has always held N rows per channel, so a group DM needed no
+-- new table. What it did need is a way to tell a group from a two-person DM
+-- that does NOT count participants, because the count changes underneath you:
+--
+--   * A group of three that two people leave has two participants, and the 1:1
+--     lookup in GetOrCreateDMChannel -- "the dm channel both of these users are
+--     in" -- would then match it. "Message Bob" would silently deliver into the
+--     remnants of a group, in front of whoever else is still there.
+--   * Leaving is destructive for a group (you come out of dm_participants) and
+--     non-destructive for a 1:1 (you only hide it). Deriving which one to run
+--     from the live count means the third-from-last leaver runs a different
+--     operation than the second-from-last, for no reason the user can see.
+--
+-- So group-ness is a property of the channel, decided once at creation and
+-- never recomputed. is_group = 0 for every pre-existing row, which is correct:
+-- every DM that existed before this migration was created by the 1:1 path.
+--
+-- The column lives on channels rather than a dm_groups side table because it
+-- is one bit about a channel, and every read that needs it is already loading
+-- the channel row.
+ALTER TABLE channels ADD COLUMN is_group INTEGER NOT NULL DEFAULT 0;
+
+-- The 1:1 DM lookup filters on it (c.type = 'dm' AND c.is_group = 0) on every
+-- "open a DM with this person", which is a hot path on the DM sidebar. Partial
+-- on type so the index covers only the DM rows -- guild channels are never
+-- groups and never looked up this way.
+CREATE INDEX IF NOT EXISTS idx_channels_dm_group ON channels(is_group) WHERE type = 'dm';
diff --git a/Server/permissions/checker.go b/Server/permissions/checker.go
index 7c174781..75195bbe 100644
--- a/Server/permissions/checker.go
+++ b/Server/permissions/checker.go
@@ -16,24 +16,32 @@ var ErrPermissionDenied = errors.New("permission denied")
 
 // ─── DB interface ───────────────────────────────────────────────────────────
 
-// ChannelOverride holds the allow/deny permission bits for a single channel.
+// ChannelOverride holds both override layers for a single channel: Allow/Deny
+// are the ROLE layer (channel_overrides), UserAllow/UserDeny the per-member
+// layer (channel_user_overrides) that is applied on top of it. The zero value
+// means "no override at either layer", which is why a missing map entry is
+// always the correct answer.
 type ChannelOverride struct {
-	Allow int64
-	Deny  int64
+	Allow     int64
+	Deny      int64
+	UserAllow int64
+	UserDeny  int64
 }
 
 // ChannelRef is the minimal channel description VisibleChannelIDs needs.
 // Declared here (not imported from db) so the permissions package stays free
 // of a db dependency; callers map their []db.Channel down to []ChannelRef.
 type ChannelRef struct {
-	ID   int64
-	Type string
+	ID       int64
+	Type     string
+	Archived bool
 }
 
 // DB is the minimal database interface the Checker needs.
 // Defined at the consumer (per Go convention: accept interfaces, return structs).
 type DB interface {
 	GetChannelPermissions(ctx context.Context, channelID, roleID int64) (allow, deny int64, err error)
+	GetUserChannelPermissions(ctx context.Context, channelID, userID int64) (allow, deny int64, err error)
 	IsDMParticipant(ctx context.Context, userID, channelID int64) (bool, error)
 }
 
@@ -50,11 +58,15 @@ func NewChecker(db DB) *Checker {
 	return &Checker{db: db}
 }
 
-// HasChannelPerm reports whether the role (identified by rolePerms and roleID)
-// has all the given permission bits on the specified channel. Administrator
-// roles bypass all checks. Channel overrides (allow/deny) are fetched from the
-// database per call.
-func (ck *Checker) HasChannelPerm(ctx context.Context, rolePerms int64, roleID, channelID, perm int64) bool {
+// HasChannelPerm reports whether the member (identified by rolePerms, roleID
+// and userID) has all the given permission bits on the specified channel.
+// Administrator roles bypass all checks. Both override layers — the role's and
+// the user's — are fetched from the database per call and resolved by
+// EffectiveChannelPerms.
+//
+// userID may be 0 for a check that is genuinely role-only (no member in hand);
+// the per-user layer is then skipped rather than queried for a nonexistent id.
+func (ck *Checker) HasChannelPerm(ctx context.Context, rolePerms int64, roleID, userID, channelID, perm int64) bool {
 	if HasAdmin(rolePerms) {
 		return true
 	}
@@ -62,25 +74,33 @@ func (ck *Checker) HasChannelPerm(ctx context.Context, rolePerms int64, roleID,
 	if err != nil {
 		return false
 	}
-	effective := EffectivePerms(rolePerms, allow, deny)
-	return effective&perm == perm
+	o := ChannelOverride{Allow: allow, Deny: deny}
+	if userID != 0 {
+		uAllow, uDeny, uErr := ck.db.GetUserChannelPermissions(ctx, channelID, userID)
+		if uErr != nil {
+			return false
+		}
+		o.UserAllow, o.UserDeny = uAllow, uDeny
+	}
+	return EffectiveChannelPerms(rolePerms, o)&perm == perm
 }
 
-// HasChannelPermBatch reports whether the role has the given permission on the
-// channel using a pre-fetched overrides map. This avoids N+1 queries when
-// filtering many channels in bulk. The zero-value ChannelOverride (no entry in
-// map) is correct -- it means no override exists.
+// HasChannelPermBatch reports whether the member has the given permission on
+// the channel using a pre-fetched overrides map carrying BOTH layers (build it
+// with db.GetChannelOverridesFor). This avoids N+1 queries when filtering many
+// channels in bulk. The zero-value ChannelOverride (no entry in map) is correct
+// -- it means no override exists at either layer.
 func (ck *Checker) HasChannelPermBatch(rolePerms int64, overrides map[int64]ChannelOverride, channelID, perm int64) bool {
 	if HasAdmin(rolePerms) {
 		return true
 	}
-	o := overrides[channelID] // zero-value (0, 0) when no override exists
-	effective := EffectivePerms(rolePerms, o.Allow, o.Deny)
-	return effective&perm == perm
+	o := overrides[channelID] // zero value when no override exists
+	return EffectiveChannelPerms(rolePerms, o)&perm == perm
 }
 
-// VisibleChannelIDs returns the set of non-DM channel IDs the role (identified
-// by rolePerms) may READ, using a pre-fetched overrides map. It is the single
+// VisibleChannelIDs returns the set of non-DM channel IDs the member
+// (identified by rolePerms plus the two-layer overrides map) may READ, using a
+// pre-fetched overrides map. It is the single
 // predicate behind every "which channels does this role see" site (REST
 // ListVisibleChannels, the ws ready payload, and reconnect replay filtering) so
 // they can never drift apart. DM channels are skipped — their visibility is
@@ -93,6 +113,12 @@ func (ck *Checker) VisibleChannelIDs(rolePerms int64, channels []ChannelRef, ove
 		if ch.Type == "dm" {
 			continue
 		}
+		// Archived channels are hidden from every client surface (admins
+		// included) — they stay manageable from the admin panel, which lists
+		// channels without this predicate.
+		if ch.Archived {
+			continue
+		}
 		if ck.HasChannelPermBatch(rolePerms, overrides, ch.ID, ReadMessages) {
 			visible[ch.ID] = true
 		}
@@ -118,7 +144,7 @@ func (ck *Checker) RequireChannelAccess(ctx context.Context, userID, rolePerms,
 		return nil
 	}
 
-	if !ck.HasChannelPerm(ctx, rolePerms, roleID, channelID, perm) {
+	if !ck.HasChannelPerm(ctx, rolePerms, roleID, userID, channelID, perm) {
 		return ErrPermissionDenied
 	}
 	return nil
diff --git a/Server/permissions/checker_test.go b/Server/permissions/checker_test.go
index e4563f7d..ce678d33 100644
--- a/Server/permissions/checker_test.go
+++ b/Server/permissions/checker_test.go
@@ -11,13 +11,16 @@ import (
 
 type mockDB struct {
 	channelPerms   map[chanRoleKey]chanPerm
+	userPerms      map[chanUserKey]chanPerm
 	dmParticipants map[dmKey]bool
 	chanErr        error
+	userErr        error
 	dmErr          error
 }
 
 type (
 	chanRoleKey struct{ channelID, roleID int64 }
+	chanUserKey struct{ channelID, userID int64 }
 	chanPerm    struct{ allow, deny int64 }
 	dmKey       struct{ userID, channelID int64 }
 )
@@ -25,6 +28,7 @@ type (
 func newMockDB() *mockDB {
 	return &mockDB{
 		channelPerms:   make(map[chanRoleKey]chanPerm),
+		userPerms:      make(map[chanUserKey]chanPerm),
 		dmParticipants: make(map[dmKey]bool),
 	}
 }
@@ -41,6 +45,17 @@ func (m *mockDB) GetChannelPermissions(_ context.Context, channelID, roleID int6
 	return p.allow, p.deny, nil
 }
 
+func (m *mockDB) GetUserChannelPermissions(_ context.Context, channelID, userID int64) (int64, int64, error) {
+	if m.userErr != nil {
+		return 0, 0, m.userErr
+	}
+	p, ok := m.userPerms[chanUserKey{channelID, userID}]
+	if !ok {
+		return 0, 0, nil
+	}
+	return p.allow, p.deny, nil
+}
+
 func (m *mockDB) IsDMParticipant(_ context.Context, userID, channelID int64) (bool, error) {
 	if m.dmErr != nil {
 		return false, m.dmErr
@@ -125,7 +140,7 @@ func TestHasChannelPerm(t *testing.T) {
 			maps.Copy(db.channelPerms, tt.overrides)
 			ck := NewChecker(db)
 
-			got := ck.HasChannelPerm(context.Background(), tt.rolePerms, tt.roleID, tt.channelID, tt.perm)
+			got := ck.HasChannelPerm(context.Background(), tt.rolePerms, tt.roleID, 0, tt.channelID, tt.perm)
 			if got != tt.want {
 				t.Errorf("HasChannelPerm() = %v, want %v", got, tt.want)
 			}
@@ -200,7 +215,8 @@ func TestVisibleChannelIDs(t *testing.T) {
 		{ID: 1, Type: "text"},
 		{ID: 2, Type: "announcement"},
 		{ID: 3, Type: "voice"},
-		{ID: 4, Type: "dm"}, // always skipped
+		{ID: 4, Type: "dm"},                   // always skipped
+		{ID: 5, Type: "text", Archived: true}, // always skipped, even for admins
 	}
 
 	tests := []struct {
@@ -248,6 +264,9 @@ func TestVisibleChannelIDs(t *testing.T) {
 			if got[4] {
 				t.Errorf("dm channel 4 must never be visible, got %v", got)
 			}
+			if got[5] {
+				t.Errorf("archived channel 5 must never be visible, got %v", got)
+			}
 			if len(got) != len(tt.want) {
 				t.Fatalf("VisibleChannelIDs() = %v, want %v", got, tt.want)
 			}
diff --git a/Server/permissions/permissions.go b/Server/permissions/permissions.go
index 5d75d575..24a4abd7 100644
--- a/Server/permissions/permissions.go
+++ b/Server/permissions/permissions.go
@@ -6,24 +6,25 @@ package permissions
 // ─── Permission bit constants (from SCHEMA.md) ───────────────────────────────
 
 const (
-	SendMessages   = int64(0x0001)     // bit 0
-	ReadMessages   = int64(0x0002)     // bit 1
-	AttachFiles    = int64(0x0020)     // bit 5
-	AddReactions   = int64(0x0040)     // bit 6
-	ConnectVoice   = int64(0x0200)     // bit 9
-	SpeakVoice     = int64(0x0400)     // bit 10
-	UseVideo       = int64(0x0800)     // bit 11
-	ShareScreen    = int64(0x1000)     // bit 12
-	ManageMessages = int64(0x10000)    // bit 16
-	ManageChannels = int64(0x20000)    // bit 17
-	KickMembers    = int64(0x40000)    // bit 18
-	BanMembers     = int64(0x80000)    // bit 19
-	MuteMembers    = int64(0x100000)   // bit 20
-	ManageRoles    = int64(0x1000000)  // bit 24
-	ManageServer   = int64(0x2000000)  // bit 25
-	ManageInvites  = int64(0x4000000)  // bit 26
-	ViewAuditLog   = int64(0x8000000)  // bit 27
-	Administrator  = int64(0x40000000) // bit 30 — bypasses all permission checks
+	SendMessages    = int64(0x0001)     // bit 0
+	ReadMessages    = int64(0x0002)     // bit 1
+	AttachFiles     = int64(0x0020)     // bit 5
+	AddReactions    = int64(0x0040)     // bit 6
+	ConnectVoice    = int64(0x0200)     // bit 9
+	SpeakVoice      = int64(0x0400)     // bit 10
+	UseVideo        = int64(0x0800)     // bit 11
+	ShareScreen     = int64(0x1000)     // bit 12
+	ManageMessages  = int64(0x10000)    // bit 16
+	ManageChannels  = int64(0x20000)    // bit 17
+	KickMembers     = int64(0x40000)    // bit 18
+	BanMembers      = int64(0x80000)    // bit 19
+	MuteMembers     = int64(0x100000)   // bit 20
+	MentionEveryone = int64(0x200000)   // bit 21
+	ManageRoles     = int64(0x1000000)  // bit 24
+	ManageServer    = int64(0x2000000)  // bit 25
+	ManageInvites   = int64(0x4000000)  // bit 26
+	ViewAuditLog    = int64(0x8000000)  // bit 27
+	Administrator   = int64(0x40000000) // bit 30 — bypasses all permission checks
 )
 
 // AllPerms is the union of every defined permission bit. Use it to mask
@@ -31,7 +32,48 @@ const (
 const AllPerms = SendMessages | ReadMessages | AttachFiles | AddReactions |
 	ConnectVoice | SpeakVoice | UseVideo | ShareScreen |
 	ManageMessages | ManageChannels | KickMembers | BanMembers | MuteMembers |
-	ManageRoles | ManageServer | ManageInvites | ViewAuditLog | Administrator
+	MentionEveryone | ManageRoles | ManageServer | ManageInvites | ViewAuditLog |
+	Administrator
+
+// AdminPerimeter is the set of bits that admits a principal to the /admin/api
+// surface. Holding ANY one of them is enough to pass the perimeter; each route
+// group then re-checks the specific bit it needs. ManageMessages and
+// ManageInvites are excluded: neither has an admin-panel route.
+const AdminPerimeter = Administrator | ManageChannels | ManageRoles |
+	ManageServer | ViewAuditLog | KickMembers | BanMembers | MuteMembers
+
+// bitNames maps each single permission bit to its SCHEMA.md name. Used for
+// authorization error messages so the wording lives in one place.
+var bitNames = map[int64]string{
+	SendMessages:    "SEND_MESSAGES",
+	ReadMessages:    "READ_MESSAGES",
+	AttachFiles:     "ATTACH_FILES",
+	AddReactions:    "ADD_REACTIONS",
+	ConnectVoice:    "CONNECT_VOICE",
+	SpeakVoice:      "SPEAK_VOICE",
+	UseVideo:        "USE_VIDEO",
+	ShareScreen:     "SHARE_SCREEN",
+	ManageMessages:  "MANAGE_MESSAGES",
+	ManageChannels:  "MANAGE_CHANNELS",
+	KickMembers:     "KICK_MEMBERS",
+	BanMembers:      "BAN_MEMBERS",
+	MuteMembers:     "MUTE_MEMBERS",
+	MentionEveryone: "MENTION_EVERYONE",
+	ManageRoles:     "MANAGE_ROLES",
+	ManageServer:    "MANAGE_SERVER",
+	ManageInvites:   "MANAGE_INVITES",
+	ViewAuditLog:    "VIEW_AUDIT_LOG",
+	Administrator:   "ADMINISTRATOR",
+}
+
+// Name returns the SCHEMA.md name of a single permission bit, or "UNKNOWN" for
+// a zero, multi-bit, or undefined value.
+func Name(bit int64) string {
+	if name, ok := bitNames[bit]; ok {
+		return name
+	}
+	return "UNKNOWN"
+}
 
 // ─── Role ID constants (default roles inserted on first run) ─────────────────
 
@@ -58,6 +100,17 @@ func HasPerm(rolePerms, requiredPerm int64) bool {
 	return rolePerms&requiredPerm == requiredPerm
 }
 
+// HasAnyPerm reports whether rolePerms contains at least one bit of mask.
+// Unlike HasPerm (ALL-of) this is ANY-of; a zero mask is never satisfied.
+// Administrator is NOT implied — callers that want the bypass pass a mask
+// that already includes it (e.g. AdminPerimeter).
+func HasAnyPerm(rolePerms, mask int64) bool {
+	if mask == 0 {
+		return false
+	}
+	return rolePerms&mask != 0
+}
+
 // HasAdmin reports whether rolePerms includes the Administrator bit, which
 // grants unconditional access to all operations.
 func HasAdmin(rolePerms int64) bool {
@@ -72,13 +125,40 @@ func HasServerPerm(rolePerms, perm int64) bool {
 	return HasAdmin(rolePerms) || HasPerm(rolePerms, perm)
 }
 
-// EffectivePerms computes the resolved permission set for a channel override.
+// EffectivePerms computes the resolved permission set for ONE override layer.
 // The formula matches Discord's channel override semantics:
 //
 //	effective = (rolePerm & ^deny) | allow
 //
 // deny is applied first (strips bits), then allow is applied (adds bits),
 // so allow takes precedence over deny when both target the same bit.
+//
+// Prefer EffectiveChannelPerms, which applies both layers in order; this is the
+// primitive it is built from.
 func EffectivePerms(rolePerm, allow, deny int64) int64 {
 	return (rolePerm &^ deny) | allow
 }
+
+// EffectiveChannelPerms resolves a member's permissions in ONE channel, in
+// Discord's order:
+//
+//	base role permissions -> role override -> user override
+//
+// Each layer is EffectivePerms, so within a layer allow beats deny, and across
+// layers the later (narrower) layer wins: a per-user deny beats a per-role
+// allow, and a per-user allow beats a per-user deny.
+//
+// ADMINISTRATOR is deliberately NOT handled here — it is a bypass, not a bit
+// that survives an override, and every caller short-circuits on HasAdmin before
+// reaching this. Keeping the bypass at the call site means a channel override
+// can still strip ADMINISTRATOR from a non-admin's computed mask (it never
+// grants it) without this function quietly re-granting it.
+//
+// This is the single resolution formula: Checker.HasChannelPerm,
+// Checker.HasChannelPermBatch (and through it VisibleChannelIDs) and
+// service.PermissionService all route through it, so no call site can be left
+// resolving only the role layer.
+func EffectiveChannelPerms(basePerms int64, o ChannelOverride) int64 {
+	roleLayer := EffectivePerms(basePerms, o.Allow, o.Deny)
+	return EffectivePerms(roleLayer, o.UserAllow, o.UserDeny)
+}
diff --git a/Server/permissions/permissions_fuzz_test.go b/Server/permissions/permissions_fuzz_test.go
new file mode 100644
index 00000000..6a36aae4
--- /dev/null
+++ b/Server/permissions/permissions_fuzz_test.go
@@ -0,0 +1,124 @@
+package permissions
+
+import "testing"
+
+// FuzzEffectivePerms checks EffectivePerms(rolePerm, allow, deny) against the
+// formula its own doc comment states -- effective = (rolePerm &^ deny) |
+// allow -- bit by bit, for arbitrary int64 inputs (not just the defined
+// permission bits): a future edit that flips deny/allow precedence, or that
+// drops a bit somewhere, shows up as a bit-level mismatch instead of only
+// failing on the handful of bits the table tests happen to cover.
+func FuzzEffectivePerms(f *testing.F) {
+	seeds := []int64{0, -1, AllPerms, Administrator, SendMessages, 0x1, 0x7FFFFFFF, 0x3FFFFFFF}
+	for _, a := range seeds {
+		for _, b := range seeds {
+			for _, c := range seeds {
+				f.Add(a, b, c)
+			}
+		}
+	}
+
+	f.Fuzz(func(t *testing.T, rolePerm, allow, deny int64) {
+		got := EffectivePerms(rolePerm, allow, deny)
+
+		for bit := range 64 {
+			mask := int64(1) << uint(bit)
+			gotBit := got&mask != 0
+			allowBit := allow&mask != 0
+			denyBit := deny&mask != 0
+			roleBit := rolePerm&mask != 0
+
+			switch {
+			case allowBit:
+				// Allow always wins, even against a deny on the same bit.
+				if !gotBit {
+					t.Fatalf("EffectivePerms(%#x,%#x,%#x): bit %d in allow but clear in result %#x", rolePerm, allow, deny, bit, got)
+				}
+			case denyBit:
+				// Deny (without allow) always clears the bit, regardless of
+				// what the base role held.
+				if gotBit {
+					t.Fatalf("EffectivePerms(%#x,%#x,%#x): bit %d in deny (not allow) but set in result %#x", rolePerm, allow, deny, bit, got)
+				}
+			default:
+				// Untouched by either override: the base role's bit passes
+				// through unchanged.
+				if gotBit != roleBit {
+					t.Fatalf("EffectivePerms(%#x,%#x,%#x): bit %d untouched by overrides, want %v (from base) got %v in result %#x", rolePerm, allow, deny, bit, roleBit, gotBit, got)
+				}
+			}
+		}
+
+		// No-op overrides never change the base.
+		if EffectivePerms(rolePerm, 0, 0) != rolePerm {
+			t.Fatalf("EffectivePerms(%#x,0,0) = %#x, want %#x unchanged", rolePerm, EffectivePerms(rolePerm, 0, 0), rolePerm)
+		}
+	})
+}
+
+// FuzzEffectiveChannelPerms checks the two-layer resolution
+// (base -> role override -> user override) against the ordering its doc
+// comment promises: each layer is EffectivePerms, and the layers compose by
+// feeding one into the next -- so this locks EffectiveChannelPerms to being
+// exactly that composition, not an inlined-and-drifted copy of it, and
+// re-derives the "user allow beats everything, user deny beats the role
+// layer, role layer beats base" precedence bit by bit.
+func FuzzEffectiveChannelPerms(f *testing.F) {
+	seeds := []int64{0, -1, AllPerms, Administrator, SendMessages, ReadMessages, 0x1, 0x7FFFFFFF}
+	for _, a := range seeds {
+		for _, b := range seeds {
+			f.Add(a, b, int64(0), int64(0), int64(0))
+			f.Add(a, int64(0), b, int64(0), int64(0))
+			f.Add(a, int64(0), int64(0), b, int64(0))
+			f.Add(a, int64(0), int64(0), int64(0), b)
+			f.Add(a, b, b, b, b)
+		}
+	}
+
+	f.Fuzz(func(t *testing.T, base, allow, deny, userAllow, userDeny int64) {
+		o := ChannelOverride{Allow: allow, Deny: deny, UserAllow: userAllow, UserDeny: userDeny}
+		got := EffectiveChannelPerms(base, o)
+
+		// The function must be exactly the two-layer composition its doc
+		// comment describes: role layer over base, user layer over that.
+		roleLayer := EffectivePerms(base, allow, deny)
+		want := EffectivePerms(roleLayer, userAllow, userDeny)
+		if got != want {
+			t.Fatalf("EffectiveChannelPerms(%#x, %+v) = %#x, want %#x (= EffectivePerms(EffectivePerms(base,Allow,Deny),UserAllow,UserDeny))", base, o, got, want)
+		}
+
+		for bit := range 64 {
+			mask := int64(1) << uint(bit)
+			gotBit := got&mask != 0
+			userAllowBit := userAllow&mask != 0
+			userDenyBit := userDeny&mask != 0
+			roleBit := roleLayer&mask != 0
+
+			switch {
+			case userAllowBit:
+				// A user allow beats a user deny on the same bit, and beats
+				// whatever the role layer decided.
+				if !gotBit {
+					t.Fatalf("EffectiveChannelPerms(%#x,%+v): bit %d in UserAllow but clear in result %#x", base, o, bit, got)
+				}
+			case userDenyBit:
+				// A user deny (without a user allow) beats a role-layer
+				// allow: the narrower, later layer always wins.
+				if gotBit {
+					t.Fatalf("EffectiveChannelPerms(%#x,%+v): bit %d in UserDeny (not UserAllow) but set in result %#x", base, o, bit, got)
+				}
+			default:
+				// No user-layer opinion: the role layer's bit passes through.
+				if gotBit != roleBit {
+					t.Fatalf("EffectiveChannelPerms(%#x,%+v): bit %d untouched by user layer, want %v (role layer) got %v in result %#x", base, o, bit, roleBit, gotBit, got)
+				}
+			}
+		}
+
+		// A channel override that touches nothing must be a pure pass-through
+		// of the base role permissions.
+		if noop := EffectiveChannelPerms(base, ChannelOverride{}); noop != base {
+			t.Fatalf("EffectiveChannelPerms(%#x, zero override) = %#x, want %#x unchanged", base, noop, base)
+		}
+	})
+}
diff --git a/Server/permissions/permissions_test.go b/Server/permissions/permissions_test.go
index 3a610056..eb1b438b 100644
--- a/Server/permissions/permissions_test.go
+++ b/Server/permissions/permissions_test.go
@@ -420,3 +420,101 @@ func TestPermissionBits_AreDistinctPowersOfTwo(t *testing.T) {
 		seen[b] = true
 	}
 }
+
+// ─── HasAnyPerm / AdminPerimeter / Name tests ────────────────────────────────
+
+func TestHasAnyPerm_AnyOfSemantics(t *testing.T) {
+	rolePerms := permissions.KickMembers | permissions.SendMessages
+	// One matching bit is enough, unlike HasPerm's ALL-of.
+	if !permissions.HasAnyPerm(rolePerms, permissions.KickMembers|permissions.ManageServer) {
+		t.Error("expected HasAnyPerm to match on KickMembers")
+	}
+	if permissions.HasPerm(rolePerms, permissions.KickMembers|permissions.ManageServer) {
+		t.Error("HasPerm must stay ALL-of")
+	}
+	if permissions.HasAnyPerm(rolePerms, permissions.ManageServer|permissions.ViewAuditLog) {
+		t.Error("expected HasAnyPerm to reject a disjoint mask")
+	}
+	if permissions.HasAnyPerm(rolePerms, 0) {
+		t.Error("a zero mask must never be satisfied")
+	}
+	if permissions.HasAnyPerm(0, permissions.AdminPerimeter) {
+		t.Error("a zero role must never satisfy the perimeter")
+	}
+}
+
+func TestAdminPerimeter_Membership(t *testing.T) {
+	admitted := []int64{
+		permissions.Administrator, permissions.ManageChannels, permissions.ManageRoles,
+		permissions.ManageServer, permissions.ViewAuditLog, permissions.KickMembers,
+		permissions.BanMembers, permissions.MuteMembers,
+	}
+	for _, p := range admitted {
+		if !permissions.HasAnyPerm(p, permissions.AdminPerimeter) {
+			t.Errorf("%s should admit to the admin perimeter", permissions.Name(p))
+		}
+	}
+	// Bits with no admin-panel route must not open the perimeter.
+	refused := []int64{
+		permissions.SendMessages, permissions.ReadMessages, permissions.ManageMessages,
+		permissions.ManageInvites, permissions.ConnectVoice,
+	}
+	for _, p := range refused {
+		if permissions.HasAnyPerm(p, permissions.AdminPerimeter) {
+			t.Errorf("%s must not admit to the admin perimeter", permissions.Name(p))
+		}
+	}
+	// The seeded Moderator role (migration 001) gets in.
+	if !permissions.HasAnyPerm(0x000FFFFF, permissions.AdminPerimeter) {
+		t.Error("the seeded Moderator mask should admit to the admin perimeter")
+	}
+	// The seeded Member role does not.
+	if permissions.HasAnyPerm(1635, permissions.AdminPerimeter) {
+		t.Error("the seeded Member mask must not admit to the admin perimeter")
+	}
+}
+
+func TestName_KnownAndUnknownBits(t *testing.T) {
+	if got := permissions.Name(permissions.ManageChannels); got != "MANAGE_CHANNELS" {
+		t.Errorf("Name(ManageChannels) = %q", got)
+	}
+	if got := permissions.Name(permissions.ViewAuditLog); got != "VIEW_AUDIT_LOG" {
+		t.Errorf("Name(ViewAuditLog) = %q", got)
+	}
+	// Zero, multi-bit and undefined values have no single name.
+	for _, bit := range []int64{0, permissions.KickMembers | permissions.BanMembers, 0x4} {
+		if got := permissions.Name(bit); got != "UNKNOWN" {
+			t.Errorf("Name(0x%X) = %q, want UNKNOWN", bit, got)
+		}
+	}
+}
+
+// TestMentionEveryone_BitIsFreeAndNamed locks phase 3's new bit: 21 was
+// unassigned, it is part of AllPerms so an externally supplied mask keeps it,
+// and it stays out of the admin perimeter (mentioning is not moderation).
+func TestMentionEveryone_BitIsFreeAndNamed(t *testing.T) {
+	if permissions.MentionEveryone != 0x200000 {
+		t.Errorf("MentionEveryone = 0x%X, want 0x200000 (bit 21)", permissions.MentionEveryone)
+	}
+	for _, other := range []int64{
+		permissions.SendMessages, permissions.ReadMessages, permissions.AttachFiles,
+		permissions.AddReactions, permissions.ConnectVoice, permissions.SpeakVoice,
+		permissions.UseVideo, permissions.ShareScreen, permissions.ManageMessages,
+		permissions.ManageChannels, permissions.KickMembers, permissions.BanMembers,
+		permissions.MuteMembers, permissions.ManageRoles, permissions.ManageServer,
+		permissions.ManageInvites, permissions.ViewAuditLog, permissions.Administrator,
+	} {
+		if other&permissions.MentionEveryone != 0 {
+			t.Errorf("bit 21 collides with 0x%X", other)
+		}
+	}
+	if permissions.AllPerms&permissions.MentionEveryone == 0 {
+		t.Error("AllPerms must include MentionEveryone")
+	}
+	if permissions.AdminPerimeter&permissions.MentionEveryone != 0 {
+		t.Error("MentionEveryone must not admit to the admin perimeter")
+	}
+	if got := permissions.Name(permissions.MentionEveryone); got != "MENTION_EVERYONE" {
+		t.Errorf("Name(MentionEveryone) = %q", got)
+	}
+}
diff --git a/Server/permissions/user_override_test.go b/Server/permissions/user_override_test.go
new file mode 100644
index 00000000..b40a4ba4
--- /dev/null
+++ b/Server/permissions/user_override_test.go
@@ -0,0 +1,212 @@
+package permissions
+
+import (
+	"context"
+	"errors"
+	"testing"
+)
+
+// ─── Resolution precedence ───────────────────────────────────────────────────
+//
+// Discord's order is: base role permissions -> role override -> user override.
+// Within a layer allow beats deny; across layers the later (narrower) layer
+// wins. These cases pin every crossing of the two rules, because getting one
+// of them backwards is exactly how a "private" channel leaks.
+
+func TestEffectiveChannelPerms_ResolutionOrder(t *testing.T) {
+	tests := []struct {
+		name string
+		base int64
+		o    ChannelOverride
+		perm int64
+		want bool
+	}{
+		{
+			name: "base grant with no overrides",
+			base: ReadMessages | SendMessages,
+			perm: SendMessages,
+			want: true,
+		},
+		{
+			name: "role deny strips a base grant",
+			base: ReadMessages | SendMessages,
+			o:    ChannelOverride{Deny: SendMessages},
+			perm: SendMessages,
+			want: false,
+		},
+		{
+			name: "role allow adds a bit the base lacks",
+			base: ReadMessages,
+			o:    ChannelOverride{Allow: SendMessages},
+			perm: SendMessages,
+			want: true,
+		},
+		{
+			name: "user deny beats a role allow",
+			base: ReadMessages,
+			o:    ChannelOverride{Allow: SendMessages, UserDeny: SendMessages},
+			perm: SendMessages,
+			want: false,
+		},
+		{
+			name: "user deny beats a base grant",
+			base: ReadMessages | SendMessages,
+			o:    ChannelOverride{UserDeny: SendMessages},
+			perm: SendMessages,
+			want: false,
+		},
+		{
+			name: "user allow beats a role deny",
+			base: ReadMessages | SendMessages,
+			o:    ChannelOverride{Deny: SendMessages, UserAllow: SendMessages},
+			perm: SendMessages,
+			want: true,
+		},
+		{
+			name: "user allow grants a bit neither the base nor the role has",
+			base: ReadMessages,
+			o:    ChannelOverride{UserAllow: SendMessages},
+			perm: SendMessages,
+			want: true,
+		},
+		{
+			name: "user allow beats user deny on the same bit",
+			base: ReadMessages,
+			o:    ChannelOverride{UserAllow: SendMessages, UserDeny: SendMessages},
+			perm: SendMessages,
+			want: true,
+		},
+		{
+			name: "user deny of READ hides a channel a role allow revealed",
+			base: 0,
+			o:    ChannelOverride{Allow: ReadMessages, UserDeny: ReadMessages},
+			perm: ReadMessages,
+			want: false,
+		},
+		{
+			name: "layers are independent per bit",
+			base: ReadMessages | SendMessages,
+			o:    ChannelOverride{UserDeny: SendMessages},
+			perm: ReadMessages,
+			want: true,
+		},
+		{
+			name: "multi-bit check is ALL-of",
+			base: ReadMessages | SendMessages,
+			o:    ChannelOverride{UserDeny: SendMessages},
+			perm: ReadMessages | SendMessages,
+			want: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			eff := EffectiveChannelPerms(tt.base, tt.o)
+			if got := eff&tt.perm == tt.perm; got != tt.want {
+				t.Errorf("EffectiveChannelPerms(0x%X, %+v)&0x%X = %v, want %v",
+					tt.base, tt.o, tt.perm, got, tt.want)
+			}
+		})
+	}
+}
+
+// An ADMINISTRATOR role bypasses BOTH layers. The bypass lives at the call
+// site, not inside EffectiveChannelPerms, so this is asserted through the
+// Checker — the surface every caller actually uses.
+func TestHasChannelPerm_AdminBypassesUserOverride(t *testing.T) {
+	mock := newMockDB()
+	mock.userPerms[chanUserKey{10, 7}] = chanPerm{deny: ReadMessages | SendMessages}
+	ck := NewChecker(mock)
+
+	if !ck.HasChannelPerm(context.Background(), Administrator, 1, 7, 10, ReadMessages|SendMessages) {
+		t.Error("ADMINISTRATOR must bypass a per-user deny")
+	}
+	if !ck.HasChannelPermBatch(Administrator, map[int64]ChannelOverride{
+		10: {UserDeny: ReadMessages},
+	}, 10, ReadMessages) {
+		t.Error("ADMINISTRATOR must bypass a per-user deny in the batch path too")
+	}
+}
+
+func TestHasChannelPerm_AppliesUserLayer(t *testing.T) {
+	const (
+		chID   = 10
+		roleID = int64(4)
+		aliceI = int64(7)
+		bobID  = int64(8)
+	)
+	mock := newMockDB()
+	// The role may read but not send here.
+	mock.channelPerms[chanRoleKey{chID, roleID}] = chanPerm{deny: SendMessages}
+	// Alice is individually granted SEND back; Bob is individually denied READ.
+	mock.userPerms[chanUserKey{chID, aliceI}] = chanPerm{allow: SendMessages}
+	mock.userPerms[chanUserKey{chID, bobID}] = chanPerm{deny: ReadMessages}
+	ck := NewChecker(mock)
+
+	base := ReadMessages | SendMessages
+	ctx := context.Background()
+
+	if !ck.HasChannelPerm(ctx, base, roleID, aliceI, chID, SendMessages) {
+		t.Error("alice: user allow must beat the role deny")
+	}
+	if ck.HasChannelPerm(ctx, base, roleID, bobID, chID, ReadMessages) {
+		t.Error("bob: user deny must beat the base READ grant")
+	}
+	// A third member with no user override falls back to the role verdict.
+	if ck.HasChannelPerm(ctx, base, roleID, 99, chID, SendMessages) {
+		t.Error("carol: role deny still applies without a user override")
+	}
+	if !ck.HasChannelPerm(ctx, base, roleID, 99, chID, ReadMessages) {
+		t.Error("carol: base READ still applies without a user override")
+	}
+}
+
+// userID 0 means "no member in hand" — the per-user layer is skipped rather
+// than queried for an id that cannot exist.
+func TestHasChannelPerm_ZeroUserSkipsUserLayer(t *testing.T) {
+	mock := newMockDB()
+	mock.userPerms[chanUserKey{10, 0}] = chanPerm{deny: ReadMessages}
+	ck := NewChecker(mock)
+
+	if !ck.HasChannelPerm(context.Background(), ReadMessages, 4, 0, 10, ReadMessages) {
+		t.Error("userID 0 must not consult channel_user_overrides")
+	}
+}
+
+// A failed per-user lookup must deny, exactly as a failed per-role lookup does:
+// substituting a zero override would restore every bit a user deny stripped.
+func TestHasChannelPerm_UserLookupErrorDenies(t *testing.T) {
+	mock := newMockDB()
+	mock.userErr = errors.New("boom")
+	ck := NewChecker(mock)
+
+	if ck.HasChannelPerm(context.Background(), ReadMessages, 4, 7, 10, ReadMessages) {
+		t.Error("a per-user override lookup failure must fail closed")
+	}
+}
+
+func TestVisibleChannelIDs_UserOverrideLayer(t *testing.T) {
+	ck := NewChecker(newMockDB())
+	channels := []ChannelRef{
+		{ID: 1, Type: "text"},
+		{ID: 2, Type: "text"},
+		{ID: 3, Type: "voice"},
+	}
+	overrides := map[int64]ChannelOverride{
+		// Role can read #2, but this member is individually denied.
+		2: {UserDeny: ReadMessages},
+		// Role is denied #3, but this member is individually allowed.
+		3: {Deny: ReadMessages, UserAllow: ReadMessages},
+	}
+
+	got := ck.VisibleChannelIDs(ReadMessages, channels, overrides)
+	if !got[1] {
+		t.Error("channel 1 (no override) must be visible")
+	}
+	if got[2] {
+		t.Error("channel 2 must be hidden by the per-user deny")
+	}
+	if !got[3] {
+		t.Error("channel 3 must be revealed by the per-user allow")
+	}
+}
diff --git a/Server/plugin/host_ui.go b/Server/plugin/host_ui.go
index 453c7b6a..553abf30 100644
--- a/Server/plugin/host_ui.go
+++ b/Server/plugin/host_ui.go
@@ -43,45 +43,56 @@ func (r *Registry) RegisterUI(inst *Instance) error {
 // inst, rooted at the plugin's directory. Defense in depth:
 //  1. Manifest validation rejects absolute paths and "..".
 //  2. The handler only serves files explicitly declared by a manifest tab.
-//  3. After resolving the on-disk path we use filepath.Rel and reject any
-//     result containing ".." or that is absolute, which catches symlink
-//     escapes and the prefix-without-separator class of bug.
+//  3. Asset paths are resolved once at construction, not per request: the
+//     request path is used solely as a map key, so no on-disk path is ever
+//     built from user input. Each declared asset is checked with
+//     filepath.Rel and dropped if the result contains ".." or is absolute,
+//     which catches symlink escapes and the prefix-without-separator bug.
 //  4. A serve-time os.Lstat check rejects symlinks that were created AFTER
 //     install (the install-time rejectSymlinksUnder walk only runs once).
 //     This closes the TOCTOU window where a malicious or buggy process
 //     swaps a regular file for a symlink post-install — http.ServeFile
 //     would otherwise follow the link and leak host files.
 func (r *Registry) AssetHandler(inst *Instance) http.Handler {
-	allowed := make(map[string]bool, len(inst.Manifest.UI.Tabs))
-	for _, t := range inst.Manifest.UI.Tabs {
-		allowed[t.Asset] = true
-	}
 	pluginDir, dirErr := filepath.Abs(filepath.Dir(inst.WASMPath))
+
+	// Resolve and traversal-check every declared asset ONCE, here at
+	// construction, mapping the manifest's asset name to its absolute path.
+	// At serve time the request path is only ever used as a map key, never
+	// as a path component, so no filesystem path is built from user input
+	// at all. An asset that fails validation is simply absent from the map
+	// and 404s, exactly as an undeclared file does.
+	allowed := make(map[string]string, len(inst.Manifest.UI.Tabs))
+	if dirErr == nil {
+		for _, t := range inst.Manifest.UI.Tabs {
+			full, absErr := filepath.Abs(filepath.Join(pluginDir, t.Asset))
+			if absErr != nil {
+				continue
+			}
+			rel, relErr := filepath.Rel(pluginDir, full)
+			if relErr != nil || rel == "" || rel == "." || strings.HasPrefix(rel, "..") || filepath.IsAbs(rel) {
+				continue
+			}
+			allowed[t.Asset] = full
+		}
+	}
+
 	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
 		if dirErr != nil {
 			http.Error(w, "plugin asset root unavailable", http.StatusInternalServerError)
 			return
 		}
 		rel := strings.TrimPrefix(req.URL.Path, "/")
-		if !allowed[rel] {
+		full, ok := allowed[rel]
+		if !ok {
 			http.NotFound(w, req)
 			return
 		}
-		full, absErr := filepath.Abs(filepath.Join(pluginDir, rel))
-		if absErr != nil {
-			http.Error(w, "forbidden", http.StatusForbidden)
-			return
-		}
-		relCheck, relErr := filepath.Rel(pluginDir, full)
-		if relErr != nil || relCheck == "" || relCheck == "." || strings.HasPrefix(relCheck, "..") || filepath.IsAbs(relCheck) {
-			http.Error(w, "forbidden", http.StatusForbidden)
-			return
-		}
 		// Lstat (not Stat) so a symlink is detected instead of followed.
 		// This runs on every request — cheap relative to the file read —
 		// and closes the TOCTOU gap between install-time validation and
 		// runtime serving.
-		info, lerr := os.Lstat(full) //nolint:gosec // path traversal blocked above: rel validated and cleaned
+		info, lerr := os.Lstat(full) //nolint:gosec // not user input: full comes from the construction-time allowlist
 		if lerr != nil {
 			http.NotFound(w, req)
 			return
@@ -94,7 +105,7 @@ func (r *Registry) AssetHandler(inst *Instance) http.Handler {
 			http.Error(w, "forbidden", http.StatusForbidden)
 			return
 		}
-		f, openErr := os.Open(full) //nolint:gosec // path traversal blocked above: rel validated and cleaned
+		f, openErr := os.Open(full) //nolint:gosec // not user input: full comes from the construction-time allowlist
 		if openErr != nil {
 			http.NotFound(w, req)
 			return
diff --git a/Server/plugin/manifest_relpath_fuzz_test.go b/Server/plugin/manifest_relpath_fuzz_test.go
new file mode 100644
index 00000000..5dddf3e7
--- /dev/null
+++ b/Server/plugin/manifest_relpath_fuzz_test.go
@@ -0,0 +1,73 @@
+package plugin
+
+import (
+	"strings"
+	"testing"
+)
+
+// FuzzValidateRelativePath asserts that whenever validateRelativePath
+// accepts a path (returns nil), that path is genuinely contained under the
+// plugin base directory: not absolute, not empty, containing no ".."
+// traversal component (checked as a real path segment, not just a
+// substring, so a segment like "..foo" or "foo.." can't false-positive),
+// no NUL byte, no backslash, and no leading separator.
+func FuzzValidateRelativePath(f *testing.F) {
+	seeds := []string{
+		"",
+		".",
+		"..",
+		"/",
+		"/etc/passwd",
+		"a/b/c.js",
+		"../secret",
+		"a/../../secret",
+		"a/../b",
+		"./a",
+		"a//b",
+		"a/",
+		"a/b/",
+		"\\windows\\evil",
+		"a\\b",
+		"a\x00b",
+		"..a",
+		"a..",
+		"a..b",
+		"foo/..bar",
+		"C:\\evil.dll",
+		strings.Repeat("a/", 100) + "x.js",
+		"a/./b",
+		"a/../b/../c",
+	}
+	for _, s := range seeds {
+		f.Add(s)
+	}
+
+	f.Fuzz(func(t *testing.T, p string) {
+		err := validateRelativePath(p)
+		if err != nil {
+			return
+		}
+
+		// Accepted: verify genuine containment under the plugin base dir.
+		if p == "" {
+			t.Fatalf("validateRelativePath(%q) = nil but path is empty", p)
+		}
+		if strings.ContainsRune(p, 0) {
+			t.Fatalf("validateRelativePath(%q) = nil but path contains a NUL byte", p)
+		}
+		if strings.ContainsRune(p, '\\') {
+			t.Fatalf("validateRelativePath(%q) = nil but path contains a backslash", p)
+		}
+		if strings.HasPrefix(p, "/") {
+			t.Fatalf("validateRelativePath(%q) = nil but path is absolute", p)
+		}
+		if p == "." {
+			t.Fatalf("validateRelativePath(%q) = nil but path is the current directory", p)
+		}
+		for seg := range strings.SplitSeq(p, "/") {
+			if seg == ".." {
+				t.Fatalf("validateRelativePath(%q) = nil but path contains a %q traversal segment", p, "..")
+			}
+		}
+	})
+}
diff --git a/Server/plugin/registry_test.go b/Server/plugin/registry_test.go
index 336e088c..6af43cb1 100644
--- a/Server/plugin/registry_test.go
+++ b/Server/plugin/registry_test.go
@@ -1,5 +1,13 @@
+//go:build !wazero
+
 // Registry lifecycle tests for the default (non-wazero) build.
 //
+// The build constraint above is load-bearing, not decorative: these tests
+// assert activation fails with ErrRuntimeUnavailable, which is only true
+// when no runtime is linked in. Under -tags wazero a real runtime exists
+// and two of them failed. The file always intended to be default-only (see
+// the paragraph below); it just never carried the tag.
+//
 // registry.go is the largest source file in the plugin package and its
 // lifecycle half — Sink, activate, EnablePlugin, DisablePlugin,
 // UninstallPlugin, List, UITabBindings — had no coverage. The wazero-tagged
diff --git a/Server/service/channel.go b/Server/service/channel.go
index b1a963c4..c0b97b67 100644
--- a/Server/service/channel.go
+++ b/Server/service/channel.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"log/slog"
 	"time"
+	"unicode/utf8"
 
 	"github.com/owncord/server/auth"
 	"github.com/owncord/server/db"
@@ -54,12 +55,13 @@ func (s *ChannelService) ListVisibleChannels(ctx context.Context, userID int64)
 	}
 
 	// Admins skip the override fetch (they bypass all channel checks anyway).
+	// Non-admins get both layers — role and per-user — in one batched fetch.
 	var overrides map[int64]db.ChannelOverride
 	if !permissions.HasAdmin(role.Permissions) {
-		overrides, err = s.st.GetAllChannelPermissionsForRole(ctx, role.ID)
+		overrides, err = s.st.GetChannelOverridesFor(ctx, role.ID, userID)
 		if err != nil {
 			// Fail closed — an empty map would return every denied channel.
-			slog.Error("ChannelService.ListVisibleChannels GetAllChannelPermissionsForRole", "err", err, "user_id", userID, "role_id", role.ID)
+			slog.Error("ChannelService.ListVisibleChannels GetChannelOverridesFor", "err", err, "user_id", userID, "role_id", role.ID)
 			return nil, fmt.Errorf("%w: failed to fetch channel overrides", ErrInternal)
 		}
 	}
@@ -80,16 +82,23 @@ func (s *ChannelService) ListVisibleChannels(ctx context.Context, userID int64)
 func channelRefs(channels []db.Channel) []permissions.ChannelRef {
 	refs := make([]permissions.ChannelRef, len(channels))
 	for i := range channels {
-		refs[i] = permissions.ChannelRef{ID: channels[i].ID, Type: channels[i].Type}
+		refs[i] = permissions.ChannelRef{ID: channels[i].ID, Type: channels[i].Type, Archived: channels[i].Archived}
 	}
 	return refs
 }
 
-// permOverrides maps a db override map to the checker's override map.
+// permOverrides maps a db override map to the checker's override map, carrying
+// BOTH layers — the role override and the per-user override — so the checker
+// resolves the full order (base -> role -> user) rather than half of it.
 func permOverrides(overrides map[int64]db.ChannelOverride) map[int64]permissions.ChannelOverride {
 	out := make(map[int64]permissions.ChannelOverride, len(overrides))
 	for id, o := range overrides {
-		out[id] = permissions.ChannelOverride{Allow: o.Allow, Deny: o.Deny}
+		out[id] = permissions.ChannelOverride{
+			Allow:     o.Allow,
+			Deny:      o.Deny,
+			UserAllow: o.UserAllow,
+			UserDeny:  o.UserDeny,
+		}
 	}
 	return out
 }
@@ -140,30 +149,64 @@ func (s *ChannelService) GetDMParticipantIDs(ctx context.Context, channelID int6
 	return s.st.GetDMParticipantIDs(ctx, channelID)
 }
 
-// HandlePresenceUpdate validates and persists a presence status change.
-func (s *ChannelService) HandlePresenceUpdate(ctx context.Context, userID int64, status string, limiter interface {
+// HandlePresenceUpdate validates and persists a presence status change, and
+// (when customStatus is non-nil) the custom status line that came with it.
+//
+// The status is stored as chosen, invisible included; collapsing invisible to
+// offline is a broadcast-time concern (db.BroadcastStatus), not a storage one —
+// the server has to be able to tell "chose to look offline" from "is gone" on
+// the next connect. Returns the sanitized custom status the caller should put
+// on the wire, so the broadcast and the row can never disagree.
+func (s *ChannelService) HandlePresenceUpdate(ctx context.Context, userID int64, status string, customStatus *string, limiter interface {
 	Allow(key string, limit int, window time.Duration) bool
 },
-) error {
+) (*string, error) {
 	// Rate limit.
 	ratKey := auth.Key("presence", userID)
 	if limiter != nil && !limiter.Allow(ratKey, 1, 10*time.Second) {
-		return ErrRateLimited
+		return nil, ErrRateLimited
 	}
 
-	validStatuses := map[string]bool{
-		"online": true, "idle": true, "dnd": true, "offline": true,
+	if !db.ValidStatuses[status] {
+		return nil, fmt.Errorf("%w: invalid status", ErrBadRequest)
 	}
-	if !validStatuses[status] {
-		return fmt.Errorf("%w: invalid status", ErrBadRequest)
+
+	var cleaned *string
+	if customStatus != nil {
+		text := cleanText(*customStatus)
+		if utf8.RuneCountInString(text) > MaxCustomStatusLen {
+			return nil, fmt.Errorf("%w: custom_status must be at most %d characters", ErrBadRequest, MaxCustomStatusLen)
+		}
+		cleaned = nullable(text)
 	}
 
 	if err := s.st.UpdateUserStatus(ctx, userID, status); err != nil {
 		slog.Error("ChannelService.HandlePresenceUpdate", "err", err, "user_id", userID)
-		return fmt.Errorf("%w: failed to update status", ErrInternal)
+		return nil, fmt.Errorf("%w: failed to update status", ErrInternal)
+	}
+	if customStatus != nil {
+		if err := s.st.UpdateUserCustomStatus(ctx, userID, cleaned); err != nil {
+			slog.Error("ChannelService.HandlePresenceUpdate custom status", "err", err, "user_id", userID)
+			return nil, fmt.Errorf("%w: failed to update custom status", ErrInternal)
+		}
+		return cleaned, nil
 	}
 
-	return nil
+	// The command carried no custom_status field, so the stored one stands and
+	// still has to ride along on the broadcast — otherwise a plain
+	// online -> idle flip would blank everyone else's copy of the text.
+	//
+	// A read failure here is deliberately swallowed rather than returned: the
+	// status is already committed and is about to be broadcast, so reporting
+	// an error would tell the caller a presence update failed that in fact
+	// succeeded. The only cost is that this one broadcast omits the text.
+	user, readErr := s.st.GetUserByID(ctx, userID)
+	if readErr != nil || user == nil {
+		slog.Warn("HandlePresenceUpdate: could not read stored custom status",
+			"err", readErr, "user_id", userID)
+		return nil, nil //nolint:nilerr,nilnil // status committed; see comment above
+	}
+	return user.CustomStatus, nil
 }
 
 // HandleChannelFocus processes a channel focus event and updates read state.
diff --git a/Server/service/channel_user_override_test.go b/Server/service/channel_user_override_test.go
new file mode 100644
index 00000000..951c3182
--- /dev/null
+++ b/Server/service/channel_user_override_test.go
@@ -0,0 +1,112 @@
+package service
+
+import (
+	"context"
+	"testing"
+
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/permissions"
+)
+
+// seedChannelUserOverride sets a per-user permission override on a channel.
+func seedChannelUserOverride(t *testing.T, database *db.DB, userID, channelID, allow, deny int64) {
+	t.Helper()
+	if err := database.UpsertChannelUserOverride(context.Background(), channelID, userID, allow, deny); err != nil {
+		t.Fatalf("seedChannelUserOverride(user=%d,chan=%d): %v", userID, channelID, err)
+	}
+}
+
+func newOverrideFixture(t *testing.T) (*ChannelService, *PermissionService, *db.DB) {
+	t.Helper()
+	database := newTestDB(t)
+	seedRole(t, database, &db.Role{
+		ID:          permissions.MemberRoleID,
+		Name:        "member",
+		Permissions: permissions.SendMessages | permissions.ReadMessages,
+		Position:    1,
+	})
+	seedUser(t, database, &db.User{ID: 1, Username: "alice", Status: "online"})
+	seedUser(t, database, &db.User{ID: 2, Username: "bob", Status: "online"})
+	seedUserRole(t, database, 1, permissions.MemberRoleID)
+	seedUserRole(t, database, 2, permissions.MemberRoleID)
+	seedChannel(t, database, &db.Channel{ID: 10, Name: "open", Type: "text"})
+	seedChannel(t, database, &db.Channel{ID: 11, Name: "locked", Type: "text"})
+	// The role cannot read #locked at all.
+	seedChannelOverride(t, database, permissions.MemberRoleID, 11, 0, permissions.ReadMessages)
+
+	permSvc := NewPermissionService(database, permissions.NewChecker(database))
+	return NewChannelService(database, permSvc), permSvc, database
+}
+
+func visibleIDs(t *testing.T, svc *ChannelService, userID int64) map[int64]bool {
+	t.Helper()
+	chans, err := svc.ListVisibleChannels(context.Background(), userID)
+	if err != nil {
+		t.Fatalf("ListVisibleChannels(%d): %v", userID, err)
+	}
+	got := make(map[int64]bool, len(chans))
+	for i := range chans {
+		got[chans[i].ID] = true
+	}
+	return got
+}
+
+// Two members of the same role must be able to disagree about a channel: the
+// per-user layer is the last one in the resolution order.
+func TestListVisibleChannels_PerUserOverrideSplitsRoleMates(t *testing.T) {
+	svc, _, database := newOverrideFixture(t)
+
+	// alice is individually granted READ on the role-denied channel.
+	seedChannelUserOverride(t, database, 1, 11, permissions.ReadMessages, 0)
+	// bob is individually denied READ on the otherwise open channel.
+	seedChannelUserOverride(t, database, 2, 10, 0, permissions.ReadMessages)
+
+	alice := visibleIDs(t, svc, 1)
+	if !alice[10] || !alice[11] {
+		t.Errorf("alice sees %v, want both 10 and 11", alice)
+	}
+	bob := visibleIDs(t, svc, 2)
+	if bob[10] || bob[11] {
+		t.Errorf("bob sees %v, want neither", bob)
+	}
+}
+
+// The cached PermissionService must answer the full order too — it is the path
+// every REST/WS permission check actually takes.
+func TestPermissionService_AppliesUserOverrideLayer(t *testing.T) {
+	_, permSvc, database := newOverrideFixture(t)
+	ctx := context.Background()
+
+	// alice: role denies READ on 11, user allow restores it.
+	seedChannelUserOverride(t, database, 1, 11, permissions.ReadMessages, 0)
+	// bob: role allows SEND on 10, user deny removes it (READ survives).
+	seedChannelUserOverride(t, database, 2, 10, 0, permissions.SendMessages)
+
+	if !permSvc.HasChannelPerm(ctx, 1, 11, permissions.ReadMessages) {
+		t.Error("alice: user allow must beat the role deny")
+	}
+	if permSvc.HasChannelPerm(ctx, 2, 10, permissions.SendMessages) {
+		t.Error("bob: user deny must beat the role grant")
+	}
+	if !permSvc.HasChannelPerm(ctx, 2, 10, permissions.ReadMessages) {
+		t.Error("bob: an unrelated bit must be untouched")
+	}
+}
+
+// A cache populated before the override was written must not answer from the
+// stale snapshot once the owning user is invalidated — this is the contract the
+// admin handler relies on when it calls InvalidateUser before the hub fan-out.
+func TestPermissionService_InvalidateUserPicksUpNewOverride(t *testing.T) {
+	_, permSvc, database := newOverrideFixture(t)
+	ctx := context.Background()
+
+	if !permSvc.HasChannelPerm(ctx, 1, 10, permissions.ReadMessages) {
+		t.Fatal("alice must start with READ on the open channel")
+	}
+	seedChannelUserOverride(t, database, 1, 10, 0, permissions.ReadMessages)
+	permSvc.InvalidateUser(1)
+
+	if permSvc.HasChannelPerm(ctx, 1, 10, permissions.ReadMessages) {
+		t.Error("after InvalidateUser the new per-user deny must apply")
+	}
+}
diff --git a/Server/service/datastore.go b/Server/service/datastore.go
index 747b9374..d6604c3c 100644
--- a/Server/service/datastore.go
+++ b/Server/service/datastore.go
@@ -20,11 +20,14 @@ type Store interface {
 	// ── Messages / reactions / read-state ──
 	CreateMessage(ctx context.Context, channelID, userID int64, content string, replyTo *int64) (int64, error)
 	CreateMessageReturning(ctx context.Context, channelID, userID int64, content string, replyTo *int64) (*db.Message, error)
+	CreateMessageWithMentions(ctx context.Context, channelID, userID int64, content string, replyTo *int64, mentionedUserIDs []int64, mentionsEveryone bool) (*db.Message, error)
 	GetMessage(ctx context.Context, id int64) (*db.Message, error)
 	GetMessages(ctx context.Context, channelID, before int64, limit int) ([]db.MessageWithUser, error)
 	GetMessagesForAPI(ctx context.Context, channelID, before int64, limit int, requestingUserID int64) ([]db.MessageAPIResponse, error)
+	GetMessagesAroundForAPI(ctx context.Context, channelID, centerID int64, beforeCount, afterCount int, requestingUserID int64) ([]db.MessageAPIResponse, error)
 	EditMessage(ctx context.Context, id, userID int64, content string) (*db.Message, error)
 	DeleteMessage(ctx context.Context, id, userID int64, isMod bool) error
+	PurgeChannelMessages(ctx context.Context, channelID, before int64, limit int) ([]int64, error)
 	SearchMessages(ctx context.Context, query string, channelID *int64, limit int) ([]db.MessageSearchResult, error)
 	SearchMessagesInChannels(ctx context.Context, query string, channelIDs []int64, limit int) ([]db.MessageSearchResult, error)
 	GetPinnedMessages(ctx context.Context, channelID int64, requestingUserID int64) ([]db.MessageAPIResponse, error)
@@ -32,8 +35,20 @@ type Store interface {
 	AddReaction(ctx context.Context, messageID, userID int64, emoji string) error
 	RemoveReaction(ctx context.Context, messageID, userID int64, emoji string) error
 	GetReactions(ctx context.Context, messageID int64) ([]db.ReactionCount, error)
+	GetReactionUsers(ctx context.Context, messageID int64, emoji string, limit int) ([]db.ReactionUser, error)
 	UpdateReadState(ctx context.Context, userID, channelID, lastReadMessageID int64) error
 	GetChannelUnreadCounts(ctx context.Context, userID int64) (map[int64]db.ChannelUnread, error)
+
+	// ── Mentions ──
+	ReplaceMessageMentions(ctx context.Context, messageID int64, mentionedUserIDs []int64, mentionsEveryone bool) error
+	GetMentionsByMessageIDs(ctx context.Context, msgIDs []int64) (map[int64][]int64, error)
+	IncrementMentionCounts(ctx context.Context, channelID int64, userIDs []int64) error
+	GetUserIDsByUsernames(ctx context.Context, usernames []string) (map[string]int64, error)
+	ListMentionTargetsByRoles(ctx context.Context, roleIDs []int64) ([]db.MentionTarget, error)
+	ListBlockersOf(ctx context.Context, blockedID int64) ([]int64, error)
+	GetChannelOverrides(ctx context.Context, channelID int64) (map[int64]db.ChannelOverride, error)
+	GetChannelUserOverrides(ctx context.Context, channelID int64) (map[int64]db.ChannelOverride, error)
+	ListMentionTargetsByUserIDs(ctx context.Context, userIDs []int64) ([]db.MentionTarget, error)
 	GetLatestMessageID(ctx context.Context, channelID int64) (int64, error)
 	LinkAttachmentsToMessage(ctx context.Context, messageID, uploaderID int64, attachmentIDs []string) (int64, error)
 	GetAttachmentsByMessageIDs(ctx context.Context, msgIDs []int64) (map[int64][]db.AttachmentInfo, error)
@@ -46,8 +61,17 @@ type Store interface {
 	DeleteChannel(ctx context.Context, id int64) error
 	SetChannelSlowMode(ctx context.Context, id int64, slowMode int) error
 	SetChannelVoiceMaxUsers(ctx context.Context, id int64, maxUsers int) error
+	// GetChannelPermissions / GetUserChannelPermissions are the two single-row
+	// override lookups permissions.DB requires (Store is passed straight to
+	// permissions.NewChecker).
 	GetChannelPermissions(ctx context.Context, channelID, roleID int64) (allow, deny int64, err error)
+	GetUserChannelPermissions(ctx context.Context, channelID, userID int64) (allow, deny int64, err error)
 	GetAllChannelPermissionsForRole(ctx context.Context, roleID int64) (map[int64]db.ChannelOverride, error)
+	// GetChannelOverridesFor merges the role and per-user override layers for
+	// one member in two batch queries — the single fetch behind every
+	// "what can this member do here" site, and the reason no site pays an N+1
+	// for the second layer.
+	GetChannelOverridesFor(ctx context.Context, roleID, userID int64) (map[int64]db.ChannelOverride, error)
 	GetChannelTypes(ctx context.Context, ids []int64) (map[int64]string, error)
 
 	// ── Users ──
@@ -56,7 +80,8 @@ type Store interface {
 	CreateUser(ctx context.Context, username, passwordHash string, roleID int) (int64, error)
 	CreateOwnerIfEmpty(ctx context.Context, username, passwordHash string, roleID int) (int64, error)
 	CreateUserWithInvite(ctx context.Context, username, passwordHash string, roleID int, inviteCode string) (int64, error)
-	UpdateUserProfile(ctx context.Context, userID int64, username string, avatar *string) error
+	UpdateUserProfile(ctx context.Context, userID int64, username string, avatar, displayName, about *string) error
+	UpdateUserCustomStatus(ctx context.Context, userID int64, customStatus *string) error
 	UpdateUserPassword(ctx context.Context, userID int64, newPasswordHash string) error
 	UpdateUserStatus(ctx context.Context, id int64, status string) error
 	UpdateUserTOTPSecret(ctx context.Context, id int64, secret *string) error
@@ -84,6 +109,21 @@ type Store interface {
 	GetRoleForUser(ctx context.Context, userID int64) (*db.Role, error)
 	GetUserWithRole(ctx context.Context, userID int64) (*db.User, *db.Role, error)
 	ListRoles(ctx context.Context) ([]*db.Role, error)
+	GetRoleByName(ctx context.Context, name string) (*db.Role, error)
+	GetDefaultRole(ctx context.Context) (*db.Role, error)
+	CreateRole(ctx context.Context, name string, color *string, perms int64, position int) (*db.Role, error)
+	UpdateRole(ctx context.Context, id int64, name string, color *string, perms int64, position int) error
+	SetRolePositions(ctx context.Context, positions map[int64]int) error
+	DeleteRoleReassigning(ctx context.Context, roleID, fallbackRoleID int64) ([]int64, error)
+	ListUserIDsByRole(ctx context.Context, roleID int64) ([]int64, error)
+	CountRoleMembers(ctx context.Context) (map[int64]int, error)
+
+	// ── Emoji ──
+	ListEmoji(ctx context.Context) ([]*db.Emoji, error)
+	GetEmoji(ctx context.Context, id int64) (*db.Emoji, error)
+	GetEmojiByShortcode(ctx context.Context, shortcode string) (*db.Emoji, error)
+	CreateEmoji(ctx context.Context, shortcode, storedAs, mimeType string, uploadedBy int64) (*db.Emoji, error)
+	DeleteEmoji(ctx context.Context, id int64) (bool, error)
 
 	// ── Invites ──
 	CreateInvite(ctx context.Context, createdBy int64, maxUses int, expiresAt *time.Time) (string, error)
@@ -119,6 +159,12 @@ type Store interface {
 	IsDMParticipant(ctx context.Context, userID, channelID int64) (bool, error)
 	GetDMParticipantIDs(ctx context.Context, channelID int64) ([]int64, error)
 	GetDMRecipient(ctx context.Context, channelID, requestingUserID int64) (*db.User, error)
+	CreateGroupDMChannel(ctx context.Context, name string, participantIDs []int64) (*db.Channel, error)
+	LeaveGroupDM(ctx context.Context, userID, channelID int64) (bool, error)
+	CountDMParticipants(ctx context.Context, channelID int64) (int, error)
+	IsGroupDM(ctx context.Context, channelID int64) (bool, error)
+	SetDMChannelName(ctx context.Context, channelID int64, name string) error
+	GetDMParticipants(ctx context.Context, channelID, viewerID int64) ([]db.DMUser, error)
 
 	// ── Blocks ──
 	BlockUser(ctx context.Context, blockerID, blockedID int64) error
@@ -142,7 +188,7 @@ type Store interface {
 	LogAudit(ctx context.Context, actorID int64, action, targetType string, targetID int64, detail string) error
 	GetAuditLog(ctx context.Context, limit, offset int) ([]db.AuditEntry, error)
 	AdminCreateChannel(ctx context.Context, name, chanType, category, topic string, position int) (int64, error)
-	AdminUpdateChannel(ctx context.Context, id int64, name, topic string, slowMode, position int, archived bool) error
+	AdminUpdateChannel(ctx context.Context, id int64, u db.ChannelUpdate) error
 	AdminDeleteChannel(ctx context.Context, id int64) error
 	BackupTo(ctx context.Context, path string) error
 	BackupToSafe(ctx context.Context, path, safeRoot string) error
diff --git a/Server/service/dm.go b/Server/service/dm.go
index 006298f2..f7577405 100644
--- a/Server/service/dm.go
+++ b/Server/service/dm.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"log/slog"
 	"time"
+	"unicode/utf8"
 
 	"github.com/owncord/server/db"
 	"github.com/owncord/server/telemetry"
@@ -83,21 +84,276 @@ func (s *DMService) ListDMs(ctx context.Context, userID int64) ([]db.DMChannelIn
 	return dms, nil
 }
 
+// CloseDMResult describes what closing a DM actually did, so the caller knows
+// which events to send.
+type CloseDMResult struct {
+	// Left is true when the caller left a *group* DM: they are no longer a
+	// participant, and the remaining members need to be told.
+	Left bool
+	// ChannelDeleted is true when the caller was the last participant of a
+	// group and the channel row went with them.
+	ChannelDeleted bool
+	// RemainingParticipantIDs is who is still in the group after a leave. Empty
+	// for a 1:1 close, which changes nothing for the other party.
+	RemainingParticipantIDs []int64
+}
+
 // CloseDM closes a DM channel for a user.
-func (s *DMService) CloseDM(ctx context.Context, userID, channelID int64) error {
+//
+// For a 1:1 DM this hides the conversation from the caller's sidebar and
+// nothing more — the other party keeps their copy, and the next message from
+// either side re-opens it. For a group DM it is a *leave*: the caller comes
+// out of dm_participants, stops receiving the group's messages, and cannot
+// re-open it without being re-added. The two meanings share a route because
+// they share a gesture ("get this out of my list"), but they are different
+// operations and the result says which one ran.
+func (s *DMService) CloseDM(ctx context.Context, userID, channelID int64) (*CloseDMResult, error) {
 	if channelID <= 0 {
-		return fmt.Errorf("%w: channel_id must be positive", ErrBadRequest)
+		return nil, fmt.Errorf("%w: channel_id must be positive", ErrBadRequest)
 	}
 
 	ok, err := s.st.IsDMParticipant(ctx, userID, channelID)
 	if err != nil || !ok {
-		return fmt.Errorf("%w: not a participant in this DM", ErrNotFound)
+		return nil, fmt.Errorf("%w: not a participant in this DM", ErrNotFound)
 	}
 
-	if err := s.st.CloseDM(ctx, userID, channelID); err != nil {
-		return fmt.Errorf("%w: failed to close DM: %v", ErrInternal, err)
+	isGroup, err := s.st.IsGroupDM(ctx, channelID)
+	if err != nil {
+		return nil, fmt.Errorf("%w: failed to read DM kind: %v", ErrInternal, err)
 	}
 
-	slog.Debug("DM closed", "user_id", userID, "channel_id", channelID)
-	return nil
+	if !isGroup {
+		if err := s.st.CloseDM(ctx, userID, channelID); err != nil {
+			return nil, fmt.Errorf("%w: failed to close DM: %v", ErrInternal, err)
+		}
+		slog.Debug("DM closed", "user_id", userID, "channel_id", channelID)
+		return &CloseDMResult{}, nil
+	}
+
+	// Read the survivors *before* the leave: after it, the caller is gone from
+	// dm_participants and a post-hoc read could not tell "left" from "was
+	// never in it" if the delete half-succeeded.
+	remaining, err := s.st.GetDMParticipantIDs(ctx, channelID)
+	if err != nil {
+		return nil, fmt.Errorf("%w: failed to read DM participants: %v", ErrInternal, err)
+	}
+	survivors := make([]int64, 0, len(remaining))
+	for _, pid := range remaining {
+		if pid != userID {
+			survivors = append(survivors, pid)
+		}
+	}
+
+	deleted, err := s.st.LeaveGroupDM(ctx, userID, channelID)
+	if err != nil {
+		return nil, fmt.Errorf("%w: failed to leave group DM: %v", ErrInternal, err)
+	}
+
+	slog.Debug("group DM left", "user_id", userID, "channel_id", channelID, "deleted", deleted)
+	return &CloseDMResult{
+		Left:                    true,
+		ChannelDeleted:          deleted,
+		RemainingParticipantIDs: survivors,
+	}, nil
+}
+
+// ─── Group DMs ──────────────────────────────────────────────────────────────
+
+// MaxGroupDMNameLen bounds the optional group name. It matches the channel
+// name cap: a group DM name renders in the same sidebar row a channel name
+// does, so a longer one would only ever be shown clipped.
+const MaxGroupDMNameLen = 100
+
+// CreateGroupDMResult holds the result of creating a group DM.
+type CreateGroupDMResult struct {
+	Channel      *db.Channel
+	Participants []db.DMUser
+	// ParticipantIDs is every member including the creator, which is the set
+	// the caller fans dm_channel_open out to.
+	ParticipantIDs []int64
+}
+
+// CreateGroupDM creates a group DM between the caller and 2..8 other users
+// (3..10 total, matching db.MaxGroupDMParticipants).
+//
+// Blocks are enforced in both directions, per recipient: a user cannot pull
+// someone they have blocked into a room with them, and cannot use a group to
+// reach someone who blocked them. The check is deliberately *creation-time
+// only* — once the group exists, sending into it is not block-checked, because
+// a group DM is a shared room and silently dropping one member's messages for
+// one other member would make the conversation lie to everybody in it. That is
+// also why the composer gate on the client applies to 1:1 DMs alone.
+//
+// Unlike CreateDM this always creates a new channel: the same set of people may
+// want more than one group, so there is no "the group for these users" to find.
+func (s *DMService) CreateGroupDM(ctx context.Context, userID int64, recipientIDs []int64, name string) (*CreateGroupDMResult, error) {
+	ctx, span := telemetry.GlobalTracer("service/dm").Start(ctx, "DMService.CreateGroupDM",
+		telemetry.Int64("user_id", userID),
+	)
+	start := time.Now()
+	defer func() {
+		telemetry.TimeSince(ctx, telemetry.NewAppMetrics().ServiceCallDurationSec, start,
+			telemetry.String("method", "CreateGroupDM"))
+		span.End()
+	}()
+
+	// De-duplicate and drop the caller: a payload naming the same person twice
+	// is a client bug, not a reason to refuse, but it must not inflate the
+	// participant count or double-insert.
+	seen := map[int64]bool{userID: true}
+	unique := make([]int64, 0, len(recipientIDs))
+	for _, rid := range recipientIDs {
+		if rid <= 0 {
+			return nil, fmt.Errorf("%w: recipient_ids must be positive", ErrBadRequest)
+		}
+		if seen[rid] {
+			continue
+		}
+		seen[rid] = true
+		unique = append(unique, rid)
+	}
+
+	if len(unique) < 2 {
+		return nil, fmt.Errorf("%w: a group DM needs at least 2 other users", ErrBadRequest)
+	}
+	if len(unique)+1 > db.MaxGroupDMParticipants {
+		return nil, fmt.Errorf("%w: a group DM holds at most %d users", ErrBadRequest, db.MaxGroupDMParticipants)
+	}
+
+	cleanName := cleanText(name)
+	if utf8.RuneCountInString(cleanName) > MaxGroupDMNameLen {
+		return nil, fmt.Errorf("%w: name must be at most %d characters", ErrBadRequest, MaxGroupDMNameLen)
+	}
+
+	for _, rid := range unique {
+		user, err := s.st.GetUserByID(ctx, rid)
+		if err != nil || user == nil {
+			return nil, fmt.Errorf("%w: recipient not found", ErrNotFound)
+		}
+		blocked, err := s.st.IsEitherBlocked(ctx, userID, rid)
+		if err != nil {
+			return nil, fmt.Errorf("%w: failed to check block status: %v", ErrInternal, err)
+		}
+		if blocked {
+			return nil, fmt.Errorf("%w: cannot add a blocked user to a group DM", ErrForbidden)
+		}
+	}
+
+	participantIDs := append([]int64{userID}, unique...)
+	ch, err := s.st.CreateGroupDMChannel(ctx, cleanName, participantIDs)
+	if err != nil {
+		slog.Error("DMService.CreateGroupDM", "err", err)
+		return nil, fmt.Errorf("%w: failed to create group DM", ErrInternal)
+	}
+
+	participants, err := s.st.GetDMParticipants(ctx, ch.ID, userID)
+	if err != nil {
+		return nil, fmt.Errorf("%w: failed to read group DM participants: %v", ErrInternal, err)
+	}
+
+	return &CreateGroupDMResult{
+		Channel:        ch,
+		Participants:   participants,
+		ParticipantIDs: participantIDs,
+	}, nil
+}
+
+// RenameGroupDM sets (or, with an empty name, clears) a group DM's name.
+//
+// Any participant may rename it, which is Discord's rule and the only one that
+// works here: a group DM has no owner column and no roles, so "who may rename"
+// has exactly one answer that does not require inventing an ownership model.
+// A 1:1 DM refuses — its name is who is in it.
+func (s *DMService) RenameGroupDM(ctx context.Context, userID, channelID int64, name string) (*db.Channel, error) {
+	if channelID <= 0 {
+		return nil, fmt.Errorf("%w: channel_id must be positive", ErrBadRequest)
+	}
+
+	ok, err := s.st.IsDMParticipant(ctx, userID, channelID)
+	if err != nil || !ok {
+		return nil, fmt.Errorf("%w: not a participant in this DM", ErrNotFound)
+	}
+
+	isGroup, err := s.st.IsGroupDM(ctx, channelID)
+	if err != nil {
+		return nil, fmt.Errorf("%w: failed to read DM kind: %v", ErrInternal, err)
+	}
+	if !isGroup {
+		return nil, fmt.Errorf("%w: only group DMs can be named", ErrBadRequest)
+	}
+
+	cleanName := cleanText(name)
+	if utf8.RuneCountInString(cleanName) > MaxGroupDMNameLen {
+		return nil, fmt.Errorf("%w: name must be at most %d characters", ErrBadRequest, MaxGroupDMNameLen)
+	}
+
+	if err := s.st.SetDMChannelName(ctx, channelID, cleanName); err != nil {
+		return nil, fmt.Errorf("%w: failed to rename group DM: %v", ErrInternal, err)
+	}
+
+	ch, err := s.st.GetChannel(ctx, channelID)
+	if err != nil || ch == nil {
+		return nil, fmt.Errorf("%w: channel not found", ErrNotFound)
+	}
+	return ch, nil
+}
+
+// DMSummaryFor returns one DM's payload shape as viewerID sees it: the group
+// name, the participants other than them, and whether it is a group.
+//
+// Every push of a DM's membership — group create, rename, leave — goes through
+// it, so the shape a client receives from an event is the same one it receives
+// from GET /dms and from `ready`. Membership is checked here rather than by
+// each caller.
+func (s *DMService) DMSummaryFor(ctx context.Context, viewerID, channelID int64) (db.DMChannelInfo, error) {
+	ok, err := s.st.IsDMParticipant(ctx, viewerID, channelID)
+	if err != nil || !ok {
+		return db.DMChannelInfo{}, fmt.Errorf("%w: not a participant in this DM", ErrNotFound)
+	}
+	participants, err := s.st.GetDMParticipants(ctx, channelID, viewerID)
+	if err != nil {
+		return db.DMChannelInfo{}, fmt.Errorf("%w: failed to read DM participants: %v", ErrInternal, err)
+	}
+	ch, err := s.st.GetChannel(ctx, channelID)
+	if err != nil || ch == nil {
+		return db.DMChannelInfo{}, fmt.Errorf("%w: channel not found", ErrNotFound)
+	}
+	isGroup, err := s.st.IsGroupDM(ctx, channelID)
+	if err != nil {
+		return db.DMChannelInfo{}, fmt.Errorf("%w: failed to read DM kind: %v", ErrInternal, err)
+	}
+	return db.NewDMChannelInfo(channelID, ch.Name, isGroup, participants, viewerID), nil
+}
+
+// RingTargets returns the other participants of a DM the caller is in — the
+// people a call_ring or call_decline is addressed to.
+//
+// Ringing carries no state: a "call" in a DM *is* somebody being present in
+// that DM's voice channel, and the ring is a nudge to come look. That is why
+// this is a permission check and a fan-out list rather than a call record —
+// there is nothing to persist that presence does not already say, and a
+// persisted call would be one more thing that can be left dangling by a crash.
+func (s *DMService) RingTargets(ctx context.Context, userID, channelID int64) ([]int64, error) {
+	if channelID <= 0 {
+		return nil, fmt.Errorf("%w: channel_id must be positive", ErrBadRequest)
+	}
+	ok, err := s.st.IsDMParticipant(ctx, userID, channelID)
+	if err != nil {
+		return nil, fmt.Errorf("%w: failed to check DM participation: %v", ErrInternal, err)
+	}
+	if !ok {
+		return nil, fmt.Errorf("%w: not a participant in this DM", ErrForbidden)
+	}
+
+	ids, err := s.st.GetDMParticipantIDs(ctx, channelID)
+	if err != nil {
+		return nil, fmt.Errorf("%w: failed to read DM participants: %v", ErrInternal, err)
+	}
+	targets := make([]int64, 0, len(ids))
+	for _, pid := range ids {
+		if pid != userID {
+			targets = append(targets, pid)
+		}
+	}
+	return targets, nil
 }
diff --git a/Server/service/emoji.go b/Server/service/emoji.go
new file mode 100644
index 00000000..16a53751
--- /dev/null
+++ b/Server/service/emoji.go
@@ -0,0 +1,192 @@
+package service
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"regexp"
+	"strings"
+
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/permissions"
+)
+
+// EmojiService owns the server-wide custom emoji set: who may change it, what
+// a shortcode is allowed to look like, and the uniqueness rule.
+//
+// Emoji are deliberately gated on MANAGE_SERVER rather than on a new bit.
+// Adding a permission bit is a schema-visible, forever decision, and "who may
+// change server-wide branding" is exactly what MANAGE_SERVER already answers
+// for the server name, icon and settings. Reading is not gated at all: an
+// emoji nobody can render is not an emoji, and the set is server-wide with no
+// per-channel scope to leak.
+type EmojiService struct {
+	st    Store
+	perms *PermissionService
+}
+
+// NewEmojiService creates an EmojiService.
+func NewEmojiService(st Store, perms *PermissionService) *EmojiService {
+	return &EmojiService{st: st, perms: perms}
+}
+
+const (
+	// MinShortcodeLen / MaxShortcodeLen bound `:name:`. Two characters is the
+	// shortest thing worth typing; 32 keeps a shortcode from dominating the
+	// composer, the picker row and the reaction pill it ends up in.
+	MinShortcodeLen = 2
+	// MaxShortcodeLen is the upper bound on a shortcode's length.
+	MaxShortcodeLen = 32
+	// MaxEmojiCount bounds the set. Every connected client holds the whole list
+	// in memory and re-receives it on every emoji_update, so this is the cap on
+	// what one MANAGE_SERVER holder can push to every session at once.
+	MaxEmojiCount = 200
+)
+
+// EmojiImageURL is the server-relative path the image bytes of an emoji are
+// served from. Defined once here because three surfaces have to agree on it:
+// the REST list response, the emoji_update broadcast, and the docs.
+func EmojiImageURL(id int64) string {
+	return fmt.Sprintf("/api/v1/emoji/%d/image", id)
+}
+
+// shortcodeRe is the exact spelling a shortcode may take. Lowercase only, so
+// the table's plain UNIQUE index enforces case-insensitive uniqueness without
+// a COLLATE change; no leading/trailing colon, because the colons are the
+// delimiter and not part of the name.
+var shortcodeRe = regexp.MustCompile(`^[a-z0-9_]{2,32}$`)
+
+// NormalizeShortcode strips the optional surrounding colons and lowercases the
+// result, so `:WAVE:`, `WAVE` and `wave` are all the same shortcode. It does
+// not validate -- ValidateShortcode does that on the normalized form.
+func NormalizeShortcode(raw string) string {
+	s := strings.ToLower(strings.TrimSpace(raw))
+	s = strings.TrimPrefix(s, ":")
+	s = strings.TrimSuffix(s, ":")
+	return s
+}
+
+// ValidateShortcode normalizes and checks a shortcode, returning the canonical
+// (lowercase, colon-free) form.
+func ValidateShortcode(raw string) (string, error) {
+	s := NormalizeShortcode(raw)
+	if s == "" {
+		return "", fmt.Errorf("%w: shortcode is required", ErrBadRequest)
+	}
+	if !shortcodeRe.MatchString(s) {
+		return "", fmt.Errorf(
+			"%w: shortcode must be %d-%d characters of a-z, 0-9 or underscore",
+			ErrBadRequest, MinShortcodeLen, MaxShortcodeLen)
+	}
+	return s, nil
+}
+
+// RequireManage reports whether actorID may add or remove emoji. Handlers call
+// it BEFORE reading an upload body, so a user without the bit is refused
+// without first being allowed to spend the server's disk on a multipart parse.
+func (s *EmojiService) RequireManage(ctx context.Context, actorID int64) error {
+	if s.perms == nil {
+		return fmt.Errorf("%w: permission service unavailable", ErrForbidden)
+	}
+	role, err := s.perms.GetRoleForUser(ctx, actorID)
+	if err != nil || role == nil {
+		return fmt.Errorf("%w: failed to load actor role", ErrForbidden)
+	}
+	if !permissions.HasServerPerm(role.Permissions, permissions.ManageServer) {
+		return fmt.Errorf("%w: missing %s permission", ErrForbidden, permissions.Name(permissions.ManageServer))
+	}
+	return nil
+}
+
+// List returns every custom emoji, ordered by shortcode. Ungated.
+func (s *EmojiService) List(ctx context.Context) ([]*db.Emoji, error) {
+	list, err := s.st.ListEmoji(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("%w: failed to list emoji: %v", ErrInternal, err)
+	}
+	return list, nil
+}
+
+// Create records an already-stored image as a custom emoji. The caller is
+// responsible for having validated and stored the bytes; this owns the
+// permission gate, the shortcode rules, the count cap and the audit entry.
+//
+// A shortcode collision is ErrConflict, not ErrBadRequest: the request was
+// well-formed, the name is simply taken. Callers delete the orphaned file when
+// this returns an error.
+func (s *EmojiService) Create(ctx context.Context, actorID int64, rawShortcode, storedAs, mimeType string) (*db.Emoji, error) {
+	if err := s.RequireManage(ctx, actorID); err != nil {
+		return nil, err
+	}
+	shortcode, err := ValidateShortcode(rawShortcode)
+	if err != nil {
+		return nil, err
+	}
+
+	existing, err := s.st.GetEmojiByShortcode(ctx, shortcode)
+	if err != nil {
+		return nil, fmt.Errorf("%w: failed to check shortcode: %v", ErrInternal, err)
+	}
+	if existing != nil {
+		return nil, fmt.Errorf("%w: an emoji named :%s: already exists", ErrConflict, shortcode)
+	}
+
+	current, err := s.st.ListEmoji(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("%w: failed to count emoji: %v", ErrInternal, err)
+	}
+	if len(current) >= MaxEmojiCount {
+		return nil, fmt.Errorf("%w: this server already has the maximum of %d emoji", ErrBadRequest, MaxEmojiCount)
+	}
+
+	created, err := s.st.CreateEmoji(ctx, shortcode, storedAs, mimeType, actorID)
+	if err != nil {
+		return nil, fmt.Errorf("%w: failed to create emoji: %v", ErrInternal, err)
+	}
+
+	db.WriteAudit(context.WithoutCancel(ctx), s.st, actorID, "emoji_create", "emoji", created.ID,
+		fmt.Sprintf("uploaded emoji :%s: (%s)", shortcode, mimeType))
+	slog.Info("custom emoji created", "actor_id", actorID, "emoji_id", created.ID, "shortcode", shortcode)
+	return created, nil
+}
+
+// Delete removes an emoji and returns the row that was removed, so the caller
+// can unlink the stored file. The row is returned even though it no longer
+// exists: the storage id is only knowable from it.
+func (s *EmojiService) Delete(ctx context.Context, actorID, emojiID int64) (*db.Emoji, error) {
+	if err := s.RequireManage(ctx, actorID); err != nil {
+		return nil, err
+	}
+	existing, err := s.st.GetEmoji(ctx, emojiID)
+	if err != nil {
+		return nil, fmt.Errorf("%w: failed to load emoji: %v", ErrInternal, err)
+	}
+	if existing == nil {
+		return nil, fmt.Errorf("%w: emoji not found", ErrNotFound)
+	}
+	deleted, err := s.st.DeleteEmoji(ctx, emojiID)
+	if err != nil {
+		return nil, fmt.Errorf("%w: failed to delete emoji: %v", ErrInternal, err)
+	}
+	if !deleted {
+		// Lost a race with another delete -- report it as the 404 it now is.
+		return nil, fmt.Errorf("%w: emoji not found", ErrNotFound)
+	}
+
+	db.WriteAudit(context.WithoutCancel(ctx), s.st, actorID, "emoji_delete", "emoji", emojiID,
+		fmt.Sprintf("deleted emoji :%s:", existing.Shortcode))
+	slog.Info("custom emoji deleted", "actor_id", actorID, "emoji_id", emojiID, "shortcode", existing.Shortcode)
+	return existing, nil
+}
+
+// Get returns one emoji by id, or ErrNotFound. Used by the image route.
+func (s *EmojiService) Get(ctx context.Context, emojiID int64) (*db.Emoji, error) {
+	e, err := s.st.GetEmoji(ctx, emojiID)
+	if err != nil {
+		return nil, fmt.Errorf("%w: failed to load emoji: %v", ErrInternal, err)
+	}
+	if e == nil {
+		return nil, fmt.Errorf("%w: emoji not found", ErrNotFound)
+	}
+	return e, nil
+}
diff --git a/Server/service/emoji_fuzz_test.go b/Server/service/emoji_fuzz_test.go
new file mode 100644
index 00000000..8808d616
--- /dev/null
+++ b/Server/service/emoji_fuzz_test.go
@@ -0,0 +1,62 @@
+package service
+
+import (
+	"strings"
+	"testing"
+)
+
+// FuzzValidateShortcode checks that ValidateShortcode never panics and that
+// any shortcode it accepts is idempotent under re-validation and matches its
+// own documented shape (^[a-z0-9_]{2,32}$).
+func FuzzValidateShortcode(f *testing.F) {
+	seeds := []string{
+		"",
+		"wave",
+		":wave:",
+		"  :WAVE:  ",
+		"a",
+		"::",
+		strings.Repeat("x", MaxShortcodeLen),
+		strings.Repeat("x", MaxShortcodeLen+1),
+		strings.Repeat("x", 10000),
+		"has space",
+		"dash-not-allowed",
+		"dot.not.allowed",
+		"emojié",
+		"semi;colon",
+		"wave:extra:",
+		"</script>",
+		"\x00\x00",
+		":::::::",
+		"UPPER_lower_0123",
+		"\U0001F600\U0001F600",
+		"\u202ewave\u202e",
+	}
+	for _, s := range seeds {
+		f.Add(s)
+	}
+
+	f.Fuzz(func(t *testing.T, raw string) {
+		got, err := ValidateShortcode(raw)
+		if err != nil {
+			if got != "" {
+				t.Fatalf("ValidateShortcode(%q) returned non-empty shortcode %q alongside error %v", raw, got, err)
+			}
+			return
+		}
+
+		if !shortcodeRe.MatchString(got) {
+			t.Fatalf("ValidateShortcode(%q) accepted %q, which does not match %s", raw, got, shortcodeRe.String())
+		}
+
+		// Idempotence: re-validating an already-canonical shortcode must
+		// return it unchanged and must not suddenly start erroring.
+		again, err2 := ValidateShortcode(got)
+		if err2 != nil {
+			t.Fatalf("ValidateShortcode(%q) succeeded but re-validating its own output %q failed: %v", raw, got, err2)
+		}
+		if again != got {
+			t.Fatalf("ValidateShortcode is not idempotent: ValidateShortcode(%q) = %q, but ValidateShortcode(%q) = %q", raw, got, got, again)
+		}
+	})
+}
diff --git a/Server/service/emoji_test.go b/Server/service/emoji_test.go
new file mode 100644
index 00000000..b86e20e8
--- /dev/null
+++ b/Server/service/emoji_test.go
@@ -0,0 +1,313 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/permissions"
+)
+
+// newEmojiService builds an EmojiService over a hierarchy where exactly one
+// non-admin role holds MANAGE_SERVER, so the gate can be shown to be that bit
+// and not "any moderator":
+//
+//	user 1 -> Owner     (ADMINISTRATOR)
+//	user 2 -> Admin     (MANAGE_SERVER, no ADMINISTRATOR)
+//	user 3 -> Moderator (MANAGE_ROLES + KICK_MEMBERS, NO MANAGE_SERVER)
+//	user 4 -> Member    (default role)
+func newEmojiService(t *testing.T) (*EmojiService, *db.DB) {
+	t.Helper()
+	database := newTestDB(t)
+	seedRole(t, database, &db.Role{ID: permissions.OwnerRoleID, Name: "Owner",
+		Permissions: permissions.Administrator, Position: permissions.OwnerRolePosition})
+	seedRole(t, database, &db.Role{ID: permissions.AdminRoleID, Name: "Admin",
+		Permissions: permissions.ManageServer | permissions.ReadMessages, Position: 80})
+	seedRole(t, database, &db.Role{ID: permissions.ModeratorRoleID, Name: "Moderator",
+		Permissions: permissions.ManageRoles | permissions.KickMembers | permissions.ReadMessages, Position: 60})
+	for userID, roleID := range map[int64]int64{
+		1: permissions.OwnerRoleID,
+		2: permissions.AdminRoleID,
+		3: permissions.ModeratorRoleID,
+		4: permissions.MemberRoleID,
+	} {
+		seedUser(t, database, &db.User{ID: userID})
+		seedUserRole(t, database, userID, roleID)
+	}
+	checker := permissions.NewChecker(database)
+	return NewEmojiService(database, NewPermissionService(database, checker)), database
+}
+
+// ─── Shortcode rules ─────────────────────────────────────────────────────────
+
+func TestValidateShortcode_Accepts(t *testing.T) {
+	cases := map[string]string{
+		"wave":                               "wave",
+		":wave:":                             "wave",
+		"  :WAVE:  ":                         "wave",
+		"PartyBlob":                          "partyblob",
+		"a1":                                 "a1",
+		"under_score":                        "under_score",
+		"0123456789":                         "0123456789",
+		strings.Repeat("x", MaxShortcodeLen): strings.Repeat("x", MaxShortcodeLen),
+	}
+	for in, want := range cases {
+		got, err := ValidateShortcode(in)
+		if err != nil {
+			t.Errorf("ValidateShortcode(%q) = error %v, want %q", in, err, want)
+			continue
+		}
+		if got != want {
+			t.Errorf("ValidateShortcode(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestValidateShortcode_Rejects(t *testing.T) {
+	bad := []string{
+		"",                                     // empty
+		"::",                                   // colons only
+		"a",                                    // one character
+		strings.Repeat("x", MaxShortcodeLen+1), // too long
+		"has space",
+		"dash-not-allowed",
+		"dot.not.allowed",
+		"emojié",
+		"semi;colon",
+		"wave:extra:",
+		"</script>",
+	}
+	for _, in := range bad {
+		if got, err := ValidateShortcode(in); err == nil {
+			t.Errorf("ValidateShortcode(%q) = %q, want ErrBadRequest", in, got)
+		} else if !errors.Is(err, ErrBadRequest) {
+			t.Errorf("ValidateShortcode(%q) error = %v, want ErrBadRequest", in, err)
+		}
+	}
+}
+
+func TestEmojiImageURL(t *testing.T) {
+	if got, want := EmojiImageURL(42), "/api/v1/emoji/42/image"; got != want {
+		t.Errorf("EmojiImageURL(42) = %q, want %q", got, want)
+	}
+}
+
+// ─── Permission gate ─────────────────────────────────────────────────────────
+
+func TestEmojiCreate_RequiresManageServer(t *testing.T) {
+	svc, _ := newEmojiService(t)
+
+	// Moderator holds MANAGE_ROLES and KICK_MEMBERS but not MANAGE_SERVER.
+	if _, err := svc.Create(context.Background(), 3, "wave", "stored-1", "image/png"); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("moderator Create error = %v, want ErrForbidden", err)
+	}
+	if _, err := svc.Create(context.Background(), 4, "wave", "stored-1", "image/png"); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("member Create error = %v, want ErrForbidden", err)
+	}
+	// MANAGE_SERVER without ADMINISTRATOR is enough.
+	if _, err := svc.Create(context.Background(), 2, "wave", "stored-1", "image/png"); err != nil {
+		t.Fatalf("admin Create: %v", err)
+	}
+	// ADMINISTRATOR bypasses the bit check.
+	if _, err := svc.Create(context.Background(), 1, "party", "stored-2", "image/gif"); err != nil {
+		t.Fatalf("owner Create: %v", err)
+	}
+}
+
+func TestEmojiDelete_RequiresManageServer(t *testing.T) {
+	svc, _ := newEmojiService(t)
+	created, err := svc.Create(context.Background(), 1, "wave", "stored-1", "image/png")
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	if _, err := svc.Delete(context.Background(), 4, created.ID); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("member Delete error = %v, want ErrForbidden", err)
+	}
+	// The refusal must not have removed anything.
+	list, err := svc.List(context.Background())
+	if err != nil {
+		t.Fatalf("List: %v", err)
+	}
+	if len(list) != 1 {
+		t.Fatalf("after refused delete len(list) = %d, want 1", len(list))
+	}
+}
+
+func TestEmojiRequireManage_UnknownUserIsForbidden(t *testing.T) {
+	svc, _ := newEmojiService(t)
+	if err := svc.RequireManage(context.Background(), 9999); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("RequireManage(unknown) = %v, want ErrForbidden", err)
+	}
+}
+
+func TestEmojiRequireManage_NilPermServiceIsForbidden(t *testing.T) {
+	database := newTestDB(t)
+	svc := NewEmojiService(database, nil)
+	if err := svc.RequireManage(context.Background(), 1); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("RequireManage(nil perms) = %v, want ErrForbidden", err)
+	}
+}
+
+// ─── Create / List / Delete ──────────────────────────────────────────────────
+
+func TestEmojiCreate_NormalizesAndPersists(t *testing.T) {
+	svc, database := newEmojiService(t)
+
+	created, err := svc.Create(context.Background(), 1, ":WAVE:", "stored-1", "image/png")
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if created.Shortcode != "wave" {
+		t.Errorf("Shortcode = %q, want %q", created.Shortcode, "wave")
+	}
+	if created.StoredAs != "stored-1" || created.MimeType != "image/png" {
+		t.Errorf("StoredAs/MimeType = %q/%q, want stored-1/image/png", created.StoredAs, created.MimeType)
+	}
+	if created.UploadedBy != 1 {
+		t.Errorf("UploadedBy = %d, want 1", created.UploadedBy)
+	}
+
+	got, err := database.GetEmojiByShortcode(context.Background(), "wave")
+	if err != nil || got == nil {
+		t.Fatalf("GetEmojiByShortcode = %v, %v", got, err)
+	}
+	if got.ID != created.ID {
+		t.Errorf("round-tripped id = %d, want %d", got.ID, created.ID)
+	}
+}
+
+func TestEmojiCreate_DuplicateShortcodeIsConflict(t *testing.T) {
+	svc, _ := newEmojiService(t)
+	if _, err := svc.Create(context.Background(), 1, "wave", "stored-1", "image/png"); err != nil {
+		t.Fatalf("first Create: %v", err)
+	}
+	// Different case, different file — same shortcode.
+	_, err := svc.Create(context.Background(), 1, ":WaVe:", "stored-2", "image/gif")
+	if !errors.Is(err, ErrConflict) {
+		t.Fatalf("duplicate Create error = %v, want ErrConflict", err)
+	}
+}
+
+func TestEmojiCreate_RejectsBadShortcodeBeforeInsert(t *testing.T) {
+	svc, _ := newEmojiService(t)
+	if _, err := svc.Create(context.Background(), 1, "no spaces", "stored-1", "image/png"); !errors.Is(err, ErrBadRequest) {
+		t.Fatalf("Create error = %v, want ErrBadRequest", err)
+	}
+	list, err := svc.List(context.Background())
+	if err != nil {
+		t.Fatalf("List: %v", err)
+	}
+	if len(list) != 0 {
+		t.Fatalf("len(list) = %d, want 0", len(list))
+	}
+}
+
+func TestEmojiCreate_EnforcesCountCap(t *testing.T) {
+	svc, database := newEmojiService(t)
+	// Insert the cap directly — going through Create MaxEmojiCount times is a
+	// slower way of arriving at the same state.
+	for i := range MaxEmojiCount {
+		if _, err := database.CreateEmoji(context.Background(),
+			fmt.Sprintf("e%d", i), fmt.Sprintf("stored-%d", i), "image/png", 1); err != nil {
+			t.Fatalf("seed emoji %d: %v", i, err)
+		}
+	}
+	_, err := svc.Create(context.Background(), 1, "onemore", "stored-x", "image/png")
+	if !errors.Is(err, ErrBadRequest) {
+		t.Fatalf("over-cap Create error = %v, want ErrBadRequest", err)
+	}
+}
+
+func TestEmojiList_OrderedByShortcode(t *testing.T) {
+	svc, _ := newEmojiService(t)
+	for _, sc := range []string{"zebra", "apple", "mango"} {
+		if _, err := svc.Create(context.Background(), 1, sc, "stored-"+sc, "image/png"); err != nil {
+			t.Fatalf("Create(%s): %v", sc, err)
+		}
+	}
+	list, err := svc.List(context.Background())
+	if err != nil {
+		t.Fatalf("List: %v", err)
+	}
+	got := make([]string, 0, len(list))
+	for _, e := range list {
+		got = append(got, e.Shortcode)
+	}
+	want := []string{"apple", "mango", "zebra"}
+	if strings.Join(got, ",") != strings.Join(want, ",") {
+		t.Errorf("List order = %v, want %v", got, want)
+	}
+}
+
+func TestEmojiDelete_RemovesAndReturnsStorageID(t *testing.T) {
+	svc, _ := newEmojiService(t)
+	created, err := svc.Create(context.Background(), 1, "wave", "stored-1", "image/png")
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	removed, err := svc.Delete(context.Background(), 1, created.ID)
+	if err != nil {
+		t.Fatalf("Delete: %v", err)
+	}
+	if removed.StoredAs != "stored-1" {
+		t.Errorf("removed.StoredAs = %q, want stored-1", removed.StoredAs)
+	}
+
+	list, err := svc.List(context.Background())
+	if err != nil {
+		t.Fatalf("List: %v", err)
+	}
+	if len(list) != 0 {
+		t.Fatalf("len(list) after delete = %d, want 0", len(list))
+	}
+	// The shortcode is free again.
+	if _, err := svc.Create(context.Background(), 1, "wave", "stored-2", "image/png"); err != nil {
+		t.Fatalf("re-Create after delete: %v", err)
+	}
+}
+
+func TestEmojiDelete_UnknownIDIsNotFound(t *testing.T) {
+	svc, _ := newEmojiService(t)
+	if _, err := svc.Delete(context.Background(), 1, 4242); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("Delete(unknown) = %v, want ErrNotFound", err)
+	}
+}
+
+func TestEmojiGet_UnknownIDIsNotFound(t *testing.T) {
+	svc, _ := newEmojiService(t)
+	if _, err := svc.Get(context.Background(), 4242); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("Get(unknown) = %v, want ErrNotFound", err)
+	}
+}
+
+func TestEmojiCreate_WritesAudit(t *testing.T) {
+	svc, database := newEmojiService(t)
+	created, err := svc.Create(context.Background(), 1, "wave", "stored-1", "image/png")
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+	if _, err := svc.Delete(context.Background(), 1, created.ID); err != nil {
+		t.Fatalf("Delete: %v", err)
+	}
+
+	entries, err := database.GetAuditLog(context.Background(), 50, 0)
+	if err != nil {
+		t.Fatalf("GetAuditLog: %v", err)
+	}
+	seen := map[string]bool{}
+	for _, e := range entries {
+		if e.TargetType == "emoji" {
+			seen[e.Action] = true
+		}
+	}
+	for _, action := range []string{"emoji_create", "emoji_delete"} {
+		if !seen[action] {
+			t.Errorf("no %s audit entry (saw %v)", action, seen)
+		}
+	}
+}
diff --git a/Server/service/mentions.go b/Server/service/mentions.go
new file mode 100644
index 00000000..0b232894
--- /dev/null
+++ b/Server/service/mentions.go
@@ -0,0 +1,322 @@
+package service
+
+import (
+	"context"
+	"log/slog"
+	"regexp"
+	"slices"
+	"strings"
+
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/permissions"
+)
+
+// maxMentionsPerMessage caps how many usernames one message can resolve.
+// Tokens past the cap stay plain text, bounding both the stored rows and the
+// read-state writes a single send can trigger.
+const maxMentionsPerMessage = 20
+
+// maxMentionCandidates caps how many distinct @tokens are looked up per
+// message, so a wall of @words cannot turn one send into an unbounded query.
+const maxMentionCandidates = 60
+
+// mentionTokenRe matches an @token that stands alone as a word. Group 1 is the
+// preceding character, which must be start-of-string or a non-word non-@ rune
+// ("mail@example" and "@@name" never resolve); group 2 is the token; group 3
+// captures a trailing "@" so address-shaped text like "@bob@example.com" is
+// rejected as a whole rather than half-matched. The token charset is letters,
+// digits, underscore, dot and hyphen — usernames may hold any printable rune,
+// but only this subset is addressable without an explicit delimiter.
+var mentionTokenRe = regexp.MustCompile(`(^|[^\p{L}\p{N}_@])@([\p{L}\p{N}_.-]{1,64})(@?)`)
+
+// everyoneToken and hereToken are reserved: a user literally named "everyone"
+// is not resolvable by @everyone.
+const (
+	everyoneToken = "everyone"
+	hereToken     = "here"
+)
+
+// mentionSet is the resolved mention state of one message.
+type mentionSet struct {
+	// UserIDs is ordered by first appearance in the content, deduplicated and
+	// capped at maxMentionsPerMessage. Never nil.
+	UserIDs []int64
+	// Everyone reports an @everyone or @here that cleared the MENTION_EVERYONE
+	// gate. Without the bit the token keeps no mention semantics at all.
+	Everyone bool
+	// HereOnly narrows an Everyone fan-out to users who are not offline. It is
+	// set when @here matched and @everyone did not.
+	HereOnly bool
+}
+
+// mentionCandidate is one @token and the username spellings it may resolve to,
+// in preference order. Trailing sentence punctuation is stripped in the second
+// spelling so "@bob." resolves to bob when no user is named "bob.".
+type mentionCandidate struct {
+	spellings []string
+}
+
+// parseMentionTokens extracts the @tokens of a message. Returned tokens are
+// lowercased, distinct and ordered by first appearance; the reserved
+// @everyone / @here tokens are reported separately and never resolved as
+// usernames.
+func parseMentionTokens(content string) (tokens []mentionCandidate, everyone, here bool) {
+	seen := make(map[string]struct{})
+	for _, m := range mentionTokenRe.FindAllStringSubmatch(content, -1) {
+		if m[3] == "@" {
+			continue // address-shaped, e.g. "@bob@example.com"
+		}
+		raw := strings.ToLower(m[2])
+		switch raw {
+		case everyoneToken:
+			everyone = true
+			continue
+		case hereToken:
+			here = true
+			continue
+		}
+		if _, dup := seen[raw]; dup {
+			continue
+		}
+		seen[raw] = struct{}{}
+		spellings := []string{raw}
+		if trimmed := strings.TrimRight(raw, ".-"); trimmed != "" && trimmed != raw {
+			spellings = append(spellings, trimmed)
+		}
+		tokens = append(tokens, mentionCandidate{spellings: spellings})
+		if len(tokens) >= maxMentionCandidates {
+			break
+		}
+	}
+	return tokens, everyone, here
+}
+
+// resolveMentions turns sanitized content into a mentionSet. Unknown @words
+// resolve to nothing and stay plain text, and @everyone/@here without the
+// MENTION_EVERYONE bit on this channel does the same. DM channels have no
+// @everyone semantics — there is no permission surface to answer to.
+//
+// Resolution failures are logged and treated as "no mentions": a message must
+// not be rejected because its mention lookup failed.
+func (s *MessageService) resolveMentions(ctx context.Context, content string, authorID, channelID int64, isDM bool) mentionSet {
+	set := mentionSet{UserIDs: []int64{}}
+
+	tokens, everyone, here := parseMentionTokens(content)
+	if (everyone || here) && !isDM &&
+		s.perms.HasChannelPerm(ctx, authorID, channelID, permissions.ReadMessages|permissions.MentionEveryone) {
+		set.Everyone = true
+		set.HereOnly = here && !everyone
+	}
+	if len(tokens) == 0 {
+		return set
+	}
+
+	lookup := make([]string, 0, len(tokens)*2)
+	for _, t := range tokens {
+		lookup = append(lookup, t.spellings...)
+	}
+	byName, err := s.st.GetUserIDsByUsernames(ctx, lookup)
+	if err != nil {
+		slog.Error("MessageService.resolveMentions GetUserIDsByUsernames", "err", err, "channel_id", channelID)
+		return set
+	}
+
+	seen := make(map[int64]struct{}, len(tokens))
+	for _, t := range tokens {
+		for _, spelling := range t.spellings {
+			id, ok := byName[spelling]
+			if !ok {
+				continue
+			}
+			if _, dup := seen[id]; !dup {
+				seen[id] = struct{}{}
+				set.UserIDs = append(set.UserIDs, id)
+			}
+			break
+		}
+		if len(set.UserIDs) >= maxMentionsPerMessage {
+			break
+		}
+	}
+	return set
+}
+
+// applyMentionCounts increments read_states.mention_count for every user the
+// message mentions who can see the channel, except the author and except users
+// who have blocked the author. @everyone reaches every reader; @here reaches
+// only readers who are not offline.
+//
+// Edits deliberately never call this: a mention that was already counted must
+// not be counted twice, and the simplest rule that guarantees it is that only
+// the original insert can raise a badge.
+//
+// The message is already committed by the time this runs, so failures are
+// logged rather than surfaced — a lost badge must not fail a delivered send.
+func (s *MessageService) applyMentionCounts(ctx context.Context, channelID, authorID int64, set mentionSet, isDM bool, participantIDs []int64) {
+	if len(set.UserIDs) == 0 && !set.Everyone {
+		return
+	}
+
+	readers, err := s.mentionReaders(ctx, channelID, isDM, participantIDs)
+	if err != nil {
+		slog.Error("MessageService.applyMentionCounts readers", "err", err, "channel_id", channelID)
+		return
+	}
+
+	recipients := make(map[int64]struct{}, len(readers))
+	if set.Everyone {
+		for _, r := range readers {
+			// db.BroadcastStatus, not a bare == "offline": the column stores the
+			// status the user *chose*, so an invisible reader holds "invisible"
+			// here and a literal comparison would ping them with @here — the one
+			// thing "appear offline" is meant to stop. Collapsing first makes
+			// @here agree with what everyone else can see of that reader.
+			if set.HereOnly && db.BroadcastStatus(r.Status) == db.StatusOffline {
+				continue
+			}
+			recipients[r.UserID] = struct{}{}
+		}
+	}
+	if len(set.UserIDs) > 0 {
+		// Build the reader set once instead of scanning readers per mentioned
+		// uid: that nested loop was O(mentions x readers), which gets
+		// expensive on a channel with many readers.
+		readerIDs := make(map[int64]struct{}, len(readers))
+		for _, r := range readers {
+			readerIDs[r.UserID] = struct{}{}
+		}
+		for _, uid := range set.UserIDs {
+			if _, ok := readerIDs[uid]; ok {
+				recipients[uid] = struct{}{}
+			}
+		}
+	}
+	delete(recipients, authorID)
+	if len(recipients) == 0 {
+		return
+	}
+
+	blockers, err := s.st.ListBlockersOf(ctx, authorID)
+	if err != nil {
+		slog.Error("MessageService.applyMentionCounts ListBlockersOf", "err", err, "user_id", authorID)
+		return // Fail closed: a badge from a blocked user is worse than no badge.
+	}
+	for _, b := range blockers {
+		delete(recipients, b)
+	}
+	if len(recipients) == 0 {
+		return
+	}
+
+	ids := make([]int64, 0, len(recipients))
+	for id := range recipients {
+		ids = append(ids, id)
+	}
+	if err := s.st.IncrementMentionCounts(ctx, channelID, ids); err != nil {
+		slog.Error("MessageService.applyMentionCounts IncrementMentionCounts", "err", err, "channel_id", channelID)
+	}
+}
+
+// mentionReaders lists the users who can read the channel, with the presence
+// status @here filters on. DM participation is membership, not permissions, so
+// DMs skip the role walk entirely.
+func (s *MessageService) mentionReaders(ctx context.Context, channelID int64, isDM bool, participantIDs []int64) ([]db.MentionTarget, error) {
+	if isDM {
+		targets := make([]db.MentionTarget, 0, len(participantIDs))
+		for _, pid := range participantIDs {
+			targets = append(targets, db.MentionTarget{UserID: pid})
+		}
+		return targets, nil
+	}
+
+	roles, err := s.st.ListRoles(ctx)
+	if err != nil {
+		return nil, err
+	}
+	overrides, err := s.st.GetChannelOverrides(ctx, channelID)
+	if err != nil {
+		return nil, err
+	}
+
+	readRoles := make([]int64, 0, len(roles))
+	adminRoles := make(map[int64]bool, len(roles))
+	for _, r := range roles {
+		if r == nil {
+			continue
+		}
+		o := overrides[r.ID]
+		eff := permissions.EffectivePerms(r.Permissions, o.Allow, o.Deny)
+		if permissions.HasAdmin(r.Permissions) {
+			adminRoles[r.ID] = true
+		}
+		if permissions.HasAdmin(r.Permissions) || eff&permissions.ReadMessages != 0 {
+			readRoles = append(readRoles, r.ID)
+		}
+	}
+	targets, err := s.st.ListMentionTargetsByRoles(ctx, readRoles)
+	if err != nil {
+		return nil, err
+	}
+	return s.applyUserOverridesToReaders(ctx, channelID, targets, adminRoles)
+}
+
+// applyUserOverridesToReaders folds the per-user override layer into a reader
+// set the role walk produced. The layer is last in the resolution order, so it
+// moves members in both directions:
+//
+//   - a user DENY of READ_MESSAGES drops a member their role admitted (unless
+//     they hold ADMINISTRATOR, which bypasses every override), and
+//   - a user ALLOW of READ_MESSAGES adds a member their role excluded.
+//
+// A user allow also beats a user deny on the same bit, matching
+// permissions.EffectiveChannelPerms.
+func (s *MessageService) applyUserOverridesToReaders(
+	ctx context.Context, channelID int64, targets []db.MentionTarget, adminRoles map[int64]bool,
+) ([]db.MentionTarget, error) {
+	userOv, err := s.st.GetChannelUserOverrides(ctx, channelID)
+	if err != nil {
+		return nil, err
+	}
+	if len(userOv) == 0 {
+		return targets, nil
+	}
+
+	granted := make([]int64, 0, len(userOv))
+	revoked := make(map[int64]bool, len(userOv))
+	for uid, o := range userOv {
+		switch {
+		case o.UserAllow&permissions.ReadMessages != 0:
+			granted = append(granted, uid)
+		case o.UserDeny&permissions.ReadMessages != 0:
+			revoked[uid] = true
+		}
+	}
+
+	kept := make([]db.MentionTarget, 0, len(targets))
+	present := make(map[int64]bool, len(targets))
+	for _, t := range targets {
+		if revoked[t.UserID] && !adminRoles[t.RoleID] {
+			continue
+		}
+		present[t.UserID] = true
+		kept = append(kept, t)
+	}
+
+	missing := make([]int64, 0, len(granted))
+	for _, uid := range granted {
+		if !present[uid] {
+			missing = append(missing, uid)
+		}
+	}
+	if len(missing) == 0 {
+		return kept, nil
+	}
+	// Deterministic order so the fan-out (and its tests) do not depend on map
+	// iteration order.
+	slices.Sort(missing)
+	added, err := s.st.ListMentionTargetsByUserIDs(ctx, missing)
+	if err != nil {
+		return nil, err
+	}
+	return append(kept, added...), nil
+}
diff --git a/Server/service/mentions_fuzz_test.go b/Server/service/mentions_fuzz_test.go
new file mode 100644
index 00000000..f379e81a
--- /dev/null
+++ b/Server/service/mentions_fuzz_test.go
@@ -0,0 +1,102 @@
+package service
+
+import (
+	"regexp"
+	"strings"
+	"testing"
+)
+
+// fuzzSpellingRe mirrors the token charset mentionTokenRe captures: letters,
+// digits, underscore, dot and hyphen, 1-64 runes. Every candidate spelling
+// parseMentionTokens returns must match it -- if it doesn't, the parser
+// leaked something outside its own documented token shape.
+var fuzzSpellingRe = regexp.MustCompile(`^[\p{L}\p{N}_.-]{1,64}$`)
+
+// FuzzParseMentionTokens shakes out panics and contract violations in
+// parseMentionTokens: unicode, RTL overrides, combining marks, null bytes,
+// pathological runs of "@", and address-shaped text that must never yield a
+// bare mention.
+func FuzzParseMentionTokens(f *testing.F) {
+	seeds := []string{
+		"",
+		"@bob",
+		"@@bob",
+		"@@@",
+		"mail@example.com",
+		"a@b",
+		"@a@b@c",
+		"@bob@example.com",
+		"@everyone",
+		"@here",
+		"@EVERYONE",
+		"@Here",
+		strings.Repeat("@", 10000),
+		strings.Repeat("@a", 5000),
+		"@bob.",
+		"@bob-",
+		"@bob_baz.qux",
+		"\U0001F642@bob\U0001F642", // emoji either side of the token
+		" @bob ",
+		"cafe\u0301@bob",   // combining acute accent (e + U+0301)
+		"\u202e@bob\u202e", // RTL override (U+202E)
+		"\u200f@bob",       // RTL mark (U+200F)
+		"@\u0301",          // bare combining mark as the token itself
+		"@bob\x00carol",    // embedded NUL
+		strings.Repeat("a", 2000) + "@" + strings.Repeat("b", 2000),
+		"@" + strings.Repeat("x", 100),
+		"@" + strings.Repeat("x", 63) + "y" + strings.Repeat("z", 63),
+		"(@bob), @carol!",
+		"@" + strings.Repeat("\U0001F600", 100),
+	}
+	for _, s := range seeds {
+		f.Add(s)
+	}
+
+	f.Fuzz(func(t *testing.T, content string) {
+		tokens, everyone, here := parseMentionTokens(content)
+
+		if len(tokens) > maxMentionCandidates {
+			t.Fatalf("token count %d exceeds cap %d", len(tokens), maxMentionCandidates)
+		}
+
+		seen := make(map[string]bool, len(tokens))
+		for _, tok := range tokens {
+			if len(tok.spellings) == 0 {
+				t.Fatalf("candidate with zero spellings for content %q", content)
+			}
+			for _, sp := range tok.spellings {
+				if sp == "" {
+					t.Fatalf("empty spelling in candidate for content %q", content)
+				}
+				if strings.Contains(sp, "@") {
+					t.Fatalf("spelling %q retained an '@' -- address-shaped text leaked a mention (content %q)", sp, content)
+				}
+				if sp != strings.ToLower(sp) {
+					t.Fatalf("spelling %q is not lowercased", sp)
+				}
+				if !fuzzSpellingRe.MatchString(sp) {
+					t.Fatalf("spelling %q outside the token charset (content %q)", sp, content)
+				}
+				if sp == everyoneToken || sp == hereToken {
+					t.Fatalf("reserved token %q leaked into resolvable candidates", sp)
+				}
+			}
+			primary := tok.spellings[0]
+			if seen[primary] {
+				t.Fatalf("duplicate candidate %q returned (content %q)", primary, content)
+			}
+			seen[primary] = true
+		}
+
+		// @everyone/@here flags must only ever be set for the literal reserved
+		// words; the substring check is a necessary (not sufficient) condition
+		// that still catches a parser gone wrong on unrelated input.
+		lower := strings.ToLower(content)
+		if everyone && !strings.Contains(lower, everyoneToken) {
+			t.Fatalf("everyone=true but content has no %q substring: %q", everyoneToken, content)
+		}
+		if here && !strings.Contains(lower, hereToken) {
+			t.Fatalf("here=true but content has no %q substring: %q", hereToken, content)
+		}
+	})
+}
diff --git a/Server/service/mentions_test.go b/Server/service/mentions_test.go
new file mode 100644
index 00000000..ef8da559
--- /dev/null
+++ b/Server/service/mentions_test.go
@@ -0,0 +1,543 @@
+package service
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/permissions"
+)
+
+// newMentionFixture builds a channel 10 with three members (alice=1 author,
+// bob=2 online, carol=3 offline) plus a moderator (mod=4) holding
+// MENTION_EVERYONE. Every role can read channel 10.
+func newMentionFixture(t *testing.T) (*MessageService, *ChannelService, *db.DB) {
+	t.Helper()
+	database := newTestDB(t)
+	seedRole(t, database, &db.Role{
+		ID:          permissions.MemberRoleID,
+		Name:        "member",
+		Permissions: permissions.SendMessages | permissions.ReadMessages,
+		Position:    1,
+	})
+	seedRole(t, database, &db.Role{
+		ID:   permissions.ModeratorRoleID,
+		Name: "moderator",
+		Permissions: permissions.SendMessages | permissions.ReadMessages |
+			permissions.MentionEveryone,
+		Position: 60,
+	})
+	seedUser(t, database, &db.User{ID: 1, Username: "alice", Status: "online"})
+	seedUser(t, database, &db.User{ID: 2, Username: "Bob", Status: "online"})
+	seedUser(t, database, &db.User{ID: 3, Username: "carol", Status: "offline"})
+	seedUser(t, database, &db.User{ID: 4, Username: "mod", Status: "online"})
+	seedUserRole(t, database, 1, permissions.MemberRoleID)
+	seedUserRole(t, database, 2, permissions.MemberRoleID)
+	seedUserRole(t, database, 3, permissions.MemberRoleID)
+	seedUserRole(t, database, 4, permissions.ModeratorRoleID)
+	seedChannel(t, database, &db.Channel{ID: 10, Name: "general", Type: "text"})
+
+	checker := permissions.NewChecker(database)
+	permSvc := NewPermissionService(database, checker)
+	msgSvc := NewMessageService(database, permSvc, nil)
+	// Mention counts are written on a background goroutine in production; run
+	// them inline here so the tests can read the counts right after a send.
+	msgSvc.RunBackgroundInlineForTest()
+	return msgSvc, NewChannelService(database, permSvc), database
+}
+
+func sendAs(t *testing.T, svc *MessageService, userID int64, content string) *SendMessageResult {
+	t.Helper()
+	res, err := svc.SendMessage(context.Background(), SendMessageParams{
+		ChannelID: 10,
+		UserID:    userID,
+		Username:  "user",
+		RoleName:  "member",
+		Content:   content,
+	})
+	if err != nil {
+		t.Fatalf("SendMessage(%q): %v", content, err)
+	}
+	return res
+}
+
+func mentionCount(t *testing.T, database *db.DB, userID int64) int {
+	t.Helper()
+	n, err := database.GetMentionCount(context.Background(), userID, 10)
+	if err != nil {
+		t.Fatalf("GetMentionCount(%d): %v", userID, err)
+	}
+	return n
+}
+
+// ─── parsing ─────────────────────────────────────────────────────────────────
+
+func TestParseMentionTokens(t *testing.T) {
+	tests := []struct {
+		name         string
+		content      string
+		wantTokens   []string
+		wantEveryone bool
+		wantHere     bool
+	}{
+		{name: "plain token", content: "hi @bob", wantTokens: []string{"bob"}},
+		{name: "lowercased", content: "hi @BoB", wantTokens: []string{"bob"}},
+		{name: "deduplicated", content: "@bob @bob @carol", wantTokens: []string{"bob", "carol"}},
+		{name: "no token", content: "no mentions here", wantTokens: nil},
+		{name: "email is not a mention", content: "write to bob@example.com", wantTokens: nil},
+		{name: "double at is not a mention", content: "@@bob", wantTokens: nil},
+		{name: "punctuation delimits", content: "(@bob), @carol!", wantTokens: []string{"bob", "carol"}},
+		{name: "everyone reserved", content: "@everyone hi", wantEveryone: true},
+		{name: "here reserved", content: "@here hi", wantHere: true},
+		{name: "case-insensitive reserved", content: "@EVERYONE", wantEveryone: true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			tokens, everyone, here := parseMentionTokens(tt.content)
+			var got []string
+			for _, tok := range tokens {
+				got = append(got, tok.spellings[0])
+			}
+			if strings.Join(got, ",") != strings.Join(tt.wantTokens, ",") {
+				t.Errorf("tokens = %v, want %v", got, tt.wantTokens)
+			}
+			if everyone != tt.wantEveryone {
+				t.Errorf("everyone = %v, want %v", everyone, tt.wantEveryone)
+			}
+			if here != tt.wantHere {
+				t.Errorf("here = %v, want %v", here, tt.wantHere)
+			}
+		})
+	}
+}
+
+// TestParseMentionTokens_TrailingPunctuationSpelling locks the fallback that
+// makes "@bob." resolve to bob when no user is literally named "bob.".
+func TestParseMentionTokens_TrailingPunctuationSpelling(t *testing.T) {
+	tokens, _, _ := parseMentionTokens("thanks @bob.")
+	if len(tokens) != 1 {
+		t.Fatalf("tokens = %d, want 1", len(tokens))
+	}
+	if got := tokens[0].spellings; len(got) != 2 || got[0] != "bob." || got[1] != "bob" {
+		t.Errorf("spellings = %v, want [bob. bob]", got)
+	}
+}
+
+func TestParseMentionTokens_CandidateCap(t *testing.T) {
+	var sb strings.Builder
+	for i := range maxMentionCandidates + 20 {
+		fmt.Fprintf(&sb, "@user%d ", i)
+	}
+	tokens, _, _ := parseMentionTokens(sb.String())
+	if len(tokens) != maxMentionCandidates {
+		t.Errorf("tokens = %d, want %d", len(tokens), maxMentionCandidates)
+	}
+}
+
+// ─── resolution on the send path ─────────────────────────────────────────────
+
+func TestSendMessage_ResolvesKnownUsername(t *testing.T) {
+	svc, _, database := newMentionFixture(t)
+
+	res := sendAs(t, svc, 1, "hey @Bob, look at this")
+	if len(res.Mentions) != 1 || res.Mentions[0] != 2 {
+		t.Fatalf("mentions = %v, want [2]", res.Mentions)
+	}
+	if res.MentionsEveryone {
+		t.Error("mentions_everyone should be false")
+	}
+
+	stored, err := database.GetMentionsByMessageIDs(context.Background(), []int64{res.MessageID})
+	if err != nil {
+		t.Fatalf("GetMentionsByMessageIDs: %v", err)
+	}
+	if len(stored[res.MessageID]) != 1 || stored[res.MessageID][0] != 2 {
+		t.Errorf("stored mentions = %v, want [2]", stored[res.MessageID])
+	}
+}
+
+func TestSendMessage_CaseInsensitiveUsername(t *testing.T) {
+	svc, _, _ := newMentionFixture(t)
+
+	res := sendAs(t, svc, 1, "hi @bOB")
+	if len(res.Mentions) != 1 || res.Mentions[0] != 2 {
+		t.Fatalf("mentions = %v, want [2]", res.Mentions)
+	}
+}
+
+func TestSendMessage_UnknownWordStaysText(t *testing.T) {
+	svc, _, database := newMentionFixture(t)
+
+	res := sendAs(t, svc, 1, "@nobody @bob@example.com hello")
+	if len(res.Mentions) != 0 {
+		t.Fatalf("mentions = %v, want none", res.Mentions)
+	}
+	if res.Content != "@nobody @bob@example.com hello" {
+		t.Errorf("content was rewritten: %q", res.Content)
+	}
+	stored, err := database.GetMentionsByMessageIDs(context.Background(), []int64{res.MessageID})
+	if err != nil {
+		t.Fatalf("GetMentionsByMessageIDs: %v", err)
+	}
+	if len(stored) != 0 {
+		t.Errorf("stored mentions = %v, want none", stored)
+	}
+}
+
+func TestSendMessage_MentionCapped(t *testing.T) {
+	svc, _, database := newMentionFixture(t)
+
+	// 25 distinct mentionable users, all readers of channel 10.
+	var sb strings.Builder
+	for i := range 25 {
+		id := int64(100 + i)
+		name := fmt.Sprintf("capuser%d", i)
+		seedUser(t, database, &db.User{ID: id, Username: name, Status: "online"})
+		seedUserRole(t, database, id, permissions.MemberRoleID)
+		sb.WriteString("@" + name + " ")
+	}
+
+	res := sendAs(t, svc, 1, sb.String())
+	if len(res.Mentions) != maxMentionsPerMessage {
+		t.Fatalf("mentions = %d, want %d", len(res.Mentions), maxMentionsPerMessage)
+	}
+	stored, err := database.GetMentionsByMessageIDs(context.Background(), []int64{res.MessageID})
+	if err != nil {
+		t.Fatalf("GetMentionsByMessageIDs: %v", err)
+	}
+	if len(stored[res.MessageID]) != maxMentionsPerMessage {
+		t.Errorf("stored = %d, want %d", len(stored[res.MessageID]), maxMentionsPerMessage)
+	}
+}
+
+// ─── @everyone / @here permission gate ───────────────────────────────────────
+
+func TestSendMessage_EveryoneRequiresPermission(t *testing.T) {
+	svc, _, database := newMentionFixture(t)
+
+	res := sendAs(t, svc, 1, "@everyone stand up") // alice is a plain member
+	if res.MentionsEveryone {
+		t.Fatal("@everyone without MENTION_EVERYONE must not gain mention semantics")
+	}
+	if got := mentionCount(t, database, 2); got != 0 {
+		t.Errorf("bob mention_count = %d, want 0", got)
+	}
+
+	res = sendAs(t, svc, 4, "@everyone stand up") // mod holds the bit
+	if !res.MentionsEveryone {
+		t.Fatal("@everyone with MENTION_EVERYONE must be honored")
+	}
+}
+
+func TestSendMessage_EveryoneCountsEveryReaderButAuthor(t *testing.T) {
+	svc, _, database := newMentionFixture(t)
+
+	sendAs(t, svc, 4, "@everyone meeting now")
+	for _, uid := range []int64{1, 2, 3} {
+		if got := mentionCount(t, database, uid); got != 1 {
+			t.Errorf("user %d mention_count = %d, want 1", uid, got)
+		}
+	}
+	if got := mentionCount(t, database, 4); got != 0 {
+		t.Errorf("author mention_count = %d, want 0", got)
+	}
+}
+
+func TestSendMessage_HereSkipsOfflineUsers(t *testing.T) {
+	svc, _, database := newMentionFixture(t)
+
+	sendAs(t, svc, 4, "@here quick question")
+	if got := mentionCount(t, database, 2); got != 1 {
+		t.Errorf("online bob mention_count = %d, want 1", got)
+	}
+	if got := mentionCount(t, database, 3); got != 0 {
+		t.Errorf("offline carol mention_count = %d, want 0", got)
+	}
+}
+
+// TestSendMessage_HereSkipsInvisibleUsers locks the phase-6 half of the @here
+// rule. users.status stores the status the user *chose*, so an invisible reader
+// holds the literal "invisible" here — a bare == "offline" test would ping them,
+// which is the one thing "appear offline" exists to prevent. The fan-out has to
+// collapse through db.BroadcastStatus first, so @here agrees with what everyone
+// else can see of that reader.
+func TestSendMessage_HereSkipsInvisibleUsers(t *testing.T) {
+	svc, _, database := newMentionFixture(t)
+
+	if err := database.UpdateUserStatus(context.Background(), 2, db.StatusInvisible); err != nil {
+		t.Fatalf("UpdateUserStatus(invisible): %v", err)
+	}
+
+	sendAs(t, svc, 4, "@here quick question")
+	if got := mentionCount(t, database, 2); got != 0 {
+		t.Errorf("invisible bob mention_count = %d, want 0", got)
+	}
+	// A plain @everyone still reaches them: only @here narrows on presence.
+	sendAs(t, svc, 4, "@everyone meeting now")
+	if got := mentionCount(t, database, 2); got != 1 {
+		t.Errorf("invisible bob @everyone mention_count = %d, want 1", got)
+	}
+}
+
+// TestSendMessage_EveryoneSkipsUsersWithoutRead locks that the @everyone
+// fan-out honors per-channel denies, not just the base role mask.
+func TestSendMessage_EveryoneSkipsUsersWithoutRead(t *testing.T) {
+	svc, _, database := newMentionFixture(t)
+	seedChannelOverride(t, database, permissions.MemberRoleID, 10, 0, permissions.ReadMessages)
+
+	sendAs(t, svc, 4, "@everyone private notice")
+	for _, uid := range []int64{1, 2, 3} {
+		if got := mentionCount(t, database, uid); got != 0 {
+			t.Errorf("denied user %d mention_count = %d, want 0", uid, got)
+		}
+	}
+}
+
+// TestSendMessage_EveryoneHonorsUserOverrides locks the per-user layer in the
+// @everyone fan-out: it is the last layer of the resolution order, so it must
+// both DROP a reader the role admitted and ADD one the role excluded.
+func TestSendMessage_EveryoneHonorsUserOverrides(t *testing.T) {
+	svc, _, database := newMentionFixture(t)
+	// The role cannot read the channel at all...
+	seedChannelOverride(t, database, permissions.MemberRoleID, 10, 0, permissions.ReadMessages)
+	// ...but bob is individually granted READ back.
+	if err := database.UpsertChannelUserOverride(context.Background(), 10, 2, permissions.ReadMessages, 0); err != nil {
+		t.Fatalf("UpsertChannelUserOverride bob: %v", err)
+	}
+
+	sendAs(t, svc, 4, "@everyone notice")
+	if got := mentionCount(t, database, 2); got != 1 {
+		t.Errorf("bob (user allow) mention_count = %d, want 1", got)
+	}
+	if got := mentionCount(t, database, 3); got != 0 {
+		t.Errorf("carol (no override) mention_count = %d, want 0", got)
+	}
+}
+
+func TestSendMessage_EveryoneSkipsUserDenied(t *testing.T) {
+	svc, _, database := newMentionFixture(t)
+	// carol alone is denied READ on a channel her role can read.
+	if err := database.UpsertChannelUserOverride(context.Background(), 10, 3, 0, permissions.ReadMessages); err != nil {
+		t.Fatalf("UpsertChannelUserOverride carol: %v", err)
+	}
+
+	sendAs(t, svc, 4, "@everyone notice")
+	if got := mentionCount(t, database, 2); got != 1 {
+		t.Errorf("bob mention_count = %d, want 1", got)
+	}
+	if got := mentionCount(t, database, 3); got != 0 {
+		t.Errorf("carol (user deny) mention_count = %d, want 0", got)
+	}
+}
+
+// A direct @mention of a user the channel's per-user deny excludes must not
+// raise their badge either — mentionReaders is the single gate behind both.
+func TestSendMessage_DirectMentionSkipsUserDenied(t *testing.T) {
+	svc, _, database := newMentionFixture(t)
+	if err := database.UpsertChannelUserOverride(context.Background(), 10, 2, 0, permissions.ReadMessages); err != nil {
+		t.Fatalf("UpsertChannelUserOverride bob: %v", err)
+	}
+
+	sendAs(t, svc, 1, "@bob ping")
+	if got := mentionCount(t, database, 2); got != 0 {
+		t.Errorf("user-denied bob mention_count = %d, want 0", got)
+	}
+}
+
+// A single message mentioning several users at once must resolve each one
+// independently against the reader set: readers get counted, a non-reader
+// (denied READ_MESSAGES via a per-user override) does not — the case the
+// mentioned-uid x reader lookup has to get right regardless of how it is
+// implemented internally (loop or map).
+func TestSendMessage_MultipleDirectMentionsResolveIndependently(t *testing.T) {
+	svc, _, database := newMentionFixture(t)
+	if err := database.UpsertChannelUserOverride(context.Background(), 10, 3, 0, permissions.ReadMessages); err != nil {
+		t.Fatalf("UpsertChannelUserOverride carol: %v", err)
+	}
+
+	sendAs(t, svc, 1, "@bob @carol @mod hi")
+
+	if got := mentionCount(t, database, 2); got != 1 {
+		t.Errorf("bob (reader) mention_count = %d, want 1", got)
+	}
+	if got := mentionCount(t, database, 3); got != 0 {
+		t.Errorf("carol (denied read) mention_count = %d, want 0", got)
+	}
+	if got := mentionCount(t, database, 4); got != 1 {
+		t.Errorf("mod (reader) mention_count = %d, want 1", got)
+	}
+}
+
+// ─── mention counts ──────────────────────────────────────────────────────────
+
+func TestSendMessage_DirectMentionIncrementsCount(t *testing.T) {
+	svc, _, database := newMentionFixture(t)
+
+	sendAs(t, svc, 1, "@bob ping")
+	sendAs(t, svc, 1, "@bob again")
+	if got := mentionCount(t, database, 2); got != 2 {
+		t.Errorf("bob mention_count = %d, want 2", got)
+	}
+	if got := mentionCount(t, database, 3); got != 0 {
+		t.Errorf("uninvolved carol mention_count = %d, want 0", got)
+	}
+}
+
+// TestSendMessage_MentionCountsWrittenInBackground exercises the default async
+// path: the fixture normally forces the inline seam, so here we restore the
+// real `go fn()` dispatcher and confirm the count still lands shortly after
+// SendMessage returns.
+func TestSendMessage_MentionCountsWrittenInBackground(t *testing.T) {
+	svc, _, database := newMentionFixture(t)
+	// Undo the fixture's inline seam so bg is the production `go fn()` again.
+	svc.bg = func(fn func()) { go fn() }
+
+	sendAs(t, svc, 1, "@Bob ping")
+
+	// The write is on a goroutine; poll briefly rather than assuming timing.
+	const deadline = 2 * time.Second
+	var got int
+	for waited := time.Duration(0); waited < deadline; waited += 10 * time.Millisecond {
+		if got = mentionCount(t, database, 2); got == 1 {
+			return
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	t.Fatalf("bob mention_count = %d after %s, want 1 (background write never landed)", got, deadline)
+}
+
+func TestSendMessage_SelfMentionDoesNotCount(t *testing.T) {
+	svc, _, database := newMentionFixture(t)
+
+	sendAs(t, svc, 2, "note to self @bob")
+	if got := mentionCount(t, database, 2); got != 0 {
+		t.Errorf("self-mention mention_count = %d, want 0", got)
+	}
+}
+
+func TestSendMessage_BlockedAuthorDoesNotRaiseBadge(t *testing.T) {
+	svc, _, database := newMentionFixture(t)
+	seedBlock(t, database, 2, 1) // bob blocked alice
+
+	sendAs(t, svc, 1, "@bob @carol hello")
+	if got := mentionCount(t, database, 2); got != 0 {
+		t.Errorf("blocker mention_count = %d, want 0", got)
+	}
+	if got := mentionCount(t, database, 3); got != 1 {
+		t.Errorf("carol mention_count = %d, want 1", got)
+	}
+}
+
+func TestChannelFocus_ClearsMentionCount(t *testing.T) {
+	msgSvc, chanSvc, database := newMentionFixture(t)
+
+	sendAs(t, msgSvc, 1, "@bob look")
+	if got := mentionCount(t, database, 2); got != 1 {
+		t.Fatalf("setup: bob mention_count = %d, want 1", got)
+	}
+
+	if _, err := chanSvc.HandleChannelFocus(context.Background(), 2, 10); err != nil {
+		t.Fatalf("HandleChannelFocus: %v", err)
+	}
+	if got := mentionCount(t, database, 2); got != 0 {
+		t.Errorf("after focus mention_count = %d, want 0", got)
+	}
+}
+
+// ─── edits ───────────────────────────────────────────────────────────────────
+
+func TestEditMessage_ReplacesMentionsWithoutRecounting(t *testing.T) {
+	svc, _, database := newMentionFixture(t)
+
+	res := sendAs(t, svc, 1, "@bob first")
+	if got := mentionCount(t, database, 2); got != 1 {
+		t.Fatalf("setup: bob mention_count = %d, want 1", got)
+	}
+
+	edited, err := svc.EditMessage(context.Background(), 1, res.MessageID, "@carol instead")
+	if err != nil {
+		t.Fatalf("EditMessage: %v", err)
+	}
+	if len(edited.Mentions) != 1 || edited.Mentions[0] != 3 {
+		t.Fatalf("edited mentions = %v, want [3]", edited.Mentions)
+	}
+
+	stored, err := database.GetMentionsByMessageIDs(context.Background(), []int64{res.MessageID})
+	if err != nil {
+		t.Fatalf("GetMentionsByMessageIDs: %v", err)
+	}
+	if len(stored[res.MessageID]) != 1 || stored[res.MessageID][0] != 3 {
+		t.Errorf("stored mentions = %v, want [3]", stored[res.MessageID])
+	}
+
+	// Edits never advance badges — bob keeps his one, carol gains none.
+	if got := mentionCount(t, database, 2); got != 1 {
+		t.Errorf("bob mention_count = %d, want 1", got)
+	}
+	if got := mentionCount(t, database, 3); got != 0 {
+		t.Errorf("carol mention_count = %d, want 0 (edits never increment)", got)
+	}
+}
+
+func TestEditMessage_EveryoneGateApplies(t *testing.T) {
+	svc, _, database := newMentionFixture(t)
+
+	res := sendAs(t, svc, 1, "plain text")
+	if _, err := svc.EditMessage(context.Background(), 1, res.MessageID, "@everyone actually"); err != nil {
+		t.Fatalf("EditMessage: %v", err)
+	}
+	msg, err := database.GetMessage(context.Background(), res.MessageID)
+	if err != nil || msg == nil {
+		t.Fatalf("GetMessage: %v", err)
+	}
+	if msg.MentionsEveryone {
+		t.Error("edit by a member must not set mentions_everyone")
+	}
+}
+
+// ─── read-state fan-out ──────────────────────────────────────────────────────
+
+func TestGetChannelUnreadCounts_CarriesMentionCount(t *testing.T) {
+	svc, _, database := newMentionFixture(t)
+
+	sendAs(t, svc, 1, "@bob check the ready payload")
+	counts, err := database.GetChannelUnreadCounts(context.Background(), 2)
+	if err != nil {
+		t.Fatalf("GetChannelUnreadCounts: %v", err)
+	}
+	got, ok := counts[10]
+	if !ok {
+		t.Fatal("channel 10 missing from unread counts")
+	}
+	if got.MentionCount != 1 {
+		t.Errorf("mention_count = %d, want 1", got.MentionCount)
+	}
+	if got.UnreadCount != 1 {
+		t.Errorf("unread_count = %d, want 1", got.UnreadCount)
+	}
+}
+
+// TestSendMessage_DMMentionsResolve locks that DMs resolve usernames but never
+// gain @everyone semantics — there is no permission surface behind a DM.
+func TestSendMessage_DMMentionsResolve(t *testing.T) {
+	svc, _, database := newMentionFixture(t)
+	seedChannel(t, database, &db.Channel{ID: 50, Name: "dm-1-2", Type: "dm"})
+	seedDMParticipant(t, database, 50, 1)
+	seedDMParticipant(t, database, 50, 2)
+
+	res, err := svc.SendMessage(context.Background(), SendMessageParams{
+		ChannelID: 50, UserID: 1, Username: "alice", Content: "@bob @everyone hi",
+	})
+	if err != nil {
+		t.Fatalf("SendMessage: %v", err)
+	}
+	if len(res.Mentions) != 1 || res.Mentions[0] != 2 {
+		t.Errorf("mentions = %v, want [2]", res.Mentions)
+	}
+	if res.MentionsEveryone {
+		t.Error("DM must not honor @everyone")
+	}
+}
diff --git a/Server/service/message.go b/Server/service/message.go
index 999a7b7b..3cf55c2e 100644
--- a/Server/service/message.go
+++ b/Server/service/message.go
@@ -53,9 +53,27 @@ type SendMessageResult struct {
 	ParticipantIDs []int64
 	SenderUser     *db.User // for dm_channel_open events
 	OpenedDMFor    []int64  // participant IDs that had their DM opened
+	// DMParticipants is the full participant list of the DM, viewer-neutral:
+	// it is read with viewerID 0, which matches nobody, so every status is
+	// already broadcast-collapsed (an invisible participant reads as offline).
+	// That is what makes it safe to reuse for every addressee — the ws layer
+	// turns it into a per-recipient dm_channel_open payload without re-deriving
+	// visibility. Nil when the participant read failed, in which case the
+	// caller falls back to the sender-only 1:1 shape.
+	DMParticipants []db.DMUser
+	// DMIsGroup mirrors channels.is_group for this DM. Carried alongside the
+	// participants because a group that people have left can have two members
+	// and must still render as a group.
+	DMIsGroup bool
 
 	// Attachment data for broadcast.
 	Attachments []db.AttachmentInfo
+
+	// Mentions is the resolved mentioned user ids (never nil) and
+	// MentionsEveryone an authorized @everyone/@here. Both are broadcast so
+	// clients highlight from server-resolved data instead of re-guessing.
+	Mentions         []int64
+	MentionsEveryone bool
 }
 
 // EditMessageResult contains the output of a successful message edit.
@@ -67,6 +85,10 @@ type EditMessageResult struct {
 	IsDM      bool
 	// DM-specific.
 	ParticipantIDs []int64
+
+	// Mentions/MentionsEveryone are re-resolved from the edited content.
+	Mentions         []int64
+	MentionsEveryone bool
 }
 
 // DeleteMessageResult contains the output of a successful message delete.
@@ -79,6 +101,13 @@ type DeleteMessageResult struct {
 	ParticipantIDs []int64
 }
 
+// PurgeMessagesResult contains the output of a successful bulk delete.
+// MessageIDs is newest-first and is empty (never nil) when nothing matched.
+type PurgeMessagesResult struct {
+	ChannelID  int64
+	MessageIDs []int64
+}
+
 // ReactionResult contains the output of a reaction add/remove.
 type ReactionResult struct {
 	MessageID int64
@@ -97,6 +126,12 @@ type MessageService struct {
 	st      Store
 	perms   *PermissionService
 	limiter *auth.RateLimiter
+	// bg runs mention-badge bookkeeping off the send path so a mention or
+	// @everyone message does not wait on the full reader-resolution chain
+	// before it is delivered to the rest of the channel. Defaults to `go fn()`;
+	// tests swap it for an inline runner via RunBackgroundInlineForTest so they
+	// can read the counts deterministically right after a send.
+	bg func(fn func())
 }
 
 // NewMessageService creates a MessageService.
@@ -105,9 +140,18 @@ func NewMessageService(st Store, perms *PermissionService, limiter *auth.RateLim
 		st:      st,
 		perms:   perms,
 		limiter: limiter,
+		bg:      func(fn func()) { go fn() },
 	}
 }
 
+// RunBackgroundInlineForTest makes deferred bookkeeping (mention counts) run
+// synchronously on the calling goroutine instead of in a background goroutine,
+// so tests can assert on the results immediately after SendMessage returns.
+// Test-only.
+func (s *MessageService) RunBackgroundInlineForTest() {
+	s.bg = func(fn func()) { fn() }
+}
+
 // sanitizeContent validates and sanitizes message content.
 func sanitizeContent(raw string, allowEmpty bool) (string, error) {
 	if len(raw) > maxMessageLen*4 {
diff --git a/Server/service/message_around_test.go b/Server/service/message_around_test.go
new file mode 100644
index 00000000..fde268d6
--- /dev/null
+++ b/Server/service/message_around_test.go
@@ -0,0 +1,178 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/owncord/server/db"
+)
+
+// seedAroundHistory fills channelID with n messages authored by user 1 and
+// returns their ids oldest-first.
+func seedAroundHistory(t *testing.T, database *db.DB, channelID int64, n int) []int64 {
+	t.Helper()
+	ids := make([]int64, 0, n)
+	for range n {
+		id, err := database.CreateMessage(context.Background(), channelID, 1, "history", nil)
+		if err != nil {
+			t.Fatalf("CreateMessage: %v", err)
+		}
+		ids = append(ids, id)
+	}
+	return ids
+}
+
+func TestGetMessagesAround_SplitsTheLimitAroundTheCentre(t *testing.T) {
+	svc, database := newTestMessageService(t)
+	ids := seedAroundHistory(t, database, 10, 40)
+
+	window, err := svc.GetMessagesAround(context.Background(), 1, 10, ids[20], 11)
+	if err != nil {
+		t.Fatalf("GetMessagesAround: %v", err)
+	}
+	if len(window.Messages) != 11 {
+		t.Fatalf("window size = %d, want 11", len(window.Messages))
+	}
+	// limit 11 → 5 older, centre, 5 newer.
+	if window.Messages[5].ID != ids[20] {
+		t.Errorf("centre at index 5 = %d, want %d", window.Messages[5].ID, ids[20])
+	}
+	if !window.HasMoreBefore || !window.HasMoreAfter {
+		t.Errorf("HasMoreBefore = %v, HasMoreAfter = %v; want both true",
+			window.HasMoreBefore, window.HasMoreAfter)
+	}
+}
+
+func TestGetMessagesAround_EdgesReportNoMore(t *testing.T) {
+	svc, database := newTestMessageService(t)
+	ids := seedAroundHistory(t, database, 10, 30)
+
+	first, err := svc.GetMessagesAround(context.Background(), 1, 10, ids[0], 10)
+	if err != nil {
+		t.Fatalf("GetMessagesAround(first): %v", err)
+	}
+	if first.HasMoreBefore {
+		t.Error("HasMoreBefore = true at the oldest message")
+	}
+	if !first.HasMoreAfter {
+		t.Error("HasMoreAfter = false with 29 newer messages")
+	}
+
+	last, err := svc.GetMessagesAround(context.Background(), 1, 10, ids[len(ids)-1], 10)
+	if err != nil {
+		t.Fatalf("GetMessagesAround(last): %v", err)
+	}
+	if last.HasMoreAfter {
+		t.Error("HasMoreAfter = true at the newest message")
+	}
+	if !last.HasMoreBefore {
+		t.Error("HasMoreBefore = false with 29 older messages")
+	}
+}
+
+func TestGetMessagesAround_ExactFitReportsNoMore(t *testing.T) {
+	svc, database := newTestMessageService(t)
+	// limit 5 → 2 older + centre + 2 newer, and the channel holds exactly that.
+	ids := seedAroundHistory(t, database, 10, 5)
+
+	window, err := svc.GetMessagesAround(context.Background(), 1, 10, ids[2], 5)
+	if err != nil {
+		t.Fatalf("GetMessagesAround: %v", err)
+	}
+	if len(window.Messages) != 5 {
+		t.Fatalf("window size = %d, want 5", len(window.Messages))
+	}
+	if window.HasMoreBefore || window.HasMoreAfter {
+		t.Errorf("HasMoreBefore = %v, HasMoreAfter = %v; a window that exactly covers the channel has no more",
+			window.HasMoreBefore, window.HasMoreAfter)
+	}
+}
+
+func TestGetMessagesAround_ClampsLimit(t *testing.T) {
+	svc, database := newTestMessageService(t)
+	ids := seedAroundHistory(t, database, 10, 150)
+
+	window, err := svc.GetMessagesAround(context.Background(), 1, 10, ids[75], 5000)
+	if err != nil {
+		t.Fatalf("GetMessagesAround: %v", err)
+	}
+	if len(window.Messages) != 100 {
+		t.Errorf("window size = %d, want the 100 cap", len(window.Messages))
+	}
+
+	// A zero/negative limit falls back to the 50 default rather than returning
+	// an empty window.
+	window, err = svc.GetMessagesAround(context.Background(), 1, 10, ids[75], 0)
+	if err != nil {
+		t.Fatalf("GetMessagesAround(limit=0): %v", err)
+	}
+	if len(window.Messages) != 50 {
+		t.Errorf("default window size = %d, want 50", len(window.Messages))
+	}
+}
+
+func TestGetMessagesAround_RejectsBadIDs(t *testing.T) {
+	svc, database := newTestMessageService(t)
+	ids := seedAroundHistory(t, database, 10, 3)
+
+	if _, err := svc.GetMessagesAround(context.Background(), 1, 10, 0, 50); !errors.Is(err, ErrBadRequest) {
+		t.Errorf("message_id 0 error = %v, want ErrBadRequest", err)
+	}
+	if _, err := svc.GetMessagesAround(context.Background(), 1, 0, ids[0], 50); !errors.Is(err, ErrBadRequest) {
+		t.Errorf("channel_id 0 error = %v, want ErrBadRequest", err)
+	}
+	if _, err := svc.GetMessagesAround(context.Background(), 1, 999, ids[0], 50); !errors.Is(err, ErrNotFound) {
+		t.Errorf("unknown channel error = %v, want ErrNotFound", err)
+	}
+}
+
+func TestGetMessagesAround_MessageFromAnotherChannelIsNotFound(t *testing.T) {
+	svc, database := newTestMessageService(t)
+	seedChannel(t, database, &db.Channel{ID: 12, Name: "other", Type: "text"})
+	otherIDs := seedAroundHistory(t, database, 12, 2)
+
+	_, err := svc.GetMessagesAround(context.Background(), 1, 10, otherIDs[0], 50)
+	if !errors.Is(err, ErrNotFound) {
+		t.Errorf("cross-channel centre error = %v, want ErrNotFound", err)
+	}
+}
+
+func TestGetMessagesAround_DeletedCentreIsNotFound(t *testing.T) {
+	svc, database := newTestMessageService(t)
+	ids := seedAroundHistory(t, database, 10, 3)
+	if err := database.DeleteMessage(context.Background(), ids[1], 1, false); err != nil {
+		t.Fatalf("DeleteMessage: %v", err)
+	}
+
+	// History omits soft-deleted rows, so there is no row to centre on — the
+	// jump must fail loudly rather than land on an arbitrary neighbour.
+	_, err := svc.GetMessagesAround(context.Background(), 1, 10, ids[1], 50)
+	if !errors.Is(err, ErrNotFound) {
+		t.Errorf("deleted centre error = %v, want ErrNotFound", err)
+	}
+}
+
+func TestGetMessagesAround_DMNonParticipantIsNotFound(t *testing.T) {
+	svc, database := newTestMessageService(t)
+	seedUser(t, database, &db.User{ID: 2, Username: "bob", Status: "online"})
+	seedUser(t, database, &db.User{ID: 3, Username: "outsider", Status: "offline"})
+	seedChannel(t, database, &db.Channel{ID: 13, Name: "dm", Type: "dm"})
+	seedDMParticipant(t, database, 13, 1)
+	seedDMParticipant(t, database, 13, 2)
+	msgID, err := database.CreateMessage(context.Background(), 13, 1, "private", nil)
+	if err != nil {
+		t.Fatalf("CreateMessage: %v", err)
+	}
+
+	if _, err := svc.GetMessagesAround(context.Background(), 3, 13, msgID, 50); !errors.Is(err, ErrNotFound) {
+		t.Errorf("outsider error = %v, want ErrNotFound", err)
+	}
+	window, err := svc.GetMessagesAround(context.Background(), 1, 13, msgID, 50)
+	if err != nil {
+		t.Fatalf("participant GetMessagesAround: %v", err)
+	}
+	if len(window.Messages) != 1 {
+		t.Errorf("participant window size = %d, want 1", len(window.Messages))
+	}
+}
diff --git a/Server/service/message_crud.go b/Server/service/message_crud.go
index 11d3efff..67281fb0 100644
--- a/Server/service/message_crud.go
+++ b/Server/service/message_crud.go
@@ -71,9 +71,15 @@ func (s *MessageService) SendMessage(ctx context.Context, p SendMessageParams) (
 		}
 	}
 
+	// Resolve mentions against the sanitized content, before the insert, so the
+	// row and its mention set are written together. Unknown @words and an
+	// unauthorized @everyone resolve to nothing and stay plain text.
+	mentions := s.resolveMentions(ctx, content, p.UserID, p.ChannelID, isDM)
+
 	// Persist message. RETURNING hands back the inserted row, so the DB-assigned
 	// timestamp the fan-out needs arrives with the insert instead of a re-read.
-	msg, err := s.st.CreateMessageReturning(ctx, p.ChannelID, p.UserID, content, p.ReplyTo)
+	msg, err := s.st.CreateMessageWithMentions(ctx, p.ChannelID, p.UserID, content, p.ReplyTo,
+		mentions.UserIDs, mentions.Everyone)
 	if err != nil {
 		slog.Error("MessageService.SendMessage CreateMessage", "err", err)
 		return nil, fmt.Errorf("%w: failed to save message", ErrInternal)
@@ -111,12 +117,14 @@ func (s *MessageService) SendMessage(ctx context.Context, p SendMessageParams) (
 	}
 
 	result := &SendMessageResult{
-		MessageID:   msgID,
-		Timestamp:   msg.Timestamp,
-		Content:     content,
-		IsDM:        isDM,
-		Channel:     ch,
-		Attachments: attachments,
+		MessageID:        msgID,
+		Timestamp:        msg.Timestamp,
+		Content:          content,
+		IsDM:             isDM,
+		Channel:          ch,
+		Attachments:      attachments,
+		Mentions:         mentions.UserIDs,
+		MentionsEveryone: mentions.Everyone,
 	}
 
 	// DM path: open DM for recipients.
@@ -131,6 +139,19 @@ func (s *MessageService) SendMessage(ctx context.Context, p SendMessageParams) (
 		sender, _ := s.st.GetUserByID(ctx, p.UserID)
 		result.SenderUser = sender
 
+		// Viewer-neutral (viewerID 0 matches nobody, so every status is
+		// broadcast-collapsed); the ws layer re-derives "who is the recipient"
+		// per addressee. A read failure is non-fatal — the message is already
+		// committed, and the caller falls back to the 1:1 shape.
+		if participants, partErr := s.st.GetDMParticipants(ctx, p.ChannelID, 0); partErr == nil {
+			result.DMParticipants = participants
+		} else {
+			slog.Warn("MessageService.SendMessage GetDMParticipants", "err", partErr, "channel_id", p.ChannelID)
+		}
+		if isGroup, gErr := s.st.IsGroupDM(ctx, p.ChannelID); gErr == nil {
+			result.DMIsGroup = isGroup
+		}
+
 		for _, pid := range participantIDs {
 			if pid == p.UserID {
 				continue
@@ -143,6 +164,19 @@ func (s *MessageService) SendMessage(ctx context.Context, p SendMessageParams) (
 		}
 	}
 
+	// Mention badges run off the send path: the message is already committed, so
+	// the recipients' badge bookkeeping (the full reader-resolution chain plus
+	// the batched increment) must not delay delivering the message to the rest
+	// of the channel. The ctx is detached from cancellation — for the same
+	// reason audit writes are — so a client hanging up mid-request cannot drop
+	// the badges. The count is advisory: if a reader's channel_focus clears it
+	// in the tiny window before the increment lands, the badge simply does not
+	// reappear, which matches Discord's eventual-consistency behaviour.
+	channelID, authorID, participantIDs := p.ChannelID, p.UserID, result.ParticipantIDs
+	s.bg(func() {
+		s.applyMentionCounts(context.WithoutCancel(ctx), channelID, authorID, mentions, isDM, participantIDs)
+	})
+
 	slog.Debug("message sent", "user", p.Username, "channel_id", p.ChannelID, "msg_id", msgID)
 	return result, nil
 }
@@ -215,12 +249,25 @@ func (s *MessageService) EditMessage(ctx context.Context, userID, msgID int64, r
 		editedAt = *msg.EditedAt
 	}
 
+	// Re-resolve mentions from the new content and replace the stored set, so a
+	// mention added by an edit is highlighted and one removed by an edit stops
+	// being. Mention counts are deliberately NOT advanced here: an edit that
+	// re-adds an already-counted mention would otherwise raise the badge twice,
+	// and "only the original insert can raise a badge" is the simplest rule that
+	// is always correct.
+	mentions := s.resolveMentions(ctx, content, userID, msg.ChannelID, isDM)
+	if mErr := s.st.ReplaceMessageMentions(context.WithoutCancel(ctx), msgID, mentions.UserIDs, mentions.Everyone); mErr != nil {
+		slog.Error("MessageService.EditMessage ReplaceMessageMentions", "err", mErr, "msg_id", msgID)
+	}
+
 	result := &EditMessageResult{
-		MessageID: msgID,
-		ChannelID: msg.ChannelID,
-		Content:   content,
-		EditedAt:  editedAt,
-		IsDM:      isDM,
+		MessageID:        msgID,
+		ChannelID:        msg.ChannelID,
+		Content:          content,
+		EditedAt:         editedAt,
+		IsDM:             isDM,
+		Mentions:         mentions.UserIDs,
+		MentionsEveryone: mentions.Everyone,
 	}
 
 	if isDM {
diff --git a/Server/service/message_perms.go b/Server/service/message_perms.go
index 0ab830bb..9e3a7efc 100644
--- a/Server/service/message_perms.go
+++ b/Server/service/message_perms.go
@@ -23,7 +23,7 @@ func (s *MessageService) GetAccessibleChannelIDs(ctx context.Context, userID int
 	var overrides map[int64]db.ChannelOverride
 	if !permissions.HasAdmin(role.Permissions) {
 		var overrideErr error
-		overrides, overrideErr = s.st.GetAllChannelPermissionsForRole(ctx, role.ID)
+		overrides, overrideErr = s.st.GetChannelOverridesFor(ctx, role.ID, userID)
 		if overrideErr != nil {
 			return nil, fmt.Errorf("%w: failed to fetch channel overrides: %v", ErrInternal, overrideErr)
 		}
@@ -107,7 +107,19 @@ func (s *MessageService) checkSendPermission(ctx context.Context, userID, channe
 // A GetDMRecipient lookup failure or a DM with no other participant is treated
 // as "not blocked", carrying over the posture the send path has always had
 // rather than newly failing closed on all five sinks at once.
+//
+// Group DMs are exempt, which is Discord's rule and the only coherent one for
+// a shared room: there is no single "the other party" to be blocked by, and
+// dropping one member's messages for one other member would leave the two of
+// them reading different conversations under the same name. Blocks are instead
+// enforced when the group is *created* (DMService.CreateGroupDM), where the
+// question "may these two be in a room together" still has one answer.
 func requireDMNotBlocked(ctx context.Context, st Store, userID, channelID int64) error {
+	isGroup, gErr := st.IsGroupDM(ctx, channelID)
+	if gErr == nil && isGroup {
+		return nil
+	}
+
 	recipient, err := st.GetDMRecipient(ctx, channelID, userID)
 	if err != nil || recipient == nil {
 		return nil //nolint:nilerr // carries over checkSendPermission's posture: a lookup failure or a DM with no other participant is not a block
diff --git a/Server/service/message_purge.go b/Server/service/message_purge.go
new file mode 100644
index 00000000..998f4057
--- /dev/null
+++ b/Server/service/message_purge.go
@@ -0,0 +1,75 @@
+package service
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"github.com/owncord/server/auth"
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/permissions"
+)
+
+// maxPurgeLimit bounds one purge request. Matches the message page size, so a
+// moderator can clear exactly what a client shows in one screenful and no
+// single call can fan out an unbounded id list to every channel subscriber.
+const maxPurgeLimit = 100
+
+// PurgeMessages soft-deletes the newest limit non-deleted messages in a
+// channel, optionally restricted to messages older than before.
+//
+// The actor needs READ_MESSAGES|MANAGE_MESSAGES on the channel (per-channel
+// overrides apply), the same pair the single-message moderator delete and the
+// pin toggle require — MANAGE_MESSAGES alone would let a role the admin panel's
+// "Can access" toggle locked out of a private channel wipe it.
+//
+// DMs are rejected outright: a DM has no MANAGE_MESSAGES gate to check, so
+// there is no participant-scoped authority a bulk delete could answer to.
+func (s *MessageService) PurgeMessages(ctx context.Context, userID, channelID int64, limit int, before int64) (*PurgeMessagesResult, error) {
+	ratKey := auth.Key("chat_purge", userID)
+	if s.limiter != nil && !s.limiter.Allow(ratKey, 5, time.Second) {
+		return nil, ErrRateLimited
+	}
+
+	if channelID <= 0 {
+		return nil, fmt.Errorf("%w: channel_id must be a positive integer", ErrBadRequest)
+	}
+	if limit < 1 {
+		return nil, fmt.Errorf("%w: limit must be between 1 and %d", ErrBadRequest, maxPurgeLimit)
+	}
+	if before < 0 {
+		return nil, fmt.Errorf("%w: before must be a non-negative integer", ErrBadRequest)
+	}
+	if limit > maxPurgeLimit {
+		limit = maxPurgeLimit
+	}
+
+	ch, err := s.st.GetChannel(ctx, channelID)
+	if err != nil || ch == nil {
+		return nil, fmt.Errorf("%w: channel not found", ErrNotFound)
+	}
+	if ch.Type == "dm" {
+		return nil, fmt.Errorf("%w: bulk delete is not available in direct messages", ErrForbidden)
+	}
+	if !s.perms.HasChannelPerm(ctx, userID, channelID, permissions.ReadMessages|permissions.ManageMessages) {
+		return nil, fmt.Errorf("%w: missing MANAGE_MESSAGES permission", ErrForbidden)
+	}
+
+	ids, err := s.st.PurgeChannelMessages(ctx, channelID, before, limit)
+	if err != nil {
+		slog.Error("MessageService.PurgeMessages", "err", err, "channel_id", channelID)
+		return nil, fmt.Errorf("%w: failed to purge messages", ErrInternal)
+	}
+	if ids == nil {
+		ids = []int64{}
+	}
+
+	slog.Info("messages purged", "user_id", userID, "channel_id", channelID, "count", len(ids))
+	// One audit row per purge, not per message. Audit rows must survive a
+	// request canceled after the delete committed.
+	db.WriteAudit(context.WithoutCancel(ctx), s.st, userID, "message_purge", "channel", channelID,
+		fmt.Sprintf("purged %d messages, limit=%d, before=%d", len(ids), limit, before))
+
+	return &PurgeMessagesResult{ChannelID: channelID, MessageIDs: ids}, nil
+}
diff --git a/Server/service/message_purge_test.go b/Server/service/message_purge_test.go
new file mode 100644
index 00000000..a9f2e765
--- /dev/null
+++ b/Server/service/message_purge_test.go
@@ -0,0 +1,247 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/permissions"
+)
+
+// newPurgeService builds a MessageService with a moderator (user 2, role 20,
+// READ_MESSAGES|MANAGE_MESSAGES) alongside the plain member (user 1) that
+// newTestMessageService seeds, plus a DM channel both users participate in.
+func newPurgeService(t *testing.T) (*MessageService, *db.DB) {
+	t.Helper()
+	svc, database := newTestMessageService(t)
+	seedRole(t, database, &db.Role{
+		ID:          20,
+		Name:        "purge-mod",
+		Permissions: permissions.ReadMessages | permissions.SendMessages | permissions.ManageMessages,
+		Position:    5,
+	})
+	seedUser(t, database, &db.User{ID: 2, Username: "mod", Status: "online"})
+	seedUserRole(t, database, 2, 20)
+	seedChannel(t, database, &db.Channel{ID: 11, Name: "dm", Type: "dm"})
+	seedDMParticipant(t, database, 11, 1)
+	seedDMParticipant(t, database, 11, 2)
+	return svc, database
+}
+
+// seedPurgeMessages inserts n messages into channelID and returns their ids in
+// insertion (oldest-first) order.
+func seedPurgeMessages(t *testing.T, database *db.DB, channelID int64, n int) []int64 {
+	t.Helper()
+	ids := make([]int64, 0, n)
+	for range n {
+		id, err := database.CreateMessage(context.Background(), channelID, 1, "spam", nil)
+		if err != nil {
+			t.Fatalf("CreateMessage: %v", err)
+		}
+		ids = append(ids, id)
+	}
+	return ids
+}
+
+func TestPurgeMessages_ModeratorPurgesNewest(t *testing.T) {
+	svc, database := newPurgeService(t)
+	ids := seedPurgeMessages(t, database, 10, 5)
+
+	result, err := svc.PurgeMessages(context.Background(), 2, 10, 2, 0)
+	if err != nil {
+		t.Fatalf("PurgeMessages: %v", err)
+	}
+	if len(result.MessageIDs) != 2 {
+		t.Fatalf("purged %d messages, want 2", len(result.MessageIDs))
+	}
+	if result.ChannelID != 10 {
+		t.Errorf("ChannelID = %d, want 10", result.ChannelID)
+	}
+	if result.MessageIDs[0] != ids[4] || result.MessageIDs[1] != ids[3] {
+		t.Errorf("purged ids = %v, want newest-first %v", result.MessageIDs, []int64{ids[4], ids[3]})
+	}
+}
+
+func TestPurgeMessages_TombstonesPreserved(t *testing.T) {
+	svc, database := newPurgeService(t)
+	ids := seedPurgeMessages(t, database, 10, 3)
+
+	if _, err := svc.PurgeMessages(context.Background(), 2, 10, 3, 0); err != nil {
+		t.Fatalf("PurgeMessages: %v", err)
+	}
+
+	// Soft delete only: the rows and their content must survive so clients
+	// render tombstones and reply targets still resolve.
+	for _, id := range ids {
+		msg, err := database.GetMessage(context.Background(), id)
+		if err != nil {
+			t.Fatalf("GetMessage(%d): %v", id, err)
+		}
+		if msg == nil {
+			t.Fatalf("message %d was hard-deleted", id)
+		}
+		if !msg.Deleted {
+			t.Errorf("message %d not marked deleted", id)
+		}
+		if msg.Content == "" {
+			t.Errorf("message %d lost its content", id)
+		}
+	}
+}
+
+func TestPurgeMessages_MissingManageMessagesDenied(t *testing.T) {
+	svc, database := newPurgeService(t)
+	seedPurgeMessages(t, database, 10, 3)
+
+	// User 1 holds SEND_MESSAGES|READ_MESSAGES but not MANAGE_MESSAGES.
+	_, err := svc.PurgeMessages(context.Background(), 1, 10, 3, 0)
+	if !errors.Is(err, ErrForbidden) {
+		t.Fatalf("err = %v, want ErrForbidden", err)
+	}
+
+	msgs, _, listErr := svc.GetMessages(context.Background(), 1, 10, 0, 50)
+	if listErr != nil {
+		t.Fatalf("GetMessages: %v", listErr)
+	}
+	if len(msgs) != 3 {
+		t.Errorf("denied purge still deleted messages: %d remain, want 3", len(msgs))
+	}
+}
+
+// A role with MANAGE_MESSAGES but READ_MESSAGES denied on the channel (what the
+// admin panel's "Can access" toggle writes) must not be able to wipe it.
+func TestPurgeMessages_DeniedReadCannotPurge(t *testing.T) {
+	svc, database := newPurgeService(t)
+	seedPurgeMessages(t, database, 10, 3)
+	seedChannelOverride(t, database, 20, 10, 0, permissions.ReadMessages)
+
+	_, err := svc.PurgeMessages(context.Background(), 2, 10, 3, 0)
+	if !errors.Is(err, ErrForbidden) {
+		t.Fatalf("err = %v, want ErrForbidden", err)
+	}
+}
+
+func TestPurgeMessages_DMRejected(t *testing.T) {
+	svc, database := newPurgeService(t)
+	seedPurgeMessages(t, database, 11, 3)
+
+	_, err := svc.PurgeMessages(context.Background(), 2, 11, 3, 0)
+	if !errors.Is(err, ErrForbidden) {
+		t.Fatalf("err = %v, want ErrForbidden for a DM channel", err)
+	}
+
+	msgs, _, listErr := svc.GetMessages(context.Background(), 2, 11, 0, 50)
+	if listErr != nil {
+		t.Fatalf("GetMessages: %v", listErr)
+	}
+	if len(msgs) != 3 {
+		t.Errorf("DM purge deleted messages: %d remain, want 3", len(msgs))
+	}
+}
+
+func TestPurgeMessages_LimitClampedToMax(t *testing.T) {
+	svc, database := newPurgeService(t)
+	seedPurgeMessages(t, database, 10, maxPurgeLimit+10)
+
+	result, err := svc.PurgeMessages(context.Background(), 2, 10, 5000, 0)
+	if err != nil {
+		t.Fatalf("PurgeMessages: %v", err)
+	}
+	if len(result.MessageIDs) != maxPurgeLimit {
+		t.Fatalf("purged %d messages, want the clamp of %d", len(result.MessageIDs), maxPurgeLimit)
+	}
+
+	msgs, _, listErr := svc.GetMessages(context.Background(), 2, 10, 0, maxPurgeLimit)
+	if listErr != nil {
+		t.Fatalf("GetMessages: %v", listErr)
+	}
+	if len(msgs) != 10 {
+		t.Errorf("%d messages remain, want 10", len(msgs))
+	}
+}
+
+func TestPurgeMessages_NonPositiveLimitRejected(t *testing.T) {
+	svc, database := newPurgeService(t)
+	seedPurgeMessages(t, database, 10, 2)
+
+	for _, limit := range []int{0, -1} {
+		if _, err := svc.PurgeMessages(context.Background(), 2, 10, limit, 0); !errors.Is(err, ErrBadRequest) {
+			t.Errorf("limit %d: err = %v, want ErrBadRequest", limit, err)
+		}
+	}
+}
+
+func TestPurgeMessages_BeforeCursorHonored(t *testing.T) {
+	svc, database := newPurgeService(t)
+	ids := seedPurgeMessages(t, database, 10, 4)
+
+	result, err := svc.PurgeMessages(context.Background(), 2, 10, 100, ids[2])
+	if err != nil {
+		t.Fatalf("PurgeMessages: %v", err)
+	}
+	if len(result.MessageIDs) != 2 {
+		t.Fatalf("purged %v, want the two messages below the cursor", result.MessageIDs)
+	}
+	for _, id := range ids[2:] {
+		msg, _ := database.GetMessage(context.Background(), id)
+		if msg.Deleted {
+			t.Errorf("message %d at/after the cursor was purged", id)
+		}
+	}
+}
+
+func TestPurgeMessages_ChannelNotFound(t *testing.T) {
+	svc, _ := newPurgeService(t)
+
+	if _, err := svc.PurgeMessages(context.Background(), 2, 9999, 10, 0); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("err = %v, want ErrNotFound", err)
+	}
+	if _, err := svc.PurgeMessages(context.Background(), 2, 0, 10, 0); !errors.Is(err, ErrBadRequest) {
+		t.Fatalf("channel 0: err = %v, want ErrBadRequest", err)
+	}
+}
+
+func TestPurgeMessages_EmptyChannelSucceedsWithNoIDs(t *testing.T) {
+	svc, _ := newPurgeService(t)
+
+	result, err := svc.PurgeMessages(context.Background(), 2, 10, 50, 0)
+	if err != nil {
+		t.Fatalf("PurgeMessages: %v", err)
+	}
+	if result.MessageIDs == nil {
+		t.Fatal("MessageIDs is nil, want an empty slice")
+	}
+	if len(result.MessageIDs) != 0 {
+		t.Fatalf("purged %v, want none", result.MessageIDs)
+	}
+}
+
+func TestPurgeMessages_WritesOneAuditEntry(t *testing.T) {
+	svc, database := newPurgeService(t)
+	seedPurgeMessages(t, database, 10, 4)
+
+	if _, err := svc.PurgeMessages(context.Background(), 2, 10, 4, 0); err != nil {
+		t.Fatalf("PurgeMessages: %v", err)
+	}
+
+	entries, err := database.GetAuditLog(context.Background(), 50, 0)
+	if err != nil {
+		t.Fatalf("GetAuditLog: %v", err)
+	}
+	var purges int
+	for _, e := range entries {
+		if e.Action == "message_purge" {
+			purges++
+			if e.TargetID != 10 {
+				t.Errorf("audit target_id = %d, want the channel id 10", e.TargetID)
+			}
+			if e.Detail == "" {
+				t.Error("audit detail is empty, want the purged count")
+			}
+		}
+	}
+	if purges != 1 {
+		t.Fatalf("wrote %d message_purge audit entries, want exactly 1", purges)
+	}
+}
diff --git a/Server/service/message_query.go b/Server/service/message_query.go
index ef28a5e2..ea9c8d7f 100644
--- a/Server/service/message_query.go
+++ b/Server/service/message_query.go
@@ -4,30 +4,41 @@ import (
 	"context"
 	"fmt"
 	"log/slog"
+	"slices"
 
 	"github.com/owncord/server/db"
 	"github.com/owncord/server/permissions"
 )
 
-// GetMessages retrieves paginated messages for a channel with permission checks.
-func (s *MessageService) GetMessages(ctx context.Context, userID, channelID, before int64, limit int) ([]db.MessageAPIResponse, bool, error) {
+// requireChannelRead resolves a channel and asserts the user may read it: DM
+// membership for a DM, READ_MESSAGES otherwise. A DM the user is not in is
+// reported as ErrNotFound rather than ErrForbidden — its existence is not
+// something an outsider gets to learn.
+func (s *MessageService) requireChannelRead(ctx context.Context, userID, channelID int64) error {
 	if channelID <= 0 {
-		return nil, false, fmt.Errorf("%w: channel_id must be positive", ErrBadRequest)
+		return fmt.Errorf("%w: channel_id must be positive", ErrBadRequest)
 	}
-
 	ch, err := s.st.GetChannel(ctx, channelID)
 	if err != nil || ch == nil {
-		return nil, false, fmt.Errorf("%w: channel not found", ErrNotFound)
+		return fmt.Errorf("%w: channel not found", ErrNotFound)
 	}
-
-	// Permission check.
 	if ch.Type == "dm" {
-		ok, err := s.st.IsDMParticipant(ctx, userID, channelID)
-		if err != nil || !ok {
-			return nil, false, fmt.Errorf("%w: access denied", ErrNotFound)
+		ok, dmErr := s.st.IsDMParticipant(ctx, userID, channelID)
+		if dmErr != nil || !ok {
+			return fmt.Errorf("%w: access denied", ErrNotFound)
 		}
-	} else if !s.perms.HasChannelPerm(ctx, userID, channelID, permissions.ReadMessages) {
-		return nil, false, fmt.Errorf("%w: access denied", ErrForbidden)
+		return nil
+	}
+	if !s.perms.HasChannelPerm(ctx, userID, channelID, permissions.ReadMessages) {
+		return fmt.Errorf("%w: access denied", ErrForbidden)
+	}
+	return nil
+}
+
+// GetMessages retrieves paginated messages for a channel with permission checks.
+func (s *MessageService) GetMessages(ctx context.Context, userID, channelID, before int64, limit int) ([]db.MessageAPIResponse, bool, error) {
+	if err := s.requireChannelRead(ctx, userID, channelID); err != nil {
+		return nil, false, err
 	}
 
 	if limit <= 0 {
@@ -101,22 +112,81 @@ func (s *MessageService) SearchMessages(ctx context.Context, userID int64, query
 	return results, nil
 }
 
+// MessageWindow is a slice of channel history centred on one message, as
+// returned by GetMessagesAround. Messages are ordered oldest-first; the
+// HasMore flags report whether the channel holds further history on each side
+// of the window.
+type MessageWindow struct {
+	Messages      []db.MessageAPIResponse `json:"messages"`
+	HasMoreBefore bool                    `json:"has_more_before"`
+	HasMoreAfter  bool                    `json:"has_more_after"`
+}
+
+// GetMessagesAround retrieves the window of `limit` messages centred on
+// messageID, ordered oldest-first, with the same read gate as GetMessages.
+//
+// The centre message must be a live message in this channel: a message from
+// another channel, one that never existed, or a soft-deleted one (which
+// history omits, so there is no row to centre on) is ErrNotFound.
+func (s *MessageService) GetMessagesAround(ctx context.Context, userID, channelID, messageID int64, limit int) (*MessageWindow, error) {
+	if messageID <= 0 {
+		return nil, fmt.Errorf("%w: message_id must be positive", ErrBadRequest)
+	}
+	if err := s.requireChannelRead(ctx, userID, channelID); err != nil {
+		return nil, err
+	}
+
+	if limit <= 0 {
+		limit = 50
+	}
+	if limit > 100 {
+		limit = 100
+	}
+
+	msg, err := s.st.GetMessage(ctx, messageID)
+	if err != nil {
+		slog.Error("MessageService.GetMessagesAround", "err", err, "message_id", messageID)
+		return nil, fmt.Errorf("%w: failed to fetch message", ErrInternal)
+	}
+	if msg == nil || msg.ChannelID != channelID || msg.Deleted {
+		return nil, fmt.Errorf("%w: message not found in this channel", ErrNotFound)
+	}
+
+	// Half the window sits before the centre, the rest after it; the centre
+	// occupies one slot. Ask for one extra on each side so the has-more flags
+	// come out of the same query instead of two follow-up counts.
+	beforeCount := limit / 2
+	afterCount := limit - beforeCount - 1
+
+	msgs, err := s.st.GetMessagesAroundForAPI(ctx, channelID, messageID, beforeCount+1, afterCount+1, userID)
+	if err != nil {
+		slog.Error("MessageService.GetMessagesAround", "err", err, "channel_id", channelID)
+		return nil, fmt.Errorf("%w: failed to fetch messages", ErrInternal)
+	}
+
+	centreIdx := slices.IndexFunc(msgs, func(m db.MessageAPIResponse) bool { return m.ID == messageID })
+	if centreIdx < 0 {
+		// The centre vanished between the lookup and the window query.
+		return nil, fmt.Errorf("%w: message not found in this channel", ErrNotFound)
+	}
+
+	window := &MessageWindow{Messages: msgs}
+	if centreIdx > beforeCount {
+		window.HasMoreBefore = true
+		window.Messages = window.Messages[centreIdx-beforeCount:]
+		centreIdx = beforeCount
+	}
+	if len(window.Messages)-centreIdx-1 > afterCount {
+		window.HasMoreAfter = true
+		window.Messages = window.Messages[:centreIdx+afterCount+1]
+	}
+	return window, nil
+}
+
 // GetPinnedMessages retrieves pinned messages for a channel.
 func (s *MessageService) GetPinnedMessages(ctx context.Context, userID, channelID int64) ([]db.MessageAPIResponse, error) {
-	if channelID <= 0 {
-		return nil, fmt.Errorf("%w: channel_id must be positive", ErrBadRequest)
-	}
-	ch, err := s.st.GetChannel(ctx, channelID)
-	if err != nil || ch == nil {
-		return nil, fmt.Errorf("%w: channel not found", ErrNotFound)
-	}
-	if ch.Type == "dm" {
-		ok, err := s.st.IsDMParticipant(ctx, userID, channelID)
-		if err != nil || !ok {
-			return nil, fmt.Errorf("%w: access denied", ErrNotFound)
-		}
-	} else if !s.perms.HasChannelPerm(ctx, userID, channelID, permissions.ReadMessages) {
-		return nil, fmt.Errorf("%w: access denied", ErrForbidden)
+	if err := s.requireChannelRead(ctx, userID, channelID); err != nil {
+		return nil, err
 	}
 	msgs, err := s.st.GetPinnedMessages(ctx, channelID, userID)
 	if err != nil {
diff --git a/Server/service/message_reaction_users_test.go b/Server/service/message_reaction_users_test.go
new file mode 100644
index 00000000..9a2a514b
--- /dev/null
+++ b/Server/service/message_reaction_users_test.go
@@ -0,0 +1,183 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/permissions"
+)
+
+// seedReactedMessage posts a message in channel 10 and has each of userIDs
+// react to it with emoji, returning the message id.
+func seedReactedMessage(t *testing.T, svc *MessageService, database *db.DB, emoji string, userIDs ...int64) int64 {
+	t.Helper()
+	msgID, err := database.CreateMessage(context.Background(), 10, 1, "react to me", nil)
+	if err != nil {
+		t.Fatalf("CreateMessage: %v", err)
+	}
+	for _, uid := range userIDs {
+		if _, err := svc.AddReaction(context.Background(), uid, msgID, emoji); err != nil {
+			t.Fatalf("AddReaction(%d): %v", uid, err)
+		}
+	}
+	return msgID
+}
+
+func TestGetReactionUsers_ReturnsReactors(t *testing.T) {
+	svc, database := newTestMessageService(t)
+	seedUser(t, database, &db.User{ID: 2, Username: "bob"})
+	seedUserRole(t, database, 2, permissions.MemberRoleID)
+	msgID := seedReactedMessage(t, svc, database, "👍", 1, 2)
+
+	users, err := svc.GetReactionUsers(context.Background(), 1, 10, msgID, "👍")
+	if err != nil {
+		t.Fatalf("GetReactionUsers: %v", err)
+	}
+	if len(users) != 2 {
+		t.Fatalf("len(users) = %d, want 2 (%+v)", len(users), users)
+	}
+	if users[0].Username != "alice" || users[1].Username != "bob" {
+		t.Errorf("usernames = [%s %s], want [alice bob]", users[0].Username, users[1].Username)
+	}
+}
+
+// An emoji nobody used is an empty list, never nil — the handler serialises it
+// straight to JSON and `null` is not a list the client can iterate.
+func TestGetReactionUsers_EmptyIsNonNil(t *testing.T) {
+	svc, database := newTestMessageService(t)
+	msgID := seedReactedMessage(t, svc, database, "👍", 1)
+
+	users, err := svc.GetReactionUsers(context.Background(), 1, 10, msgID, "🎉")
+	if err != nil {
+		t.Fatalf("GetReactionUsers: %v", err)
+	}
+	if users == nil {
+		t.Fatal("users = nil, want an empty slice")
+	}
+	if len(users) != 0 {
+		t.Errorf("len(users) = %d, want 0", len(users))
+	}
+}
+
+// Reading the reactor list is gated by the same READ_MESSAGES check as reading
+// the channel's history: a reaction pill must not leak who is in a channel the
+// caller cannot see.
+func TestGetReactionUsers_ForbiddenWithoutReadPermission(t *testing.T) {
+	svc, database := newTestMessageService(t)
+	msgID := seedReactedMessage(t, svc, database, "👍", 1)
+
+	seedRole(t, database, &db.Role{ID: 90, Name: "outsider", Permissions: 0, Position: 1})
+	seedUser(t, database, &db.User{ID: 3, Username: "outsider"})
+	seedUserRole(t, database, 3, 90)
+
+	_, err := svc.GetReactionUsers(context.Background(), 3, 10, msgID, "👍")
+	if !errors.Is(err, ErrForbidden) {
+		t.Fatalf("err = %v, want ErrForbidden", err)
+	}
+}
+
+// The channel in the URL is what the permission check ran against, so a message
+// that lives elsewhere must not be answered from that check.
+func TestGetReactionUsers_MessageInAnotherChannelIsNotFound(t *testing.T) {
+	svc, database := newTestMessageService(t)
+	seedChannel(t, database, &db.Channel{ID: 11, Name: "other", Type: "text"})
+	msgID := seedReactedMessage(t, svc, database, "👍", 1)
+
+	_, err := svc.GetReactionUsers(context.Background(), 1, 11, msgID, "👍")
+	if !errors.Is(err, ErrNotFound) {
+		t.Fatalf("err = %v, want ErrNotFound", err)
+	}
+}
+
+func TestGetReactionUsers_RejectsBadInput(t *testing.T) {
+	svc, database := newTestMessageService(t)
+	msgID := seedReactedMessage(t, svc, database, "👍", 1)
+
+	tests := []struct {
+		name    string
+		msgID   int64
+		emoji   string
+		wantErr error
+	}{
+		{"zero message id", 0, "👍", ErrBadRequest},
+		{"negative message id", -5, "👍", ErrBadRequest},
+		{"empty emoji", msgID, "", ErrBadRequest},
+		// The cap is derived from MaxShortcodeLen + 2, so a bare ":wave:"-shaped
+		// string at that exact length must pass and one rune more must not.
+		{"overlong emoji", msgID, strings.Repeat("a", MaxShortcodeLen+3), ErrBadRequest},
+		{"control character", msgID, "a\x01b", ErrBadRequest},
+		{"unknown message", 999999, "👍", ErrNotFound},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := svc.GetReactionUsers(context.Background(), 1, 10, tt.msgID, tt.emoji)
+			if !errors.Is(err, tt.wantErr) {
+				t.Fatalf("err = %v, want %v", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+// A DM the caller is not a participant of is reported as not-found (matching
+// requireChannelRead), so its existence stays hidden.
+func TestGetReactionUsers_ForeignDMIsNotFound(t *testing.T) {
+	svc, database := newTestMessageService(t)
+	seedUser(t, database, &db.User{ID: 2, Username: "bob"})
+	seedUser(t, database, &db.User{ID: 3, Username: "carol"})
+	seedUserRole(t, database, 2, permissions.MemberRoleID)
+	seedUserRole(t, database, 3, permissions.MemberRoleID)
+
+	ch, _, err := database.GetOrCreateDMChannel(context.Background(), 2, 3)
+	if err != nil {
+		t.Fatalf("GetOrCreateDMChannel: %v", err)
+	}
+	msgID, err := database.CreateMessage(context.Background(), ch.ID, 2, "psst", nil)
+	if err != nil {
+		t.Fatalf("CreateMessage: %v", err)
+	}
+	if _, err := svc.AddReaction(context.Background(), 3, msgID, "👍"); err != nil {
+		t.Fatalf("AddReaction: %v", err)
+	}
+
+	if _, err := svc.GetReactionUsers(context.Background(), 1, ch.ID, msgID, "👍"); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("err = %v, want ErrNotFound", err)
+	}
+	// A participant does get the list.
+	users, err := svc.GetReactionUsers(context.Background(), 2, ch.ID, msgID, "👍")
+	if err != nil {
+		t.Fatalf("GetReactionUsers(participant): %v", err)
+	}
+	if len(users) != 1 || users[0].Username != "carol" {
+		t.Errorf("users = %+v, want [carol]", users)
+	}
+}
+
+// A custom emoji is reacted with as its ":shortcode:" literal, so the longest
+// shortcode the emoji service will accept has to fit inside the reaction length
+// cap. Before the cap was derived from MaxShortcodeLen, a 31- or 32-character
+// shortcode produced an emoji that rendered in messages but was silently
+// refused as a reaction.
+func TestReaction_AcceptsLongestCustomShortcode(t *testing.T) {
+	svc, database := newTestMessageService(t)
+	msgID, err := database.CreateMessage(context.Background(), 10, 1, "react to me", nil)
+	if err != nil {
+		t.Fatalf("CreateMessage: %v", err)
+	}
+
+	longest := ":" + strings.Repeat("a", MaxShortcodeLen) + ":"
+	if _, vErr := ValidateShortcode(longest); vErr != nil {
+		t.Fatalf("the emoji service would refuse %q: %v", longest, vErr)
+	}
+	if _, rErr := svc.AddReaction(context.Background(), 1, msgID, longest); rErr != nil {
+		t.Fatalf("AddReaction(longest shortcode): %v", rErr)
+	}
+
+	// One rune past it is still refused.
+	tooLong := ":" + strings.Repeat("a", MaxShortcodeLen+1) + ":"
+	if _, rErr := svc.AddReaction(context.Background(), 1, msgID, tooLong); !errors.Is(rErr, ErrBadRequest) {
+		t.Fatalf("AddReaction(one past the cap) = %v, want ErrBadRequest", rErr)
+	}
+}
diff --git a/Server/service/message_reactions.go b/Server/service/message_reactions.go
index 915c2bd8..16234fa8 100644
--- a/Server/service/message_reactions.go
+++ b/Server/service/message_reactions.go
@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"github.com/owncord/server/auth"
+	"github.com/owncord/server/db"
 	"github.com/owncord/server/permissions"
 )
 
@@ -20,6 +21,65 @@ func (s *MessageService) RemoveReaction(ctx context.Context, userID, msgID int64
 	return s.handleReaction(ctx, userID, msgID, emoji, false)
 }
 
+// GetReactionUsers returns the users who reacted to msgID with emoji, capped at
+// db.MaxReactionUsers. Gated by the same read check as fetching the channel's
+// history, so a reaction pill never leaks membership of a channel the caller
+// cannot read. The message must live in channelID — the URL's channel is what
+// the permission check ran against, so a mismatch is a not-found, not a
+// silently-broader lookup.
+func (s *MessageService) GetReactionUsers(ctx context.Context, userID, channelID, msgID int64, emoji string) ([]db.ReactionUser, error) {
+	if msgID <= 0 {
+		return nil, fmt.Errorf("%w: message_id must be positive", ErrBadRequest)
+	}
+	if err := validateEmoji(emoji); err != nil {
+		return nil, err
+	}
+	if err := s.requireChannelRead(ctx, userID, channelID); err != nil {
+		return nil, err
+	}
+
+	msg, err := s.st.GetMessage(ctx, msgID)
+	if err != nil || msg == nil || msg.ChannelID != channelID {
+		return nil, fmt.Errorf("%w: message not found", ErrNotFound)
+	}
+
+	users, err := s.st.GetReactionUsers(ctx, msgID, emoji, db.MaxReactionUsers)
+	if err != nil {
+		slog.Error("MessageService.GetReactionUsers", "err", err, "msg_id", msgID)
+		return nil, fmt.Errorf("%w: failed to fetch reaction users", ErrInternal)
+	}
+	if users == nil {
+		users = []db.ReactionUser{}
+	}
+	return users, nil
+}
+
+// maxReactionRunes bounds a reaction string. Reactions are free-form text, so
+// the ceiling has to clear the longest thing a client can legitimately react
+// with: a custom emoji is stored as its ":shortcode:" literal, which is
+// MaxShortcodeLen plus the two colons. Deriving it keeps the two from drifting
+// into an emoji that renders in a message but is silently refused as a
+// reaction. Unicode emoji, even long ZWJ sequences, sit far below this.
+const maxReactionRunes = MaxShortcodeLen + 2
+
+// validateEmoji applies the shared shape rules for a reaction emoji: non-empty,
+// at most maxReactionRunes runes, no control characters, and unchanged by the
+// sanitizer.
+func validateEmoji(emoji string) error {
+	if emoji == "" || len([]rune(emoji)) > maxReactionRunes {
+		return fmt.Errorf("%w: invalid emoji", ErrBadRequest)
+	}
+	for _, r := range emoji {
+		if r <= 0x1F || r == 0x7F {
+			return fmt.Errorf("%w: emoji contains control characters", ErrBadRequest)
+		}
+	}
+	if sanitizer.Sanitize(emoji) != emoji {
+		return fmt.Errorf("%w: emoji contains unsafe content", ErrBadRequest)
+	}
+	return nil
+}
+
 func (s *MessageService) handleReaction(ctx context.Context, userID, msgID int64, emoji string, add bool) (*ReactionResult, error) {
 	// Rate limit.
 	ratKey := auth.Key("reaction", userID)
@@ -30,18 +90,8 @@ func (s *MessageService) handleReaction(ctx context.Context, userID, msgID int64
 	if msgID <= 0 {
 		return nil, fmt.Errorf("%w: message_id must be positive", ErrBadRequest)
 	}
-	if emoji == "" || len([]rune(emoji)) > 32 {
-		return nil, fmt.Errorf("%w: invalid emoji", ErrBadRequest)
-	}
-	// Reject control characters.
-	for _, r := range emoji {
-		if r <= 0x1F || r == 0x7F {
-			return nil, fmt.Errorf("%w: emoji contains control characters", ErrBadRequest)
-		}
-	}
-	// Sanitize check.
-	if sanitizer.Sanitize(emoji) != emoji {
-		return nil, fmt.Errorf("%w: emoji contains unsafe content", ErrBadRequest)
+	if err := validateEmoji(emoji); err != nil {
+		return nil, err
 	}
 
 	msg, err := s.st.GetMessage(ctx, msgID)
diff --git a/Server/service/moderation.go b/Server/service/moderation.go
index b4545f52..93400fa6 100644
--- a/Server/service/moderation.go
+++ b/Server/service/moderation.go
@@ -22,38 +22,62 @@ func NewModerationService(st Store, perms *PermissionService) *ModerationService
 	return &ModerationService{st: st, perms: perms}
 }
 
-// requireBanPermission verifies the actor holds BAN_MEMBERS (or the
-// Administrator bypass). It deliberately takes no target: it runs before any
-// target lookup so an actor without ban authority always sees Forbidden and
-// never NotFound — the ban path cannot be used to enumerate user ids.
-func (s *ModerationService) requireBanPermission(ctx context.Context, actorID int64) error {
+// roleFor loads a principal's role through the permission cache. Every failure
+// is Forbidden: an unresolvable role must never authorize a moderation action.
+// The which argument names the principal in the error message ("actor" or
+// "target").
+func (s *ModerationService) roleFor(ctx context.Context, userID int64, which string) (*db.Role, error) {
 	if s.perms == nil {
-		// No permission service wired — fail closed rather than allow unchecked bans.
-		return fmt.Errorf("%w: permission service unavailable", ErrForbidden)
+		// No permission service wired — fail closed rather than allow unchecked actions.
+		return nil, fmt.Errorf("%w: permission service unavailable", ErrForbidden)
 	}
-	actorRole, err := s.perms.GetRoleForUser(ctx, actorID)
-	if err != nil || actorRole == nil {
-		return fmt.Errorf("%w: failed to load actor role", ErrForbidden)
+	role, err := s.perms.GetRoleForUser(ctx, userID)
+	if err != nil || role == nil {
+		return nil, fmt.Errorf("%w: failed to load %s role", ErrForbidden, which)
 	}
-	if !permissions.HasServerPerm(actorRole.Permissions, permissions.BanMembers) {
-		return fmt.Errorf("%w: missing BAN_MEMBERS permission", ErrForbidden)
+	return role, nil
+}
+
+// requirePerm verifies the actor holds perm (or the Administrator bypass) and
+// returns the actor's role for follow-up hierarchy checks. It deliberately
+// takes no target: it runs before any target lookup so an actor without
+// authority always sees Forbidden and never NotFound — these paths cannot be
+// used to enumerate user ids.
+func (s *ModerationService) requirePerm(ctx context.Context, actorID, perm int64) (*db.Role, error) {
+	actorRole, err := s.roleFor(ctx, actorID, "actor")
+	if err != nil {
+		return nil, err
 	}
-	return nil
+	if !permissions.HasServerPerm(actorRole.Permissions, perm) {
+		return nil, fmt.Errorf("%w: missing %s permission", ErrForbidden, permissions.Name(perm))
+	}
+	return actorRole, nil
+}
+
+// requireBanPermission verifies the actor holds BAN_MEMBERS. See requirePerm.
+func (s *ModerationService) requireBanPermission(ctx context.Context, actorID int64) error {
+	_, err := s.requirePerm(ctx, actorID, permissions.BanMembers)
+	return err
 }
 
 // requireOutranks enforces the role hierarchy: the actor must strictly
-// outrank the target so a user cannot ban a peer or a higher-ranked user
+// outrank the target so a user cannot moderate a peer or a higher-ranked user
 // (e.g. the owner) — mirroring the position-based hierarchy used elsewhere.
-// Runs after requireBanPermission and the existence check, so only callers
-// that already hold ban authority reach it.
+// Runs after the permission and existence checks, so only callers that already
+// hold authority reach it.
 func (s *ModerationService) requireOutranks(ctx context.Context, actorID, targetID int64) error {
-	actorRole, err := s.perms.GetRoleForUser(ctx, actorID)
-	if err != nil || actorRole == nil {
-		return fmt.Errorf("%w: failed to load actor role", ErrForbidden)
+	actorRole, err := s.roleFor(ctx, actorID, "actor")
+	if err != nil {
+		return err
 	}
-	targetRole, err := s.perms.GetRoleForUser(ctx, targetID)
-	if err != nil || targetRole == nil {
-		return fmt.Errorf("%w: failed to load target role", ErrForbidden)
+	return s.requireOutranksRole(ctx, actorRole, targetID)
+}
+
+// requireOutranksRole is requireOutranks with the actor's role already loaded.
+func (s *ModerationService) requireOutranksRole(ctx context.Context, actorRole *db.Role, targetID int64) error {
+	targetRole, err := s.roleFor(ctx, targetID, "target")
+	if err != nil {
+		return err
 	}
 	if actorRole.Position <= targetRole.Position {
 		return fmt.Errorf("%w: cannot moderate a user of equal or higher rank", ErrForbidden)
@@ -106,6 +130,93 @@ func (s *ModerationService) BanUser(ctx context.Context, actorID, targetID int64
 	return nil
 }
 
+// ChangeUserRole assigns newRoleID to the target user. It enforces
+// MANAGE_ROLES plus two hierarchy rules the admin panel previously had none
+// of: the actor must strictly outrank the target, and may not hand out a role
+// positioned at or above their own — otherwise any admin could promote anyone
+// (including themselves via a second account) to Owner.
+func (s *ModerationService) ChangeUserRole(ctx context.Context, actorID, targetID, newRoleID int64) error {
+	if targetID <= 0 {
+		return fmt.Errorf("%w: user_id must be positive", ErrBadRequest)
+	}
+	if actorID == targetID {
+		return fmt.Errorf("%w: cannot change your own role", ErrBadRequest)
+	}
+
+	// Authorization before existence — see BanUser.
+	actorRole, err := s.requirePerm(ctx, actorID, permissions.ManageRoles)
+	if err != nil {
+		return err
+	}
+	target, err := s.st.GetUserByID(ctx, targetID)
+	if err != nil || target == nil {
+		return fmt.Errorf("%w: user not found", ErrNotFound)
+	}
+	if err := s.requireOutranksRole(ctx, actorRole, targetID); err != nil {
+		return err
+	}
+
+	newRole, err := s.st.GetRoleByID(ctx, newRoleID)
+	if err != nil || newRole == nil {
+		return fmt.Errorf("%w: role not found", ErrBadRequest)
+	}
+	// Administrator bypasses permission bits, never the hierarchy: the owner
+	// role is above every admin, so only the owner can grant it.
+	if newRole.Position >= actorRole.Position {
+		return fmt.Errorf("%w: cannot assign a role at or above your own rank", ErrForbidden)
+	}
+
+	if err := s.st.UpdateUserRole(ctx, targetID, newRoleID); err != nil {
+		return fmt.Errorf("%w: failed to update role: %v", ErrInternal, err)
+	}
+	// Drop the target's cached role immediately: without this a demotion keeps
+	// granting the old bits (and the old rank) for up to permCacheTTL.
+	s.perms.InvalidateUser(targetID)
+
+	// Audit rows must survive a request canceled after the update committed.
+	db.WriteAudit(context.WithoutCancel(ctx), s.st, actorID, "role_change", "user", targetID,
+		fmt.Sprintf("changed %s role to %s", target.Username, newRole.Name))
+
+	slog.Info("role changed", "actor_id", actorID, "target_id", targetID, "new_role_id", newRoleID)
+	return nil
+}
+
+// ForceLogout revokes every session of the target user (the client's "Kick").
+// Gated on KICK_MEMBERS plus the same hierarchy rule as ban, so a moderator
+// cannot log out an admin or the owner.
+func (s *ModerationService) ForceLogout(ctx context.Context, actorID, targetID int64) error {
+	if targetID <= 0 {
+		return fmt.Errorf("%w: user_id must be positive", ErrBadRequest)
+	}
+	if actorID == targetID {
+		return fmt.Errorf("%w: cannot force-logout yourself", ErrBadRequest)
+	}
+
+	// Authorization before existence — see BanUser.
+	actorRole, err := s.requirePerm(ctx, actorID, permissions.KickMembers)
+	if err != nil {
+		return err
+	}
+	target, err := s.st.GetUserByID(ctx, targetID)
+	if err != nil || target == nil {
+		return fmt.Errorf("%w: user not found", ErrNotFound)
+	}
+	if err := s.requireOutranksRole(ctx, actorRole, targetID); err != nil {
+		return err
+	}
+
+	if err := s.st.ForceLogoutUser(ctx, targetID); err != nil {
+		return fmt.Errorf("%w: failed to log out user: %v", ErrInternal, err)
+	}
+
+	// Audit rows must survive a request canceled after the sessions were cut.
+	db.WriteAudit(context.WithoutCancel(ctx), s.st, actorID, "force_logout", "user", targetID,
+		"all sessions terminated")
+
+	slog.Info("force logout", "actor_id", actorID, "target_id", targetID)
+	return nil
+}
+
 // UnbanUser removes a ban on a target user.
 func (s *ModerationService) UnbanUser(ctx context.Context, actorID, targetID int64) error {
 	if targetID <= 0 {
diff --git a/Server/service/moderation_test.go b/Server/service/moderation_test.go
index 2f0cf36b..f7e086ea 100644
--- a/Server/service/moderation_test.go
+++ b/Server/service/moderation_test.go
@@ -82,6 +82,166 @@ func TestBanUser_AuthorizedSucceeds(t *testing.T) {
 	}
 }
 
+// newTestRoleService seeds a four-rank hierarchy for the role-assignment and
+// force-logout paths: owner (pos 100, Administrator) > admin (pos 80,
+// Administrator) > mod (pos 60, MANAGE_ROLES+KICK_MEMBERS) > member (pos 40).
+// Users: 1=owner, 2=admin, 3=mod, 4=member, 5=member.
+func newTestRoleService(t *testing.T) (*ModerationService, *db.DB) {
+	t.Helper()
+	database := newTestDB(t)
+	seedRole(t, database, &db.Role{ID: 1, Name: "owner", Permissions: permissions.Administrator, Position: 100})
+	seedRole(t, database, &db.Role{ID: 2, Name: "admin", Permissions: permissions.Administrator, Position: 80})
+	seedRole(t, database, &db.Role{ID: 3, Name: "mod",
+		Permissions: permissions.ManageRoles | permissions.KickMembers, Position: 60})
+	seedRole(t, database, &db.Role{ID: 4, Name: "member", Permissions: permissions.SendMessages, Position: 40})
+	for userID, roleID := range map[int64]int64{1: 1, 2: 2, 3: 3, 4: 4, 5: 4} {
+		seedUser(t, database, &db.User{ID: userID, Username: fmt.Sprintf("u%d", userID), Status: "offline"})
+		seedUserRole(t, database, userID, roleID)
+	}
+	checker := permissions.NewChecker(database)
+	return NewModerationService(database, NewPermissionService(database, checker)), database
+}
+
+func roleIDOf(t *testing.T, database *db.DB, userID int64) int64 {
+	t.Helper()
+	user, err := database.GetUserByID(context.Background(), userID)
+	if err != nil || user == nil {
+		t.Fatalf("GetUserByID(%d): %v", userID, err)
+	}
+	return user.RoleID
+}
+
+func TestChangeUserRole_RequiresManageRoles(t *testing.T) {
+	svc, database := newTestRoleService(t)
+
+	// A member without MANAGE_ROLES is refused...
+	if err := svc.ChangeUserRole(context.Background(), 4, 5, 3); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("member role change: want ErrForbidden, got %v", err)
+	}
+	// ...and gets Forbidden, not NotFound, for a missing target.
+	if err := svc.ChangeUserRole(context.Background(), 4, 999, 3); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("unauthorized probe of missing id: want ErrForbidden, got %v", err)
+	}
+	if got := roleIDOf(t, database, 5); got != 4 {
+		t.Fatalf("target role changed to %d despite refusal", got)
+	}
+}
+
+func TestChangeUserRole_CannotAssignAtOrAboveOwnRank(t *testing.T) {
+	svc, database := newTestRoleService(t)
+
+	// The hole this closes: an Administrator could promote anyone to Owner.
+	if err := svc.ChangeUserRole(context.Background(), 2, 4, 1); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("admin promoting to owner: want ErrForbidden, got %v", err)
+	}
+	// Equal rank is refused too — an admin cannot mint another admin.
+	if err := svc.ChangeUserRole(context.Background(), 2, 4, 2); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("admin assigning own rank: want ErrForbidden, got %v", err)
+	}
+	if got := roleIDOf(t, database, 4); got != 4 {
+		t.Fatalf("member role changed to %d despite refusal", got)
+	}
+	// Strictly below own rank is allowed.
+	if err := svc.ChangeUserRole(context.Background(), 2, 4, 3); err != nil {
+		t.Fatalf("admin promoting to mod: %v", err)
+	}
+	if got := roleIDOf(t, database, 4); got != 3 {
+		t.Fatalf("role after promotion = %d, want 3", got)
+	}
+	// The owner outranks the admin role, so the owner may grant it.
+	if err := svc.ChangeUserRole(context.Background(), 1, 5, 2); err != nil {
+		t.Fatalf("owner promoting to admin: %v", err)
+	}
+}
+
+func TestChangeUserRole_HierarchyAndValidation(t *testing.T) {
+	svc, database := newTestRoleService(t)
+
+	// A moderator holding MANAGE_ROLES still cannot touch a higher-ranked user.
+	if err := svc.ChangeUserRole(context.Background(), 3, 2, 4); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("mod demoting an admin: want ErrForbidden, got %v", err)
+	}
+	if got := roleIDOf(t, database, 2); got != 2 {
+		t.Fatalf("admin role changed to %d despite refusal", got)
+	}
+	// Nor the owner.
+	if err := svc.ChangeUserRole(context.Background(), 3, 1, 4); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("mod demoting the owner: want ErrForbidden, got %v", err)
+	}
+	// Self-service promotion is a bad request regardless of authority.
+	if err := svc.ChangeUserRole(context.Background(), 2, 2, 1); !errors.Is(err, ErrBadRequest) {
+		t.Fatalf("self role change: want ErrBadRequest, got %v", err)
+	}
+	// A nonexistent role is a bad request, not a 500.
+	if err := svc.ChangeUserRole(context.Background(), 1, 4, 9999); !errors.Is(err, ErrBadRequest) {
+		t.Fatalf("unknown role id: want ErrBadRequest, got %v", err)
+	}
+	// Authorized actor gets a real NotFound for a missing target.
+	if err := svc.ChangeUserRole(context.Background(), 1, 999, 4); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("missing target: want ErrNotFound, got %v", err)
+	}
+}
+
+func TestChangeUserRole_AuditWritten(t *testing.T) {
+	svc, database := newTestRoleService(t)
+
+	if err := svc.ChangeUserRole(context.Background(), 1, 4, 3); err != nil {
+		t.Fatalf("owner role change: %v", err)
+	}
+	entries, err := database.GetAuditLog(context.Background(), 10, 0)
+	if err != nil {
+		t.Fatalf("GetAuditLog: %v", err)
+	}
+	found := false
+	for _, e := range entries {
+		if e.Action == "role_change" && e.TargetID == 4 && e.ActorID == 1 {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("no role_change audit entry, got %+v", entries)
+	}
+}
+
+func TestForceLogout_AuthorizationMatrix(t *testing.T) {
+	svc, database := newTestRoleService(t)
+
+	ctx := context.Background()
+	if _, err := database.CreateSession(ctx, 4, "victim-hash", "web", "127.0.0.1"); err != nil {
+		t.Fatalf("CreateSession: %v", err)
+	}
+
+	// No KICK_MEMBERS → Forbidden (member 5 targeting member 4).
+	if err := svc.ForceLogout(ctx, 5, 4); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("member force-logout: want ErrForbidden, got %v", err)
+	}
+	// Holding KICK_MEMBERS is not enough against a higher rank.
+	if err := svc.ForceLogout(ctx, 3, 2); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("mod force-logout of admin: want ErrForbidden, got %v", err)
+	}
+	// Self is a bad request.
+	if err := svc.ForceLogout(ctx, 3, 3); !errors.Is(err, ErrBadRequest) {
+		t.Fatalf("self force-logout: want ErrBadRequest, got %v", err)
+	}
+	sessions, _ := database.GetUserSessions(ctx, 4)
+	if len(sessions) != 1 {
+		t.Fatalf("sessions = %d before an authorized call, want 1", len(sessions))
+	}
+
+	// Authorized: mod outranks member and holds KICK_MEMBERS.
+	if err := svc.ForceLogout(ctx, 3, 4); err != nil {
+		t.Fatalf("authorized force-logout: %v", err)
+	}
+	sessions, _ = database.GetUserSessions(ctx, 4)
+	if len(sessions) != 0 {
+		t.Fatalf("sessions = %d after force logout, want 0", len(sessions))
+	}
+	// Authorized actor gets a real NotFound for a missing target.
+	if err := svc.ForceLogout(ctx, 3, 999); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("missing target: want ErrNotFound, got %v", err)
+	}
+}
+
 func TestUnbanUser_AuthorizationMatrix(t *testing.T) {
 	svc, database := newTestModerationService(t)
 
diff --git a/Server/service/permission.go b/Server/service/permission.go
index 97b05cd8..f4f26373 100644
--- a/Server/service/permission.go
+++ b/Server/service/permission.go
@@ -148,10 +148,13 @@ func (s *PermissionService) getOrPopulate(ctx context.Context, userID int64) *ca
 		return nil
 	}
 	// Admins bypass every channel check, so skip the fetch entirely (mirrors
-	// ChannelService.ListVisibleChannels and ws.buildReady).
+	// ChannelService.ListVisibleChannels and ws.buildReady). The fetch pulls
+	// BOTH override layers (role + per-user) in two batch queries, so the
+	// cached snapshot can answer the full Discord resolution order without an
+	// extra query per channel.
 	var overrides map[int64]permissions.ChannelOverride
 	if !permissions.HasAdmin(role.Permissions) {
-		raw, oErr := s.st.GetAllChannelPermissionsForRole(ctx, role.ID)
+		raw, oErr := s.st.GetChannelOverridesFor(ctx, role.ID, userID)
 		if oErr != nil {
 			// Fail closed: an empty map would silently drop every deny bit,
 			// and caching it would keep doing so for permCacheTTL.
diff --git a/Server/service/permission_test.go b/Server/service/permission_test.go
index 1c56ae7a..28e55692 100644
--- a/Server/service/permission_test.go
+++ b/Server/service/permission_test.go
@@ -22,6 +22,12 @@ func (errOverrideStore) GetAllChannelPermissionsForRole(context.Context, int64)
 	return nil, errors.New("boom")
 }
 
+// GetChannelOverridesFor is the merged role+user fetch every visibility site
+// now uses. It must fail closed for exactly the same reason.
+func (errOverrideStore) GetChannelOverridesFor(context.Context, int64, int64) (map[int64]db.ChannelOverride, error) {
+	return nil, errors.New("boom")
+}
+
 // TestHasChannelPerm_OverrideFetchErrorDenies locks the fail-closed rule: when
 // the override fetch errors we must NOT substitute an empty map, because that
 // restores every bit a channel-level deny had stripped — and PermissionService
diff --git a/Server/service/profile_fields_test.go b/Server/service/profile_fields_test.go
new file mode 100644
index 00000000..0e9f3304
--- /dev/null
+++ b/Server/service/profile_fields_test.go
@@ -0,0 +1,203 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/permissions"
+)
+
+// Phase 6 profile fields. The rules that matter here are the ones a handler
+// could plausibly skip: sanitization, the length bounds, "omitted means
+// unchanged", and "empty means cleared". They live in the service precisely so
+// every transport gets them, so they are tested against the service.
+
+func newUserSvc(t *testing.T) (*UserService, *db.DB) {
+	t.Helper()
+	database := newTestDB(t)
+	seedUser(t, database, &db.User{ID: 1, Username: "ada", PasswordHash: "h"})
+	return NewUserService(database), database
+}
+
+func TestUpdateProfile_SetsAndClearsDisplayNameAndAbout(t *testing.T) {
+	svc, _ := newUserSvc(t)
+	ctx := context.Background()
+
+	name, about := "Ada L.", "counts on it"
+	u, err := svc.UpdateProfile(ctx, 1, ProfilePatch{Username: "ada", DisplayName: &name, About: &about})
+	if err != nil {
+		t.Fatalf("UpdateProfile: %v", err)
+	}
+	if u.DisplayName == nil || *u.DisplayName != name {
+		t.Fatalf("display_name = %v, want %q", u.DisplayName, name)
+	}
+	if u.About == nil || *u.About != about {
+		t.Fatalf("about = %v, want %q", u.About, about)
+	}
+
+	// A patch that mentions neither field must leave both standing — the
+	// update writes every column, so this is the merge doing its job.
+	u, err = svc.UpdateProfile(ctx, 1, ProfilePatch{Username: "ada"})
+	if err != nil {
+		t.Fatalf("UpdateProfile (username only): %v", err)
+	}
+	if u.DisplayName == nil || u.About == nil {
+		t.Fatalf("a username-only patch cleared other fields: %v / %v", u.DisplayName, u.About)
+	}
+
+	// An explicit empty string clears.
+	empty := ""
+	u, err = svc.UpdateProfile(ctx, 1, ProfilePatch{Username: "ada", DisplayName: &empty, About: &empty})
+	if err != nil {
+		t.Fatalf("UpdateProfile (clear): %v", err)
+	}
+	if u.DisplayName != nil || u.About != nil {
+		t.Fatalf("expected cleared, got %v / %v", u.DisplayName, u.About)
+	}
+}
+
+func TestUpdateProfile_SanitizesAndTrims(t *testing.T) {
+	svc, _ := newUserSvc(t)
+	name := "  <b>Ada</b>  "
+	about := "<script>alert(1)</script>hello"
+	u, err := svc.UpdateProfile(context.Background(), 1, ProfilePatch{
+		Username: "ada", DisplayName: &name, About: &about,
+	})
+	if err != nil {
+		t.Fatalf("UpdateProfile: %v", err)
+	}
+	if u.DisplayName == nil || *u.DisplayName != "Ada" {
+		t.Errorf("display_name = %v, want %q", u.DisplayName, "Ada")
+	}
+	if u.About == nil || strings.Contains(*u.About, "<") {
+		t.Errorf("about = %v, want markup stripped", u.About)
+	}
+}
+
+func TestUpdateProfile_RejectsOverlongFields(t *testing.T) {
+	svc, _ := newUserSvc(t)
+	ctx := context.Background()
+
+	tooLongName := strings.Repeat("a", MaxDisplayNameLen+1)
+	if _, err := svc.UpdateProfile(ctx, 1, ProfilePatch{Username: "ada", DisplayName: &tooLongName}); !errors.Is(err, ErrBadRequest) {
+		t.Errorf("overlong display_name err = %v, want ErrBadRequest", err)
+	}
+	tooLongAbout := strings.Repeat("b", MaxAboutLen+1)
+	if _, err := svc.UpdateProfile(ctx, 1, ProfilePatch{Username: "ada", About: &tooLongAbout}); !errors.Is(err, ErrBadRequest) {
+		t.Errorf("overlong about err = %v, want ErrBadRequest", err)
+	}
+
+	// Exactly at the bound is accepted, and the bound counts runes rather than
+	// bytes — otherwise a name in a non-Latin script would be a third as long.
+	atBound := strings.Repeat("é", MaxDisplayNameLen)
+	if _, err := svc.UpdateProfile(ctx, 1, ProfilePatch{Username: "ada", DisplayName: &atBound}); err != nil {
+		t.Errorf("display_name at bound rejected: %v", err)
+	}
+}
+
+func TestSetCustomStatus_RoundTripClearAndBound(t *testing.T) {
+	svc, database := newUserSvc(t)
+	ctx := context.Background()
+
+	if err := svc.SetCustomStatus(ctx, 1, "  <i>debugging</i>  "); err != nil {
+		t.Fatalf("SetCustomStatus: %v", err)
+	}
+	u, _ := database.GetUserByID(ctx, 1)
+	if u.CustomStatus == nil || *u.CustomStatus != "debugging" {
+		t.Fatalf("custom_status = %v, want sanitized+trimmed %q", u.CustomStatus, "debugging")
+	}
+
+	if err := svc.SetCustomStatus(ctx, 1, "   "); err != nil {
+		t.Fatalf("SetCustomStatus (blank): %v", err)
+	}
+	u, _ = database.GetUserByID(ctx, 1)
+	if u.CustomStatus != nil {
+		t.Fatalf("whitespace-only text should clear, got %q", *u.CustomStatus)
+	}
+
+	if err := svc.SetCustomStatus(ctx, 1, strings.Repeat("x", MaxCustomStatusLen+1)); !errors.Is(err, ErrBadRequest) {
+		t.Errorf("overlong custom_status err = %v, want ErrBadRequest", err)
+	}
+}
+
+func TestClearCustomStatus(t *testing.T) {
+	svc, database := newUserSvc(t)
+	ctx := context.Background()
+	if err := svc.SetCustomStatus(ctx, 1, "afk"); err != nil {
+		t.Fatalf("SetCustomStatus: %v", err)
+	}
+	if err := svc.ClearCustomStatus(ctx, 1); err != nil {
+		t.Fatalf("ClearCustomStatus: %v", err)
+	}
+	u, _ := database.GetUserByID(ctx, 1)
+	if u.CustomStatus != nil {
+		t.Fatalf("custom_status = %q, want nil", *u.CustomStatus)
+	}
+}
+
+func TestAvatarFileURL(t *testing.T) {
+	if got := AvatarFileURL("abc"); got != "/api/v1/files/abc" {
+		t.Errorf("AvatarFileURL = %q", got)
+	}
+}
+
+func TestHandlePresenceUpdate_AcceptsInvisibleAndCarriesCustomStatus(t *testing.T) {
+	database := newTestDB(t)
+	seedUser(t, database, &db.User{ID: 1, Username: "ada", PasswordHash: "h"})
+	svc := NewChannelService(database, NewPermissionService(database, permissions.NewChecker(database)))
+	ctx := context.Background()
+
+	text := "  <b>away</b>  "
+	got, err := svc.HandlePresenceUpdate(ctx, 1, db.StatusInvisible, &text, nil)
+	if err != nil {
+		t.Fatalf("HandlePresenceUpdate: %v", err)
+	}
+	if got == nil || *got != "away" {
+		t.Fatalf("returned custom status = %v, want sanitized %q", got, "away")
+	}
+	u, _ := database.GetUserByID(ctx, 1)
+	// Stored as chosen — the invisible -> offline collapse is a broadcast-time
+	// concern, and storing it collapsed would make the next connect unable to
+	// tell "appear offline" from "not connected".
+	if u.Status != db.StatusInvisible {
+		t.Fatalf("stored status = %q, want invisible", u.Status)
+	}
+
+	// A later status flip that carries no custom_status field must leave the
+	// text alone AND still put it on the wire, or the auto-idle timer would
+	// blank everyone else's copy several times an hour.
+	got, err = svc.HandlePresenceUpdate(ctx, 1, db.StatusIdle, nil, nil)
+	if err != nil {
+		t.Fatalf("HandlePresenceUpdate (bare): %v", err)
+	}
+	if got == nil || *got != "away" {
+		t.Fatalf("bare status flip returned %v, want the stored %q", got, "away")
+	}
+	u, _ = database.GetUserByID(ctx, 1)
+	if u.CustomStatus == nil || *u.CustomStatus != "away" {
+		t.Fatalf("bare status flip changed the stored text: %v", u.CustomStatus)
+	}
+}
+
+func TestHandlePresenceUpdate_RejectsUnknownStatusAndOverlongText(t *testing.T) {
+	database := newTestDB(t)
+	seedUser(t, database, &db.User{ID: 1, Username: "ada", PasswordHash: "h"})
+	svc := NewChannelService(database, NewPermissionService(database, permissions.NewChecker(database)))
+	ctx := context.Background()
+
+	if _, err := svc.HandlePresenceUpdate(ctx, 1, "afk", nil, nil); !errors.Is(err, ErrBadRequest) {
+		t.Errorf("unknown status err = %v, want ErrBadRequest", err)
+	}
+	long := strings.Repeat("x", MaxCustomStatusLen+1)
+	if _, err := svc.HandlePresenceUpdate(ctx, 1, db.StatusOnline, &long, nil); !errors.Is(err, ErrBadRequest) {
+		t.Errorf("overlong custom_status err = %v, want ErrBadRequest", err)
+	}
+	// The rejected call must not have committed the status either.
+	u, _ := database.GetUserByID(ctx, 1)
+	if u.Status == db.StatusOnline {
+		t.Error("a rejected presence_update must not commit the status")
+	}
+}
diff --git a/Server/service/role.go b/Server/service/role.go
new file mode 100644
index 00000000..83e4371e
--- /dev/null
+++ b/Server/service/role.go
@@ -0,0 +1,459 @@
+package service
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"regexp"
+	"strings"
+
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/permissions"
+)
+
+// RoleService owns create/edit/delete/reorder of roles. It is the only writer
+// of the roles table outside migrations.
+//
+// Every mutation is checked against the ACTOR's role position rather than
+// against a bit alone: MANAGE_ROLES says "may manage roles", the hierarchy says
+// "which ones". Without the position rule any holder of the bit could edit the
+// role above them — or grant themselves ADMINISTRATOR through a role they
+// create — which is the same privilege-escalation hole ChangeUserRole closed
+// for role *assignment*.
+type RoleService struct {
+	st    Store
+	perms *PermissionService
+}
+
+// NewRoleService creates a RoleService.
+func NewRoleService(st Store, perms *PermissionService) *RoleService {
+	return &RoleService{st: st, perms: perms}
+}
+
+const (
+	// maxRoleNameLen bounds the name so a role label cannot be used to blow up
+	// every member list and permission modal that renders it.
+	maxRoleNameLen = 32
+	// maxRoles bounds how many roles a server can hold. Reorder normalizes
+	// positions into 1..N strictly below the actor, so N must stay well under
+	// the owner position (100) for the hierarchy to remain expressible.
+	maxRoles = 64
+)
+
+// hexColorRe matches the two CSS hex forms the client renders (#rgb, #rrggbb).
+// Anything else — named colors, rgb(), a bare hex without the hash — is
+// rejected rather than normalized: the value is written straight into a style
+// attribute by the desktop client and the admin panel.
+var hexColorRe = regexp.MustCompile(`^#([0-9a-fA-F]{3}|[0-9a-fA-F]{6})$`)
+
+// RoleInput carries the mutable fields of a role. Pointer fields are "leave
+// unchanged" on update; on create a nil Position means "just below the actor".
+type RoleInput struct {
+	Name        *string
+	Color       *string // points at "" to clear the color
+	Permissions *int64
+	Position    *int
+}
+
+// RoleWithMembers is a role plus how many users currently hold it. The count
+// is what makes the delete confirmation honest ("12 members move to Member").
+type RoleWithMembers struct {
+	db.Role
+	MemberCount int `json:"member_count"`
+}
+
+// actorRole loads the actor's role through the permission cache and verifies
+// MANAGE_ROLES (ADMINISTRATOR bypasses). Every failure is Forbidden: an
+// unresolvable role must never authorize a role mutation.
+func (s *RoleService) actorRole(ctx context.Context, actorID int64) (*db.Role, error) {
+	if s.perms == nil {
+		return nil, fmt.Errorf("%w: permission service unavailable", ErrForbidden)
+	}
+	role, err := s.perms.GetRoleForUser(ctx, actorID)
+	if err != nil || role == nil {
+		return nil, fmt.Errorf("%w: failed to load actor role", ErrForbidden)
+	}
+	if !permissions.HasServerPerm(role.Permissions, permissions.ManageRoles) {
+		return nil, fmt.Errorf("%w: missing %s permission", ErrForbidden, permissions.Name(permissions.ManageRoles))
+	}
+	return role, nil
+}
+
+// requireBelowActor enforces the hierarchy rule shared by edit, delete and
+// reorder: the target role must sit strictly below the actor's own position.
+// Equality is refused too, so a peer cannot rewrite the role they both hold.
+func requireBelowActor(actor *db.Role, target *db.Role) error {
+	if target.Position >= actor.Position {
+		return fmt.Errorf("%w: cannot manage a role at or above your own rank", ErrForbidden)
+	}
+	return nil
+}
+
+// requireGrantable enforces "you cannot hand out what you do not hold": every
+// bit being ADDED must be present in the actor's own mask. Removing a bit the
+// actor lacks is allowed — that is a de-escalation, and refusing it would make
+// an over-permissioned role impossible to wind down by anyone but an admin.
+// ADMINISTRATOR bypasses, which is what lets the owner grant anything.
+func requireGrantable(actor *db.Role, oldPerms, newPerms int64) error {
+	if permissions.HasAdmin(actor.Permissions) {
+		return nil
+	}
+	added := newPerms &^ oldPerms
+	if missing := added &^ actor.Permissions; missing != 0 {
+		return fmt.Errorf("%w: cannot grant a permission your own role lacks (%s)",
+			ErrForbidden, permissions.Name(missing&-missing))
+	}
+	return nil
+}
+
+// validateName trims, bounds and uniqueness-checks a role name. excludeID is
+// the role being renamed (0 on create) so a no-op rename is not a collision.
+func (s *RoleService) validateName(ctx context.Context, raw string, excludeID int64) (string, error) {
+	name := strings.TrimSpace(raw)
+	if name == "" {
+		return "", fmt.Errorf("%w: name is required", ErrBadRequest)
+	}
+	if len([]rune(name)) > maxRoleNameLen {
+		return "", fmt.Errorf("%w: name must be at most %d characters", ErrBadRequest, maxRoleNameLen)
+	}
+	existing, err := s.st.GetRoleByName(ctx, name)
+	if err != nil {
+		return "", fmt.Errorf("%w: failed to check role name: %v", ErrInternal, err)
+	}
+	if existing != nil && existing.ID != excludeID {
+		return "", fmt.Errorf("%w: a role named %q already exists", ErrBadRequest, existing.Name)
+	}
+	return name, nil
+}
+
+// validateColor normalizes an optional color. A nil pointer means "unset"; an
+// empty string clears it.
+func validateColor(raw *string) (*string, error) {
+	if raw == nil {
+		return nil, nil
+	}
+	c := strings.TrimSpace(*raw)
+	if c == "" {
+		return nil, nil
+	}
+	if !hexColorRe.MatchString(c) {
+		return nil, fmt.Errorf("%w: color must be a hex value like #5865F2", ErrBadRequest)
+	}
+	c = strings.ToUpper(c)
+	return &c, nil
+}
+
+// validatePosition bounds a requested position: non-negative and strictly below
+// the actor's own rank.
+func validatePosition(actor *db.Role, pos int) error {
+	if pos < 0 {
+		return fmt.Errorf("%w: position must not be negative", ErrBadRequest)
+	}
+	if pos >= actor.Position {
+		return fmt.Errorf("%w: cannot place a role at or above your own rank", ErrForbidden)
+	}
+	return nil
+}
+
+// ListRoles returns every role, highest position first, with member counts.
+// Gated on MANAGE_ROLES like the mutations — the panel section that shows it is.
+func (s *RoleService) ListRoles(ctx context.Context, actorID int64) ([]RoleWithMembers, error) {
+	if _, err := s.actorRole(ctx, actorID); err != nil {
+		return nil, err
+	}
+	roles, err := s.st.ListRoles(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("%w: failed to list roles: %v", ErrInternal, err)
+	}
+	counts, err := s.st.CountRoleMembers(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("%w: failed to count role members: %v", ErrInternal, err)
+	}
+	out := make([]RoleWithMembers, 0, len(roles))
+	for _, r := range roles {
+		out = append(out, RoleWithMembers{Role: *r, MemberCount: counts[r.ID]})
+	}
+	return out, nil
+}
+
+// CreateRole creates a role strictly below the actor's own rank.
+func (s *RoleService) CreateRole(ctx context.Context, actorID int64, in RoleInput) (*db.Role, error) {
+	actor, err := s.actorRole(ctx, actorID)
+	if err != nil {
+		return nil, err
+	}
+	if in.Name == nil {
+		return nil, fmt.Errorf("%w: name is required", ErrBadRequest)
+	}
+	name, err := s.validateName(ctx, *in.Name, 0)
+	if err != nil {
+		return nil, err
+	}
+	color, err := validateColor(in.Color)
+	if err != nil {
+		return nil, err
+	}
+
+	// Unknown bits are dropped rather than rejected, matching the channel
+	// override handlers — a client sending a wider mask than this build knows
+	// about must not be able to persist bits nothing enforces.
+	perms := int64(0)
+	if in.Permissions != nil {
+		perms = *in.Permissions & permissions.AllPerms
+	}
+	// Every bit is "added" on create, so the grantable check runs against 0.
+	if err := requireGrantable(actor, 0, perms); err != nil {
+		return nil, err
+	}
+
+	existing, err := s.st.ListRoles(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("%w: failed to list roles: %v", ErrInternal, err)
+	}
+	if len(existing) >= maxRoles {
+		return nil, fmt.Errorf("%w: server already has the maximum of %d roles", ErrBadRequest, maxRoles)
+	}
+
+	// Positions must stay unique: every hierarchy comparison uses >=/<=, so two
+	// roles sharing a position read as equal rank and can never manage each
+	// other's members. Track the slots already taken.
+	taken := make(map[int]bool, len(existing))
+	for _, rl := range existing {
+		taken[rl.Position] = true
+	}
+
+	// Default placement is the highest free slot below the actor — directly
+	// below when that is free, which is what a manager creating a deputy role
+	// expects, but stepping past any occupied position so a second create does
+	// not collide with the first.
+	position := actor.Position - 1
+	if in.Position != nil {
+		position = *in.Position
+		// Rank first: an at/above-rank position is a hierarchy violation
+		// (ErrForbidden) regardless of whether it also happens to be occupied.
+		if err := validatePosition(actor, position); err != nil {
+			return nil, err
+		}
+		if taken[position] {
+			return nil, fmt.Errorf("%w: position %d is already used by another role", ErrBadRequest, position)
+		}
+	} else {
+		for position > 0 && taken[position] {
+			position--
+		}
+		if position <= 0 {
+			return nil, fmt.Errorf("%w: no free position below your rank — reorder existing roles first", ErrBadRequest)
+		}
+		if err := validatePosition(actor, position); err != nil {
+			return nil, err
+		}
+	}
+
+	role, err := s.st.CreateRole(ctx, name, color, perms, position)
+	if err != nil {
+		return nil, fmt.Errorf("%w: failed to create role: %v", ErrInternal, err)
+	}
+
+	db.WriteAudit(context.WithoutCancel(ctx), s.st, actorID, "role_create", "role", role.ID,
+		fmt.Sprintf("created role %s (permissions=%#x position=%d)", role.Name, role.Permissions, role.Position))
+	slog.Info("role created", "actor_id", actorID, "role_id", role.ID, "name", role.Name)
+	return role, nil
+}
+
+// UpdateRole applies a partial change to a role below the actor's rank.
+// Returns the updated role and whether the permission mask actually moved —
+// the caller uses that to decide between a cheap roles_update broadcast and a
+// full visibility re-sync.
+func (s *RoleService) UpdateRole(ctx context.Context, actorID, roleID int64, in RoleInput) (updated *db.Role, permsChanged bool, err error) {
+	actor, err := s.actorRole(ctx, actorID)
+	if err != nil {
+		return nil, false, err
+	}
+	role, err := s.st.GetRoleByID(ctx, roleID)
+	if err != nil {
+		return nil, false, fmt.Errorf("%w: failed to fetch role: %v", ErrInternal, err)
+	}
+	if role == nil {
+		return nil, false, fmt.Errorf("%w: role not found", ErrNotFound)
+	}
+	if err := requireBelowActor(actor, role); err != nil {
+		return nil, false, err
+	}
+
+	name := role.Name
+	if in.Name != nil {
+		if name, err = s.validateName(ctx, *in.Name, role.ID); err != nil {
+			return nil, false, err
+		}
+	}
+	color := role.Color
+	if in.Color != nil {
+		if color, err = validateColor(in.Color); err != nil {
+			return nil, false, err
+		}
+	}
+	perms := role.Permissions
+	if in.Permissions != nil {
+		perms = *in.Permissions & permissions.AllPerms
+		if err := requireGrantable(actor, role.Permissions, perms); err != nil {
+			return nil, false, err
+		}
+	}
+	position := role.Position
+	if in.Position != nil {
+		position = *in.Position
+		if err := validatePosition(actor, position); err != nil {
+			return nil, false, err
+		}
+	}
+
+	if err := s.st.UpdateRole(ctx, role.ID, name, color, perms, position); err != nil {
+		return nil, false, fmt.Errorf("%w: failed to update role: %v", ErrInternal, err)
+	}
+
+	db.WriteAudit(context.WithoutCancel(ctx), s.st, actorID, "role_update", "role", role.ID,
+		fmt.Sprintf("updated role %s (permissions=%#x position=%d)", name, perms, position))
+	slog.Info("role updated", "actor_id", actorID, "role_id", role.ID, "name", name)
+
+	return &db.Role{
+		ID:          role.ID,
+		Name:        name,
+		Color:       color,
+		Permissions: perms,
+		Position:    position,
+		IsDefault:   role.IsDefault,
+	}, perms != role.Permissions, nil
+}
+
+// DeleteRole removes a role below the actor's rank, moving its members onto the
+// default role. Returns the deleted role, the fallback its members landed on,
+// and the ids of those members so the caller can invalidate and re-sync them.
+func (s *RoleService) DeleteRole(ctx context.Context, actorID, roleID int64) (deleted, fallback *db.Role, movedUserIDs []int64, err error) {
+	actor, err := s.actorRole(ctx, actorID)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+	role, err := s.st.GetRoleByID(ctx, roleID)
+	if err != nil {
+		return nil, nil, nil, fmt.Errorf("%w: failed to fetch role: %v", ErrInternal, err)
+	}
+	if role == nil {
+		return nil, nil, nil, fmt.Errorf("%w: role not found", ErrNotFound)
+	}
+	if err := requireBelowActor(actor, role); err != nil {
+		return nil, nil, nil, err
+	}
+	// Belt and braces: the position rule already puts the owner role out of
+	// reach (nothing is above position 100), but the seeded owner is named
+	// explicitly so a database whose positions were edited by hand cannot make
+	// the server ownerless.
+	if role.ID == permissions.OwnerRoleID || role.Position >= permissions.OwnerRolePosition {
+		return nil, nil, nil, fmt.Errorf("%w: the Owner role cannot be deleted", ErrBadRequest)
+	}
+	if role.IsDefault {
+		return nil, nil, nil, fmt.Errorf("%w: the default role cannot be deleted — every member falls back to it", ErrBadRequest)
+	}
+
+	fallback, err = s.st.GetDefaultRole(ctx)
+	if err != nil {
+		return nil, nil, nil, fmt.Errorf("%w: failed to resolve the default role: %v", ErrInternal, err)
+	}
+	if fallback == nil {
+		// Fail closed: without a fallback the members would be orphaned on a
+		// role id that no longer exists.
+		return nil, nil, nil, fmt.Errorf("%w: no default role is configured", ErrInternal)
+	}
+
+	movedUserIDs, err = s.st.DeleteRoleReassigning(ctx, role.ID, fallback.ID)
+	if err != nil {
+		return nil, nil, nil, fmt.Errorf("%w: failed to delete role: %v", ErrInternal, err)
+	}
+	// The members' cached masks are the deleted role's until this drops them.
+	if s.perms != nil {
+		for _, uid := range movedUserIDs {
+			s.perms.InvalidateUser(uid)
+		}
+	}
+
+	db.WriteAudit(context.WithoutCancel(ctx), s.st, actorID, "role_delete", "role", role.ID,
+		fmt.Sprintf("deleted role %s (%d members reassigned to %s)", role.Name, len(movedUserIDs), fallback.Name))
+	slog.Warn("role deleted", "actor_id", actorID, "role_id", role.ID, "name", role.Name,
+		"members_reassigned", len(movedUserIDs))
+	return role, fallback, movedUserIDs, nil
+}
+
+// ReorderRoles rewrites the positions of every role the actor may manage.
+// orderedIDs is highest-rank-first and must name exactly the set of roles
+// strictly below the actor — a partial list is refused rather than silently
+// leaving the omitted roles wherever they were, which is how positions
+// collided in the first place.
+//
+// Positions are normalized to N..1, so they stay unique, stay strictly below
+// the actor (N < actor.Position, enforced by maxRoles), and never collide with
+// the untouched roles above the actor.
+func (s *RoleService) ReorderRoles(ctx context.Context, actorID int64, orderedIDs []int64) ([]*db.Role, error) {
+	actor, err := s.actorRole(ctx, actorID)
+	if err != nil {
+		return nil, err
+	}
+	roles, err := s.st.ListRoles(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("%w: failed to list roles: %v", ErrInternal, err)
+	}
+
+	manageable := make(map[int64]*db.Role, len(roles))
+	for _, r := range roles {
+		if r.Position < actor.Position {
+			manageable[r.ID] = r
+		}
+	}
+	if len(orderedIDs) != len(manageable) {
+		return nil, fmt.Errorf("%w: the order must list all %d roles below your own rank", ErrBadRequest, len(manageable))
+	}
+	seen := make(map[int64]bool, len(orderedIDs))
+	for _, id := range orderedIDs {
+		if seen[id] {
+			return nil, fmt.Errorf("%w: role %d listed twice", ErrBadRequest, id)
+		}
+		seen[id] = true
+		if _, ok := manageable[id]; !ok {
+			// Covers both "unknown role" and "role at or above your rank"; the
+			// two are deliberately indistinguishable to the caller.
+			return nil, fmt.Errorf("%w: role %d is not yours to reorder", ErrForbidden, id)
+		}
+	}
+	if len(orderedIDs) >= actor.Position {
+		return nil, fmt.Errorf("%w: too many roles to place below your own rank", ErrBadRequest)
+	}
+
+	positions := make(map[int64]int, len(orderedIDs))
+	for i, id := range orderedIDs {
+		positions[id] = len(orderedIDs) - i
+	}
+	if err := s.st.SetRolePositions(ctx, positions); err != nil {
+		return nil, fmt.Errorf("%w: failed to reorder roles: %v", ErrInternal, err)
+	}
+
+	db.WriteAudit(context.WithoutCancel(ctx), s.st, actorID, "role_reorder", "role", 0,
+		fmt.Sprintf("reordered %d roles", len(orderedIDs)))
+	slog.Info("roles reordered", "actor_id", actorID, "count", len(orderedIDs))
+
+	updated, err := s.st.ListRoles(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("%w: failed to list roles: %v", ErrInternal, err)
+	}
+	return updated, nil
+}
+
+// AffectedUserIDs returns the ids of the users holding roleID. Handlers use it
+// to invalidate exactly the permission-cache entries a role edit touches.
+func (s *RoleService) AffectedUserIDs(ctx context.Context, roleID int64) []int64 {
+	ids, err := s.st.ListUserIDsByRole(ctx, roleID)
+	if err != nil {
+		// The caller falls back to a blanket invalidation; a partial list here
+		// would silently leave stale masks in place.
+		slog.Warn("role service: failed to list role members", "role_id", roleID, "err", err)
+		return nil
+	}
+	return ids
+}
diff --git a/Server/service/role_test.go b/Server/service/role_test.go
new file mode 100644
index 00000000..363aad7d
--- /dev/null
+++ b/Server/service/role_test.go
@@ -0,0 +1,607 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/permissions"
+)
+
+// newRoleCRUDService builds a RoleService over the hierarchy these tests use,
+// layered on the four migration-seeded defaults (Owner 100, Admin 80,
+// Moderator 60, Member 40 / is_default):
+//
+//	user 1 → Owner    (ADMINISTRATOR, position 100)
+//	user 2 → Admin    (everything but ADMINISTRATOR, position 80)
+//	user 3 → Moderator(MANAGE_ROLES + a few bits, position 60)
+//	user 4 → Member   (default role, position 40)
+//	user 5 → Member
+//
+// The Moderator role is redefined so it holds MANAGE_ROLES but NOT
+// MANAGE_SERVER — that gap is what the "cannot grant a bit you lack" tests
+// exercise.
+func newRoleCRUDService(t *testing.T) (*RoleService, *db.DB) {
+	t.Helper()
+	database := newTestDB(t)
+	seedRole(t, database, &db.Role{ID: permissions.OwnerRoleID, Name: "Owner",
+		Permissions: permissions.Administrator, Position: permissions.OwnerRolePosition})
+	seedRole(t, database, &db.Role{ID: permissions.AdminRoleID, Name: "Admin",
+		Permissions: permissions.AllPerms &^ permissions.Administrator, Position: 80})
+	seedRole(t, database, &db.Role{ID: permissions.ModeratorRoleID, Name: "Moderator",
+		Permissions: permissions.ManageRoles | permissions.ReadMessages | permissions.SendMessages |
+			permissions.KickMembers, Position: 60})
+	for userID, roleID := range map[int64]int64{
+		1: permissions.OwnerRoleID,
+		2: permissions.AdminRoleID,
+		3: permissions.ModeratorRoleID,
+		4: permissions.MemberRoleID,
+		5: permissions.MemberRoleID,
+	} {
+		seedUser(t, database, &db.User{ID: userID})
+		seedUserRole(t, database, userID, roleID)
+	}
+	checker := permissions.NewChecker(database)
+	return NewRoleService(database, NewPermissionService(database, checker)), database
+}
+
+// ─── Create ──────────────────────────────────────────────────────────────────
+
+func TestCreateRole_HappyPath(t *testing.T) {
+	svc, database := newRoleCRUDService(t)
+
+	role, err := svc.CreateRole(context.Background(), 1, RoleInput{
+		Name:        new("  Helper  "),
+		Color:       new("#5865f2"),
+		Permissions: new(permissions.SendMessages | permissions.ReadMessages),
+		Position:    new(50),
+	})
+	if err != nil {
+		t.Fatalf("CreateRole: %v", err)
+	}
+	if role.Name != "Helper" {
+		t.Errorf("name = %q, want trimmed %q", role.Name, "Helper")
+	}
+	if role.Color == nil || *role.Color != "#5865F2" {
+		t.Errorf("color = %v, want normalized #5865F2", role.Color)
+	}
+	if role.Position != 50 {
+		t.Errorf("position = %d, want 50", role.Position)
+	}
+	if role.IsDefault {
+		t.Error("a created role must never be the default")
+	}
+
+	stored, err := database.GetRoleByID(context.Background(), role.ID)
+	if err != nil || stored == nil {
+		t.Fatalf("GetRoleByID: %v", err)
+	}
+	if stored.Permissions != permissions.SendMessages|permissions.ReadMessages {
+		t.Errorf("stored permissions = %#x", stored.Permissions)
+	}
+
+	assertAudit(t, database, "role_create")
+}
+
+func TestCreateRole_DefaultsToJustBelowActor(t *testing.T) {
+	svc, _ := newRoleCRUDService(t)
+
+	// The Admin actor sits at 80, so an unpositioned role lands at 79.
+	role, err := svc.CreateRole(context.Background(), 2, RoleInput{Name: new("Deputy")})
+	if err != nil {
+		t.Fatalf("CreateRole: %v", err)
+	}
+	if role.Position != 79 {
+		t.Errorf("position = %d, want 79 (one below the actor)", role.Position)
+	}
+	if role.Permissions != 0 {
+		t.Errorf("permissions = %#x, want 0 when the body omits them", role.Permissions)
+	}
+}
+
+// Two roles created back-to-back without an explicit position must not collide:
+// tied positions read as equal rank in every hierarchy check, so the second
+// default placement steps past the first.
+func TestCreateRole_DefaultPlacementAvoidsCollision(t *testing.T) {
+	svc, _ := newRoleCRUDService(t)
+
+	first, err := svc.CreateRole(context.Background(), 2, RoleInput{Name: new("Deputy")})
+	if err != nil {
+		t.Fatalf("CreateRole first: %v", err)
+	}
+	second, err := svc.CreateRole(context.Background(), 2, RoleInput{Name: new("Deputy2")})
+	if err != nil {
+		t.Fatalf("CreateRole second: %v", err)
+	}
+	if first.Position == second.Position {
+		t.Fatalf("two default-placed roles collided at position %d", first.Position)
+	}
+	if second.Position != first.Position-1 {
+		t.Errorf("second position = %d, want %d (the next free slot below the first)", second.Position, first.Position-1)
+	}
+}
+
+// An explicit position already held by another role is refused rather than
+// silently duplicated.
+func TestCreateRole_RejectsExplicitPositionCollision(t *testing.T) {
+	svc, _ := newRoleCRUDService(t)
+
+	first, err := svc.CreateRole(context.Background(), 2, RoleInput{Name: new("Deputy")})
+	if err != nil {
+		t.Fatalf("CreateRole first: %v", err)
+	}
+	_, err = svc.CreateRole(context.Background(), 2, RoleInput{Name: new("Clash"), Position: &first.Position})
+	if !errors.Is(err, ErrBadRequest) {
+		t.Fatalf("explicit-collision err = %v, want ErrBadRequest", err)
+	}
+}
+
+func TestCreateRole_NameUniquenessIsCaseInsensitive(t *testing.T) {
+	svc, _ := newRoleCRUDService(t)
+
+	if _, err := svc.CreateRole(context.Background(), 1, RoleInput{Name: new("mEmBeR")}); !errors.Is(err, ErrBadRequest) {
+		t.Fatalf("colliding name: want ErrBadRequest, got %v", err)
+	}
+	if _, err := svc.CreateRole(context.Background(), 1, RoleInput{Name: new("   ")}); !errors.Is(err, ErrBadRequest) {
+		t.Fatalf("blank name: want ErrBadRequest, got %v", err)
+	}
+	long := strings.Repeat("x", maxRoleNameLen+1)
+	if _, err := svc.CreateRole(context.Background(), 1, RoleInput{Name: &long}); !errors.Is(err, ErrBadRequest) {
+		t.Fatalf("over-long name: want ErrBadRequest, got %v", err)
+	}
+}
+
+func TestCreateRole_RejectsBadColor(t *testing.T) {
+	svc, _ := newRoleCRUDService(t)
+
+	for _, color := range []string{"red", "5865F2", "#12345", "rgb(1,2,3)"} {
+		if _, err := svc.CreateRole(context.Background(), 1, RoleInput{
+			Name: new("c-" + color), Color: new(color),
+		}); !errors.Is(err, ErrBadRequest) {
+			t.Errorf("color %q: want ErrBadRequest, got %v", color, err)
+		}
+	}
+	// An empty color is "no color", not an error.
+	role, err := svc.CreateRole(context.Background(), 1, RoleInput{Name: new("Plain"), Color: new("")})
+	if err != nil {
+		t.Fatalf("empty color: %v", err)
+	}
+	if role.Color != nil {
+		t.Errorf("color = %v, want nil", role.Color)
+	}
+}
+
+func TestCreateRole_RequiresManageRoles(t *testing.T) {
+	svc, _ := newRoleCRUDService(t)
+
+	// User 4 holds the default Member role — no MANAGE_ROLES.
+	if _, err := svc.CreateRole(context.Background(), 4, RoleInput{Name: new("Sneaky")}); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("member create: want ErrForbidden, got %v", err)
+	}
+	// An unresolvable actor is Forbidden too, never a silent success.
+	if _, err := svc.CreateRole(context.Background(), 999, RoleInput{Name: new("Ghost")}); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("unknown actor: want ErrForbidden, got %v", err)
+	}
+}
+
+func TestCreateRole_CannotPlaceAtOrAboveOwnRank(t *testing.T) {
+	svc, _ := newRoleCRUDService(t)
+
+	// Moderator sits at 60.
+	for _, pos := range []int{60, 80, 100} {
+		if _, err := svc.CreateRole(context.Background(), 3, RoleInput{
+			Name: new("Above"), Position: new(pos),
+		}); !errors.Is(err, ErrForbidden) {
+			t.Errorf("position %d: want ErrForbidden, got %v", pos, err)
+		}
+	}
+	if _, err := svc.CreateRole(context.Background(), 3, RoleInput{
+		Name: new("Negative"), Position: new(-1),
+	}); !errors.Is(err, ErrBadRequest) {
+		t.Errorf("negative position: want ErrBadRequest, got %v", err)
+	}
+}
+
+func TestCreateRole_CannotGrantUnheldBit(t *testing.T) {
+	svc, _ := newRoleCRUDService(t)
+
+	// The Moderator role has MANAGE_ROLES but not MANAGE_SERVER.
+	if _, err := svc.CreateRole(context.Background(), 3, RoleInput{
+		Name: new("Escalation"), Permissions: new(permissions.ManageServer),
+	}); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("granting an unheld bit: want ErrForbidden, got %v", err)
+	}
+	// ADMINISTRATOR bypasses: the owner may grant anything.
+	if _, err := svc.CreateRole(context.Background(), 1, RoleInput{
+		Name: new("Powerful"), Permissions: new(permissions.ManageServer | permissions.BanMembers),
+	}); err != nil {
+		t.Fatalf("owner grant: %v", err)
+	}
+	// Bits this build does not define are dropped, not persisted.
+	role, err := svc.CreateRole(context.Background(), 1, RoleInput{
+		Name: new("Masked"), Permissions: new(^int64(0)),
+	})
+	if err != nil {
+		t.Fatalf("CreateRole with unknown bits: %v", err)
+	}
+	if role.Permissions != permissions.AllPerms {
+		t.Errorf("permissions = %#x, want the mask narrowed to AllPerms (%#x)", role.Permissions, permissions.AllPerms)
+	}
+}
+
+// ─── Update ──────────────────────────────────────────────────────────────────
+
+func TestUpdateRole_PartialBodyLeavesOtherFields(t *testing.T) {
+	svc, _ := newRoleCRUDService(t)
+
+	created, err := svc.CreateRole(context.Background(), 1, RoleInput{
+		Name:        new("Support"),
+		Color:       new("#ABC"),
+		Permissions: new(permissions.ReadMessages),
+		Position:    new(30),
+	})
+	if err != nil {
+		t.Fatalf("CreateRole: %v", err)
+	}
+
+	updated, permsChanged, err := svc.UpdateRole(context.Background(), 1, created.ID, RoleInput{
+		Name: new("Support Team"),
+	})
+	if err != nil {
+		t.Fatalf("UpdateRole: %v", err)
+	}
+	if permsChanged {
+		t.Error("permsChanged must be false when the body omits permissions")
+	}
+	if updated.Name != "Support Team" {
+		t.Errorf("name = %q", updated.Name)
+	}
+	if updated.Color == nil || *updated.Color != "#ABC" {
+		t.Errorf("color = %v, want unchanged #ABC", updated.Color)
+	}
+	if updated.Permissions != permissions.ReadMessages || updated.Position != 30 {
+		t.Errorf("permissions/position changed unexpectedly: %#x / %d", updated.Permissions, updated.Position)
+	}
+}
+
+func TestUpdateRole_ReportsPermissionChange(t *testing.T) {
+	svc, database := newRoleCRUDService(t)
+
+	created, err := svc.CreateRole(context.Background(), 1, RoleInput{Name: new("Bots")})
+	if err != nil {
+		t.Fatalf("CreateRole: %v", err)
+	}
+	_, permsChanged, err := svc.UpdateRole(context.Background(), 1, created.ID, RoleInput{
+		Permissions: new(permissions.ReadMessages),
+	})
+	if err != nil {
+		t.Fatalf("UpdateRole: %v", err)
+	}
+	if !permsChanged {
+		t.Error("permsChanged should be true when the mask moves")
+	}
+	// Re-applying the same mask is not a change.
+	_, permsChanged, err = svc.UpdateRole(context.Background(), 1, created.ID, RoleInput{
+		Permissions: new(permissions.ReadMessages),
+	})
+	if err != nil {
+		t.Fatalf("UpdateRole idempotent: %v", err)
+	}
+	if permsChanged {
+		t.Error("permsChanged should be false when the mask is unchanged")
+	}
+	assertAudit(t, database, "role_update")
+}
+
+func TestUpdateRole_HierarchyAndGrantRules(t *testing.T) {
+	svc, _ := newRoleCRUDService(t)
+
+	// A moderator (60) may not edit the Admin role (80) …
+	if _, _, err := svc.UpdateRole(context.Background(), 3, permissions.AdminRoleID, RoleInput{
+		Name: new("Pwned"),
+	}); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("edit higher role: want ErrForbidden, got %v", err)
+	}
+	// … nor their own role, which is at equal rank.
+	if _, _, err := svc.UpdateRole(context.Background(), 3, permissions.ModeratorRoleID, RoleInput{
+		Permissions: new(permissions.Administrator),
+	}); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("edit own role: want ErrForbidden, got %v", err)
+	}
+	// … and may not add a bit they lack to a role they can edit.
+	if _, _, err := svc.UpdateRole(context.Background(), 3, permissions.MemberRoleID, RoleInput{
+		Permissions: new(permissions.ManageServer),
+	}); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("grant unheld bit: want ErrForbidden, got %v", err)
+	}
+	// Removing a bit they lack IS allowed — de-escalation is always safe.
+	member, err := svc.CreateRole(context.Background(), 1, RoleInput{
+		Name: new("Overpowered"), Position: new(20),
+		Permissions: new(permissions.ManageServer | permissions.ReadMessages),
+	})
+	if err != nil {
+		t.Fatalf("CreateRole: %v", err)
+	}
+	if _, _, err := svc.UpdateRole(context.Background(), 3, member.ID, RoleInput{
+		Permissions: new(permissions.ReadMessages),
+	}); err != nil {
+		t.Fatalf("de-escalating edit: %v", err)
+	}
+}
+
+func TestUpdateRole_NotFoundAndNameCollision(t *testing.T) {
+	svc, _ := newRoleCRUDService(t)
+
+	if _, _, err := svc.UpdateRole(context.Background(), 1, 9999, RoleInput{Name: new("Nope")}); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("missing role: want ErrNotFound, got %v", err)
+	}
+	// Renaming onto another role's name (case-insensitively) is refused …
+	if _, _, err := svc.UpdateRole(context.Background(), 1, permissions.MemberRoleID, RoleInput{
+		Name: new("moderator"),
+	}); !errors.Is(err, ErrBadRequest) {
+		t.Fatalf("name collision: want ErrBadRequest, got %v", err)
+	}
+	// … but re-submitting a role's own name is not a collision.
+	if _, _, err := svc.UpdateRole(context.Background(), 1, permissions.MemberRoleID, RoleInput{
+		Name: new("member"),
+	}); err != nil {
+		t.Fatalf("self-rename: %v", err)
+	}
+}
+
+// ─── Delete ──────────────────────────────────────────────────────────────────
+
+func TestDeleteRole_ReassignsMembersAndDropsOverrides(t *testing.T) {
+	svc, database := newRoleCRUDService(t)
+	ctx := context.Background()
+
+	role, err := svc.CreateRole(ctx, 1, RoleInput{Name: new("Contractor"), Position: new(30)})
+	if err != nil {
+		t.Fatalf("CreateRole: %v", err)
+	}
+	seedChannel(t, database, &db.Channel{ID: 10, Name: "general"})
+	if err := database.UpsertChannelOverride(ctx, 10, role.ID, 0, permissions.ReadMessages); err != nil {
+		t.Fatalf("UpsertChannelOverride: %v", err)
+	}
+	// Two members hold the role; a third stays put so the UPDATE is proven
+	// to be scoped rather than global.
+	seedUserRole(t, database, 4, role.ID)
+	seedUserRole(t, database, 5, role.ID)
+
+	deleted, fallback, moved, err := svc.DeleteRole(ctx, 1, role.ID)
+	if err != nil {
+		t.Fatalf("DeleteRole: %v", err)
+	}
+	if deleted.ID != role.ID {
+		t.Errorf("deleted role id = %d, want %d", deleted.ID, role.ID)
+	}
+	if fallback.ID != permissions.MemberRoleID || !fallback.IsDefault {
+		t.Errorf("fallback = %+v, want the default role", fallback)
+	}
+	if len(moved) != 2 {
+		t.Fatalf("moved = %v, want 2 members", moved)
+	}
+
+	for _, uid := range []int64{4, 5} {
+		u, err := database.GetUserByID(ctx, uid)
+		if err != nil || u == nil {
+			t.Fatalf("GetUserByID(%d): %v", uid, err)
+		}
+		if u.RoleID != permissions.MemberRoleID {
+			t.Errorf("user %d role = %d, want the default %d", uid, u.RoleID, permissions.MemberRoleID)
+		}
+	}
+	if gone, err := database.GetRoleByID(ctx, role.ID); err != nil || gone != nil {
+		t.Errorf("role still present after delete: %v, %v", gone, err)
+	}
+	overrides, err := database.GetChannelOverrides(ctx, 10)
+	if err != nil {
+		t.Fatalf("GetChannelOverrides: %v", err)
+	}
+	if _, ok := overrides[role.ID]; ok {
+		t.Error("channel_overrides row for the deleted role survived")
+	}
+	// User 3 (Moderator) is untouched — the reassignment is scoped to the role.
+	if u, _ := database.GetUserByID(ctx, 3); u.RoleID != permissions.ModeratorRoleID {
+		t.Errorf("unrelated user role changed to %d", u.RoleID)
+	}
+	assertAudit(t, database, "role_delete")
+}
+
+func TestDeleteRole_OwnerAndDefaultAreUndeletable(t *testing.T) {
+	svc, database := newRoleCRUDService(t)
+	ctx := context.Background()
+
+	// Nothing outranks the Owner role, so even the owner is refused.
+	if _, _, _, err := svc.DeleteRole(ctx, 1, permissions.OwnerRoleID); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("delete owner role: want ErrForbidden, got %v", err)
+	}
+	// The default role is below the owner, so it clears the hierarchy check and
+	// is stopped by the is_default rule specifically.
+	_, _, _, err := svc.DeleteRole(ctx, 1, permissions.MemberRoleID)
+	if !errors.Is(err, ErrBadRequest) {
+		t.Fatalf("delete default role: want ErrBadRequest, got %v", err)
+	}
+	if role, _ := database.GetRoleByID(ctx, permissions.MemberRoleID); role == nil {
+		t.Fatal("the default role was deleted")
+	}
+
+	// A moderator may not delete a role at or above their own rank.
+	if _, _, _, err := svc.DeleteRole(ctx, 3, permissions.AdminRoleID); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("delete higher role: want ErrForbidden, got %v", err)
+	}
+	if _, _, _, err := svc.DeleteRole(ctx, 3, permissions.ModeratorRoleID); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("delete own role: want ErrForbidden, got %v", err)
+	}
+	if _, _, _, err := svc.DeleteRole(ctx, 1, 9999); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("delete missing role: want ErrNotFound, got %v", err)
+	}
+}
+
+func TestDeleteRole_InvalidatesReassignedMembers(t *testing.T) {
+	svc, database := newRoleCRUDService(t)
+	ctx := context.Background()
+
+	role, err := svc.CreateRole(ctx, 1, RoleInput{
+		Name: new("Temp"), Position: new(30),
+		Permissions: new(permissions.ReadMessages | permissions.ManageMessages),
+	})
+	if err != nil {
+		t.Fatalf("CreateRole: %v", err)
+	}
+	seedUserRole(t, database, 4, role.ID)
+
+	// Warm the cache with the doomed role's mask.
+	cached, err := svc.perms.GetRoleForUser(ctx, 4)
+	if err != nil || cached == nil {
+		t.Fatalf("GetRoleForUser: %v", err)
+	}
+	if cached.ID != role.ID {
+		t.Fatalf("cached role = %d, want %d", cached.ID, role.ID)
+	}
+
+	if _, _, _, err := svc.DeleteRole(ctx, 1, role.ID); err != nil {
+		t.Fatalf("DeleteRole: %v", err)
+	}
+
+	// Without the invalidation this still answers with the deleted role.
+	after, err := svc.perms.GetRoleForUser(ctx, 4)
+	if err != nil || after == nil {
+		t.Fatalf("GetRoleForUser after delete: %v", err)
+	}
+	if after.ID != permissions.MemberRoleID {
+		t.Errorf("cached role after delete = %d, want the default %d", after.ID, permissions.MemberRoleID)
+	}
+}
+
+// ─── Reorder ─────────────────────────────────────────────────────────────────
+
+func TestReorderRoles_NormalizesPositions(t *testing.T) {
+	svc, database := newRoleCRUDService(t)
+	ctx := context.Background()
+
+	extra, err := svc.CreateRole(ctx, 1, RoleInput{Name: new("Helper"), Position: new(50)})
+	if err != nil {
+		t.Fatalf("CreateRole: %v", err)
+	}
+
+	// The owner may reorder everything below position 100: Admin, Moderator,
+	// Helper and Member — highest first.
+	updated, err := svc.ReorderRoles(ctx, 1, []int64{
+		permissions.AdminRoleID, extra.ID, permissions.ModeratorRoleID, permissions.MemberRoleID,
+	})
+	if err != nil {
+		t.Fatalf("ReorderRoles: %v", err)
+	}
+
+	want := map[int64]int{
+		permissions.OwnerRoleID:     100, // untouched, still above everything
+		permissions.AdminRoleID:     4,
+		extra.ID:                    3,
+		permissions.ModeratorRoleID: 2,
+		permissions.MemberRoleID:    1,
+	}
+	for _, r := range updated {
+		if got := want[r.ID]; r.Position != got {
+			t.Errorf("role %d position = %d, want %d", r.ID, r.Position, got)
+		}
+	}
+	// The returned list is the persisted one.
+	stored, err := database.ListRoles(ctx)
+	if err != nil {
+		t.Fatalf("ListRoles: %v", err)
+	}
+	for _, r := range stored {
+		if got := want[r.ID]; r.Position != got {
+			t.Errorf("stored role %d position = %d, want %d", r.ID, r.Position, got)
+		}
+	}
+	// Highest position first, as the ready payload expects.
+	if stored[0].ID != permissions.OwnerRoleID || stored[len(stored)-1].ID != permissions.MemberRoleID {
+		t.Errorf("order = %d…%d, want owner first and member last", stored[0].ID, stored[len(stored)-1].ID)
+	}
+	assertAudit(t, database, "role_reorder")
+}
+
+func TestReorderRoles_RejectsPartialAndForeignLists(t *testing.T) {
+	svc, _ := newRoleCRUDService(t)
+	ctx := context.Background()
+
+	// Three roles sit below the owner; a two-element list is refused rather
+	// than leaving the omitted role at a position that now collides.
+	if _, err := svc.ReorderRoles(ctx, 1, []int64{permissions.AdminRoleID, permissions.MemberRoleID}); !errors.Is(err, ErrBadRequest) {
+		t.Fatalf("partial list: want ErrBadRequest, got %v", err)
+	}
+	// Duplicates would silently drop a role.
+	if _, err := svc.ReorderRoles(ctx, 1, []int64{
+		permissions.AdminRoleID, permissions.AdminRoleID, permissions.MemberRoleID,
+	}); !errors.Is(err, ErrBadRequest) {
+		t.Fatalf("duplicate ids: want ErrBadRequest, got %v", err)
+	}
+	// A moderator may reorder only what is below them: naming the Admin role
+	// is Forbidden, and the count check runs first for a short list.
+	if _, err := svc.ReorderRoles(ctx, 3, []int64{permissions.AdminRoleID}); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("foreign role: want ErrForbidden, got %v", err)
+	}
+	// Same for an id that does not exist at all.
+	if _, err := svc.ReorderRoles(ctx, 3, []int64{9999}); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("unknown role: want ErrForbidden, got %v", err)
+	}
+	// A member cannot reorder anything.
+	if _, err := svc.ReorderRoles(ctx, 4, nil); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("member reorder: want ErrForbidden, got %v", err)
+	}
+}
+
+// ─── List ────────────────────────────────────────────────────────────────────
+
+func TestListRoles_CarriesMemberCounts(t *testing.T) {
+	svc, _ := newRoleCRUDService(t)
+
+	list, err := svc.ListRoles(context.Background(), 1)
+	if err != nil {
+		t.Fatalf("ListRoles: %v", err)
+	}
+	counts := map[int64]int{}
+	for _, r := range list {
+		counts[r.ID] = r.MemberCount
+	}
+	if counts[permissions.MemberRoleID] != 2 {
+		t.Errorf("member count = %d, want 2", counts[permissions.MemberRoleID])
+	}
+	if counts[permissions.OwnerRoleID] != 1 {
+		t.Errorf("owner count = %d, want 1", counts[permissions.OwnerRoleID])
+	}
+	if _, err := svc.ListRoles(context.Background(), 4); !errors.Is(err, ErrForbidden) {
+		t.Errorf("member list: want ErrForbidden, got %v", err)
+	}
+}
+
+func TestAffectedUserIDs(t *testing.T) {
+	svc, _ := newRoleCRUDService(t)
+
+	ids := svc.AffectedUserIDs(context.Background(), permissions.MemberRoleID)
+	if len(ids) != 2 {
+		t.Errorf("AffectedUserIDs = %v, want 2 members", ids)
+	}
+	if got := svc.AffectedUserIDs(context.Background(), 9999); len(got) != 0 {
+		t.Errorf("AffectedUserIDs(missing) = %v, want empty", got)
+	}
+}
+
+// assertAudit fails unless an audit row with the given action exists.
+func assertAudit(t *testing.T, database *db.DB, action string) {
+	t.Helper()
+	entries, err := database.GetAuditLog(context.Background(), 50, 0)
+	if err != nil {
+		t.Fatalf("GetAuditLog: %v", err)
+	}
+	for _, e := range entries {
+		if e.Action == action {
+			return
+		}
+	}
+	t.Errorf("no %q audit entry written", action)
+}
diff --git a/Server/service/sanitize_content_fuzz_test.go b/Server/service/sanitize_content_fuzz_test.go
new file mode 100644
index 00000000..b9c16d19
--- /dev/null
+++ b/Server/service/sanitize_content_fuzz_test.go
@@ -0,0 +1,115 @@
+package service
+
+import (
+	"regexp"
+	"strings"
+	"testing"
+	"unicode/utf8"
+)
+
+// onEventAttr matches an on-event handler attribute (onerror=, onload=, etc.)
+// living inside an actual surviving tag, case-insensitively, tolerating
+// whitespace around the '='.
+//
+// The check is deliberately tag-scoped (requires a preceding unclosed '<')
+// rather than a bare `\bon\w+\s*=` substring match: bluemonday's
+// StrictPolicy strips every tag, so the only way "onerror=" et al. can
+// survive into `out` is as inert plain text a user actually typed (e.g. a
+// message that reads "use onClick= to bind a handler") — that text renders
+// as a text node, not as a live attribute, so it is not an active-content
+// sink. A bare substring match flags that benign case as a false positive
+// (confirmed via fuzzing: seed "on0=" round-trips unchanged through
+// sanitizeContent and is not exploitable). Requiring tag context is what
+// actually distinguishes "typed the word onclick=" from "smuggled a live
+// onclick attribute".
+var onEventAttr = regexp.MustCompile(`(?i)<[^>]*\bon\w+\s*=`)
+
+// jsURLInTag matches a javascript: (or similar) pseudo-scheme living inside
+// an actual surviving tag's attribute — the only shape that is an active
+// sink. Like onEventAttr, this is tag-scoped rather than a bare substring
+// match: bluemonday's StrictPolicy strips every tag (and HTML-escapes any
+// stray '<'), so "javascript:" surviving into `out` at all means it arrived
+// as inert plain text (e.g. a message that reads "the demo used
+// javascript:void(0) links") — not as a live href. Fuzzing confirmed the
+// bare-substring version false-positives on exactly that case (seed
+// "jAvAsCript:0"), and the client's own markdown renderer independently
+// refuses to autolink a javascript: pseudo-URL (see
+// tauri-client/tests/unit/content-markdown.test.ts, "does not autolink a
+// javascript: pseudo-URL"), so plain-text "javascript:" is not exploitable
+// through any known rendering path.
+var jsURLInTag = regexp.MustCompile(`(?i)<[^>]*\bjavascript:`)
+
+// FuzzSanitizeContent hammers sanitizeContent with untrusted message content
+// looking for a case where the "strip everything" bluemonday policy still
+// lets an active-content sink survive (a real XSS in every client that
+// renders message content), or where the length/idempotency contract the
+// function documents (implicitly, via maxMessageLen and repeated calls in
+// the edit path) breaks.
+func FuzzSanitizeContent(f *testing.F) {
+	seeds := []string{
+		"",
+		"hello world",
+		"<script>alert(1)</script>",
+		"<SCRIPT>alert(1)</SCRIPT>",
+		"<scr<script>ipt>alert(1)</scr</script>ipt>",
+		`<img src=x onerror="alert(1)">`,
+		`<img src=x OnError = alert(1)>`,
+		`<a href="javascript:alert(1)">click</a>`,
+		`<a href="JaVaScRiPt:alert(1)">click</a>`,
+		`<a href="  javascript:alert(1)">click</a>`,
+		`<div onclick=alert(1)>hi</div>`,
+		`<svg onload=alert(1)>`,
+		`<body onload=alert(1)>`,
+		"<iframe src=javascript:alert(1)></iframe>",
+		"plain <b>bold</b> and <i>italic</i>",
+		strings.Repeat("a", maxMessageLen*4-1),
+		strings.Repeat("a", maxMessageLen*4+1),
+		strings.Repeat("é", maxMessageLen+10),
+		"\u200b\u200c\u200dzero-width",
+		"\u202ereversed bidi text\u202c",
+		"<<script>script>alert(1)<</script>/script>",
+		"&lt;script&gt;alert(1)&lt;/script&gt;",
+		"<script src=//evil.example/x.js></script>",
+		"\x00\x01\x02 control chars",
+		"line1\nline2\r\nline3",
+		strings.Repeat("<img onerror=alert(1) src=x>", 50),
+	}
+	for _, s := range seeds {
+		f.Add(s, true)
+		f.Add(s, false)
+	}
+
+	f.Fuzz(func(t *testing.T, raw string, allowEmpty bool) {
+		out, err := sanitizeContent(raw, allowEmpty)
+		if err != nil {
+			// sanitizeContent may legitimately reject input (too long, or
+			// empty when not allowed); nothing further to check.
+			return
+		}
+
+		lower := strings.ToLower(out)
+		if strings.Contains(lower, "<script") {
+			t.Fatalf("sanitizeContent(%q, %v) = %q: contains an active <script sink", raw, allowEmpty, out)
+		}
+		if jsURLInTag.MatchString(out) {
+			t.Fatalf("sanitizeContent(%q, %v) = %q: contains a javascript: URL sink inside a surviving tag", raw, allowEmpty, out)
+		}
+		if onEventAttr.MatchString(out) {
+			t.Fatalf("sanitizeContent(%q, %v) = %q: contains an on-event handler attribute", raw, allowEmpty, out)
+		}
+		if n := utf8.RuneCountInString(out); n > maxMessageLen {
+			t.Fatalf("sanitizeContent(%q, %v) = %q: %d runes exceeds maxMessageLen %d", raw, allowEmpty, out, n, maxMessageLen)
+		}
+
+		// Idempotency: re-sanitizing already-sanitized output must be a
+		// no-op. allowEmpty=true so a legitimately-empty `out` doesn't
+		// spuriously error on the second pass.
+		out2, err2 := sanitizeContent(out, true)
+		if err2 != nil {
+			t.Fatalf("sanitizeContent(%q, %v) = %q, but re-sanitizing it failed: %v", raw, allowEmpty, out, err2)
+		}
+		if out2 != out {
+			t.Fatalf("sanitizeContent not idempotent: sanitizeContent(%q,true) = %q, sanitizing that again gave %q", raw, out, out2)
+		}
+	})
+}
diff --git a/Server/service/seed_test.go b/Server/service/seed_test.go
index 163c2432..30ace65b 100644
--- a/Server/service/seed_test.go
+++ b/Server/service/seed_test.go
@@ -35,6 +35,18 @@ func newTestDB(t *testing.T) *db.DB {
 // collides with one of the migration-seeded defaults).
 func seedRole(t *testing.T, database *db.DB, r *db.Role) {
 	t.Helper()
+	// Migration 023 made role names unique case-insensitively, so a test that
+	// redefines role 3 as "member" now collides with the seeded "Member"
+	// (role 4). Free the name from whichever OTHER role holds it rather than
+	// making every test pick names that dodge the four defaults — the
+	// displaced role keeps its id, permissions and position, which is all the
+	// tests read it for.
+	if _, err := database.ExecContext(context.Background(),
+		`UPDATE roles SET name = name || ' #' || id WHERE name = ? COLLATE NOCASE AND id != ?`,
+		r.Name, r.ID,
+	); err != nil {
+		t.Fatalf("seedRole(%d) freeing name %q: %v", r.ID, r.Name, err)
+	}
 	_, err := database.ExecContext(context.Background(),
 		`INSERT INTO roles (id, name, color, permissions, position, is_default)
 		 VALUES (?, ?, ?, ?, ?, 0)
diff --git a/Server/service/service.go b/Server/service/service.go
index 081e9689..6c84217e 100644
--- a/Server/service/service.go
+++ b/Server/service/service.go
@@ -20,6 +20,8 @@ type Services struct {
 	Invites     *InviteService
 	Blocks      *BlockService
 	Moderation  *ModerationService
+	Roles       *RoleService
+	Emoji       *EmojiService
 }
 
 // New creates all domain services wired together.
@@ -35,5 +37,7 @@ func New(st Store, limiter *auth.RateLimiter) *Services {
 		Invites:     NewInviteService(st),
 		Blocks:      NewBlockService(st),
 		Moderation:  NewModerationService(st, permSvc),
+		Roles:       NewRoleService(st, permSvc),
+		Emoji:       NewEmojiService(st, permSvc),
 	}
 }
diff --git a/Server/service/testdata/fuzz/FuzzSanitizeContent/c597d5b9888593d8 b/Server/service/testdata/fuzz/FuzzSanitizeContent/c597d5b9888593d8
new file mode 100644
index 00000000..9144487d
--- /dev/null
+++ b/Server/service/testdata/fuzz/FuzzSanitizeContent/c597d5b9888593d8
@@ -0,0 +1,3 @@
+go test fuzz v1
+string("jAvAsCript:0")
+bool(false)
diff --git a/Server/service/testdata/fuzz/FuzzSanitizeContent/d5f11853eed0e37f b/Server/service/testdata/fuzz/FuzzSanitizeContent/d5f11853eed0e37f
new file mode 100644
index 00000000..2160f2cd
--- /dev/null
+++ b/Server/service/testdata/fuzz/FuzzSanitizeContent/d5f11853eed0e37f
@@ -0,0 +1,3 @@
+go test fuzz v1
+string("on0=")
+bool(true)
diff --git a/Server/service/user.go b/Server/service/user.go
index acd3a207..7f4ebed0 100644
--- a/Server/service/user.go
+++ b/Server/service/user.go
@@ -5,7 +5,9 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"strings"
 	"time"
+	"unicode/utf8"
 
 	"github.com/owncord/server/db"
 	"github.com/owncord/server/telemetry"
@@ -21,9 +23,71 @@ func NewUserService(st Store) *UserService {
 	return &UserService{st: st}
 }
 
-// UpdateProfile updates a user's username and/or avatar.
-// Returns the updated user for response building.
-func (s *UserService) UpdateProfile(ctx context.Context, userID int64, username string, avatar *string) (*db.User, error) {
+// AvatarFileURL is the server-relative path an uploaded avatar is served from.
+// It is the ordinary attachment route: the upload handler writes an attachment
+// row and points users.avatar here, and handleServeFile admits an unlinked
+// attachment that some user's avatar names. Defined once because three places
+// have to agree on the spelling — the upload response, the stored column, and
+// the file route's authorization probe, which matches the column *by string*.
+func AvatarFileURL(fileID string) string {
+	return "/api/v1/files/" + fileID
+}
+
+// ─── Profile field bounds ───────────────────────────────────────────────────
+
+const (
+	// MaxDisplayNameLen bounds users.display_name. 32 matches the username
+	// cap: a nickname that could not fit where a username fits would render
+	// clipped in exactly the places the fallback puts the username.
+	MaxDisplayNameLen = 32
+	// MaxAboutLen bounds users.about — long enough for a paragraph, short
+	// enough that the popup's two-line section stays a section.
+	MaxAboutLen = 300
+	// MaxCustomStatusLen bounds users.custom_status: one line under a name.
+	MaxCustomStatusLen = 128
+)
+
+// ProfilePatch is a partial update to a user's profile. A nil field means
+// "leave unchanged"; a non-nil pointer to the empty string clears the nullable
+// fields (display name, about). The free-text fields are sanitized and
+// length-checked *here* rather than in the handler, so every transport that
+// can reach a profile gets the same rules.
+type ProfilePatch struct {
+	Username    string
+	Avatar      *string
+	DisplayName *string
+	About       *string
+}
+
+// nullable turns a sanitized, trimmed patch value into the column value:
+// empty string clears the column, anything else is stored as-is.
+func nullable(v string) *string {
+	if v == "" {
+		return nil
+	}
+	return &v
+}
+
+// cleanText strips HTML and trims a free-text profile field. Both the profile
+// PATCH and the presence path run values through it before any bound check, so
+// a payload cannot buy length with markup that is about to be stripped anyway.
+func cleanText(v string) string {
+	return strings.TrimSpace(sanitizer.Sanitize(v))
+}
+
+// resolveOptional picks the column value for one nullable text field: the
+// sanitized patch when it was supplied, the existing row otherwise.
+func resolveOptional(patch *string, existing *string) *string {
+	if patch == nil {
+		return existing
+	}
+	return nullable(cleanText(*patch))
+}
+
+// UpdateProfile applies a ProfilePatch: username and avatar as before, plus
+// the nullable display name and about text. Returns the updated user for
+// response building.
+func (s *UserService) UpdateProfile(ctx context.Context, userID int64, patch ProfilePatch) (*db.User, error) {
 	ctx, span := telemetry.GlobalTracer("service/user").Start(ctx, "UserService.UpdateProfile",
 		telemetry.Int64("user_id", userID),
 	)
@@ -34,7 +98,28 @@ func (s *UserService) UpdateProfile(ctx context.Context, userID int64, username
 		span.End()
 	}()
 
-	if err := s.st.UpdateUserProfile(ctx, userID, username, avatar); err != nil {
+	if patch.DisplayName != nil && utf8.RuneCountInString(cleanText(*patch.DisplayName)) > MaxDisplayNameLen {
+		return nil, fmt.Errorf("%w: display_name must be at most %d characters", ErrBadRequest, MaxDisplayNameLen)
+	}
+	if patch.About != nil && utf8.RuneCountInString(cleanText(*patch.About)) > MaxAboutLen {
+		return nil, fmt.Errorf("%w: about must be at most %d characters", ErrBadRequest, MaxAboutLen)
+	}
+
+	// The update writes every column, so a partial patch has to be merged
+	// against the current row first — otherwise setting only a display name
+	// would silently clear the about text.
+	current, err := s.st.GetUserByID(ctx, userID)
+	if err != nil || current == nil {
+		return nil, fmt.Errorf("%w: user not found", ErrNotFound)
+	}
+	avatar := current.Avatar
+	if patch.Avatar != nil {
+		avatar = nullable(*patch.Avatar)
+	}
+	displayName := resolveOptional(patch.DisplayName, current.DisplayName)
+	about := resolveOptional(patch.About, current.About)
+
+	if err := s.st.UpdateUserProfile(ctx, userID, patch.Username, avatar, displayName, about); err != nil {
 		if db.IsUniqueConstraintError(err) {
 			return nil, fmt.Errorf("%w: username is already taken", ErrConflict)
 		}
@@ -46,11 +131,36 @@ func (s *UserService) UpdateProfile(ctx context.Context, userID int64, username
 	}
 	// Audit rows must survive a request canceled after the write committed.
 	db.WriteAudit(context.WithoutCancel(ctx), s.st, userID, "profile_update", "user", userID,
-		fmt.Sprintf("username=%s", username))
-	slog.Info("profile updated", "user_id", userID, "username", username)
+		fmt.Sprintf("username=%s", patch.Username))
+	slog.Info("profile updated", "user_id", userID, "username", patch.Username)
 	return user, nil
 }
 
+// SetCustomStatus stores (or clears, with an empty string) the user's custom
+// status line. It is the presence path's counterpart to UpdateProfile: the
+// value persists across reconnects and is cleared explicitly on logout, which
+// is why it is stored rather than held on the connection.
+func (s *UserService) SetCustomStatus(ctx context.Context, userID int64, text string) error {
+	cleaned := cleanText(text)
+	if utf8.RuneCountInString(cleaned) > MaxCustomStatusLen {
+		return fmt.Errorf("%w: custom_status must be at most %d characters", ErrBadRequest, MaxCustomStatusLen)
+	}
+	if err := s.st.UpdateUserCustomStatus(ctx, userID, nullable(cleaned)); err != nil {
+		return fmt.Errorf("%w: failed to update custom status: %v", ErrInternal, err)
+	}
+	return nil
+}
+
+// ClearCustomStatus wipes the custom status line. Called on logout: the text
+// is a "what I am doing right now" note, and leaving it standing after the
+// user signed out states something about them that is no longer true.
+func (s *UserService) ClearCustomStatus(ctx context.Context, userID int64) error {
+	if err := s.st.UpdateUserCustomStatus(ctx, userID, nil); err != nil {
+		return fmt.Errorf("%w: failed to clear custom status: %v", ErrInternal, err)
+	}
+	return nil
+}
+
 // UpdateIdentityKey publishes the user's long-term E2EE identity public key
 // (F3 voice E2EE TOFU). Last write wins; every write is audited so a key
 // rotation — which peers surface as a TOFU mismatch — leaves a trail.
diff --git a/Server/storage/storage_filename_fuzz_test.go b/Server/storage/storage_filename_fuzz_test.go
new file mode 100644
index 00000000..5388854e
--- /dev/null
+++ b/Server/storage/storage_filename_fuzz_test.go
@@ -0,0 +1,92 @@
+package storage
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// FuzzSanitizeFilename checks sanitizeFilename's own documented contract
+// (no separators, not "."/".."/"" and not a leading dot) and, more
+// importantly, its safety composition with (*Storage).resolvedPath: any name
+// that sanitizeFilename accepts must resolve to a path that both succeeds
+// and stays inside the storage directory. A name that passes sanitize but
+// escapes the directory in resolvedPath would be a real path-traversal bug.
+func FuzzSanitizeFilename(f *testing.F) {
+	seeds := []string{
+		"",
+		".",
+		"..",
+		"...",
+		"/",
+		"\\",
+		"a/b",
+		"a\\b",
+		".hidden",
+		"..secret",
+		"normal-file.txt",
+		"/etc/passwd",
+		"../../../etc/passwd",
+		"..\\..\\windows\\system32\\config",
+		"a/../../b",
+		"~root",
+		"foo/",
+		"/foo",
+		"foo\x00bar",
+		"con",
+		"NUL",
+		strings.Repeat("a", 300),
+		"..a",
+		"a..",
+		"a.b",
+	}
+	for _, s := range seeds {
+		f.Add(s)
+	}
+
+	dir := f.TempDir()
+	s, err := New(dir, 10)
+	if err != nil {
+		f.Fatalf("New(%q, 10) failed: %v", dir, err)
+	}
+	absDir, err := filepath.Abs(dir)
+	if err != nil {
+		f.Fatalf("filepath.Abs(%q) failed: %v", dir, err)
+	}
+
+	f.Fuzz(func(t *testing.T, name string) {
+		err := sanitizeFilename(name)
+		if err != nil {
+			// sanitizeFilename rejected it -- nothing further to assert about
+			// its own contract, but we still cross-check resolvedPath below
+			// isn't the sole gatekeeper (defense in depth), so just return.
+			return
+		}
+
+		// sanitizeFilename returned nil: verify its documented contract.
+		if name == "" {
+			t.Fatalf("sanitizeFilename(%q) = nil but name is empty", name)
+		}
+		if name == "." || name == ".." {
+			t.Fatalf("sanitizeFilename(%q) = nil but name is a reserved dot-name", name)
+		}
+		if strings.HasPrefix(name, ".") {
+			t.Fatalf("sanitizeFilename(%q) = nil but name starts with '.'", name)
+		}
+		if strings.ContainsAny(name, "/\\") {
+			t.Fatalf("sanitizeFilename(%q) = nil but name contains a path separator", name)
+		}
+		if filepath.Base(name) != name {
+			t.Fatalf("sanitizeFilename(%q) = nil but filepath.Base(name) = %q differs", name, filepath.Base(name))
+		}
+
+		// Safety composition: resolvedPath must succeed and stay inside dir.
+		target, err := s.resolvedPath(name)
+		if err != nil {
+			t.Fatalf("sanitizeFilename(%q) = nil but resolvedPath failed: %v", name, err)
+		}
+		if target != absDir && !strings.HasPrefix(target, absDir+string(filepath.Separator)) {
+			t.Fatalf("sanitizeFilename(%q) = nil but resolvedPath(%q) = %q escapes storage dir %q", name, name, target, absDir)
+		}
+	})
+}
diff --git a/Server/storage/validate_filetype_fuzz_test.go b/Server/storage/validate_filetype_fuzz_test.go
new file mode 100644
index 00000000..066d3c94
--- /dev/null
+++ b/Server/storage/validate_filetype_fuzz_test.go
@@ -0,0 +1,56 @@
+package storage
+
+import (
+	"bytes"
+	"testing"
+)
+
+// FuzzValidateFileType asserts ValidateFileType never panics on any header
+// byte slice (nil, empty, short, or huge) and that it returns an error iff
+// the header actually starts with one of the blocked magic prefixes -- no
+// false positives, no false negatives.
+func FuzzValidateFileType(f *testing.F) {
+	seeds := [][]byte{
+		nil,
+		{},
+		{0},
+		[]byte("MZ"),
+		[]byte("M"),
+		[]byte("\x7fELF"),
+		[]byte("\x7fEL"),
+		[]byte("\xcf\xfa\xed\xfe"),
+		[]byte("\xce\xfa\xed\xfe"),
+		[]byte("#!"),
+		[]byte("#!/bin/sh\nrm -rf /"),
+		[]byte("\xca\xfe\xba\xbe"),
+		[]byte("\xd0\xcf\x11\xe0"),
+		[]byte("\x00asm"),
+		{0x4c, 0x00, 0x00, 0x00},
+		[]byte("PNG"),
+		[]byte("\x89PNG\r\n\x1a\n"),
+		bytes.Repeat([]byte{0xff}, 4096),
+		[]byte("GIF89a"),
+	}
+	for _, s := range seeds {
+		f.Add(s)
+	}
+
+	f.Fuzz(func(t *testing.T, header []byte) {
+		err := ValidateFileType(header)
+
+		wantBlocked := false
+		for _, blocked := range blockedMagic {
+			if len(header) >= len(blocked.magic) && bytes.Equal(header[:len(blocked.magic)], blocked.magic) {
+				wantBlocked = true
+				break
+			}
+		}
+
+		if wantBlocked && err == nil {
+			t.Fatalf("ValidateFileType(%x) = nil, want error (header matches a blocked magic prefix)", header)
+		}
+		if !wantBlocked && err != nil {
+			t.Fatalf("ValidateFileType(%x) = %v, want nil (header matches no blocked magic prefix)", header, err)
+		}
+	})
+}
diff --git a/Server/ws/channel_flags_ready_test.go b/Server/ws/channel_flags_ready_test.go
new file mode 100644
index 00000000..14b7f952
--- /dev/null
+++ b/Server/ws/channel_flags_ready_test.go
@@ -0,0 +1,102 @@
+package ws_test
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/owncord/server/db"
+)
+
+// The channel feature flags (nsfw + the two voice capacity limits) have to be
+// in `ready` and not only in the channel_update broadcast: a client that has
+// just connected has received no broadcasts, and the desktop client pre-fills
+// its edit modal and draws the sidebar's age-gate indicator straight from the
+// channel store.
+func TestBuildReady_CarriesChannelFeatureFlags(t *testing.T) {
+	hub, database := newCoverageHub(t)
+	user := seedCoverageOwner(t, database, "flags-user")
+	role, err := database.GetRoleByID(context.Background(), 1)
+	if err != nil || role == nil {
+		t.Fatalf("GetRoleByID: %v", err)
+	}
+
+	plainID, err := database.CreateChannel(context.Background(), "general", "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+	loungeID, err := database.CreateChannel(context.Background(), "lounge", "voice", "", "", 1)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+	if err := database.AdminUpdateChannel(context.Background(), loungeID, db.ChannelUpdate{
+		Name:          "lounge",
+		SlowMode:      30,
+		Position:      1,
+		NSFW:          true,
+		VoiceMaxUsers: 5,
+		VoiceMaxVideo: 2,
+	}); err != nil {
+		t.Fatalf("AdminUpdateChannel: %v", err)
+	}
+
+	msg, err := hub.BuildReadyWithRoleForTest(database, user.ID, role)
+	if err != nil {
+		t.Fatalf("BuildReadyWithRoleForTest: %v", err)
+	}
+	var env struct {
+		Payload struct {
+			Channels []map[string]any `json:"channels"`
+		} `json:"payload"`
+	}
+	if err := json.Unmarshal(msg, &env); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+
+	byID := make(map[float64]map[string]any, len(env.Payload.Channels))
+	for _, ch := range env.Payload.Channels {
+		id, ok := ch["id"].(float64)
+		if !ok {
+			t.Fatalf("channel %v has no numeric id", ch)
+		}
+		byID[id] = ch
+	}
+
+	lounge, ok := byID[float64(loungeID)]
+	if !ok {
+		t.Fatalf("lounge missing from ready channels: %v", env.Payload.Channels)
+	}
+	if lounge["nsfw"] != true {
+		t.Errorf("lounge nsfw = %v, want true", lounge["nsfw"])
+	}
+	if lounge["voice_max_users"] != float64(5) {
+		t.Errorf("lounge voice_max_users = %v, want 5", lounge["voice_max_users"])
+	}
+	if lounge["voice_max_video"] != float64(2) {
+		t.Errorf("lounge voice_max_video = %v, want 2", lounge["voice_max_video"])
+	}
+	if lounge["slow_mode"] != float64(30) {
+		t.Errorf("lounge slow_mode = %v, want 30", lounge["slow_mode"])
+	}
+
+	// An unflagged channel sends the keys with their zero values rather than
+	// omitting them — "absent" must not have to mean two different things.
+	plain, ok := byID[float64(plainID)]
+	if !ok {
+		t.Fatalf("general missing from ready channels: %v", env.Payload.Channels)
+	}
+	for key, want := range map[string]any{
+		"nsfw":            false,
+		"voice_max_users": float64(0),
+		"voice_max_video": float64(0),
+	} {
+		got, present := plain[key]
+		if !present {
+			t.Errorf("general is missing %q", key)
+			continue
+		}
+		if got != want {
+			t.Errorf("general %s = %v, want %v", key, got, want)
+		}
+	}
+}
diff --git a/Server/ws/channel_visibility_agreement_test.go b/Server/ws/channel_visibility_agreement_test.go
index 1cadf179..2311d61c 100644
--- a/Server/ws/channel_visibility_agreement_test.go
+++ b/Server/ws/channel_visibility_agreement_test.go
@@ -170,6 +170,108 @@ func TestChannelVisibility_RESTWSAgreement(t *testing.T) {
 	}
 }
 
+// TestChannelVisibility_UserOverrideAgreement extends the invariant to the
+// per-user override layer: the same three sites must agree for two members who
+// share a role but carry different channel_user_overrides rows. A per-role memo
+// anywhere in the three paths would show up here as a disagreement.
+func TestChannelVisibility_UserOverrideAgreement(t *testing.T) {
+	database := openServeTestDB(t)
+	limiter := auth.NewRateLimiter()
+	hub := ws.NewHub(database, limiter, nil)
+	svc := service.New(database, limiter)
+
+	openID, err := database.CreateChannel(context.Background(), "open", "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel open: %v", err)
+	}
+	lockedID, err := database.CreateChannel(context.Background(), "locked", "text", "", "", 1)
+	if err != nil {
+		t.Fatalf("CreateChannel locked: %v", err)
+	}
+
+	const roleMember = 4
+	// The role cannot read #locked at all.
+	if err := database.UpsertChannelOverride(context.Background(), lockedID, roleMember, 0, permissions.ReadMessages); err != nil {
+		t.Fatalf("UpsertChannelOverride: %v", err)
+	}
+
+	// Three members of the SAME role, differing only by their user override.
+	plain := seedVisibilityUser(t, database, "uo-plain", roleMember)
+	granted := seedVisibilityUser(t, database, "uo-granted", roleMember)
+	revoked := seedVisibilityUser(t, database, "uo-revoked", roleMember)
+
+	// granted: user allow on the locked channel beats the role deny.
+	if err := database.UpsertChannelUserOverride(context.Background(), lockedID, granted.ID, permissions.ReadMessages, 0); err != nil {
+		t.Fatalf("UpsertChannelUserOverride granted: %v", err)
+	}
+	// revoked: user deny on the open channel beats the base READ grant.
+	if err := database.UpsertChannelUserOverride(context.Background(), openID, revoked.ID, 0, permissions.ReadMessages); err != nil {
+		t.Fatalf("UpsertChannelUserOverride revoked: %v", err)
+	}
+
+	cases := []struct {
+		name string
+		user *db.User
+		want map[int64]bool
+	}{
+		{"no user override sees only the open channel", plain, idSet([]int64{openID})},
+		{"user allow reveals the role-denied channel", granted, idSet([]int64{openID, lockedID})},
+		{"user deny hides an otherwise readable channel", revoked, idSet([]int64{})},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			role, err := database.GetRoleByID(context.Background(), tc.user.RoleID)
+			if err != nil || role == nil {
+				t.Fatalf("GetRoleByID: %v", err)
+			}
+
+			restChans, err := svc.Channels.ListVisibleChannels(context.Background(), tc.user.ID)
+			if err != nil {
+				t.Fatalf("ListVisibleChannels: %v", err)
+			}
+			restSet := make(map[int64]bool, len(restChans))
+			for i := range restChans {
+				restSet[restChans[i].ID] = true
+			}
+
+			readyRaw, err := hub.BuildReadyWithRoleForTest(database, tc.user.ID, role)
+			if err != nil {
+				t.Fatalf("BuildReadyWithRoleForTest: %v", err)
+			}
+			var ready struct {
+				Payload struct {
+					Channels []struct {
+						ID int64 `json:"id"`
+					} `json:"channels"`
+				} `json:"payload"`
+			}
+			if err := json.Unmarshal(readyRaw, &ready); err != nil {
+				t.Fatalf("unmarshal ready: %v", err)
+			}
+			readySet := make(map[int64]bool, len(ready.Payload.Channels))
+			for _, ch := range ready.Payload.Channels {
+				readySet[ch.ID] = true
+			}
+
+			allowed, err := hub.ComputeAllowedChannelsForTest(database, tc.user)
+			if err != nil {
+				t.Fatalf("ComputeAllowedChannelsForTest: %v", err)
+			}
+
+			for label, got := range map[string]map[int64]bool{
+				"REST ListVisibleChannels": restSet,
+				"WS buildReady":            readySet,
+				"replay computeAllowed":    allowed,
+			} {
+				if !equalSets(got, tc.want) {
+					t.Errorf("%s = %v, want %v", label, sortedKeys(got), sortedKeys(tc.want))
+				}
+			}
+		})
+	}
+}
+
 func equalSets(a, b map[int64]bool) bool {
 	if len(a) != len(b) {
 		return false
diff --git a/Server/ws/command.go b/Server/ws/command.go
index a54e0b77..b93591ec 100644
--- a/Server/ws/command.go
+++ b/Server/ws/command.go
@@ -91,11 +91,18 @@ func (c TypingStartCmd) ChannelID() int64 { return c.channelID }
 type PresenceUpdateCmd struct {
 	userID int64
 	status string
+	// customStatus is nil when the payload carried no custom_status field at
+	// all, which means "leave the stored text alone". A present-but-empty
+	// string clears it. The distinction matters because the auto-idle timer
+	// sends a bare status flip several times an hour and must not wipe the
+	// text the user typed.
+	customStatus *string
 }
 
-func (c PresenceUpdateCmd) Type() string   { return MsgTypePresenceUpdate }
-func (c PresenceUpdateCmd) UserID() int64  { return c.userID }
-func (c PresenceUpdateCmd) Status() string { return c.status }
+func (c PresenceUpdateCmd) Type() string          { return MsgTypePresenceUpdate }
+func (c PresenceUpdateCmd) UserID() int64         { return c.userID }
+func (c PresenceUpdateCmd) Status() string        { return c.status }
+func (c PresenceUpdateCmd) CustomStatus() *string { return c.customStatus }
 
 // ChannelFocusCmd represents a channel_focus message.
 type ChannelFocusCmd struct {
@@ -107,6 +114,19 @@ func (c ChannelFocusCmd) Type() string     { return MsgTypeChannelFocus }
 func (c ChannelFocusCmd) UserID() int64    { return c.userID }
 func (c ChannelFocusCmd) ChannelID() int64 { return c.channelID }
 
+// MarkReadCmd represents a mark_read message: advance the caller's read state
+// for a channel without making it their focused channel. channel_focus already
+// marks read, but it also rebinds the connection's focused channel, so it is
+// the wrong tool for "mark that other channel read from its context menu".
+type MarkReadCmd struct {
+	userID    int64
+	channelID int64
+}
+
+func (c MarkReadCmd) Type() string     { return MsgTypeMarkRead }
+func (c MarkReadCmd) UserID() int64    { return c.userID }
+func (c MarkReadCmd) ChannelID() int64 { return c.channelID }
+
 // ReactionAddCmd represents a reaction_add message.
 type ReactionAddCmd struct {
 	userID    int64
@@ -197,6 +217,62 @@ func (c VoiceScreenshareCmd) Type() string  { return MsgTypeVoiceScreenshare }
 func (c VoiceScreenshareCmd) UserID() int64 { return c.userID }
 func (c VoiceScreenshareCmd) Enabled() bool { return c.enabled }
 
+// VoiceModMuteCmd represents a voice_mod_mute message: a moderator setting
+// another user's server mute. channelID is the voice channel the moderator
+// believes the target is in — the handler refuses when it disagrees, so a
+// stale sidebar cannot mute someone who has since moved.
+type VoiceModMuteCmd struct {
+	userID    int64
+	channelID int64
+	targetID  int64
+	muted     bool
+}
+
+func (c VoiceModMuteCmd) Type() string     { return MsgTypeVoiceModMute }
+func (c VoiceModMuteCmd) UserID() int64    { return c.userID }
+func (c VoiceModMuteCmd) ChannelID() int64 { return c.channelID }
+func (c VoiceModMuteCmd) TargetID() int64  { return c.targetID }
+func (c VoiceModMuteCmd) Muted() bool      { return c.muted }
+
+// VoiceModDeafenCmd represents a voice_mod_deafen message. See VoiceModMuteCmd
+// for the channelID contract.
+type VoiceModDeafenCmd struct {
+	userID    int64
+	channelID int64
+	targetID  int64
+	deafened  bool
+}
+
+func (c VoiceModDeafenCmd) Type() string     { return MsgTypeVoiceModDeafen }
+func (c VoiceModDeafenCmd) UserID() int64    { return c.userID }
+func (c VoiceModDeafenCmd) ChannelID() int64 { return c.channelID }
+func (c VoiceModDeafenCmd) TargetID() int64  { return c.targetID }
+func (c VoiceModDeafenCmd) Deafened() bool   { return c.deafened }
+
+// VoiceModMoveCmd represents a voice_mod_move message: a moderator moving a
+// user to another voice channel.
+type VoiceModMoveCmd struct {
+	userID      int64
+	targetID    int64
+	toChannelID int64
+}
+
+func (c VoiceModMoveCmd) Type() string       { return MsgTypeVoiceModMove }
+func (c VoiceModMoveCmd) UserID() int64      { return c.userID }
+func (c VoiceModMoveCmd) TargetID() int64    { return c.targetID }
+func (c VoiceModMoveCmd) ToChannelID() int64 { return c.toChannelID }
+
+// VoiceModKickCmd represents a voice_mod_kick message: a moderator
+// disconnecting a user from voice.
+type VoiceModKickCmd struct {
+	userID   int64
+	targetID int64
+}
+
+func (c VoiceModKickCmd) Type() string    { return MsgTypeVoiceModKick }
+func (c VoiceModKickCmd) UserID() int64   { return c.userID }
+func (c VoiceModKickCmd) TargetID() int64 { return c.targetID }
+
 // VoiceE2EEAnnounceCmd represents a voice_e2ee_announce message.
 // signature is the ECDSA identity-key signature over the ephemeral public key
 // (F3 TOFU); optional at the protocol level — legacy clients omit it and the
@@ -246,8 +322,73 @@ func (c VoiceE2EEOfferCmd) TargetUserID() int64  { return c.targetUserID }
 func (c VoiceE2EEOfferCmd) EncryptedKey() string { return c.encryptedKey }
 func (c VoiceE2EEOfferCmd) IV() string           { return c.iv }
 
+// CallRingCmd represents a call_ring message: "start ringing the other people
+// in this DM". It carries only the channel — who is calling is the
+// authenticated sender, and there is no call id because there is no call
+// record (see registerCallHandlers).
+type CallRingCmd struct {
+	userID    int64
+	channelID int64
+}
+
+func (c CallRingCmd) Type() string     { return MsgTypeCallRing }
+func (c CallRingCmd) UserID() int64    { return c.userID }
+func (c CallRingCmd) ChannelID() int64 { return c.channelID }
+
+// CallDeclineCmd represents a call_decline message.
+type CallDeclineCmd struct {
+	userID    int64
+	channelID int64
+}
+
+func (c CallDeclineCmd) Type() string     { return MsgTypeCallDecline }
+func (c CallDeclineCmd) UserID() int64    { return c.userID }
+func (c CallDeclineCmd) ChannelID() int64 { return c.channelID }
+
 // ── Command constructors ────────────────────────────────────────────────────
 
+// parseModTarget parses the (channel, target user) pair every voice moderation
+// payload carries. Both must be positive: a non-positive id can only come from
+// a malformed client, and rejecting at parse time keeps the handlers free of
+// id-shape checks.
+func parseModTarget(channelID, userID json.Number) (int64, int64, error) {
+	chID, err := channelID.Int64()
+	if err != nil {
+		return 0, 0, fmt.Errorf("channel_id must be integer: %w", err)
+	}
+	if chID <= 0 {
+		return 0, 0, fmt.Errorf("channel_id must be positive")
+	}
+	targetID, err := userID.Int64()
+	if err != nil {
+		return 0, 0, fmt.Errorf("user_id must be integer: %w", err)
+	}
+	if targetID <= 0 {
+		return 0, 0, fmt.Errorf("user_id must be positive")
+	}
+	return chID, targetID, nil
+}
+
+// parseCallChannelID parses the lone channel_id both call signalling payloads
+// carry. Shared so call_ring and call_decline cannot drift on what counts as a
+// valid channel reference.
+func parseCallChannelID(msgType string, raw json.RawMessage) (int64, error) {
+	var p struct {
+		ChannelID json.Number `json:"channel_id"`
+	}
+	if err := json.Unmarshal(raw, &p); err != nil {
+		return 0, fmt.Errorf("invalid %s payload: %w", msgType, err)
+	}
+	chID, err := p.ChannelID.Int64()
+	if err != nil {
+		return 0, fmt.Errorf("channel_id must be integer: %w", err)
+	}
+	if chID <= 0 {
+		return 0, fmt.Errorf("channel_id must be positive")
+	}
+	return chID, nil
+}
+
 // commandConstructors maps message types to functions that parse payloads
 // into typed Commands. The userID and reqID come from the envelope and
 // authenticated client; raw is the JSON payload body.
@@ -274,11 +415,17 @@ var commandConstructors = map[string]func(userID int64, reqID string, raw json.R
 		if len(p.Attachments) > 10 {
 			return nil, fmt.Errorf("too many attachments (max 10)")
 		}
-		// TODO: validate attachment URL scheme (require https://) to prevent
-		// javascript:, data:, or file: URLs from being stored and relayed.
-		for i, url := range p.Attachments {
-			if len(url) > 2048 {
-				return nil, fmt.Errorf("attachment[%d] URL too long (max 2048)", i)
+		// These are upload IDs (UUIDs from POST /api/v1/uploads), NOT URLs: the
+		// client renders an attachment by resolving its id to /api/v1/files/{id},
+		// and SendMessage links each id through LinkAttachmentsToMessage, which
+		// keeps only ids that name a real upload owned by the sender and still
+		// unlinked. A javascript:/data: string is therefore never stored or
+		// echoed — it simply matches no row and is dropped. A scheme check would
+		// be wrong here (it would reject the legitimate UUID ids); the only
+		// bound that applies is length.
+		for i, id := range p.Attachments {
+			if len(id) > 2048 {
+				return nil, fmt.Errorf("attachment[%d] id too long (max 2048)", i)
 			}
 		}
 		attachments := make([]string, len(p.Attachments))
@@ -350,12 +497,13 @@ var commandConstructors = map[string]func(userID int64, reqID string, raw json.R
 
 	MsgTypePresenceUpdate: func(userID int64, _ string, raw json.RawMessage) (Command, error) {
 		var p struct {
-			Status string `json:"status"`
+			Status       string  `json:"status"`
+			CustomStatus *string `json:"custom_status"`
 		}
 		if err := json.Unmarshal(raw, &p); err != nil {
 			return nil, fmt.Errorf("invalid presence_update payload: %w", err)
 		}
-		return PresenceUpdateCmd{userID: userID, status: p.Status}, nil
+		return PresenceUpdateCmd{userID: userID, status: p.Status, customStatus: p.CustomStatus}, nil
 	},
 
 	MsgTypeChannelFocus: func(userID int64, _ string, raw json.RawMessage) (Command, error) {
@@ -375,6 +523,39 @@ var commandConstructors = map[string]func(userID int64, reqID string, raw json.R
 		return ChannelFocusCmd{userID: userID, channelID: chID}, nil
 	},
 
+	MsgTypeMarkRead: func(userID int64, _ string, raw json.RawMessage) (Command, error) {
+		var p struct {
+			ChannelID json.Number `json:"channel_id"`
+		}
+		if err := json.Unmarshal(raw, &p); err != nil {
+			return nil, fmt.Errorf("invalid mark_read payload: %w", err)
+		}
+		chID, err := p.ChannelID.Int64()
+		if err != nil {
+			return nil, fmt.Errorf("channel_id must be integer: %w", err)
+		}
+		if chID <= 0 {
+			return nil, fmt.Errorf("channel_id must be positive")
+		}
+		return MarkReadCmd{userID: userID, channelID: chID}, nil
+	},
+
+	MsgTypeCallRing: func(userID int64, _ string, raw json.RawMessage) (Command, error) {
+		chID, err := parseCallChannelID(MsgTypeCallRing, raw)
+		if err != nil {
+			return nil, err
+		}
+		return CallRingCmd{userID: userID, channelID: chID}, nil
+	},
+
+	MsgTypeCallDecline: func(userID int64, _ string, raw json.RawMessage) (Command, error) {
+		chID, err := parseCallChannelID(MsgTypeCallDecline, raw)
+		if err != nil {
+			return nil, err
+		}
+		return CallDeclineCmd{userID: userID, channelID: chID}, nil
+	},
+
 	MsgTypeReactionAdd: func(userID int64, _ string, raw json.RawMessage) (Command, error) {
 		var p struct {
 			MessageID json.Number `json:"message_id"`
@@ -470,6 +651,70 @@ var commandConstructors = map[string]func(userID int64, reqID string, raw json.R
 		return VoiceScreenshareCmd{userID: userID, enabled: p.Enabled}, nil
 	},
 
+	MsgTypeVoiceModMute: func(userID int64, _ string, raw json.RawMessage) (Command, error) {
+		var p struct {
+			ChannelID json.Number `json:"channel_id"`
+			UserID    json.Number `json:"user_id"`
+			Muted     bool        `json:"muted"`
+		}
+		if err := json.Unmarshal(raw, &p); err != nil {
+			return nil, fmt.Errorf("invalid voice_mod_mute payload: %w", err)
+		}
+		chID, targetID, err := parseModTarget(p.ChannelID, p.UserID)
+		if err != nil {
+			return nil, err
+		}
+		return VoiceModMuteCmd{userID: userID, channelID: chID, targetID: targetID, muted: p.Muted}, nil
+	},
+
+	MsgTypeVoiceModDeafen: func(userID int64, _ string, raw json.RawMessage) (Command, error) {
+		var p struct {
+			ChannelID json.Number `json:"channel_id"`
+			UserID    json.Number `json:"user_id"`
+			Deafened  bool        `json:"deafened"`
+		}
+		if err := json.Unmarshal(raw, &p); err != nil {
+			return nil, fmt.Errorf("invalid voice_mod_deafen payload: %w", err)
+		}
+		chID, targetID, err := parseModTarget(p.ChannelID, p.UserID)
+		if err != nil {
+			return nil, err
+		}
+		return VoiceModDeafenCmd{userID: userID, channelID: chID, targetID: targetID, deafened: p.Deafened}, nil
+	},
+
+	MsgTypeVoiceModMove: func(userID int64, _ string, raw json.RawMessage) (Command, error) {
+		var p struct {
+			UserID      json.Number `json:"user_id"`
+			ToChannelID json.Number `json:"to_channel_id"`
+		}
+		if err := json.Unmarshal(raw, &p); err != nil {
+			return nil, fmt.Errorf("invalid voice_mod_move payload: %w", err)
+		}
+		toChID, targetID, err := parseModTarget(p.ToChannelID, p.UserID)
+		if err != nil {
+			return nil, err
+		}
+		return VoiceModMoveCmd{userID: userID, targetID: targetID, toChannelID: toChID}, nil
+	},
+
+	MsgTypeVoiceModKick: func(userID int64, _ string, raw json.RawMessage) (Command, error) {
+		var p struct {
+			UserID json.Number `json:"user_id"`
+		}
+		if err := json.Unmarshal(raw, &p); err != nil {
+			return nil, fmt.Errorf("invalid voice_mod_kick payload: %w", err)
+		}
+		targetID, err := p.UserID.Int64()
+		if err != nil {
+			return nil, fmt.Errorf("user_id must be integer: %w", err)
+		}
+		if targetID <= 0 {
+			return nil, fmt.Errorf("user_id must be positive")
+		}
+		return VoiceModKickCmd{userID: userID, targetID: targetID}, nil
+	},
+
 	MsgTypeVoiceE2EEAnnounce: func(userID int64, _ string, raw json.RawMessage) (Command, error) {
 		var p struct {
 			PublicKey string `json:"public_key"`
diff --git a/Server/ws/command_test.go b/Server/ws/command_test.go
index 60fd8192..f409c6e1 100644
--- a/Server/ws/command_test.go
+++ b/Server/ws/command_test.go
@@ -17,6 +17,7 @@ func allClientToServerTypes() []string {
 		MsgTypeTypingStart,
 		MsgTypePresenceUpdate,
 		MsgTypeChannelFocus,
+		MsgTypeMarkRead,
 		MsgTypeReactionAdd,
 		MsgTypeReactionRemove,
 		MsgTypeVoiceJoin,
@@ -53,6 +54,7 @@ func TestCommandTypeAndUserID(t *testing.T) {
 		{"TypingStartCmd", TypingStartCmd{userID: 5, channelID: 11}, MsgTypeTypingStart, 5},
 		{"PresenceUpdateCmd", PresenceUpdateCmd{userID: 6, status: "online"}, MsgTypePresenceUpdate, 6},
 		{"ChannelFocusCmd", ChannelFocusCmd{userID: 7, channelID: 12}, MsgTypeChannelFocus, 7},
+		{"MarkReadCmd", MarkReadCmd{userID: 7, channelID: 12}, MsgTypeMarkRead, 7},
 		{"ReactionAddCmd", ReactionAddCmd{userID: 8, messageID: 40, emoji: "👍"}, MsgTypeReactionAdd, 8},
 		{"ReactionRemoveCmd", ReactionRemoveCmd{userID: 9, messageID: 41, emoji: "👎"}, MsgTypeReactionRemove, 9},
 		{"VoiceJoinCmd", VoiceJoinCmd{userID: 10, channelID: 13}, MsgTypeVoiceJoin, 10},
@@ -87,6 +89,7 @@ func TestCommandChannelScoped(t *testing.T) {
 		{"ChatSendCmd", ChatSendCmd{channelID: 100}, 100, true},
 		{"TypingStartCmd", TypingStartCmd{channelID: 200}, 200, true},
 		{"ChannelFocusCmd", ChannelFocusCmd{channelID: 300}, 300, true},
+		{"MarkReadCmd", MarkReadCmd{channelID: 301}, 301, true},
 		{"VoiceJoinCmd", VoiceJoinCmd{channelID: 400}, 400, true},
 		{"PingCmd", PingCmd{userID: 1}, 0, false},
 		{"VoiceLeaveCmd", VoiceLeaveCmd{userID: 1}, 0, false},
@@ -200,6 +203,17 @@ func TestCommandConstructorParseValid(t *testing.T) {
 				}
 			},
 		},
+		{
+			name:    "mark_read",
+			msgType: MsgTypeMarkRead,
+			payload: `{"channel_id": 34}`,
+			checkFn: func(t *testing.T, cmd Command) {
+				mr := cmd.(MarkReadCmd)
+				if mr.ChannelID() != 34 {
+					t.Errorf("ChannelID() = %d, want 34", mr.ChannelID())
+				}
+			},
+		},
 		{
 			name:    "reaction_add",
 			msgType: MsgTypeReactionAdd,
@@ -356,6 +370,7 @@ func TestCommandConstructorRejectsInvalidJSON(t *testing.T) {
 		MsgTypeTypingStart,
 		MsgTypePresenceUpdate,
 		MsgTypeChannelFocus,
+		MsgTypeMarkRead,
 		MsgTypeReactionAdd,
 		MsgTypeReactionRemove,
 		MsgTypeVoiceJoin,
diff --git a/Server/ws/coverage_helpers_test.go b/Server/ws/coverage_helpers_test.go
index f270f63b..5bad9839 100644
--- a/Server/ws/coverage_helpers_test.go
+++ b/Server/ws/coverage_helpers_test.go
@@ -29,6 +29,8 @@ CREATE TABLE IF NOT EXISTS voice_states (
     speaking    INTEGER NOT NULL DEFAULT 0,
     camera      INTEGER NOT NULL DEFAULT 0,
     screenshare INTEGER NOT NULL DEFAULT 0,
+    server_muted    INTEGER NOT NULL DEFAULT 0,
+    server_deafened INTEGER NOT NULL DEFAULT 0,
     joined_at   TEXT    NOT NULL DEFAULT (datetime('now'))
 );
 CREATE INDEX IF NOT EXISTS idx_voice_states_channel_cov ON voice_states(channel_id);
diff --git a/Server/ws/coverage_misc_test.go b/Server/ws/coverage_misc_test.go
index f6819efb..e710d437 100644
--- a/Server/ws/coverage_misc_test.go
+++ b/Server/ws/coverage_misc_test.go
@@ -305,7 +305,7 @@ func TestHandlePresence_InvalidStatus(t *testing.T) {
 	raw, _ := json.Marshal(map[string]any{
 		"type": "presence_update",
 		"payload": map[string]any{
-			"status": "invisible", // not allowed per CLAUDE.md
+			"status": "afk", // not a protocol status (invisible IS one since phase 6)
 		},
 	})
 	hub.HandleMessageForTest(c, raw)
diff --git a/Server/ws/deps.go b/Server/ws/deps.go
index 723b0114..97da312a 100644
--- a/Server/ws/deps.go
+++ b/Server/ws/deps.go
@@ -15,9 +15,13 @@ import (
 // Handlers receive this instead of a mutable *Client pointer, making them
 // easier to test and reason about.
 type ClientInfo struct {
-	UserID         int64
-	Username       string
-	Avatar         *string
+	UserID   int64
+	Username string
+	Avatar   *string
+	// DisplayName is the connection's nickname, nil when unset. Carried
+	// alongside Username rather than replacing it: renderers fall back to the
+	// username, and mentions still resolve against it.
+	DisplayName    *string
 	RoleName       string
 	ReqID          string
 	VoiceChannelID int64  // 0 if not in a voice channel
@@ -55,6 +59,20 @@ type VoiceTokenGenerator interface {
 	URL() string
 }
 
+// VoiceModerator applies the effects of a voice moderation action that reach
+// past the acting connection: the SFU and the target's own socket. *Hub
+// implements it, and VoiceDeps carries the Hub itself so SetLiveKit's late
+// wiring is picked up at call time (same reason as VoiceTokenGenerator).
+type VoiceModerator interface {
+	// MuteParticipant mutes or unmutes the target's published audio at the SFU.
+	MuteParticipant(ctx context.Context, channelID, userID int64, voiceJoinToken string, muted bool) error
+	// DisconnectFromVoice runs the voice-leave routine for the target's
+	// connection. Reports false when the target has no connection on this node.
+	DisconnectFromVoice(ctx context.Context, userID int64) bool
+	// SendToUser delivers one server->client frame to the target.
+	SendToUser(userID int64, msg []byte) bool
+}
+
 // KeyHolderChecker reports whether a user is the E2EE key holder for a voice channel.
 type KeyHolderChecker interface {
 	IsVoiceKeyHolder(channelID, userID int64) bool
@@ -83,6 +101,7 @@ type VoiceDeps struct {
 	LiveKit   *LiveKitClient
 	TokenGen  VoiceTokenGenerator // used by voice_token_refresh V2
 	KeyHolder KeyHolderChecker    // used by voice_token_refresh V2
+	Mod       VoiceModerator      // used by the voice moderation handlers
 }
 
 // ── V2 permission helpers ───────────────────────────────────────────────────
@@ -124,7 +143,7 @@ func requirePerm(ctx context.Context, database *db.DB, perms *permissions.Checke
 		r := Result{Error: ClientError{Code: ErrCodeForbidden, Message: "missing " + label + " permission"}}
 		return &r
 	}
-	if !perms.HasChannelPerm(ctx, role.Permissions, role.ID, channelID, perm) {
+	if !perms.HasChannelPerm(ctx, role.Permissions, role.ID, userID, channelID, perm) {
 		r := Result{Error: ClientError{Code: ErrCodeForbidden, Message: "missing " + label + " permission"}}
 		return &r
 	}
@@ -146,7 +165,7 @@ func hasPerm(ctx context.Context, database *db.DB, perms *permissions.Checker, p
 	if err != nil || role == nil {
 		return false
 	}
-	return perms.HasChannelPerm(ctx, role.Permissions, role.ID, channelID, perm)
+	return perms.HasChannelPerm(ctx, role.Permissions, role.ID, userID, channelID, perm)
 }
 
 // hasChannelAccess is the gate to use when the channel id comes from the client:
@@ -217,7 +236,7 @@ func hasChannelAccessLive(ctx context.Context, database *db.DB, perms *permissio
 	if err != nil || role == nil {
 		return false
 	}
-	if !perms.HasChannelPerm(ctx, role.Permissions, role.ID, channelID, perm) {
+	if !perms.HasChannelPerm(ctx, role.Permissions, role.ID, userID, channelID, perm) {
 		return false
 	}
 	ch, err := database.GetChannel(ctx, channelID)
diff --git a/Server/ws/dm_group_call_test.go b/Server/ws/dm_group_call_test.go
new file mode 100644
index 00000000..ded6f86e
--- /dev/null
+++ b/Server/ws/dm_group_call_test.go
@@ -0,0 +1,334 @@
+package ws_test
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/ws"
+)
+
+// absenceWindow is how long an "it must NOT arrive" assertion waits. The
+// dispatch it is watching for is synchronous, so anything that was going to
+// land has landed well inside it.
+const absenceWindow = 100 * time.Millisecond
+
+// ─── helpers ────────────────────────────────────────────────────────────────
+
+// seedGroupDM creates a group DM containing every listed user.
+func seedGroupDM(t *testing.T, database *db.DB, name string, userIDs ...int64) int64 {
+	t.Helper()
+	ch, err := database.CreateGroupDMChannel(context.Background(), name, userIDs)
+	if err != nil {
+		t.Fatalf("seedGroupDM: %v", err)
+	}
+	return ch.ID
+}
+
+func callMsg(msgType string, channelID int64) []byte {
+	raw, _ := json.Marshal(map[string]any{
+		"type":    msgType,
+		"payload": map[string]any{"channel_id": channelID},
+	})
+	return raw
+}
+
+// ─── group DM fan-out ───────────────────────────────────────────────────────
+
+// A chat_send into a group DM must reach every other participant, not just
+// "the recipient" — the single-recipient assumption the DM path started with.
+func TestGroupDM_ChatSendFansOutToAllParticipants(t *testing.T) {
+	hub, database := newHandlerHub(t)
+	alice := seedOwnerUser(t, database, "grp-send-alice")
+	bob := seedMemberUser(t, database, "grp-send-bob")
+	carol := seedMemberUser(t, database, "grp-send-carol")
+	chID := seedGroupDM(t, database, "Trio", alice.ID, bob.ID, carol.ID)
+
+	sendAlice := make(chan []byte, 64)
+	sendBob := make(chan []byte, 64)
+	sendCarol := make(chan []byte, 64)
+	cAlice := ws.NewTestClientWithUser(hub, alice, chID, sendAlice)
+	cBob := ws.NewTestClientWithUser(hub, bob, chID, sendBob)
+	cCarol := ws.NewTestClientWithUser(hub, carol, chID, sendCarol)
+	hub.Register(cAlice)
+	hub.Register(cBob)
+	hub.Register(cCarol)
+	waitRegistered(t, hub, cCarol)
+
+	hub.HandleMessageForTest(cAlice, dmChatSendMsg(chID, "hello everyone"))
+
+	if dmWaitMsgType(sendBob, "chat_message", waitTimeout) == nil {
+		t.Error("bob did not receive the group message")
+	}
+	if dmWaitMsgType(sendCarol, "chat_message", waitTimeout) == nil {
+		t.Error("carol did not receive the group message")
+	}
+}
+
+// Every recipient's dm_channel_open must describe the group from *their* seat:
+// they never appear in their own recipients list, and the list is the other two.
+func TestGroupDM_ChannelOpenIsPerViewer(t *testing.T) {
+	hub, database := newHandlerHub(t)
+	alice := seedOwnerUser(t, database, "grp-open-alice")
+	bob := seedMemberUser(t, database, "grp-open-bob")
+	carol := seedMemberUser(t, database, "grp-open-carol")
+	chID := seedGroupDM(t, database, "Openers", alice.ID, bob.ID, carol.ID)
+
+	// A closed DM is what makes the send re-open it and emit dm_channel_open.
+	if err := database.CloseDM(context.Background(), bob.ID, chID); err != nil {
+		t.Fatalf("CloseDM: %v", err)
+	}
+	if err := database.CloseDM(context.Background(), carol.ID, chID); err != nil {
+		t.Fatalf("CloseDM: %v", err)
+	}
+
+	sendAlice := make(chan []byte, 64)
+	sendBob := make(chan []byte, 64)
+	cAlice := ws.NewTestClientWithUser(hub, alice, chID, sendAlice)
+	cBob := ws.NewTestClientWithUser(hub, bob, chID, sendBob)
+	hub.Register(cAlice)
+	hub.Register(cBob)
+	waitRegistered(t, hub, cBob)
+
+	hub.HandleMessageForTest(cAlice, dmChatSendMsg(chID, "ping"))
+
+	env := dmWaitMsgType(sendBob, "dm_channel_open", waitTimeout)
+	if env == nil {
+		t.Fatal("bob did not receive dm_channel_open")
+	}
+	payload, _ := env["payload"].(map[string]any)
+	if payload["is_group"] != true {
+		t.Errorf("expected is_group=true, got %v", payload["is_group"])
+	}
+	if payload["name"] != "Openers" {
+		t.Errorf("expected the group name on the wire, got %v", payload["name"])
+	}
+	recips, _ := payload["recipients"].([]any)
+	if len(recips) != 2 {
+		t.Fatalf("expected bob to see 2 other participants, got %d", len(recips))
+	}
+	for _, r := range recips {
+		m, _ := r.(map[string]any)
+		if int64(m["id"].(float64)) == bob.ID {
+			t.Error("bob appears in his own recipients list")
+		}
+	}
+}
+
+// Typing already fanned out over dm_participants; this pins that a group's
+// third member is included and the sender is not.
+func TestGroupDM_TypingReachesAllOthers(t *testing.T) {
+	hub, database := newHandlerHub(t)
+	alice := seedOwnerUser(t, database, "grp-type-alice")
+	bob := seedMemberUser(t, database, "grp-type-bob")
+	carol := seedMemberUser(t, database, "grp-type-carol")
+	chID := seedGroupDM(t, database, "Typers", alice.ID, bob.ID, carol.ID)
+
+	sendAlice := make(chan []byte, 64)
+	sendBob := make(chan []byte, 64)
+	sendCarol := make(chan []byte, 64)
+	cAlice := ws.NewTestClientWithUser(hub, alice, chID, sendAlice)
+	cBob := ws.NewTestClientWithUser(hub, bob, chID, sendBob)
+	cCarol := ws.NewTestClientWithUser(hub, carol, chID, sendCarol)
+	hub.Register(cAlice)
+	hub.Register(cBob)
+	hub.Register(cCarol)
+	waitRegistered(t, hub, cCarol)
+
+	hub.HandleMessageForTest(cAlice, dmTypingMsg(chID))
+
+	if dmWaitMsgType(sendBob, "typing", waitTimeout) == nil {
+		t.Error("bob did not receive the typing indicator")
+	}
+	if dmWaitMsgType(sendCarol, "typing", waitTimeout) == nil {
+		t.Error("carol did not receive the typing indicator")
+	}
+	if got := dmFindMsgType(dmDrainAll(sendAlice), "typing"); got != nil {
+		t.Error("the typist received their own typing indicator")
+	}
+}
+
+// A block between two members of a group must NOT silence the group: the
+// composer gate is a 1:1 rule, and dropping one member's messages for one
+// other member would leave them reading different conversations.
+func TestGroupDM_BlockDoesNotSilenceGroupSend(t *testing.T) {
+	hub, database := newHandlerHub(t)
+	alice := seedOwnerUser(t, database, "grp-blk-alice")
+	bob := seedMemberUser(t, database, "grp-blk-bob")
+	carol := seedMemberUser(t, database, "grp-blk-carol")
+	chID := seedGroupDM(t, database, "Blockers", alice.ID, bob.ID, carol.ID)
+
+	if err := database.BlockUser(context.Background(), bob.ID, alice.ID); err != nil {
+		t.Fatalf("BlockUser: %v", err)
+	}
+
+	sendAlice := make(chan []byte, 64)
+	sendCarol := make(chan []byte, 64)
+	cAlice := ws.NewTestClientWithUser(hub, alice, chID, sendAlice)
+	cCarol := ws.NewTestClientWithUser(hub, carol, chID, sendCarol)
+	hub.Register(cAlice)
+	hub.Register(cCarol)
+	waitRegistered(t, hub, cCarol)
+
+	hub.HandleMessageForTest(cAlice, dmChatSendMsg(chID, "still a room"))
+
+	if dmWaitMsgType(sendAlice, "chat_send_ok", waitTimeout) == nil {
+		t.Error("a group send was refused because of a block between two members")
+	}
+	if dmWaitMsgType(sendCarol, "chat_message", waitTimeout) == nil {
+		t.Error("carol did not receive the group message")
+	}
+}
+
+// A 1:1 block must still bite — the group exemption is not a general one.
+func TestOneToOneDM_BlockStillRefusesSend(t *testing.T) {
+	hub, database := newHandlerHub(t)
+	alice := seedOwnerUser(t, database, "one-blk-alice")
+	bob := seedMemberUser(t, database, "one-blk-bob")
+	chID := seedDMChannel(t, database, alice.ID, bob.ID)
+
+	if err := database.BlockUser(context.Background(), bob.ID, alice.ID); err != nil {
+		t.Fatalf("BlockUser: %v", err)
+	}
+
+	sendAlice := make(chan []byte, 64)
+	cAlice := ws.NewTestClientWithUser(hub, alice, chID, sendAlice)
+	hub.Register(cAlice)
+	waitRegistered(t, hub, cAlice)
+
+	hub.HandleMessageForTest(cAlice, dmChatSendMsg(chID, "blocked"))
+
+	if code := dmFindErrorCode(dmCollectAll(sendAlice, absenceWindow)); code != "FORBIDDEN" {
+		t.Errorf("expected FORBIDDEN on a blocked 1:1 send, got %q", code)
+	}
+}
+
+// ─── call ringing ───────────────────────────────────────────────────────────
+
+func TestCallRing_ForwardsToOtherParticipants(t *testing.T) {
+	hub, database := newHandlerHub(t)
+	alice := seedOwnerUser(t, database, "ring-alice")
+	bob := seedMemberUser(t, database, "ring-bob")
+	carol := seedMemberUser(t, database, "ring-carol")
+	chID := seedGroupDM(t, database, "Ringers", alice.ID, bob.ID, carol.ID)
+
+	sendAlice := make(chan []byte, 64)
+	sendBob := make(chan []byte, 64)
+	sendCarol := make(chan []byte, 64)
+	cAlice := ws.NewTestClientWithUser(hub, alice, chID, sendAlice)
+	cBob := ws.NewTestClientWithUser(hub, bob, chID, sendBob)
+	cCarol := ws.NewTestClientWithUser(hub, carol, chID, sendCarol)
+	hub.Register(cAlice)
+	hub.Register(cBob)
+	hub.Register(cCarol)
+	waitRegistered(t, hub, cCarol)
+
+	hub.HandleMessageForTest(cAlice, callMsg("call_ring", chID))
+
+	env := dmWaitMsgType(sendBob, "call_incoming", waitTimeout)
+	if env == nil {
+		t.Fatal("bob did not receive call_incoming")
+	}
+	payload, _ := env["payload"].(map[string]any)
+	if int64(payload["channel_id"].(float64)) != chID {
+		t.Errorf("call_incoming carried channel %v, want %d", payload["channel_id"], chID)
+	}
+	if int64(payload["from_user"].(float64)) != alice.ID {
+		t.Errorf("call_incoming carried from_user %v, want %d", payload["from_user"], alice.ID)
+	}
+	if dmWaitMsgType(sendCarol, "call_incoming", waitTimeout) == nil {
+		t.Error("carol did not receive call_incoming")
+	}
+	// The ringer must not ring themselves.
+	if got := dmFindMsgType(dmDrainAll(sendAlice), "call_incoming"); got != nil {
+		t.Error("the ringer received their own call_incoming")
+	}
+}
+
+func TestCallRing_NonParticipantForbidden(t *testing.T) {
+	hub, database := newHandlerHub(t)
+	alice := seedOwnerUser(t, database, "ring-perm-alice")
+	bob := seedMemberUser(t, database, "ring-perm-bob")
+	mallory := seedMemberUser(t, database, "ring-perm-mallory")
+	chID := seedDMChannel(t, database, alice.ID, bob.ID)
+
+	sendMallory := make(chan []byte, 64)
+	sendBob := make(chan []byte, 64)
+	cMallory := ws.NewTestClientWithUser(hub, mallory, chID, sendMallory)
+	cBob := ws.NewTestClientWithUser(hub, bob, chID, sendBob)
+	hub.Register(cMallory)
+	hub.Register(cBob)
+	waitRegistered(t, hub, cBob)
+
+	hub.HandleMessageForTest(cMallory, callMsg("call_ring", chID))
+
+	if code := dmFindErrorCode(dmCollectAll(sendMallory, absenceWindow)); code != "FORBIDDEN" {
+		t.Errorf("expected FORBIDDEN ringing a DM she is not in, got %q", code)
+	}
+	if got := dmFindMsgType(dmDrainAll(sendBob), "call_incoming"); got != nil {
+		t.Error("a non-participant's ring reached a participant")
+	}
+}
+
+func TestCallDecline_ForwardsToOtherParticipants(t *testing.T) {
+	hub, database := newHandlerHub(t)
+	alice := seedOwnerUser(t, database, "decline-alice")
+	bob := seedMemberUser(t, database, "decline-bob")
+	chID := seedDMChannel(t, database, alice.ID, bob.ID)
+
+	sendAlice := make(chan []byte, 64)
+	sendBob := make(chan []byte, 64)
+	cAlice := ws.NewTestClientWithUser(hub, alice, chID, sendAlice)
+	cBob := ws.NewTestClientWithUser(hub, bob, chID, sendBob)
+	hub.Register(cAlice)
+	hub.Register(cBob)
+	waitRegistered(t, hub, cBob)
+
+	hub.HandleMessageForTest(cBob, callMsg("call_decline", chID))
+
+	env := dmWaitMsgType(sendAlice, "call_declined", waitTimeout)
+	if env == nil {
+		t.Fatal("the ringer did not receive call_declined")
+	}
+	payload, _ := env["payload"].(map[string]any)
+	if int64(payload["from_user"].(float64)) != bob.ID {
+		t.Errorf("call_declined carried from_user %v, want %d", payload["from_user"], bob.ID)
+	}
+}
+
+func TestCallRing_RateLimited(t *testing.T) {
+	hub, database := newHandlerHub(t)
+	alice := seedOwnerUser(t, database, "ringlimit-alice")
+	bob := seedMemberUser(t, database, "ringlimit-bob")
+	chID := seedDMChannel(t, database, alice.ID, bob.ID)
+
+	sendAlice := make(chan []byte, 64)
+	cAlice := ws.NewTestClientWithUser(hub, alice, chID, sendAlice)
+	hub.Register(cAlice)
+	waitRegistered(t, hub, cAlice)
+
+	hub.HandleMessageForTest(cAlice, callMsg("call_ring", chID))
+	hub.HandleMessageForTest(cAlice, callMsg("call_ring", chID))
+
+	if code := dmFindErrorCode(dmCollectAll(sendAlice, absenceWindow)); code != "RATE_LIMITED" {
+		t.Errorf("expected RATE_LIMITED on a second immediate ring, got %q", code)
+	}
+}
+
+func TestCallRing_RejectsNonPositiveChannel(t *testing.T) {
+	hub, database := newHandlerHub(t)
+	alice := seedOwnerUser(t, database, "ringbad-alice")
+
+	sendAlice := make(chan []byte, 64)
+	cAlice := ws.NewTestClientWithUser(hub, alice, 0, sendAlice)
+	hub.Register(cAlice)
+	waitRegistered(t, hub, cAlice)
+
+	hub.HandleMessageForTest(cAlice, callMsg("call_ring", 0))
+
+	if code := dmFindErrorCode(dmCollectAll(sendAlice, absenceWindow)); code != "BAD_REQUEST" {
+		t.Errorf("expected BAD_REQUEST for channel_id 0, got %q", code)
+	}
+}
diff --git a/Server/ws/errors.go b/Server/ws/errors.go
index 5abcbb7c..f92dc010 100644
--- a/Server/ws/errors.go
+++ b/Server/ws/errors.go
@@ -18,4 +18,7 @@ const (
 	ErrCodeConflict      = "CONFLICT"
 	ErrCodeBadPayload    = "BAD_PAYLOAD"
 	ErrCodeNotKeyHolder  = "NOT_KEY_HOLDER"
+	// Returned when a user tries to lift a moderator-imposed voice state.
+	ErrCodeServerMuted    = "SERVER_MUTED"
+	ErrCodeServerDeafened = "SERVER_DEAFENED"
 )
diff --git a/Server/ws/event.go b/Server/ws/event.go
index 59267310..8370d7a7 100644
--- a/Server/ws/event.go
+++ b/Server/ws/event.go
@@ -1,5 +1,7 @@
 package ws
 
+import "github.com/owncord/server/db"
+
 // ClientError represents an error to send back to the requesting client.
 // It implements the error interface so it can be used as Result.Error.
 type ClientError struct {
@@ -240,6 +242,57 @@ type PresenceEvent struct {
 func (e PresenceEvent) EventType() string { return MsgTypePresence }
 func (e PresenceEvent) Payload() []byte   { return e.payload }
 
+// PresenceOthersEvent is the public half of an invisible user's presence: the
+// mapped ("offline") payload, broadcast to everyone except the user it
+// describes. Satisfies ExcludeSenderEvent with a channel id of 0, which
+// broadcastExcludeLow routes as a global publish minus one subscriber.
+type PresenceOthersEvent struct {
+	excludeUserID int64
+	payload       []byte
+}
+
+func (e PresenceOthersEvent) EventType() string    { return MsgTypePresence }
+func (e PresenceOthersEvent) ChannelID() int64     { return 0 }
+func (e PresenceOthersEvent) ExcludeUserID() int64 { return e.excludeUserID }
+func (e PresenceOthersEvent) Payload() []byte      { return e.payload }
+
+// PresenceSelfEvent is the private half: the owner's own true status, sent
+// only to them. Without it a user who went invisible would be told they are
+// offline by the very broadcast that hid them, and would re-announce online on
+// the next reconnect.
+type PresenceSelfEvent struct {
+	targetUserID int64
+	payload      []byte
+}
+
+func (e PresenceSelfEvent) EventType() string   { return MsgTypePresence }
+func (e PresenceSelfEvent) TargetUserID() int64 { return e.targetUserID }
+func (e PresenceSelfEvent) Payload() []byte     { return e.payload }
+
+// presenceEvents builds the events one presence change needs.
+//
+// The common case is one global broadcast. Invisible is the exception and the
+// reason this helper exists: what others see and what the owner sees differ,
+// so the broadcast excludes the owner and a second, targeted event carries
+// their real status. Every presence emitter goes through here, so no new call
+// site can leak an invisible user by forgetting the mapping.
+func presenceEvents(userID int64, status string, customStatus *string) []Event {
+	public := db.BroadcastStatus(status)
+	if public == status {
+		return []Event{PresenceEvent{payload: buildPresenceMsg(userID, status, customStatus)}}
+	}
+	return []Event{
+		PresenceOthersEvent{
+			excludeUserID: userID,
+			payload:       buildPresenceMsg(userID, public, customStatus),
+		},
+		PresenceSelfEvent{
+			targetUserID: userID,
+			payload:      buildPresenceMsg(userID, status, customStatus),
+		},
+	}
+}
+
 // ReactionChannelEvent is a reaction update broadcast to a non-DM channel.
 type ReactionChannelEvent struct {
 	channelID int64
@@ -324,3 +377,17 @@ type DMChannelOpenEvent struct {
 func (e DMChannelOpenEvent) EventType() string   { return MsgTypeDMChannelOpen }
 func (e DMChannelOpenEvent) TargetUserID() int64 { return e.targetUserID }
 func (e DMChannelOpenEvent) Payload() []byte     { return e.payload }
+
+// CallSignalEvent delivers a DM call signal (call_incoming / call_declined) to
+// one participant. Satisfies UserTargetedEvent, so an offline addressee is a
+// no-op — which is the correct behaviour for ringing: a ring that arrives
+// after the fact is worse than no ring.
+type CallSignalEvent struct {
+	eventType    string
+	targetUserID int64
+	payload      []byte
+}
+
+func (e CallSignalEvent) EventType() string   { return e.eventType }
+func (e CallSignalEvent) TargetUserID() int64 { return e.targetUserID }
+func (e CallSignalEvent) Payload() []byte     { return e.payload }
diff --git a/Server/ws/export_test.go b/Server/ws/export_test.go
index 61ca31aa..1f13596d 100644
--- a/Server/ws/export_test.go
+++ b/Server/ws/export_test.go
@@ -151,6 +151,12 @@ func ClientUserIDForTest(c *Client) int64 {
 	return c.userID
 }
 
+// ClientChannelIDForTest returns the client's currently focused channel for
+// external tests.
+func ClientChannelIDForTest(c *Client) int64 {
+	return c.getChannelID()
+}
+
 // TouchForTest exposes Client.touch for external tests.
 func TouchForTest(c *Client) {
 	c.touch()
@@ -208,6 +214,13 @@ func (h *Hub) BuildAuthOKForTest(user *db.User, roleName string) []byte {
 	return h.buildAuthOK(context.Background(), user, roleName, "none")
 }
 
+// RunMentionCountsInlineForTest makes the hub's MessageService apply mention
+// counts synchronously instead of on a background goroutine, so a test can read
+// the counts deterministically right after driving a chat_send through the hub.
+func (h *Hub) RunMentionCountsInlineForTest() {
+	h.messageSvc.RunBackgroundInlineForTest()
+}
+
 // BuildReadyForTest exposes Hub.buildReady for external tests.
 // Passes nil role so no channels are visible (fail-closed, BUG-094).
 func (h *Hub) BuildReadyForTest(database *db.DB, userID int64) ([]byte, error) {
@@ -305,9 +318,19 @@ func QualityBitrateForTest(quality string) int {
 	return qualityBitrate(quality)
 }
 
-// BuildDMChannelOpenForTest exposes buildDMChannelOpen for external tests.
+// BuildDMChannelOpenForTest exposes buildDMChannelOpenFor for external tests.
 func BuildDMChannelOpenForTest(channelID int64, recipient *db.User) []byte {
-	return buildDMChannelOpen(channelID, recipient)
+	return buildDMChannelOpenFor(channelID, recipient, 0)
+}
+
+// BuildDMChannelOpenInfoForTest exposes the group-aware buildDMChannelOpen.
+func BuildDMChannelOpenInfoForTest(info db.DMChannelInfo) []byte {
+	return buildDMChannelOpen(info)
+}
+
+// BuildCallSignalForTest exposes buildCallSignal for external tests.
+func BuildCallSignalForTest(msgType string, channelID, fromUserID int64, username string) []byte {
+	return buildCallSignal(msgType, channelID, fromUserID, username)
 }
 
 // HandleWebhookParticipantLeftForTest exposes handleWebhookParticipantLeft for
@@ -355,3 +378,11 @@ func (h *Hub) MustFullResyncForTest(lastSeq uint64) bool {
 func (h *Hub) HasChannelPermForTest(c *Client, channelID, perm int64) bool {
 	return h.hasChannelPerm(context.Background(), c, channelID, perm)
 }
+
+// BroadcastVoiceEventForTest exposes Hub.broadcastVoiceEvent for external
+// tests so a load/soak test can drive the channelReadAudience-resolved
+// voice_state/voice_leave fan-out directly, without a full LiveKit join
+// round-trip.
+func (h *Hub) BroadcastVoiceEventForTest(channelID int64, msg []byte) {
+	h.broadcastVoiceEvent(context.Background(), channelID, msg)
+}
diff --git a/Server/ws/handler_v2_mark_read_test.go b/Server/ws/handler_v2_mark_read_test.go
new file mode 100644
index 00000000..f588361c
--- /dev/null
+++ b/Server/ws/handler_v2_mark_read_test.go
@@ -0,0 +1,128 @@
+package ws_test
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/owncord/server/permissions"
+	"github.com/owncord/server/ws"
+)
+
+// ─── mark_read ──────────────────────────────────────────────────────────────
+//
+// mark_read exists because channel_focus conflates two things: "this is the
+// channel I am looking at" and "I have read this channel". Marking a *different*
+// channel read from its context menu must do the second without the first.
+
+func markReadEnvelope(channelID int64) []byte {
+	raw, _ := json.Marshal(map[string]any{
+		"type":    "mark_read",
+		"payload": map[string]any{"channel_id": channelID},
+	})
+	return raw
+}
+
+func TestMarkRead_AdvancesReadStateWithoutChangingFocus(t *testing.T) {
+	hub, database := newCoverageHub(t)
+	user := seedCoverageOwner(t, database, "markread-user")
+	focused := seedTestChannel(t, database, "markread-focused")
+	other := seedTestChannel(t, database, "markread-other")
+
+	latest, err := database.CreateMessage(context.Background(), other, user.ID, "unread", nil)
+	if err != nil {
+		t.Fatalf("CreateMessage: %v", err)
+	}
+
+	send := make(chan []byte, 16)
+	c := ws.NewTestClientWithUser(hub, user, focused, send)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+
+	hub.HandleMessageForTest(c, markReadEnvelope(other))
+
+	if code := drainForErrorCode(send, 100*time.Millisecond); code != "" {
+		t.Fatalf("unexpected error code %q for a valid mark_read", code)
+	}
+
+	// The read state for the *other* channel advanced …
+	counts, err := database.GetChannelUnreadCounts(context.Background(), user.ID)
+	if err != nil {
+		t.Fatalf("GetChannelUnreadCounts: %v", err)
+	}
+	if cu := counts[other]; cu.UnreadCount != 0 {
+		t.Errorf("unread for marked channel = %d, want 0", cu.UnreadCount)
+	}
+	if cu := counts[other]; cu.LastMessageID != latest {
+		t.Errorf("last message id = %d, want %d", cu.LastMessageID, latest)
+	}
+
+	// … while the connection still points at the channel the user is viewing.
+	if got := ws.ClientChannelIDForTest(c); got != focused {
+		t.Errorf("focused channel = %d, want %d (mark_read must not move focus)", got, focused)
+	}
+}
+
+// mark_read clears the mention badge too — read_states.mention_count is zeroed
+// by UpdateReadState, which is what makes "Mark as Read" clear a red badge.
+func TestMarkRead_ClearsMentionCount(t *testing.T) {
+	hub, database := newCoverageHub(t)
+	user := seedCoverageOwner(t, database, "markread-mention-user")
+	chID := seedTestChannel(t, database, "markread-mention-chan")
+	if _, err := database.CreateMessage(context.Background(), chID, user.ID, "@you", nil); err != nil {
+		t.Fatalf("CreateMessage: %v", err)
+	}
+	if err := database.IncrementMentionCounts(context.Background(), chID, []int64{user.ID}); err != nil {
+		t.Fatalf("IncrementMentionCounts: %v", err)
+	}
+
+	send := make(chan []byte, 16)
+	c := ws.NewTestClientWithUser(hub, user, 0, send)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+
+	hub.HandleMessageForTest(c, markReadEnvelope(chID))
+
+	counts, err := database.GetChannelUnreadCounts(context.Background(), user.ID)
+	if err != nil {
+		t.Fatalf("GetChannelUnreadCounts: %v", err)
+	}
+	if cu := counts[chID]; cu.MentionCount != 0 {
+		t.Errorf("mention count = %d, want 0", cu.MentionCount)
+	}
+}
+
+func TestMarkRead_DeniedChannelIsForbidden(t *testing.T) {
+	hub, database := newHandlerHub(t)
+	chID := seedTestChannel(t, database, "markread-denied-chan")
+	user := seedMemberUser(t, database, "markread-denied-user")
+	denyReadOnChannel(t, database, chID, permissions.MemberRoleID)
+
+	send := make(chan []byte, 16)
+	c := ws.NewTestClientWithUser(hub, user, 0, send)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+
+	hub.HandleMessageForTest(c, markReadEnvelope(chID))
+
+	if code := drainForErrorCode(send, 300*time.Millisecond); code != "FORBIDDEN" {
+		t.Errorf("error code = %q, want FORBIDDEN", code)
+	}
+}
+
+func TestMarkRead_RejectsInvalidPayload(t *testing.T) {
+	hub, database := newCoverageHub(t)
+	user := seedCoverageOwner(t, database, "markread-badpayload-user")
+
+	send := make(chan []byte, 16)
+	c := ws.NewTestClientWithUser(hub, user, 0, send)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+
+	hub.HandleMessageForTest(c, markReadEnvelope(0))
+
+	if code := drainForErrorCode(send, 300*time.Millisecond); code != "BAD_REQUEST" {
+		t.Errorf("error code = %q, want BAD_REQUEST for channel_id 0", code)
+	}
+}
diff --git a/Server/ws/handlers.go b/Server/ws/handlers.go
index 589c9799..b59da2ba 100644
--- a/Server/ws/handlers.go
+++ b/Server/ws/handlers.go
@@ -110,16 +110,18 @@ func (h *Hub) handleMessage(c *Client, raw []byte) {
 	}
 
 	var username string
-	var avatar *string
+	var avatar, displayName *string
 	if c.user != nil {
 		username = c.user.Username
 		avatar = c.user.Avatar
+		displayName = c.user.DisplayName
 	}
 	voiceChID, voiceJoinTok := c.getVoiceState()
 	info := ClientInfo{
 		UserID:         c.userID,
 		Username:       username,
 		Avatar:         avatar,
+		DisplayName:    displayName,
 		RoleName:       c.roleName,
 		ReqID:          env.ID,
 		VoiceChannelID: voiceChID,
@@ -220,7 +222,7 @@ func (h *Hub) hasChannelPerm(ctx context.Context, c *Client, channelID int64, pe
 	if err != nil || role == nil {
 		return false
 	}
-	return h.permChecker.HasChannelPerm(ctx, role.Permissions, role.ID, channelID, perm)
+	return h.permChecker.HasChannelPerm(ctx, role.Permissions, role.ID, c.userID, channelID, perm)
 }
 
 // requireChannelAccess checks whether the client may act on the channel with the
diff --git a/Server/ws/handlers_call.go b/Server/ws/handlers_call.go
new file mode 100644
index 00000000..bf5464ee
--- /dev/null
+++ b/Server/ws/handlers_call.go
@@ -0,0 +1,94 @@
+package ws
+
+import (
+	"context"
+	"time"
+
+	"github.com/owncord/server/auth"
+	"github.com/owncord/server/service"
+)
+
+// Ringing is rate limited per user rather than per (user, channel): the abuse
+// it exists to stop is spamming *someone* with call banners, and a per-channel
+// key would let one user ring five different DMs a second. One ring every three
+// seconds is far below what a human does and far above what a redial costs.
+const (
+	callRingRateLimit = 1
+	callRingWindow    = 3 * time.Second
+)
+
+// registerCallHandlers registers the DM call signalling handlers.
+//
+// There is deliberately no call state on the server. A "call" in a DM is
+// nothing more than somebody being present in that DM's voice channel — which
+// voice_state already broadcasts — and a ring is a transient nudge to come
+// look. Persisting a call row would add a thing that a crashed client can
+// leave dangling, in exchange for information the presence already carries.
+func registerCallHandlers(r *HandlerRegistry, deps CallDeps) {
+	r.RegisterV2(MsgTypeCallRing, handleCallRingV2, deps)
+	r.RegisterV2(MsgTypeCallDecline, handleCallDeclineV2, deps)
+}
+
+// handleCallRingV2 forwards a call_ring to the DM's other participants as
+// call_incoming. Only a participant of the DM may ring it; the fan-out reaches
+// whichever of them are connected, because a targeted event to an offline user
+// is a no-op by construction.
+func handleCallRingV2(ctx context.Context, cmd Command, info ClientInfo, deps any) Result {
+	d := deps.(CallDeps)
+	ringCmd := cmd.(CallRingCmd)
+
+	ratKey := auth.Key("call_ring", info.UserID)
+	if d.Limiter != nil && !d.Limiter.Allow(ratKey, callRingRateLimit, callRingWindow) {
+		return Result{Error: ClientError{Code: ErrCodeRateLimited, Message: "too many call attempts"}}
+	}
+
+	targets, err := d.DMSvc.RingTargets(ctx, info.UserID, ringCmd.ChannelID())
+	if err != nil {
+		return serviceErrorToResult(err)
+	}
+
+	payload := buildCallSignal(MsgTypeCallIncoming, ringCmd.ChannelID(), info.UserID, info.Username)
+	events := make([]Event, 0, len(targets))
+	for _, pid := range targets {
+		events = append(events, CallSignalEvent{
+			eventType:    MsgTypeCallIncoming,
+			targetUserID: pid,
+			payload:      payload,
+		})
+	}
+	return Result{Events: events}
+}
+
+// handleCallDeclineV2 tells the DM's other participants that the caller is not
+// picking up, so a ringing client can stop ringing before the 30s timeout.
+//
+// It is addressed to every other participant rather than to "the ringer"
+// because the server does not know who that was — no call state, by design —
+// and in a group DM more than one person may be ringing anyway. The decline is
+// advisory: a client that has already been answered ignores it.
+func handleCallDeclineV2(ctx context.Context, cmd Command, info ClientInfo, deps any) Result {
+	d := deps.(CallDeps)
+	declineCmd := cmd.(CallDeclineCmd)
+
+	targets, err := d.DMSvc.RingTargets(ctx, info.UserID, declineCmd.ChannelID())
+	if err != nil {
+		return serviceErrorToResult(err)
+	}
+
+	payload := buildCallSignal(MsgTypeCallDeclined, declineCmd.ChannelID(), info.UserID, info.Username)
+	events := make([]Event, 0, len(targets))
+	for _, pid := range targets {
+		events = append(events, CallSignalEvent{
+			eventType:    MsgTypeCallDeclined,
+			targetUserID: pid,
+			payload:      payload,
+		})
+	}
+	return Result{Events: events}
+}
+
+// CallDeps holds dependencies for the DM call signalling handlers.
+type CallDeps struct {
+	Limiter *auth.RateLimiter
+	DMSvc   *service.DMService
+}
diff --git a/Server/ws/handlers_chat.go b/Server/ws/handlers_chat.go
index 5910ae21..0f573da3 100644
--- a/Server/ws/handlers_chat.go
+++ b/Server/ws/handlers_chat.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 
+	"github.com/owncord/server/db"
 	"github.com/owncord/server/service"
 )
 
@@ -46,9 +47,21 @@ func handleChatSendV2(ctx context.Context, cmd Command, info ClientInfo, deps an
 	}
 
 	reply := buildChatSendOK(info.ReqID, result.MessageID, result.Timestamp)
-	broadcast := buildChatMessage(result.MessageID, sendCmd.ChannelID(), info.UserID,
-		info.Username, info.Avatar, info.RoleName, result.Content, result.Timestamp,
-		sendCmd.ReplyTo(), attData)
+	broadcast := buildChatMessage(chatMessageArgs{
+		MsgID:            result.MessageID,
+		ChannelID:        sendCmd.ChannelID(),
+		UserID:           info.UserID,
+		Username:         info.Username,
+		Avatar:           info.Avatar,
+		DisplayName:      info.DisplayName,
+		RoleName:         info.RoleName,
+		Content:          result.Content,
+		Timestamp:        result.Timestamp,
+		ReplyTo:          sendCmd.ReplyTo(),
+		Attachments:      attData,
+		Mentions:         result.Mentions,
+		MentionsEveryone: result.MentionsEveryone,
+	})
 
 	if !result.IsDM {
 		return Result{
@@ -59,11 +72,25 @@ func handleChatSendV2(ctx context.Context, cmd Command, info ClientInfo, deps an
 
 	// DM path: build dm_channel_open events + sequenced message.
 	var events []Event
-	if result.SenderUser != nil && len(result.OpenedDMFor) > 0 {
-		// The payload is identical for every recipient, so marshal it once
-		// outside the loop (delivery wraps it per-send without mutating it).
-		openPayload := buildDMChannelOpen(sendCmd.ChannelID(), result.SenderUser)
+	if len(result.OpenedDMFor) > 0 {
+		// One payload per recipient, not one for all of them: `recipient` and
+		// `recipients` are defined relative to who is reading, so a shared
+		// payload would list a group member as their own DM partner.
+		chName := ""
+		if result.Channel != nil {
+			chName = result.Channel.Name
+		}
 		for _, pid := range result.OpenedDMFor {
+			var openPayload []byte
+			if len(result.DMParticipants) > 0 {
+				openPayload = buildDMChannelOpen(
+					db.NewDMChannelInfo(sendCmd.ChannelID(), chName, result.DMIsGroup, result.DMParticipants, pid))
+			} else {
+				openPayload = buildDMChannelOpenFor(sendCmd.ChannelID(), result.SenderUser, pid)
+			}
+			if openPayload == nil {
+				continue
+			}
 			events = append(events, DMChannelOpenEvent{
 				targetUserID: pid,
 				payload:      openPayload,
@@ -90,7 +117,8 @@ func handleChatEditV2(ctx context.Context, cmd Command, info ClientInfo, deps an
 		return serviceErrorToResult(err)
 	}
 
-	editedPayload := buildChatEdited(result.MessageID, result.ChannelID, result.Content, result.EditedAt)
+	editedPayload := buildChatEdited(result.MessageID, result.ChannelID, result.Content, result.EditedAt,
+		result.Mentions, result.MentionsEveryone)
 	if result.IsDM {
 		return Result{Events: []Event{MessageEditedDMEvent{
 			channelID:      result.ChannelID,
diff --git a/Server/ws/handlers_presence.go b/Server/ws/handlers_presence.go
index 0aae0f7f..4b41b026 100644
--- a/Server/ws/handlers_presence.go
+++ b/Server/ws/handlers_presence.go
@@ -13,6 +13,7 @@ func registerPresenceHandlers(r *HandlerRegistry, deps PresenceDeps) {
 	r.RegisterV2(MsgTypeTypingStart, handleTypingV2, deps)
 	r.RegisterV2(MsgTypePresenceUpdate, handlePresenceV2, deps)
 	r.RegisterV2(MsgTypeChannelFocus, handleChannelFocusV2, deps)
+	r.RegisterV2(MsgTypeMarkRead, handleMarkReadV2, deps)
 }
 
 // handleTypingV2 is the V2 handler for typing_start messages.
@@ -68,15 +69,12 @@ func handlePresenceV2(ctx context.Context, cmd Command, info ClientInfo, deps an
 	userID := info.UserID
 	status := presenceCmd.Status()
 
-	if err := d.ChannelSvc.HandlePresenceUpdate(ctx, userID, status, d.Limiter); err != nil {
+	customStatus, err := d.ChannelSvc.HandlePresenceUpdate(ctx, userID, status, presenceCmd.CustomStatus(), d.Limiter)
+	if err != nil {
 		return serviceErrorToResult(err)
 	}
 
-	return Result{
-		Events: []Event{
-			PresenceEvent{payload: buildPresenceMsg(userID, status)},
-		},
-	}
+	return Result{Events: presenceEvents(userID, status, customStatus)}
 }
 
 // handleChannelFocusV2 is the V2 handler for channel_focus messages.
@@ -97,3 +95,22 @@ func handleChannelFocusV2(ctx context.Context, cmd Command, info ClientInfo, dep
 
 	return Result{SetChannelID: &chID}
 }
+
+// handleMarkReadV2 is the V2 handler for mark_read messages. It runs the same
+// access check and read-state advance as channel_focus but deliberately leaves
+// SetChannelID unset: marking a channel read from its context menu must not
+// move the connection's focus off the channel the user is actually looking at
+// (which would misroute typing/read bookkeeping for the visible channel).
+func handleMarkReadV2(ctx context.Context, cmd Command, info ClientInfo, deps any) Result {
+	d := deps.(PresenceDeps)
+	markCmd := cmd.(MarkReadCmd)
+
+	_, err := d.ChannelSvc.HandleChannelFocus(ctx, info.UserID, markCmd.ChannelID())
+	if err != nil {
+		if errors.Is(err, service.ErrForbidden) {
+			return Result{Error: ClientError{Code: ErrCodeForbidden, Message: "access denied"}}
+		}
+		return Result{} // silently drop other errors
+	}
+	return Result{}
+}
diff --git a/Server/ws/handlers_test.go b/Server/ws/handlers_test.go
index 665ab7a4..6cb2c1a9 100644
--- a/Server/ws/handlers_test.go
+++ b/Server/ws/handlers_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"strings"
 	"testing"
 	"testing/fstest"
 	"time"
@@ -26,6 +27,8 @@ CREATE TABLE IF NOT EXISTS voice_states (
     muted      INTEGER NOT NULL DEFAULT 0,
     deafened   INTEGER NOT NULL DEFAULT 0,
     speaking   INTEGER NOT NULL DEFAULT 0,
+    server_muted    INTEGER NOT NULL DEFAULT 0,
+    server_deafened INTEGER NOT NULL DEFAULT 0,
     joined_at  TEXT    NOT NULL DEFAULT (datetime('now'))
 );
 CREATE INDEX IF NOT EXISTS idx_voice_states_channel ON voice_states(channel_id);
@@ -1361,7 +1364,9 @@ func TestReaction_EmptyEmoji_ReturnsBadRequest(t *testing.T) {
 }
 
 // TestReaction_TooLongEmoji_ReturnsBadRequest verifies that an emoji string
-// exceeding 32 bytes is rejected.
+// past the reaction length cap is rejected. The cap is derived from the custom
+// emoji shortcode limit (32) plus its two colons, so a reaction has to clear 34
+// runes to be refused.
 func TestReaction_TooLongEmoji_ReturnsBadRequest(t *testing.T) {
 	hub, database := newHandlerHub(t)
 	user := seedOwnerUser(t, database, "react-owner5")
@@ -1373,8 +1378,8 @@ func TestReaction_TooLongEmoji_ReturnsBadRequest(t *testing.T) {
 	hub.Register(c)
 	waitRegistered(t, hub, c)
 
-	// 33-character emoji string — exceeds the 32-byte limit.
-	longEmoji := "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" // 33 chars
+	// 35 runes — one past the ":" + 32-rune shortcode + ":" ceiling.
+	longEmoji := strings.Repeat("a", 35)
 	hub.HandleMessageForTest(c, reactionMsg("reaction_add", msgID, longEmoji))
 
 	code := receiveErrorCode(send, 300*time.Millisecond)
@@ -1744,7 +1749,7 @@ func TestPresence_InvalidStatus_ReturnsBadRequest(t *testing.T) {
 	hub.Register(c)
 	waitRegistered(t, hub, c)
 
-	hub.HandleMessageForTest(c, presenceUpdateMsg("invisible"))
+	hub.HandleMessageForTest(c, presenceUpdateMsg("afk"))
 
 	code := receiveErrorCode(send, 300*time.Millisecond)
 	if code != "BAD_REQUEST" {
diff --git a/Server/ws/handlers_voice.go b/Server/ws/handlers_voice.go
index ce98ea09..4b138004 100644
--- a/Server/ws/handlers_voice.go
+++ b/Server/ws/handlers_voice.go
@@ -25,6 +25,7 @@ func registerVoiceControlsV2(r *HandlerRegistry, deps VoiceDeps) {
 	r.RegisterV2(MsgTypeVoiceE2EEAnnounce, handleVoiceE2EEAnnounceV2, deps)
 	r.RegisterV2(MsgTypeVoiceE2EEOffer, handleVoiceE2EEOfferV2, deps)
 	r.RegisterV2(MsgTypeVoiceTokenRefresh, handleVoiceTokenRefreshV2, deps)
+	registerVoiceModerationV2(r, deps)
 }
 
 // handleVoiceJoinV2 gates parsing via the VoiceJoinCmd constructor (which
diff --git a/Server/ws/hub.go b/Server/ws/hub.go
index 4b2a71e2..144bbe5d 100644
--- a/Server/ws/hub.go
+++ b/Server/ws/hub.go
@@ -136,10 +136,12 @@ func NewHub(database *db.DB, limiter *auth.RateLimiter, svc *service.Services) *
 		Limiter: h.limiter,
 	}
 	reactionDeps := ReactionDeps{}
+	callDeps := CallDeps{Limiter: h.limiter}
 	if svc != nil {
 		chatDeps.MessageSvc = svc.Messages
 		presenceDeps.ChannelSvc = svc.Channels
 		reactionDeps.MessageSvc = svc.Messages
+		callDeps.DMSvc = svc.DMs
 		h.messageSvc = svc.Messages
 		h.perms = svc.Permissions
 	}
@@ -147,6 +149,7 @@ func NewHub(database *db.DB, limiter *auth.RateLimiter, svc *service.Services) *
 	registerChatHandlers(reg, chatDeps)
 	registerPresenceHandlers(reg, presenceDeps)
 	registerReactionHandlers(reg, reactionDeps)
+	registerCallHandlers(reg, callDeps)
 	// Phase C Step 9 — plugin slash commands. Registry is read live because
 	// SetPluginRegistry wires it after NewHub; MessageSvc gates broadcasts.
 	reg.RegisterV2(MsgTypeChatCommand, handleChatCommandV2, PluginDeps{
@@ -161,6 +164,7 @@ func NewHub(database *db.DB, limiter *auth.RateLimiter, svc *service.Services) *
 		LiveKit:     h.livekit,
 		TokenGen:    h, // Hub delegates to h.livekit at call time (set via SetLiveKit)
 		KeyHolder:   h,
+		Mod:         h,
 	})
 
 	h.refreshSettingsLocked(context.Background())
diff --git a/Server/ws/hub_broadcast.go b/Server/ws/hub_broadcast.go
index 58e07abb..084f6676 100644
--- a/Server/ws/hub_broadcast.go
+++ b/Server/ws/hub_broadcast.go
@@ -114,6 +114,42 @@ func (h *Hub) channelReadAudience(ctx context.Context, channelID int64) []int64
 	}
 	h.mu.RUnlock()
 
+	// A DM channel carries no channel_overrides rows, so every connected
+	// user whose base role holds READ_MESSAGES would otherwise pass the role
+	// scan below — leaking a private DM call's voice_state/voice_leave
+	// events to the whole server. Resolve the DM's real audience (its
+	// participants, intersected with who is actually connected) instead,
+	// mirroring the IsDMParticipant membership rule hasChannelAccess uses.
+	if h.db != nil {
+		ch, err := h.db.GetChannel(ctx, channelID)
+		if err != nil {
+			// Fail closed: an unresolvable channel must not fall through to
+			// the role scan, which would treat it as a readable non-DM channel.
+			slog.Error("ws: channelReadAudience GetChannel failed, denying",
+				"channel_id", channelID, "err", err)
+			return []int64{}
+		}
+		if ch != nil && ch.Type == "dm" {
+			participantIDs, err := h.db.GetDMParticipantIDs(ctx, channelID)
+			if err != nil {
+				slog.Error("ws: channelReadAudience GetDMParticipantIDs failed, denying",
+					"channel_id", channelID, "err", err)
+				return []int64{}
+			}
+			connected := make(map[int64]struct{}, len(userIDs))
+			for _, uid := range userIDs {
+				connected[uid] = struct{}{}
+			}
+			audience := make([]int64, 0, len(participantIDs))
+			for _, uid := range participantIDs {
+				if _, ok := connected[uid]; ok {
+					audience = append(audience, uid)
+				}
+			}
+			return audience
+		}
+	}
+
 	audience := make([]int64, 0, len(userIDs))
 	if h.perms != nil {
 		for _, uid := range userIDs {
@@ -126,18 +162,16 @@ func (h *Hub) channelReadAudience(ctx context.Context, channelID int64) []int64
 	if h.db == nil || h.permChecker == nil {
 		return audience
 	}
-	visibleByRole := make(map[int64]bool)
+	// Resolved per USER, not memoised per role: channel_user_overrides is the
+	// last layer of the resolution order, so two members of the same role can
+	// legitimately disagree about one channel and a per-role memo would hand
+	// one of them the other's verdict.
 	for _, uid := range userIDs {
 		role, err := h.db.GetRoleForUser(ctx, uid)
 		if err != nil || role == nil {
 			continue
 		}
-		visible, ok := visibleByRole[role.ID]
-		if !ok {
-			visible = h.permChecker.HasChannelPerm(ctx, role.Permissions, role.ID, channelID, permissions.ReadMessages)
-			visibleByRole[role.ID] = visible
-		}
-		if visible {
+		if h.permChecker.HasChannelPerm(ctx, role.Permissions, role.ID, uid, channelID, permissions.ReadMessages) {
 			audience = append(audience, uid)
 		}
 	}
@@ -215,22 +249,21 @@ func (h *Hub) RefreshChannelVisibility(ch *db.Channel) {
 	// calling into the hub, so the lookups below repopulate from post-change
 	// data; the 30s TTL is only a backstop and the F6 gen-counter guard keeps
 	// a racing populate from caching stale rows. Without a service (bare test
-	// hubs) each role is resolved live, once.
-	visibleByRole := make(map[int64]bool)
-	roleVisible := func(roleID int64) bool {
-		if v, ok := visibleByRole[roleID]; ok {
-			return v
-		}
-		visible := false
+	// hubs) each client is resolved live.
+	//
+	// Deliberately NOT memoised per role: channel_user_overrides is the last
+	// layer of the resolution order, so two members of the same role can
+	// legitimately disagree about one channel — exactly the case a per-user
+	// override edit creates, and exactly the fan-out this function targets.
+	userVisible := func(userID, roleID int64) bool {
 		role, err := h.db.GetRoleByID(ctx, roleID)
-		if err == nil && role != nil {
-			// Single visibility predicate shared with buildReady / REST
-			// ListVisibleChannels; the checker fails closed on a lookup error
-			// and bypasses for admins, matching the other sites exactly.
-			visible = h.permChecker.HasChannelPerm(ctx, role.Permissions, roleID, ch.ID, permissions.ReadMessages)
+		if err != nil || role == nil {
+			return false
 		}
-		visibleByRole[roleID] = visible
-		return visible
+		// Single visibility predicate shared with buildReady / REST
+		// ListVisibleChannels; the checker fails closed on a lookup error
+		// and bypasses for admins, matching the other sites exactly.
+		return h.permChecker.HasChannelPerm(ctx, role.Permissions, roleID, userID, ch.ID, permissions.ReadMessages)
 	}
 
 	for _, c := range clients {
@@ -238,12 +271,17 @@ func (h *Hub) RefreshChannelVisibility(ch *db.Channel) {
 			continue
 		}
 		var visible bool
-		if h.perms != nil {
+		switch {
+		case ch.Archived:
+			// Archived channels are hidden from every client regardless of
+			// permissions, mirroring VisibleChannelIDs.
+			visible = false
+		case h.perms != nil:
 			// The service resolves the user's CURRENT role internally (c.user
 			// is a connect-time snapshot), failing closed — an unresolvable
 			// role loses visibility rather than keeping a stale grant.
 			visible = h.perms.HasChannelPerm(ctx, c.user.ID, ch.ID, permissions.ReadMessages)
-		} else {
+		default:
 			// c.user is a connect-time snapshot; an admin may have changed the
 			// user's role mid-session, so resolve the current role from the DB.
 			// Fail closed: on error send nothing rather than mis-target.
@@ -253,7 +291,7 @@ func (h *Hub) RefreshChannelVisibility(ch *db.Channel) {
 					"user_id", c.user.ID, "err", err)
 				continue
 			}
-			visible = roleVisible(fresh.RoleID)
+			visible = userVisible(fresh.ID, fresh.RoleID)
 		}
 		if visible {
 			// Idempotent add on the client; also refreshes channel metadata.
@@ -276,6 +314,64 @@ func (h *Hub) RefreshChannelVisibility(ch *db.Channel) {
 	h.visibilityChangeSeq.Store(atomic.LoadUint64(&h.seq))
 }
 
+// RefreshAllChannelVisibility re-runs RefreshChannelVisibility for every
+// non-DM channel. A role's permission mask is the base every channel's
+// effective permission is computed from, so editing or deleting a role can
+// change visibility of *any* channel at once — where a channel_overrides edit
+// touches exactly one. DM channels are skipped: their access is participant-
+// based and no role change can alter it.
+//
+// Called via the admin HubBroadcaster interface (no context), so the channel
+// list is read against Background — the re-sync must complete regardless of the
+// triggering request. The caller invalidates the permission cache first, as the
+// channel-override handlers do, so the per-client lookups below repopulate from
+// post-change data.
+func (h *Hub) RefreshAllChannelVisibility() {
+	if h.db == nil {
+		return
+	}
+	ctx := context.Background()
+	channels, err := h.db.ListChannels(ctx)
+	if err != nil {
+		slog.Warn("hub: RefreshAllChannelVisibility could not list channels", "err", err)
+		return
+	}
+	for i := range channels {
+		if channels[i].Type == "dm" {
+			continue
+		}
+		h.RefreshChannelVisibility(&channels[i])
+	}
+}
+
+// BroadcastRolesUpdate sends the full role list to every connected client so
+// name colors and permission-gated affordances converge without a reconnect.
+//
+// Unfiltered on purpose: the role list is already in every client's ready
+// payload, so it discloses nothing a connected client cannot already read.
+func (h *Hub) BroadcastRolesUpdate(roles []*db.Role) {
+	h.BroadcastToAll(buildRolesUpdate(roles))
+}
+
+// BroadcastEmojiUpdate sends the full custom-emoji set to every connected
+// client so a newly uploaded (or deleted) emoji renders in messages, the
+// picker and reaction pills without a reconnect.
+//
+// Unfiltered, like BroadcastRolesUpdate: emoji are server-wide with no channel
+// scope, and every client may already GET the same list.
+func (h *Hub) BroadcastEmojiUpdate(list []*db.Emoji) {
+	h.BroadcastToAll(buildEmojiUpdate(list))
+}
+
+// BroadcastChatBulkDeleted sends one chat_bulk_deleted message carrying every
+// purged message id to the subscribers of channelID, replacing the N separate
+// chat_deleted broadcasts a loop of single deletes would produce. Fan-out goes
+// through the ordinary sequenced channel path, so the event replays on
+// reconnect exactly like chat_deleted does.
+func (h *Hub) BroadcastChatBulkDeleted(channelID int64, messageIDs []int64) {
+	h.BroadcastToChannel(channelID, buildChatBulkDeleted(channelID, messageIDs))
+}
+
 // BroadcastMemberBan sends a member_ban message to all connected clients
 // and immediately disconnects the banned user's WebSocket connection (BUG-113).
 func (h *Hub) BroadcastMemberBan(userID int64) {
@@ -298,9 +394,24 @@ func (h *Hub) DisconnectUser(userID int64) {
 }
 
 // BroadcastUserUpdate sends a user_update message to all connected clients
-// when a user changes their profile (username, avatar, identity key).
-func (h *Hub) BroadcastUserUpdate(userID int64, username string, avatar *string, identityPublicKey *string) {
-	h.BroadcastToAll(buildUserUpdate(userID, username, avatar, identityPublicKey))
+// when a user changes their profile (username, avatar, display name, about,
+// identity key).
+func (h *Hub) BroadcastUserUpdate(u UserUpdate) {
+	h.BroadcastToAll(buildUserUpdate(u))
+}
+
+// BroadcastPresence fans a presence change out with the invisible mapping
+// applied: everyone else sees db.BroadcastStatus(status), the user themselves
+// sees the truth. It is the non-handler counterpart of presenceEvents, used by
+// the connect and disconnect paths which write to the hub directly.
+func (h *Hub) BroadcastPresence(userID int64, status string, customStatus *string) {
+	public := db.BroadcastStatus(status)
+	if public == status {
+		h.BroadcastToAll(buildPresenceMsg(userID, status, customStatus))
+		return
+	}
+	h.broadcastExcludeLow(0, userID, buildPresenceMsg(userID, public, customStatus))
+	h.SendToUser(userID, buildPresenceMsg(userID, status, customStatus))
 }
 
 // BroadcastMemberUpdate sends a member_update message to all connected clients
diff --git a/Server/ws/hub_broadcast_test.go b/Server/ws/hub_broadcast_test.go
index 45fa7e60..88cc547a 100644
--- a/Server/ws/hub_broadcast_test.go
+++ b/Server/ws/hub_broadcast_test.go
@@ -40,7 +40,7 @@ func TestHub_BroadcastUserUpdate(t *testing.T) {
 
 	avatar := "avatar.png"
 	identityKey := "pubkey-abc"
-	hub.BroadcastUserUpdate(42, "renamed", &avatar, &identityKey)
+	hub.BroadcastUserUpdate(ws.UserUpdate{UserID: 42, Username: "renamed", Avatar: &avatar, IdentityPublicKey: &identityKey})
 
 	msg := awaitMessage(t, send)
 	if msg["type"] != "user_update" {
@@ -74,7 +74,7 @@ func TestHub_BroadcastUserUpdate_NilOptionalFields(t *testing.T) {
 	send := make(chan []byte, 8)
 	hub.RegisterNowForTest(ws.NewTestClient(hub, 1, send))
 
-	hub.BroadcastUserUpdate(42, "noextras", nil, nil)
+	hub.BroadcastUserUpdate(ws.UserUpdate{UserID: 42, Username: "noextras"})
 
 	msg := awaitMessage(t, send)
 	payload, ok := msg["payload"].(map[string]any)
@@ -104,7 +104,7 @@ func TestHub_BroadcastUserUpdate_ReachesEveryClient(t *testing.T) {
 	hub.RegisterNowForTest(ws.NewTestClient(hub, 1, a))
 	hub.RegisterNowForTest(ws.NewTestClient(hub, 2, b))
 
-	hub.BroadcastUserUpdate(7, "everyone", nil, nil)
+	hub.BroadcastUserUpdate(ws.UserUpdate{UserID: 7, Username: "everyone"})
 
 	for i, ch := range []chan []byte{a, b} {
 		msg := awaitMessage(t, ch)
@@ -129,7 +129,7 @@ func TestHub_BroadcastDropCount(t *testing.T) {
 
 	send := make(chan []byte, 8)
 	hub.RegisterNowForTest(ws.NewTestClient(hub, 1, send))
-	hub.BroadcastUserUpdate(1, "u", nil, nil)
+	hub.BroadcastUserUpdate(ws.UserUpdate{UserID: 1, Username: "u"})
 	awaitMessage(t, send)
 
 	// A single delivered broadcast must not increment the drop counter.
diff --git a/Server/ws/hub_emoji_test.go b/Server/ws/hub_emoji_test.go
new file mode 100644
index 00000000..3c432da0
--- /dev/null
+++ b/Server/ws/hub_emoji_test.go
@@ -0,0 +1,107 @@
+package ws_test
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/ws"
+)
+
+// ─── emoji_update ────────────────────────────────────────────────────────────
+
+// emojiUpdatePayload mirrors the wire shape the client parses. Declared here
+// rather than reused from ws so a change to the broadcast that the client would
+// notice also fails this test.
+type emojiUpdatePayload struct {
+	Emoji []struct {
+		ID        int64  `json:"id"`
+		Shortcode string `json:"shortcode"`
+		URL       string `json:"url"`
+	} `json:"emoji"`
+}
+
+func decodeEmojiUpdate(t *testing.T, msg map[string]any) emojiUpdatePayload {
+	t.Helper()
+	raw, err := json.Marshal(msg["payload"])
+	if err != nil {
+		t.Fatalf("marshal payload: %v", err)
+	}
+	var payload emojiUpdatePayload
+	if err := json.Unmarshal(raw, &payload); err != nil {
+		t.Fatalf("unmarshal payload: %v", err)
+	}
+	return payload
+}
+
+func TestBroadcastEmojiUpdate_CarriesShortcodeAndURL(t *testing.T) {
+	hub, database := newTestHub(t)
+	go hub.Run()
+	defer hub.Stop()
+
+	user := seedOwnerUser(t, database, "emoji-owner")
+	send := make(chan []byte, 16)
+	client := ws.NewTestClientWithUser(hub, user, 0, send)
+	hub.Register(client)
+	waitRegistered(t, hub, client)
+
+	hub.BroadcastEmojiUpdate([]*db.Emoji{
+		{ID: 3, Shortcode: "wave", StoredAs: "uuid-a", MimeType: "image/png"},
+		{ID: 9, Shortcode: "party", StoredAs: "uuid-b", MimeType: "image/gif"},
+	})
+
+	payload := decodeEmojiUpdate(t, drainForMsgType(t, send, "emoji_update"))
+	if len(payload.Emoji) != 2 {
+		t.Fatalf("emoji count = %d, want 2", len(payload.Emoji))
+	}
+	if payload.Emoji[0].Shortcode != "wave" || payload.Emoji[0].URL != "/api/v1/emoji/3/image" {
+		t.Errorf("first entry = %+v, want wave at /api/v1/emoji/3/image", payload.Emoji[0])
+	}
+	if payload.Emoji[1].ID != 9 || payload.Emoji[1].URL != "/api/v1/emoji/9/image" {
+		t.Errorf("second entry = %+v, want id 9", payload.Emoji[1])
+	}
+}
+
+func TestBroadcastEmojiUpdate_EmptySetIsAnArray(t *testing.T) {
+	hub, database := newTestHub(t)
+	go hub.Run()
+	defer hub.Stop()
+
+	user := seedOwnerUser(t, database, "emoji-empty-owner")
+	send := make(chan []byte, 16)
+	client := ws.NewTestClientWithUser(hub, user, 0, send)
+	hub.Register(client)
+	waitRegistered(t, hub, client)
+
+	// Deleting the last emoji broadcasts an empty set; it must be [] and not
+	// null, so the client can replace its map unconditionally.
+	hub.BroadcastEmojiUpdate(nil)
+
+	msg := drainForMsgType(t, send, "emoji_update")
+	raw, err := json.Marshal(msg["payload"])
+	if err != nil {
+		t.Fatalf("marshal payload: %v", err)
+	}
+	if got := string(raw); got != `{"emoji":[]}` {
+		t.Errorf("payload = %s, want {\"emoji\":[]}", got)
+	}
+}
+
+func TestBroadcastEmojiUpdate_NilEntriesAreSkipped(t *testing.T) {
+	hub, database := newTestHub(t)
+	go hub.Run()
+	defer hub.Stop()
+
+	user := seedOwnerUser(t, database, "emoji-nil-owner")
+	send := make(chan []byte, 16)
+	client := ws.NewTestClientWithUser(hub, user, 0, send)
+	hub.Register(client)
+	waitRegistered(t, hub, client)
+
+	hub.BroadcastEmojiUpdate([]*db.Emoji{nil, {ID: 1, Shortcode: "wave"}})
+
+	payload := decodeEmojiUpdate(t, drainForMsgType(t, send, "emoji_update"))
+	if len(payload.Emoji) != 1 || payload.Emoji[0].Shortcode != "wave" {
+		t.Fatalf("emoji = %+v, want just the non-nil entry", payload.Emoji)
+	}
+}
diff --git a/Server/ws/hub_roles_test.go b/Server/ws/hub_roles_test.go
new file mode 100644
index 00000000..8fa55281
--- /dev/null
+++ b/Server/ws/hub_roles_test.go
@@ -0,0 +1,168 @@
+package ws_test
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/ws"
+)
+
+// ─── roles_update ────────────────────────────────────────────────────────────
+
+func TestBroadcastRolesUpdate_CarriesFullList(t *testing.T) {
+	hub, database := newTestHub(t)
+	go hub.Run()
+	defer hub.Stop()
+
+	user := seedOwnerUser(t, database, "roles-owner")
+	send := make(chan []byte, 16)
+	client := ws.NewTestClientWithUser(hub, user, 0, send)
+	hub.Register(client)
+	waitRegistered(t, hub, client)
+
+	roles, err := database.ListRoles(context.Background())
+	if err != nil {
+		t.Fatalf("ListRoles: %v", err)
+	}
+	hub.BroadcastRolesUpdate(roles)
+
+	msg := drainForMsgType(t, send, "roles_update")
+	payload, ok := msg["payload"].(map[string]any)
+	if !ok {
+		t.Fatalf("payload missing: %v", msg)
+	}
+	list, ok := payload["roles"].([]any)
+	if !ok {
+		t.Fatalf("roles missing: %v", payload)
+	}
+	if len(list) != len(roles) {
+		t.Fatalf("broadcast carried %d roles, want %d", len(list), len(roles))
+	}
+	first, ok := list[0].(map[string]any)
+	if !ok {
+		t.Fatalf("role entry is not an object: %v", list[0])
+	}
+	// The client refreshes channelsStore.roles from this, so it needs the same
+	// fields the ready payload's role list carries.
+	for _, key := range []string{"id", "name", "color", "permissions", "position", "is_default"} {
+		if _, present := first[key]; !present {
+			t.Errorf("role entry missing %q: %v", key, first)
+		}
+	}
+}
+
+func TestBroadcastRolesUpdate_NilEntriesAreSkipped(t *testing.T) {
+	hub, database := newTestHub(t)
+	go hub.Run()
+	defer hub.Stop()
+
+	user := seedOwnerUser(t, database, "roles-nil-owner")
+	send := make(chan []byte, 16)
+	client := ws.NewTestClientWithUser(hub, user, 0, send)
+	hub.Register(client)
+	waitRegistered(t, hub, client)
+
+	// A nil in the slice must not produce a null entry the client would have
+	// to defend against.
+	hub.BroadcastRolesUpdate([]*db.Role{nil, {ID: 7, Name: "Helper", Position: 3}})
+
+	msg := drainForMsgType(t, send, "roles_update")
+	raw, err := json.Marshal(msg["payload"])
+	if err != nil {
+		t.Fatalf("marshal payload: %v", err)
+	}
+	var payload struct {
+		Roles []db.Role `json:"roles"`
+	}
+	if err := json.Unmarshal(raw, &payload); err != nil {
+		t.Fatalf("unmarshal payload: %v", err)
+	}
+	if len(payload.Roles) != 1 || payload.Roles[0].Name != "Helper" {
+		t.Fatalf("roles = %+v, want just the non-nil entry", payload.Roles)
+	}
+}
+
+// ─── RefreshAllChannelVisibility ─────────────────────────────────────────────
+
+func TestRefreshAllChannelVisibility_CoversEveryChannel(t *testing.T) {
+	hub, database := newTestHub(t)
+	go hub.Run()
+	defer hub.Stop()
+
+	firstID := seedTestChannel(t, database, "room-one")
+	secondID := seedTestChannel(t, database, "room-two")
+
+	memberID := seedTestUser(t, database, "vis-all-member")
+	member, err := database.GetUserByID(context.Background(), memberID)
+	if err != nil || member == nil {
+		t.Fatalf("GetUserByID: %v", err)
+	}
+	send := make(chan []byte, 32)
+	client := ws.NewTestClientWithUser(hub, member, firstID, send)
+	hub.Register(client)
+	waitRegistered(t, hub, client)
+
+	// Strip READ_MESSAGES from the Member role itself — the case a role edit
+	// produces, where no single channel's overrides changed but every channel's
+	// audience did.
+	if _, err := database.ExecContext(context.Background(),
+		`UPDATE roles SET permissions = 0 WHERE id = 4`,
+	); err != nil {
+		t.Fatalf("strip role permissions: %v", err)
+	}
+
+	hub.RefreshAllChannelVisibility()
+
+	// Both channels are revoked, not just the focused one.
+	seen := map[int64]bool{}
+	for range 2 {
+		msg := drainForMsgType(t, send, "channel_delete")
+		payload, ok := msg["payload"].(map[string]any)
+		if !ok {
+			t.Fatalf("channel_delete payload missing: %v", msg)
+		}
+		id, ok := payload["id"].(float64)
+		if !ok {
+			t.Fatalf("channel_delete carries no id: %v", payload)
+		}
+		seen[int64(id)] = true
+	}
+	if !seen[firstID] || !seen[secondID] {
+		t.Errorf("revoked channels = %v, want both %d and %d", seen, firstID, secondID)
+	}
+}
+
+func TestRefreshAllChannelVisibility_SkipsDMChannels(t *testing.T) {
+	hub, database := newTestHub(t)
+	go hub.Run()
+	defer hub.Stop()
+
+	memberID := seedTestUser(t, database, "vis-dm-member")
+	member, err := database.GetUserByID(context.Background(), memberID)
+	if err != nil || member == nil {
+		t.Fatalf("GetUserByID: %v", err)
+	}
+	otherID := seedTestUser(t, database, "vis-dm-other")
+	dm, _, err := database.GetOrCreateDMChannel(context.Background(), memberID, otherID)
+	if err != nil {
+		t.Fatalf("GetOrCreateDMChannel: %v", err)
+	}
+
+	send := make(chan []byte, 32)
+	client := ws.NewTestClientWithUser(hub, member, dm.ID, send)
+	hub.Register(client)
+	waitRegistered(t, hub, client)
+
+	// A DM's access is participation, which no role change can revoke — so a
+	// role-driven visibility sweep must leave it alone.
+	if _, err := database.ExecContext(context.Background(),
+		`UPDATE roles SET permissions = 0 WHERE id = 4`,
+	); err != nil {
+		t.Fatalf("strip role permissions: %v", err)
+	}
+	hub.RefreshAllChannelVisibility()
+
+	assertNoMsgType(t, send, "channel_delete")
+}
diff --git a/Server/ws/hub_test.go b/Server/ws/hub_test.go
index d993e880..ee6b43e5 100644
--- a/Server/ws/hub_test.go
+++ b/Server/ws/hub_test.go
@@ -236,6 +236,58 @@ func TestHub_BroadcastToChannel_ZeroChannelSendsToAll(t *testing.T) {
 	assertReceived(t, s1, msg, "client")
 }
 
+// ─── BroadcastChatBulkDeleted ─────────────────────────────────────────────────
+
+// One chat_bulk_deleted carrying every purged id reaches the channel's
+// subscribers, and nobody else — a purge must not fan out N chat_deleted events
+// nor disclose ids to a client focused elsewhere.
+func TestHub_BroadcastChatBulkDeleted_OneEventToChannelMembers(t *testing.T) {
+	hub, database := newTestHub(t)
+	go hub.Run()
+	defer hub.Stop()
+
+	chID := seedTestChannel(t, database, "purged")
+	u1 := seedTestUser(t, database, "bulk1")
+	u2 := seedTestUser(t, database, "bulk2")
+
+	s1 := make(chan []byte, 4)
+	s2 := make(chan []byte, 4)
+	hub.Register(ws.NewTestClientWithChannel(hub, u1, chID, s1))
+	c2 := ws.NewTestClientWithChannel(hub, u2, 999, s2)
+	hub.Register(c2)
+	waitRegistered(t, hub, c2)
+
+	hub.BroadcastChatBulkDeleted(chID, []int64{7, 6, 5})
+
+	select {
+	case got := <-s1:
+		var env struct {
+			Type    string `json:"type"`
+			Payload struct {
+				ChannelID int64   `json:"channel_id"`
+				IDs       []int64 `json:"ids"`
+			} `json:"payload"`
+		}
+		if err := json.Unmarshal(got, &env); err != nil {
+			t.Fatalf("unmarshal: %v", err)
+		}
+		if env.Type != "chat_bulk_deleted" {
+			t.Errorf("type = %q, want chat_bulk_deleted", env.Type)
+		}
+		if env.Payload.ChannelID != chID {
+			t.Errorf("channel_id = %d, want %d", env.Payload.ChannelID, chID)
+		}
+		if !slices.Equal(env.Payload.IDs, []int64{7, 6, 5}) {
+			t.Errorf("ids = %v, want [7 6 5]", env.Payload.IDs)
+		}
+	case <-time.After(500 * time.Millisecond):
+		t.Fatal("channel member did not receive chat_bulk_deleted")
+	}
+
+	assertNotReceived(t, s1, "channel member (second event)")
+	assertNotReceived(t, s2, "client focused on another channel")
+}
+
 // ─── BUG-122: Unfocused client must NOT receive channel-scoped broadcasts ────
 
 func TestHub_BroadcastToChannel_SkipsUnfocusedClient(t *testing.T) {
@@ -1208,7 +1260,10 @@ CREATE TABLE IF NOT EXISTS users (
     banned      INTEGER NOT NULL DEFAULT 0,
     ban_reason  TEXT,
     ban_expires TEXT,
-    identity_public_key TEXT
+    identity_public_key TEXT,
+    display_name TEXT,
+    about TEXT,
+    custom_status TEXT
 );
 
 CREATE TABLE IF NOT EXISTS sessions (
@@ -1235,7 +1290,9 @@ CREATE TABLE IF NOT EXISTS channels (
     voice_max_users  INTEGER NOT NULL DEFAULT 0,
     voice_quality    TEXT,
     mixing_threshold INTEGER,
-    voice_max_video  INTEGER NOT NULL DEFAULT 0
+    voice_max_video  INTEGER NOT NULL DEFAULT 0,
+    nsfw             INTEGER NOT NULL DEFAULT 0,
+    is_group         INTEGER NOT NULL DEFAULT 0
 );
 
 CREATE TABLE IF NOT EXISTS channel_overrides (
@@ -1247,6 +1304,14 @@ CREATE TABLE IF NOT EXISTS channel_overrides (
     UNIQUE(channel_id, role_id)
 );
 
+CREATE TABLE IF NOT EXISTS channel_user_overrides (
+    channel_id INTEGER NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
+    user_id    INTEGER NOT NULL REFERENCES users(id)    ON DELETE CASCADE,
+    allow      INTEGER NOT NULL DEFAULT 0,
+    deny       INTEGER NOT NULL DEFAULT 0,
+    PRIMARY KEY (channel_id, user_id)
+);
+
 CREATE TABLE IF NOT EXISTS messages (
     id         INTEGER PRIMARY KEY AUTOINCREMENT,
     channel_id INTEGER NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
@@ -1256,8 +1321,15 @@ CREATE TABLE IF NOT EXISTS messages (
     edited_at  TEXT,
     deleted    INTEGER NOT NULL DEFAULT 0,
     pinned     INTEGER NOT NULL DEFAULT 0,
-    timestamp  TEXT    NOT NULL DEFAULT (datetime('now'))
+    timestamp  TEXT    NOT NULL DEFAULT (datetime('now')),
+    mentions_everyone INTEGER NOT NULL DEFAULT 0
 );
+CREATE TABLE IF NOT EXISTS message_mentions (
+    message_id        INTEGER NOT NULL REFERENCES messages(id) ON DELETE CASCADE,
+    mentioned_user_id INTEGER NOT NULL REFERENCES users(id)    ON DELETE CASCADE,
+    PRIMARY KEY (message_id, mentioned_user_id)
+);
+
 
 CREATE VIRTUAL TABLE IF NOT EXISTS messages_fts USING fts5(
     content,
diff --git a/Server/ws/livekit.go b/Server/ws/livekit.go
index a1392e00..fcd45738 100644
--- a/Server/ws/livekit.go
+++ b/Server/ws/livekit.go
@@ -173,6 +173,46 @@ func (c *LiveKitClient) RemoveParticipant(ctx context.Context, channelID int64,
 	return nil
 }
 
+// MuteParticipantAudio mutes or unmutes every microphone track the participant
+// publishes, so a moderator's server mute holds at the SFU instead of relying
+// on the target's client to honor it. A participant with no published audio
+// track yet is not an error: the room join grant is re-derived on the next
+// token mint, and the client refuses its own unmute while server_muted.
+func (c *LiveKitClient) MuteParticipantAudio(ctx context.Context, channelID, userID int64, voiceJoinToken string, muted bool) error {
+	roomName := RoomName(channelID)
+	identity := participantIdentity(userID, voiceJoinToken)
+
+	ctx, cancel := context.WithTimeout(ctx, lkTimeout)
+	defer cancel()
+	p, err := c.roomSvc.GetParticipant(ctx, &livekit.RoomParticipantIdentity{
+		Room:     roomName,
+		Identity: identity,
+	})
+	if err != nil {
+		return fmt.Errorf("livekit: getting participant %s in %s: %w", identity, roomName, err)
+	}
+
+	for _, t := range p.Tracks {
+		if t.Type != livekit.TrackType_AUDIO {
+			continue
+		}
+		if _, mErr := c.roomSvc.MutePublishedTrack(ctx, &livekit.MuteRoomTrackRequest{
+			Room:     roomName,
+			Identity: identity,
+			TrackSid: t.Sid,
+			Muted:    muted,
+		}); mErr != nil {
+			return fmt.Errorf("livekit: muting track %s of %s: %w", t.Sid, identity, mErr)
+		}
+	}
+
+	slog.Info("livekit: server mute applied",
+		"identity", identity,
+		"room", roomName,
+		"muted", muted)
+	return nil
+}
+
 // ListParticipants returns all participants in a channel's voice room.
 func (c *LiveKitClient) ListParticipants(channelID int64) ([]*livekit.ParticipantInfo, error) {
 	roomName := RoomName(channelID)
diff --git a/Server/ws/livekit_process.go b/Server/ws/livekit_process.go
index e3c6c268..131c62e1 100644
--- a/Server/ws/livekit_process.go
+++ b/Server/ws/livekit_process.go
@@ -81,11 +81,21 @@ func (p *LiveKitProcess) generateConfig() (string, error) {
 
 	// Sanitize credentials for safe YAML interpolation: reject strings
 	// containing characters that could break YAML structure.
-	for _, cred := range []string{p.cfg.LiveKitAPIKey, p.cfg.LiveKitAPISecret} {
-		for _, ch := range cred {
-			if ch == ':' || ch == '#' || ch == '{' || ch == '}' || ch == '\n' || ch == '\r' || ch == '"' || ch == '\\' {
-				return "", fmt.Errorf("LiveKit credential contains unsafe YAML character %q", string(ch))
-			}
+	//
+	// The error names the offending config field but never echoes the
+	// offending byte: this error is wrapped by Start() and logged by the
+	// caller, so quoting a character from the key or secret would write a
+	// byte of a credential to the server log in clear text.
+	const unsafeYAML = ":#{}\n\r\"\\"
+	for _, cred := range []struct {
+		field string
+		value string
+	}{
+		{"voice.livekit_api_key", p.cfg.LiveKitAPIKey},
+		{"voice.livekit_api_secret", p.cfg.LiveKitAPISecret},
+	} {
+		if strings.ContainsAny(cred.value, unsafeYAML) {
+			return "", fmt.Errorf(`%s contains a character that cannot be safely written to livekit.yaml (one of : # { } " \ CR LF)`, cred.field)
 		}
 	}
 	// Build node_ip line only when configured (required for remote users behind NAT).
diff --git a/Server/ws/livekit_test.go b/Server/ws/livekit_test.go
index 7debe3c1..ea4f04f6 100644
--- a/Server/ws/livekit_test.go
+++ b/Server/ws/livekit_test.go
@@ -629,6 +629,56 @@ func TestGenerateConfig_UnsafeCredentialChars(t *testing.T) {
 	}
 }
 
+// The rejection error is wrapped by Start() and logged by the caller, so it
+// must never echo any part of the credential it rejected — quoting even the
+// single offending byte writes a piece of a secret to the server log in clear
+// text (CodeQL go/clear-text-logging). It must still name the field at fault.
+func TestGenerateConfig_UnsafeCredentialErrorDoesNotLeakCredential(t *testing.T) {
+	t.Parallel()
+
+	const (
+		key    = "sup3rsecret:apikey"
+		secret = "sup3rsecret{apisecret"
+	)
+
+	for _, tt := range []struct {
+		name  string
+		key   string
+		sec   string
+		field string
+		leak  string
+	}{
+		{"key", key, "safesecret", "voice.livekit_api_key", key},
+		{"secret", "safekey", secret, "voice.livekit_api_secret", secret},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			proc := ws.NewLiveKitProcess(&config.VoiceConfig{
+				LiveKitAPIKey:    tt.key,
+				LiveKitAPISecret: tt.sec,
+				LiveKitURL:       "ws://localhost:7880",
+			}, &config.TLSConfig{}, t.TempDir())
+
+			_, err := proc.GenerateConfigForTest()
+			if err == nil {
+				t.Fatal("expected an error for the unsafe credential, got nil")
+			}
+			msg := err.Error()
+			if strings.Contains(msg, tt.leak) {
+				t.Errorf("error leaks the credential verbatim: %q", msg)
+			}
+			// The distinctive prefix must not appear even partially quoted.
+			if strings.Contains(msg, "sup3rsecret") {
+				t.Errorf("error leaks part of the credential: %q", msg)
+			}
+			if !strings.Contains(msg, tt.field) {
+				t.Errorf("error should name the offending field %q, got %q", tt.field, msg)
+			}
+		})
+	}
+}
+
 func TestGenerateConfig_UnsafeNodeIPChars(t *testing.T) {
 	t.Parallel()
 
diff --git a/Server/ws/livekit_webhook_fuzz_test.go b/Server/ws/livekit_webhook_fuzz_test.go
new file mode 100644
index 00000000..7ca051cf
--- /dev/null
+++ b/Server/ws/livekit_webhook_fuzz_test.go
@@ -0,0 +1,115 @@
+package ws
+
+import (
+	"strconv"
+	"strings"
+	"testing"
+)
+
+// FuzzParseParticipantIdentity checks parseParticipantIdentity, which parses
+// an untrusted LiveKit webhook participant identity of the form
+// "user-{id}" or "user-{id}:{joinToken}". Invariant: it never panics on any
+// input, and on success the returned (userID, joinToken) are exactly what
+// the "user-" + strconv.ParseInt + strings.Cut(":") pipeline the source uses
+// would produce — i.e. identity must start with "user-", and the ID part
+// (up to the first ':') must parse as the returned userID with the returned
+// joinToken being everything after that first ':' (or "" if none).
+func FuzzParseParticipantIdentity(f *testing.F) {
+	seeds := []string{
+		"",
+		"user-",
+		"user-1",
+		"user-1:tok",
+		"user-1:tok:extra:colons",
+		"user--1",
+		"user-9223372036854775807",  // max int64
+		"user-9223372036854775808",  // overflow
+		"user--9223372036854775808", // min int64
+		"user-abc",
+		"user-1abc",
+		"user-1 ",
+		"USER-1",
+		"user-1\x00:tok",
+		"user-1:",
+		"user-:tok",
+		"not-a-user",
+		"user",
+		"user-0",
+		"user-+1",
+		"user-01",
+	}
+	for _, s := range seeds {
+		f.Add(s)
+	}
+
+	f.Fuzz(func(t *testing.T, identity string) {
+		userID, joinToken, err := parseParticipantIdentity(identity)
+		if err != nil {
+			return
+		}
+
+		if !strings.HasPrefix(identity, "user-") {
+			t.Fatalf("parseParticipantIdentity(%q) = (%d,%q,nil), but input lacks the required user- prefix", identity, userID, joinToken)
+		}
+		body := identity[len("user-"):]
+		idPart, wantJoinToken, _ := strings.Cut(body, ":")
+
+		wantUserID, perr := strconv.ParseInt(idPart, 10, 64)
+		if perr != nil {
+			t.Fatalf("parseParticipantIdentity(%q) = (%d,%q,nil), but the id part %q does not itself parse as int64: %v", identity, userID, joinToken, idPart, perr)
+		}
+		if wantUserID != userID {
+			t.Fatalf("parseParticipantIdentity(%q) = userID %d, want %d (parsed from id part %q)", identity, userID, wantUserID, idPart)
+		}
+		if wantJoinToken != joinToken {
+			t.Fatalf("parseParticipantIdentity(%q) = joinToken %q, want %q", identity, joinToken, wantJoinToken)
+		}
+	})
+}
+
+// FuzzParseRoomChannelID checks parseRoomChannelID, which parses an
+// untrusted LiveKit webhook room name of the form "channel-{id}". Invariant:
+// it never panics on any input, and on success the input must start with
+// "channel-" and the remainder must parse as the returned channelID.
+func FuzzParseRoomChannelID(f *testing.F) {
+	seeds := []string{
+		"",
+		"channel-",
+		"channel-1",
+		"channel--1",
+		"channel-9223372036854775807",
+		"channel-9223372036854775808",
+		"channel--9223372036854775808",
+		"channel-abc",
+		"channel-1abc",
+		"CHANNEL-1",
+		"not-a-channel",
+		"channel",
+		"channel-0",
+		"channel-+1",
+		"channel-01",
+		"channel-1\x00",
+	}
+	for _, s := range seeds {
+		f.Add(s)
+	}
+
+	f.Fuzz(func(t *testing.T, roomName string) {
+		channelID, err := parseRoomChannelID(roomName)
+		if err != nil {
+			return
+		}
+
+		if !strings.HasPrefix(roomName, "channel-") {
+			t.Fatalf("parseRoomChannelID(%q) = (%d,nil), but input lacks the required channel- prefix", roomName, channelID)
+		}
+		idPart := roomName[len("channel-"):]
+		wantChannelID, perr := strconv.ParseInt(idPart, 10, 64)
+		if perr != nil {
+			t.Fatalf("parseRoomChannelID(%q) = (%d,nil), but the id part %q does not itself parse as int64: %v", roomName, channelID, idPart, perr)
+		}
+		if wantChannelID != channelID {
+			t.Fatalf("parseRoomChannelID(%q) = %d, want %d (parsed from id part %q)", roomName, channelID, wantChannelID, idPart)
+		}
+	})
+}
diff --git a/Server/ws/load_soak_test.go b/Server/ws/load_soak_test.go
new file mode 100644
index 00000000..bb54a47f
--- /dev/null
+++ b/Server/ws/load_soak_test.go
@@ -0,0 +1,295 @@
+package ws_test
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"sync"
+	"testing"
+	"testing/fstest"
+	"time"
+
+	"go.uber.org/goleak"
+
+	"github.com/owncord/server/auth"
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/service"
+	"github.com/owncord/server/ws"
+)
+
+// TestTheLoadTest is a load/soak test for the hub's concurrency machinery: it
+// churns a few hundred WS clients through Register/Unregister from many
+// goroutines while other goroutines drive broadcasts (chat_message via the
+// real chat_send handler path, voice_state, presence, and raw channel-scoped
+// fan-out) and channel focus changes, all against one live hub.
+//
+// It exercises two paths that are easy to get right in isolation but wrong
+// under contention:
+//   - channelReadAudience, the per-broadcast permission-audience resolution
+//     used by voice_state/voice_leave and channel_create/update fan-out;
+//   - MessageService's background mention-count bookkeeping, which the
+//     production code fires with a bare `go fn()` per send (see
+//     RunBackgroundInlineForTest's doc comment on MessageService.bg).
+//
+// Skipped under -short. Run explicitly with:
+//
+//	go test ./ws/ -race -run TheLoadTest -count=1
+func TestTheLoadTest(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping load/soak test in -short mode")
+	}
+
+	// Baseline before anything is started, so this test only fails on
+	// goroutines IT leaked — not on background goroutines belonging to
+	// earlier tests in the same binary that happen to still be unwinding.
+	defer goleak.VerifyNone(t, goleak.IgnoreCurrent())
+
+	const (
+		numChannels     = 4
+		numAnchors      = 8   // steady readers, registered for the whole run
+		numChurnUsers   = 200 // distinct users churned through register/unregister
+		numChurnWorkers = 20
+		churnRounds     = 4
+		numBroadcasters = 6
+		broadcastIters  = 30
+		overallTimeout  = 90 * time.Second
+	)
+
+	// Deliberately not the shared openServeTestDB(t) helper: it closes the DB
+	// via t.Cleanup, which fires AFTER this function's own defers (including
+	// the goleak check above) — leaving database/sql's connectionOpener
+	// goroutine looking "leaked" at check time even though it would close
+	// fine a moment later. Closing it with an ordinary defer, positioned
+	// after the goleak defer so it runs first (defers are LIFO), keeps the
+	// check honest.
+	database, err := db.Open(":memory:")
+	if err != nil {
+		t.Fatalf("db.Open: %v", err)
+	}
+	defer func() { _ = database.Close() }()
+	migrFS := fstest.MapFS{"001_schema.sql": {Data: serveTestSchema}}
+	if err := db.MigrateFS(database, migrFS); err != nil {
+		t.Fatalf("MigrateFS: %v", err)
+	}
+
+	limiter := auth.NewRateLimiter()
+	svc := service.New(database, limiter)
+	hub := ws.NewHub(database, limiter, svc)
+
+	runDone := make(chan struct{})
+	go func() {
+		hub.Run()
+		close(runDone)
+	}()
+	waitFor(t, waitTimeout, hub.RunningForTest, "hub Run loop to start")
+	// Registered after database's defer above, so it runs first (LIFO): the
+	// hub — and every background goroutine it owns — is fully stopped before
+	// the DB closes under it.
+	defer func() {
+		hub.Stop()
+		select {
+		case <-runDone:
+		case <-time.After(5 * time.Second):
+			t.Error("hub.Run() did not stop after hub.Stop()")
+		}
+	}()
+
+	ctx := context.Background()
+
+	// ── shared channels every client fans in and out of ────────────────────
+	chIDs := make([]int64, numChannels)
+	for i := range chIDs {
+		chIDs[i] = seedTestChannel(t, database, fmt.Sprintf("load-ch-%d", i))
+	}
+
+	// ── anchors: registered once, stay up for the whole run, and are the
+	// steady audience broadcasts land on plus the @mention targets that
+	// exercise applyMentionCounts. ───────────────────────────────────────────
+	type anchor struct {
+		user      *db.User
+		c         *ws.Client
+		send      chan []byte
+		stopDrain chan struct{}
+	}
+	anchors := make([]anchor, 0, numAnchors)
+	for i := range numAnchors {
+		u := seedOwnerUser(t, database, fmt.Sprintf("load-anchor-%d", i))
+		send := make(chan []byte, 1024)
+		c := ws.NewTestClientWithUser(hub, u, chIDs[i%numChannels], send)
+		hub.Register(c)
+
+		// Drain continuously so a busy channel never trips the client's
+		// full-buffer auto-disconnect (BUG-124 behavior) — that disconnect is
+		// correct production behavior but not what this test means to probe.
+		stop := make(chan struct{})
+		go func(ch chan []byte, stop chan struct{}) {
+			for {
+				select {
+				case <-ch:
+				case <-stop:
+					return
+				}
+			}
+		}(send, stop)
+
+		anchors = append(anchors, anchor{user: u, c: c, send: send, stopDrain: stop})
+	}
+	for _, a := range anchors {
+		waitRegistered(t, hub, a.c)
+	}
+	mentionNames := make([]string, len(anchors))
+	for i, a := range anchors {
+		mentionNames[i] = a.user.Username
+	}
+
+	// ── churn pool: pre-seeded so DB writes stay off the timed section; the
+	// timed section only churns hub Register/Unregister + message dispatch. ──
+	churnUsers := make([]*db.User, numChurnUsers)
+	for i := range numChurnUsers {
+		uid := seedTestUser(t, database, fmt.Sprintf("load-churn-%d", i))
+		u, err := database.GetUserByID(ctx, uid)
+		if err != nil || u == nil {
+			t.Fatalf("GetUserByID(%d): %v", uid, err)
+		}
+		churnUsers[i] = u
+	}
+
+	var wg sync.WaitGroup
+	usersPerWorker := numChurnUsers / numChurnWorkers
+
+	// ── churn goroutines: concurrent register -> channel_focus -> chat_send
+	// (mentioning an anchor) -> presence_update -> unregister, repeated for
+	// churnRounds per assigned user. ────────────────────────────────────────
+	for w := range numChurnWorkers {
+		wg.Add(1)
+		go func(workerIdx int) {
+			defer wg.Done()
+			start := workerIdx * usersPerWorker
+			end := start + usersPerWorker
+			for round := range churnRounds {
+				for ui := start; ui < end; ui++ {
+					user := churnUsers[ui]
+					chID := chIDs[(ui+round)%numChannels]
+					focusChID := chIDs[(ui+round+1)%numChannels]
+
+					send := make(chan []byte, 32)
+					c := ws.NewTestClientWithUser(hub, user, chID, send)
+					hub.Register(c)
+
+					focusPayload, _ := json.Marshal(map[string]any{
+						"type":    "channel_focus",
+						"payload": map[string]any{"channel_id": focusChID},
+					})
+					hub.HandleMessageForTest(c, focusPayload)
+
+					target := mentionNames[(ui+round)%len(mentionNames)]
+					content := fmt.Sprintf("hi @%s from churn user %d round %d", target, user.ID, round)
+					chatPayload, _ := json.Marshal(map[string]any{
+						"type": "chat_send",
+						"id":   fmt.Sprintf("req-%d-%d", user.ID, round),
+						"payload": map[string]any{
+							"channel_id": chID,
+							"content":    content,
+						},
+					})
+					hub.HandleMessageForTest(c, chatPayload)
+
+					status := []string{"online", "idle", "dnd"}[round%3]
+					presPayload, _ := json.Marshal(map[string]any{
+						"type":    "presence_update",
+						"payload": map[string]any{"status": status},
+					})
+					hub.HandleMessageForTest(c, presPayload)
+
+					hub.Unregister(c)
+				}
+			}
+		}(w)
+	}
+
+	// ── broadcaster goroutines: hammer the real broadcast paths (channel-
+	// scoped fan-out, voice_state/channelReadAudience, presence, and
+	// channel_update/channelReadAudience) concurrently with the churn above. ─
+	for b := range numBroadcasters {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			for i := range broadcastIters {
+				chID := chIDs[(idx+i)%numChannels]
+				switch i % 4 {
+				case 0:
+					msg := fmt.Appendf(nil, `{"type":"chat_message","payload":{"synthetic":%d}}`, i)
+					hub.BroadcastToChannel(chID, msg)
+				case 1:
+					msg := fmt.Appendf(nil, `{"type":"voice_state","payload":{"channel_id":%d,"user_id":%d}}`, chID, idx)
+					hub.BroadcastVoiceEventForTest(chID, msg)
+				case 2:
+					anchorUser := anchors[idx%len(anchors)].user
+					status := []string{"online", "idle", "dnd", "invisible"}[i%4]
+					hub.BroadcastPresence(anchorUser.ID, status, nil)
+				case 3:
+					// BroadcastChannelUpdate is called by the admin HubBroadcaster
+					// interface, which carries no context (see hub_broadcast.go);
+					// context.Background() matches that production call shape,
+					// not the request-scoped ctx used elsewhere in this test.
+					ch, err := database.GetChannel(context.Background(), chID)
+					if err == nil && ch != nil {
+						hub.BroadcastChannelUpdate(ch) // exercises channelReadAudience
+					}
+				}
+			}
+		}(b)
+	}
+
+	// Fail loudly instead of hanging if anything above ever deadlocks: every
+	// send in the production path is non-blocking (select+default), so the
+	// only way this fires is a genuine bug (e.g. the hub loop stuck, or a
+	// lock held across a blocking call).
+	allDone := make(chan struct{})
+	go func() {
+		wg.Wait()
+		close(allDone)
+	}()
+	select {
+	case <-allDone:
+	case <-time.After(overallTimeout):
+		t.Fatal("load test workers did not finish within timeout — possible deadlock in the hub")
+	}
+
+	if !hub.RunningForTest() {
+		t.Error("hub stopped running mid-test (panic-loop guard tripped?)")
+	}
+
+	// Only the anchors should remain registered — every churned client
+	// unregistered itself at the end of its own round.
+	waitFor(t, 5*time.Second, func() bool { return hub.ClientCount() == numAnchors },
+		"churned clients to fully unregister")
+	if got := hub.ClientCount(); got != numAnchors {
+		t.Errorf("ClientCount = %d after churn settled, want %d (anchors only)", got, numAnchors)
+	}
+
+	t.Logf("load test done: %d anchors, %d churn users x %d rounds, %d broadcasters x %d iters, broadcast drops=%d",
+		numAnchors, numChurnUsers, churnRounds, numBroadcasters, broadcastIters, hub.BroadcastDropCount())
+
+	for _, a := range anchors {
+		hub.Unregister(a.c)
+	}
+	waitFor(t, 5*time.Second, func() bool { return hub.ClientCount() == 0 }, "anchors to unregister")
+	for _, a := range anchors {
+		close(a.stopDrain)
+	}
+
+	// SendMessage fires mention-count bookkeeping with a bare `go fn()` and
+	// deliberately does not wait for it (see MessageService.bg) — that is the
+	// exact background path this test means to exercise. Give the last few
+	// in-flight goroutines a moment to finish their handful of DB queries
+	// before the deferred teardown stops the hub and closes the DB out from
+	// under them; without this they still exit cleanly (goleak retries with
+	// backoff), but they'd do it via a "database is closed" error instead of
+	// completing the work, which is a false alarm this bounded wait avoids.
+	time.Sleep(300 * time.Millisecond)
+
+	// hub.Stop()/runDone wait and the DB close happen in the deferred cleanup
+	// above (LIFO: hub first, then DB, then the goleak check registered at
+	// the top of this test).
+}
diff --git a/Server/ws/mentions_ready_test.go b/Server/ws/mentions_ready_test.go
new file mode 100644
index 00000000..a5ef7e88
--- /dev/null
+++ b/Server/ws/mentions_ready_test.go
@@ -0,0 +1,163 @@
+package ws_test
+
+// mentions_ready_test.go: the ready payload's per-channel mention_count and the
+// chat_message broadcast's mention fields (phase 3).
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/owncord/server/ws"
+)
+
+// TestChatSend_BroadcastCarriesMentions locks that the chat_message fan-out
+// ships server-resolved mention ids and the @everyone flag, so clients never
+// have to re-guess them from the content.
+func TestChatSend_BroadcastCarriesMentions(t *testing.T) {
+	hub, database := newCoverageHub(t)
+	// Mention counts are written on a background goroutine in production; run
+	// them inline so this test can read GetMentionCount right after the send.
+	hub.RunMentionCountsInlineForTest()
+	ctx := context.Background()
+
+	author := seedCoverageOwner(t, database, "mention-author") // owner role holds MENTION_EVERYONE
+	target := seedCoverageOwner(t, database, "mention-target")
+	chID := seedTestChannel(t, database, "mention-chan")
+
+	send := make(chan []byte, 32)
+	c := ws.NewTestClientWithUser(hub, author, chID, send)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+
+	raw, _ := json.Marshal(map[string]any{
+		"type": "chat_send",
+		"payload": map[string]any{
+			"channel_id": chID,
+			"content":    "@everyone please review, @mention-target",
+		},
+	})
+	hub.HandleMessageForTest(c, raw)
+
+	var found bool
+	for _, msg := range drainChanTimeout(send, 300*time.Millisecond) {
+		var env struct {
+			Type    string `json:"type"`
+			Payload struct {
+				Mentions         []int64 `json:"mentions"`
+				MentionsEveryone bool    `json:"mentions_everyone"`
+			} `json:"payload"`
+		}
+		if json.Unmarshal(msg, &env) != nil || env.Type != "chat_message" {
+			continue
+		}
+		found = true
+		if !env.Payload.MentionsEveryone {
+			t.Error("mentions_everyone = false, want true")
+		}
+		if len(env.Payload.Mentions) != 1 || env.Payload.Mentions[0] != target.ID {
+			t.Errorf("mentions = %v, want [%d]", env.Payload.Mentions, target.ID)
+		}
+	}
+	if !found {
+		t.Fatal("no chat_message broadcast received")
+	}
+
+	// The mentioned reader's badge went up; the author's did not.
+	if n, _ := database.GetMentionCount(ctx, target.ID, chID); n != 1 {
+		t.Errorf("target mention_count = %d, want 1", n)
+	}
+	if n, _ := database.GetMentionCount(ctx, author.ID, chID); n != 0 {
+		t.Errorf("author mention_count = %d, want 0", n)
+	}
+}
+
+func TestBuildReady_CarriesMentionCount(t *testing.T) {
+	hub, database := newCoverageHub(t)
+	ctx := context.Background()
+
+	user := seedCoverageOwner(t, database, "mention-reader")
+	role, err := database.GetRoleByID(ctx, 1)
+	if err != nil || role == nil {
+		t.Fatalf("GetRoleByID: %v", err)
+	}
+	chID, err := database.CreateChannel(ctx, "general", "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+	if err := database.IncrementMentionCounts(ctx, chID, []int64{user.ID}); err != nil {
+		t.Fatalf("IncrementMentionCounts: %v", err)
+	}
+
+	msg, err := hub.BuildReadyWithRoleForTest(database, user.ID, role)
+	if err != nil {
+		t.Fatalf("BuildReadyWithRoleForTest: %v", err)
+	}
+
+	var env struct {
+		Payload struct {
+			Channels []struct {
+				ID           int64 `json:"id"`
+				MentionCount *int  `json:"mention_count"`
+			} `json:"channels"`
+		} `json:"payload"`
+	}
+	if err := json.Unmarshal(msg, &env); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+
+	var found bool
+	for _, ch := range env.Payload.Channels {
+		if ch.ID != chID {
+			continue
+		}
+		found = true
+		if ch.MentionCount == nil {
+			t.Fatal("channel is missing mention_count")
+		}
+		if *ch.MentionCount != 1 {
+			t.Errorf("mention_count = %d, want 1", *ch.MentionCount)
+		}
+	}
+	if !found {
+		t.Fatalf("channel %d missing from ready payload", chID)
+	}
+}
+
+// TestBuildReady_MentionCountZeroWithoutReadState locks that a channel with no
+// read_states row still ships the field, so the client never sees it undefined.
+func TestBuildReady_MentionCountZeroWithoutReadState(t *testing.T) {
+	hub, database := newCoverageHub(t)
+	ctx := context.Background()
+
+	user := seedCoverageOwner(t, database, "mention-fresh")
+	role, err := database.GetRoleByID(ctx, 1)
+	if err != nil || role == nil {
+		t.Fatalf("GetRoleByID: %v", err)
+	}
+	if _, err := database.CreateChannel(ctx, "quiet", "text", "", "", 0); err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+
+	msg, err := hub.BuildReadyWithRoleForTest(database, user.ID, role)
+	if err != nil {
+		t.Fatalf("BuildReadyWithRoleForTest: %v", err)
+	}
+	var env struct {
+		Payload struct {
+			Channels []map[string]any `json:"channels"`
+		} `json:"payload"`
+	}
+	if err := json.Unmarshal(msg, &env); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if len(env.Payload.Channels) == 0 {
+		t.Fatal("no channels in ready payload")
+	}
+	for _, ch := range env.Payload.Channels {
+		if _, ok := ch["mention_count"]; !ok {
+			t.Errorf("text channel %v is missing mention_count", ch["id"])
+		}
+	}
+}
diff --git a/Server/ws/message_types.go b/Server/ws/message_types.go
index 7e08c2a5..dc258fd9 100644
--- a/Server/ws/message_types.go
+++ b/Server/ws/message_types.go
@@ -16,6 +16,7 @@ const (
 	MsgTypeReactionRemove    = "reaction_remove"
 	MsgTypeTypingStart       = "typing_start"
 	MsgTypeChannelFocus      = "channel_focus"
+	MsgTypeMarkRead          = "mark_read"
 	MsgTypePresenceUpdate    = "presence_update"
 	MsgTypeVoiceJoin         = "voice_join"
 	MsgTypeVoiceLeave        = "voice_leave"
@@ -23,10 +24,16 @@ const (
 	MsgTypeVoiceDeafen       = "voice_deafen"
 	MsgTypeVoiceCamera       = "voice_camera"
 	MsgTypeVoiceScreenshare  = "voice_screenshare"
+	MsgTypeVoiceModMute      = "voice_mod_mute"
+	MsgTypeVoiceModDeafen    = "voice_mod_deafen"
+	MsgTypeVoiceModMove      = "voice_mod_move"
+	MsgTypeVoiceModKick      = "voice_mod_kick"
 	MsgTypePing              = "ping"
 	MsgTypeVoiceTokenRefresh = "voice_token_refresh" //nolint:gosec // G101: false positive — message type constant, not a credential
 	MsgTypeVoiceE2EEAnnounce = "voice_e2ee_announce"
 	MsgTypeVoiceE2EEOffer    = "voice_e2ee_offer"
+	MsgTypeCallRing          = "call_ring"
+	MsgTypeCallDecline       = "call_decline"
 )
 
 // Server → Client message types (sent in broadcasts/responses).
@@ -38,6 +45,7 @@ const (
 	MsgTypeChatSendOK          = "chat_send_ok"
 	MsgTypeChatEdited          = "chat_edited"
 	MsgTypeChatDeleted         = "chat_deleted"
+	MsgTypeChatBulkDeleted     = "chat_bulk_deleted"
 	MsgTypeReactionUpdate      = "reaction_update"
 	MsgTypeTyping              = "typing"
 	MsgTypePresence            = "presence"
@@ -49,16 +57,22 @@ const (
 	MsgTypeVoiceToken          = "voice_token"
 	MsgTypeVoiceSpeakers       = "voice_speakers"
 	MsgTypeVoiceLeaveBC        = "voice_leave" // broadcast (same string as client msg)
+	MsgTypeVoiceMoved          = "voice_moved"
+	MsgTypeVoiceDisconnected   = "voice_disconnected"
 	MsgTypeMemberJoin          = "member_join"
 	MsgTypeMemberLeave         = "member_leave"
 	MsgTypeMemberUpdate        = "member_update"
 	MsgTypeUserUpdate          = "user_update"
 	MsgTypeMemberBan           = "member_ban"
+	MsgTypeRolesUpdate         = "roles_update"
+	MsgTypeEmojiUpdate         = "emoji_update"
 	MsgTypeServerRestart       = "server_restart"
 	MsgTypeError               = "error"
 	MsgTypePong                = "pong"
 	MsgTypeDMChannelOpen       = "dm_channel_open"
 	MsgTypeDMChannelClose      = "dm_channel_close"
+	MsgTypeCallIncoming        = "call_incoming"
+	MsgTypeCallDeclined        = "call_declined"
 	MsgTypeVoiceE2EEAnnounceBC = "voice_e2ee_announce" // broadcast (same string as client msg)
 	MsgTypeVoiceE2EEOfferRelay = "voice_e2ee_offer"    // relay (same string as client msg)
 )
diff --git a/Server/ws/messages.go b/Server/ws/messages.go
index a19b2ebd..38f6193c 100644
--- a/Server/ws/messages.go
+++ b/Server/ws/messages.go
@@ -6,6 +6,7 @@ import (
 	"log/slog"
 
 	"github.com/owncord/server/db"
+	"github.com/owncord/server/service"
 )
 
 // envelope is the common wrapper for all WebSocket messages.
@@ -29,6 +30,11 @@ type wsMsg struct {
 type presencePayload struct {
 	UserID int64  `json:"user_id"`
 	Status string `json:"status"`
+	// CustomStatus is the user's free-text status line. Always present (null
+	// when unset) rather than omitempty: a client has to be able to tell
+	// "cleared it" from "this event does not mention it", and every presence
+	// broadcast carries the current value.
+	CustomStatus *string `json:"custom_status"`
 }
 
 type memberUserPayload struct {
@@ -36,6 +42,10 @@ type memberUserPayload struct {
 	Username string  `json:"username"`
 	Avatar   *string `json:"avatar"`
 	Role     string  `json:"role"`
+	// DisplayName is the nickname to render instead of Username. Omitted when
+	// unset; clients fall back to Username. Username stays on the wire because
+	// it is still the unique handle mentions resolve against.
+	DisplayName *string `json:"display_name,omitempty"`
 	// IdentityPublicKey is the user's long-term E2EE identity public key
 	// (base64), pinned by peers on first sight (F3 TOFU). Omitted when the
 	// user has not published one (legacy client) and in payloads that do not
@@ -45,6 +55,15 @@ type memberUserPayload struct {
 
 type memberJoinPayload struct {
 	User memberUserPayload `json:"user"`
+	// Status is the viewer-safe presence the connecting user comes online as
+	// (db.BroadcastStatus of the ConnectStatus-mapped value): an invisible
+	// connector reports "offline" here, never their true chosen status. This
+	// is BroadcastToAll, not the channel-scoped presence path, so every
+	// connected client — invisible or not — receives it; the client MUST
+	// render members from this field rather than assuming "online" just
+	// because a member_join arrived, or an invisible user renders online
+	// until the (droppable, low-priority) presence correction catches up.
+	Status string `json:"status"`
 }
 
 type chatMessagePayload struct {
@@ -57,6 +76,11 @@ type chatMessagePayload struct {
 	Attachments []map[string]any  `json:"attachments"`
 	Reactions   []any             `json:"reactions"`
 	Pinned      bool              `json:"pinned"`
+	// Mentions carries the server-resolved user ids; MentionsEveryone reports
+	// an @everyone/@here that cleared MENTION_EVERYONE. Clients highlight from
+	// these instead of re-parsing the content.
+	Mentions         []int64 `json:"mentions"`
+	MentionsEveryone bool    `json:"mentions_everyone"`
 }
 
 type memberUpdatePayload struct {
@@ -68,6 +92,11 @@ type userUpdatePayload struct {
 	UserID   int64   `json:"user_id"`
 	Username string  `json:"username"`
 	Avatar   *string `json:"avatar"`
+	// DisplayName and About are always present (null = cleared) so a profile
+	// edit that removes either one is distinguishable from one that leaves it
+	// alone — user_update replaces the client's copy wholesale.
+	DisplayName *string `json:"display_name"`
+	About       *string `json:"about"`
 	// IdentityPublicKey mirrors memberUserPayload — carried so peers can
 	// detect an identity-key change (TOFU mismatch) as it happens.
 	IdentityPublicKey *string `json:"identity_public_key,omitempty"`
@@ -77,6 +106,33 @@ type memberBanPayload struct {
 	UserID int64 `json:"user_id"`
 }
 
+// rolesUpdatePayload carries the whole role list rather than a delta. The
+// client's role state is a flat list keyed by id that drives name colors and
+// permission gating; replacing it wholesale is both smaller to reason about
+// than a patch protocol and immune to a dropped intermediate event leaving a
+// deleted role on screen.
+type rolesUpdatePayload struct {
+	Roles []db.Role `json:"roles"`
+}
+
+// emojiInfo is the client-facing shape of one custom emoji: enough to render
+// it and to spell it. The storage id and mime type stay server-side -- the
+// image route is the only thing that needs them.
+type emojiInfo struct {
+	ID        int64  `json:"id"`
+	Shortcode string `json:"shortcode"`
+	URL       string `json:"url"`
+}
+
+// emojiUpdatePayload carries the whole emoji set, for the same reason
+// rolesUpdatePayload carries the whole role list: the client's emoji state is a
+// flat map keyed by shortcode that message rendering, the picker and reaction
+// pills all read, and a wholesale replace cannot leave a deleted emoji on
+// screen after a dropped event.
+type emojiUpdatePayload struct {
+	Emoji []emojiInfo `json:"emoji"`
+}
+
 type chatSendOKPayload struct {
 	MessageID int64  `json:"message_id"`
 	Timestamp string `json:"timestamp"`
@@ -87,6 +143,10 @@ type chatEditedPayload struct {
 	ChannelID int64  `json:"channel_id"`
 	Content   string `json:"content"`
 	EditedAt  string `json:"edited_at"`
+	// Mentions/MentionsEveryone are re-resolved from the edited content, so an
+	// edit that adds or drops a mention updates the highlight too.
+	Mentions         []int64 `json:"mentions"`
+	MentionsEveryone bool    `json:"mentions_everyone"`
 }
 
 type chatDeletedPayload struct {
@@ -94,6 +154,11 @@ type chatDeletedPayload struct {
 	ChannelID int64 `json:"channel_id"`
 }
 
+type chatBulkDeletedPayload struct {
+	ChannelID int64   `json:"channel_id"`
+	IDs       []int64 `json:"ids"`
+}
+
 type reactionUpdatePayload struct {
 	MessageID int64  `json:"message_id"`
 	ChannelID int64  `json:"channel_id"`
@@ -117,6 +182,25 @@ type voiceStatePayload struct {
 	Speaking    bool   `json:"speaking"`
 	Camera      bool   `json:"camera"`
 	Screenshare bool   `json:"screenshare"`
+	// ServerMuted/ServerDeafened are moderator-imposed. Muted/Deafened are
+	// always set alongside them, so a client that ignores these two still
+	// renders the user as silenced; they exist so the UI can distinguish a
+	// self-mute from one the user may not lift.
+	ServerMuted    bool `json:"server_muted"`
+	ServerDeafened bool `json:"server_deafened"`
+}
+
+// voiceMovedPayload tells one client its moderator moved it to another voice
+// channel. The client tears down its LiveKit session and re-joins to_channel_id
+// through the normal voice_join path.
+type voiceMovedPayload struct {
+	ToChannelID int64 `json:"to_channel_id"`
+}
+
+// voiceDisconnectedPayload tells one client a moderator removed it from voice.
+type voiceDisconnectedPayload struct {
+	ChannelID int64  `json:"channel_id"`
+	Reason    string `json:"reason"`
 }
 
 type voiceConfigPayload struct {
@@ -171,6 +255,33 @@ type channelPayload struct {
 	// instead of accepting a message the server will refuse with SLOW_MODE.
 	// Seconds; 0 means off.
 	SlowMode int `json:"slow_mode"`
+	// NSFW marks the channel as possibly carrying sensitive content. It is
+	// shipped so clients can gate or label it; the server applies no content
+	// behaviour of its own to a flagged channel.
+	NSFW bool `json:"nsfw"`
+	// Voice capacity limits (0 = unlimited), the same values the voice-join
+	// path enforces with CHANNEL_FULL / VIDEO_LIMIT. Sent so the sidebar can
+	// show "3/5" and the client can explain a refusal it could have predicted.
+	VoiceMaxUsers int `json:"voice_max_users"`
+	VoiceMaxVideo int `json:"voice_max_video"`
+}
+
+// channelPayloadFrom narrows a channel row to the wire shape shared by the
+// channel_create and channel_update broadcasts. One constructor so the two
+// events can never disagree about which fields a client is told about.
+func channelPayloadFrom(ch *db.Channel) channelPayload {
+	return channelPayload{
+		ID:            ch.ID,
+		Name:          ch.Name,
+		Type:          ch.Type,
+		Category:      ch.Category,
+		Topic:         ch.Topic,
+		Position:      ch.Position,
+		SlowMode:      ch.SlowMode,
+		NSFW:          ch.NSFW,
+		VoiceMaxUsers: ch.VoiceMaxUsers,
+		VoiceMaxVideo: ch.VoiceMaxVideo,
+	}
 }
 
 type channelDeletePayload struct {
@@ -182,18 +293,13 @@ type serverRestartPayload struct {
 	DelaySeconds int    `json:"delay_seconds"`
 }
 
-// dmChannelOpenPayload is sent when a DM is opened/reopened for a user.
-type dmChannelOpenPayload struct {
-	ChannelID int64         `json:"channel_id"`
-	Recipient dmUserPayload `json:"recipient"`
-}
-
-// dmUserPayload is the public-facing shape for a DM participant in WS events.
-type dmUserPayload struct {
-	ID       int64  `json:"id"`
-	Username string `json:"username"`
-	Avatar   string `json:"avatar"`
-	Status   string `json:"status"`
+// callSignalPayload carries an ephemeral DM call signal (call_incoming /
+// call_declined). There is no call id: the "call" is presence in the DM's
+// voice channel, so channel_id plus who is signalling is the whole state.
+type callSignalPayload struct {
+	ChannelID int64  `json:"channel_id"`
+	FromUser  int64  `json:"from_user"`
+	Username  string `json:"username"`
 }
 
 // ---------------------------------------------------------------------------
@@ -256,14 +362,24 @@ func buildAuthError(message string) []byte {
 // ---------------------------------------------------------------------------
 
 // buildPresenceMsg constructs a presence broadcast payload.
-func buildPresenceMsg(userID int64, status string) []byte {
+//
+// status is taken verbatim: callers decide whose eyes the payload is for and
+// pass db.BroadcastStatus(status) for everyone but the owner. Keeping the
+// mapping out of the builder is deliberate — a builder that always collapsed
+// invisible could never produce the owner's own true-state message.
+func buildPresenceMsg(userID int64, status string, customStatus *string) []byte {
 	return buildJSON(wsMsg{
 		Type:    MsgTypePresence,
-		Payload: presencePayload{UserID: userID, Status: status},
+		Payload: presencePayload{UserID: userID, Status: status, CustomStatus: customStatus},
 	})
 }
 
-// buildMemberJoin constructs a member_join broadcast for when a user comes online.
+// buildMemberJoin constructs a member_join broadcast for when a user comes
+// online. user.Status is expected to already carry the ConnectStatus-mapped
+// value the caller settled the session on (see serve.go's applyConnectStatus,
+// which runs before this); Status here applies the BroadcastStatus collapse
+// so an invisible connector's member_join reports "offline" like every other
+// payload another user can see, instead of the raw chosen status.
 func buildMemberJoin(user *db.User, roleName string) []byte {
 	return buildJSON(wsMsg{
 		Type: MsgTypeMemberJoin,
@@ -273,35 +389,63 @@ func buildMemberJoin(user *db.User, roleName string) []byte {
 				Username:          user.Username,
 				Avatar:            user.Avatar,
 				Role:              roleName,
+				DisplayName:       user.DisplayName,
 				IdentityPublicKey: user.IdentityPublicKey,
 			},
+			Status: db.BroadcastStatus(user.Status),
 		},
 	})
 }
 
+// chatMessageArgs is the input to buildChatMessage. It is a struct rather than
+// a positional list because the payload has outgrown readable call sites.
+type chatMessageArgs struct {
+	MsgID            int64
+	ChannelID        int64
+	UserID           int64
+	Username         string
+	Avatar           *string
+	DisplayName      *string
+	RoleName         string
+	Content          string
+	Timestamp        string
+	ReplyTo          *int64
+	Attachments      []map[string]any
+	Mentions         []int64
+	MentionsEveryone bool
+}
+
 // buildChatMessage constructs a chat_message broadcast envelope.
 // Includes role in user object and empty reactions array for consistency with REST API.
-func buildChatMessage(msgID, channelID, userID int64, username string, avatar *string, roleName string, content string, timestamp string, replyTo *int64, attachments []map[string]any) []byte {
+func buildChatMessage(a chatMessageArgs) []byte {
+	attachments := a.Attachments
 	if attachments == nil {
 		attachments = []map[string]any{}
 	}
+	mentions := a.Mentions
+	if mentions == nil {
+		mentions = []int64{}
+	}
 	return buildJSON(wsMsg{
 		Type: MsgTypeChatMessage,
 		Payload: chatMessagePayload{
-			ID:        msgID,
-			ChannelID: channelID,
+			ID:        a.MsgID,
+			ChannelID: a.ChannelID,
 			User: memberUserPayload{
-				ID:       userID,
-				Username: username,
-				Avatar:   avatar,
-				Role:     roleName,
+				ID:          a.UserID,
+				Username:    a.Username,
+				Avatar:      a.Avatar,
+				Role:        a.RoleName,
+				DisplayName: a.DisplayName,
 			},
-			Content:     content,
-			ReplyTo:     replyTo,
-			Timestamp:   timestamp,
-			Attachments: attachments,
-			Reactions:   []any{},
-			Pinned:      false,
+			Content:          a.Content,
+			ReplyTo:          a.ReplyTo,
+			Timestamp:        a.Timestamp,
+			Attachments:      attachments,
+			Reactions:        []any{},
+			Pinned:           false,
+			Mentions:         mentions,
+			MentionsEveryone: a.MentionsEveryone,
 		},
 	})
 }
@@ -314,16 +458,23 @@ func buildMemberUpdate(userID int64, roleName string) []byte {
 	})
 }
 
+// UserUpdate is the profile snapshot a user_update broadcast carries. It is a
+// struct rather than five positional arguments because every field is a
+// nullable string and a swapped pair would compile.
+type UserUpdate struct {
+	UserID            int64
+	Username          string
+	Avatar            *string
+	DisplayName       *string
+	About             *string
+	IdentityPublicKey *string
+}
+
 // buildUserUpdate constructs a user_update broadcast for profile changes.
-func buildUserUpdate(userID int64, username string, avatar *string, identityPublicKey *string) []byte {
+func buildUserUpdate(u UserUpdate) []byte {
 	return buildJSON(wsMsg{
-		Type: MsgTypeUserUpdate,
-		Payload: userUpdatePayload{
-			UserID:            userID,
-			Username:          username,
-			Avatar:            avatar,
-			IdentityPublicKey: identityPublicKey,
-		},
+		Type:    MsgTypeUserUpdate,
+		Payload: userUpdatePayload(u),
 	})
 }
 
@@ -335,6 +486,41 @@ func buildMemberBan(userID int64) []byte {
 	})
 }
 
+// buildRolesUpdate constructs a roles_update broadcast carrying the full role
+// list, ordered highest position first exactly like the ready payload's.
+func buildRolesUpdate(roles []*db.Role) []byte {
+	flat := make([]db.Role, 0, len(roles))
+	for _, r := range roles {
+		if r != nil {
+			flat = append(flat, *r)
+		}
+	}
+	return buildJSON(wsMsg{
+		Type:    MsgTypeRolesUpdate,
+		Payload: rolesUpdatePayload{Roles: flat},
+	})
+}
+
+// buildEmojiUpdate constructs an emoji_update broadcast carrying the full
+// custom-emoji set, ordered the way the server listed it.
+func buildEmojiUpdate(list []*db.Emoji) []byte {
+	flat := make([]emojiInfo, 0, len(list))
+	for _, e := range list {
+		if e == nil {
+			continue
+		}
+		flat = append(flat, emojiInfo{
+			ID:        e.ID,
+			Shortcode: e.Shortcode,
+			URL:       service.EmojiImageURL(e.ID),
+		})
+	}
+	return buildJSON(wsMsg{
+		Type:    MsgTypeEmojiUpdate,
+		Payload: emojiUpdatePayload{Emoji: flat},
+	})
+}
+
 // buildChatSendOK constructs a chat_send_ok ack.
 func buildChatSendOK(requestID string, msgID int64, timestamp string) []byte {
 	return buildJSON(wsMsg{
@@ -345,14 +531,19 @@ func buildChatSendOK(requestID string, msgID int64, timestamp string) []byte {
 }
 
 // buildChatEdited constructs a chat_edited broadcast.
-func buildChatEdited(msgID, channelID int64, content, editedAt string) []byte {
+func buildChatEdited(msgID, channelID int64, content, editedAt string, mentions []int64, mentionsEveryone bool) []byte {
+	if mentions == nil {
+		mentions = []int64{}
+	}
 	return buildJSON(wsMsg{
 		Type: MsgTypeChatEdited,
 		Payload: chatEditedPayload{
-			MessageID: msgID,
-			ChannelID: channelID,
-			Content:   content,
-			EditedAt:  editedAt,
+			MessageID:        msgID,
+			ChannelID:        channelID,
+			Content:          content,
+			EditedAt:         editedAt,
+			Mentions:         mentions,
+			MentionsEveryone: mentionsEveryone,
 		},
 	})
 }
@@ -365,6 +556,19 @@ func buildChatDeleted(msgID, channelID int64) []byte {
 	})
 }
 
+// buildChatBulkDeleted constructs a chat_bulk_deleted broadcast. ids is
+// emitted as an empty array rather than null when nothing was purged, so
+// clients can iterate it unconditionally.
+func buildChatBulkDeleted(channelID int64, ids []int64) []byte {
+	if ids == nil {
+		ids = []int64{}
+	}
+	return buildJSON(wsMsg{
+		Type:    MsgTypeChatBulkDeleted,
+		Payload: chatBulkDeletedPayload{ChannelID: channelID, IDs: ids},
+	})
+}
+
 // buildReactionUpdate constructs a reaction_update broadcast.
 func buildReactionUpdate(msgID, channelID, userID int64, emoji, action string) []byte {
 	return buildJSON(wsMsg{
@@ -404,10 +608,30 @@ func buildVoiceState(state db.VoiceState) []byte {
 			Speaking:    state.Speaking,
 			Camera:      state.Camera,
 			Screenshare: state.Screenshare,
+
+			ServerMuted:    state.ServerMuted,
+			ServerDeafened: state.ServerDeafened,
 		},
 	})
 }
 
+// buildVoiceMoved constructs a voice_moved message for the moved client.
+func buildVoiceMoved(toChannelID int64) []byte {
+	return buildJSON(wsMsg{
+		Type:    MsgTypeVoiceMoved,
+		Payload: voiceMovedPayload{ToChannelID: toChannelID},
+	})
+}
+
+// buildVoiceDisconnected constructs a voice_disconnected message for the
+// client a moderator removed from voice.
+func buildVoiceDisconnected(channelID int64, reason string) []byte {
+	return buildJSON(wsMsg{
+		Type:    MsgTypeVoiceDisconnected,
+		Payload: voiceDisconnectedPayload{ChannelID: channelID, Reason: reason},
+	})
+}
+
 // buildVoiceConfig constructs a voice_config message sent after voice_join acceptance.
 func buildVoiceConfig(channelID int64, quality string, bitrate int, maxUsers int) []byte {
 	return buildJSON(wsMsg{
@@ -476,32 +700,16 @@ func buildVoiceLeave(channelID, userID int64) []byte {
 // buildChannelCreate constructs a channel_create broadcast.
 func buildChannelCreate(ch *db.Channel) []byte {
 	return buildJSON(wsMsg{
-		Type: MsgTypeChannelCreate,
-		Payload: channelPayload{
-			ID:       ch.ID,
-			Name:     ch.Name,
-			Type:     ch.Type,
-			Category: ch.Category,
-			Topic:    ch.Topic,
-			Position: ch.Position,
-			SlowMode: ch.SlowMode,
-		},
+		Type:    MsgTypeChannelCreate,
+		Payload: channelPayloadFrom(ch),
 	})
 }
 
 // buildChannelUpdate constructs a channel_update broadcast.
 func buildChannelUpdate(ch *db.Channel) []byte {
 	return buildJSON(wsMsg{
-		Type: MsgTypeChannelUpdate,
-		Payload: channelPayload{
-			ID:       ch.ID,
-			Name:     ch.Name,
-			Type:     ch.Type,
-			Category: ch.Category,
-			Topic:    ch.Topic,
-			Position: ch.Position,
-			SlowMode: ch.SlowMode,
-		},
+		Type:    MsgTypeChannelUpdate,
+		Payload: channelPayloadFrom(ch),
 	})
 }
 
@@ -513,27 +721,57 @@ func buildChannelDelete(channelID int64) []byte {
 	})
 }
 
-// buildDMChannelOpen constructs a dm_channel_open event sent to a user.
-// Returns nil if recipient is nil to avoid a panic on dereferencing.
-func buildDMChannelOpen(channelID int64, recipient *db.User) []byte {
+// buildDMChannelOpen constructs a dm_channel_open event for one viewer.
+//
+// The payload is a db.DMChannelInfo, the same shape the REST list and the
+// ready payload carry, so a client has exactly one DM shape to parse. It is
+// built per viewer rather than once per channel because `recipient` and
+// `recipients` are both defined relative to who is reading them.
+func buildDMChannelOpen(info db.DMChannelInfo) []byte {
+	return buildJSON(wsMsg{
+		Type:    MsgTypeDMChannelOpen,
+		Payload: info,
+	})
+}
+
+// buildDMChannelOpenFor constructs a dm_channel_open event announcing a 1:1 DM
+// to the user on the other end of it. Returns nil if recipient is nil to avoid
+// a panic on dereferencing.
+func buildDMChannelOpenFor(channelID int64, recipient *db.User, viewerID int64) []byte {
 	if recipient == nil {
-		slog.Warn("buildDMChannelOpen called with nil recipient", "channel_id", channelID)
+		slog.Warn("buildDMChannelOpenFor called with nil recipient", "channel_id", channelID)
 		return nil
 	}
 	avatarStr := ""
 	if recipient.Avatar != nil {
 		avatarStr = *recipient.Avatar
 	}
+	displayName := ""
+	if recipient.DisplayName != nil {
+		displayName = *recipient.DisplayName
+	}
+	other := db.DMUser{
+		ID:          recipient.ID,
+		Username:    recipient.Username,
+		Avatar:      avatarStr,
+		Status:      db.StatusForViewer(recipient.Status, recipient.ID, viewerID),
+		DisplayName: displayName,
+	}
+	return buildDMChannelOpen(db.DMChannelInfo{
+		ChannelID:  channelID,
+		Recipient:  other,
+		Recipients: []db.DMUser{other},
+	})
+}
+
+// buildCallSignal constructs a call_incoming or call_declined frame.
+func buildCallSignal(msgType string, channelID, fromUserID int64, username string) []byte {
 	return buildJSON(wsMsg{
-		Type: MsgTypeDMChannelOpen,
-		Payload: dmChannelOpenPayload{
+		Type: msgType,
+		Payload: callSignalPayload{
 			ChannelID: channelID,
-			Recipient: dmUserPayload{
-				ID:       recipient.ID,
-				Username: recipient.Username,
-				Avatar:   avatarStr,
-				Status:   recipient.Status,
-			},
+			FromUser:  fromUserID,
+			Username:  username,
 		},
 	})
 }
diff --git a/Server/ws/messages_test.go b/Server/ws/messages_test.go
index 5b23e996..473a6ed0 100644
--- a/Server/ws/messages_test.go
+++ b/Server/ws/messages_test.go
@@ -2,6 +2,8 @@ package ws
 
 import (
 	"encoding/json"
+	"slices"
+	"strings"
 	"testing"
 
 	"github.com/owncord/server/db"
@@ -287,6 +289,44 @@ func TestBuildMemberJoin_NonNilAvatar(t *testing.T) {
 	}
 }
 
+// An invisible connector's member_join must carry the collapsed "offline"
+// status, not their true chosen status — member_join goes out via
+// BroadcastToAll to every connected client, so it must never leak "invisible"
+// the way the channel-scoped presence path already avoids.
+func TestBuildMemberJoin_StatusField_InvisibleCollapsesToOffline(t *testing.T) {
+	user := &db.User{ID: 1, Username: "ghost", Status: db.StatusInvisible}
+	msg := buildMemberJoin(user, "member")
+	var env struct {
+		Payload struct {
+			Status string `json:"status"`
+		} `json:"payload"`
+	}
+	if err := json.Unmarshal(msg, &env); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if env.Payload.Status != db.StatusOffline {
+		t.Errorf("status = %q, want %q", env.Payload.Status, db.StatusOffline)
+	}
+}
+
+// A non-invisible status (already ConnectStatus-mapped by the caller) passes
+// through unchanged.
+func TestBuildMemberJoin_StatusField_PassesThroughNonInvisible(t *testing.T) {
+	user := &db.User{ID: 1, Username: "idler", Status: db.StatusIdle}
+	msg := buildMemberJoin(user, "member")
+	var env struct {
+		Payload struct {
+			Status string `json:"status"`
+		} `json:"payload"`
+	}
+	if err := json.Unmarshal(msg, &env); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if env.Payload.Status != db.StatusIdle {
+		t.Errorf("status = %q, want %q", env.Payload.Status, db.StatusIdle)
+	}
+}
+
 // ─── buildMemberUpdate ────────────────────────────────────────────────────────
 
 func TestBuildMemberUpdate_Type(t *testing.T) {
@@ -360,7 +400,7 @@ func TestBuildMemberBan_ValidJSON(t *testing.T) {
 // ─── buildChatEdited ──────────────────────────────────────────────────────────
 
 func TestBuildChatEdited_Type(t *testing.T) {
-	msg := buildChatEdited(10, 20, "new content", "2024-01-01T00:00:00Z")
+	msg := buildChatEdited(10, 20, "new content", "2024-01-01T00:00:00Z", []int64{7}, true)
 	var env struct {
 		Type string `json:"type"`
 	}
@@ -373,13 +413,15 @@ func TestBuildChatEdited_Type(t *testing.T) {
 }
 
 func TestBuildChatEdited_Payload(t *testing.T) {
-	msg := buildChatEdited(10, 20, "new content", "2024-01-01T00:00:00Z")
+	msg := buildChatEdited(10, 20, "new content", "2024-01-01T00:00:00Z", []int64{7}, true)
 	var env struct {
 		Payload struct {
-			MessageID int64  `json:"message_id"`
-			ChannelID int64  `json:"channel_id"`
-			Content   string `json:"content"`
-			EditedAt  string `json:"edited_at"`
+			MessageID        int64   `json:"message_id"`
+			ChannelID        int64   `json:"channel_id"`
+			Content          string  `json:"content"`
+			EditedAt         string  `json:"edited_at"`
+			Mentions         []int64 `json:"mentions"`
+			MentionsEveryone bool    `json:"mentions_everyone"`
 		} `json:"payload"`
 	}
 	if err := json.Unmarshal(msg, &env); err != nil {
@@ -398,6 +440,12 @@ func TestBuildChatEdited_Payload(t *testing.T) {
 	if p.EditedAt != "2024-01-01T00:00:00Z" {
 		t.Errorf("payload.edited_at = %q, want 2024-01-01T00:00:00Z", p.EditedAt)
 	}
+	if len(p.Mentions) != 1 || p.Mentions[0] != 7 {
+		t.Errorf("payload.mentions = %v, want [7]", p.Mentions)
+	}
+	if !p.MentionsEveryone {
+		t.Error("payload.mentions_everyone = false, want true")
+	}
 }
 
 // ─── buildChatDeleted ─────────────────────────────────────────────────────────
@@ -440,6 +488,42 @@ func TestBuildChatDeleted_ValidJSON(t *testing.T) {
 	}
 }
 
+// ─── buildChatBulkDeleted ─────────────────────────────────────────────────────
+
+func TestBuildChatBulkDeleted_TypeAndPayload(t *testing.T) {
+	msg := buildChatBulkDeleted(22, []int64{11, 10, 9})
+	var env struct {
+		Type    string `json:"type"`
+		Payload struct {
+			ChannelID int64   `json:"channel_id"`
+			IDs       []int64 `json:"ids"`
+		} `json:"payload"`
+	}
+	if err := json.Unmarshal(msg, &env); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if env.Type != "chat_bulk_deleted" {
+		t.Errorf("type = %q, want chat_bulk_deleted", env.Type)
+	}
+	if env.Payload.ChannelID != 22 {
+		t.Errorf("payload.channel_id = %d, want 22", env.Payload.ChannelID)
+	}
+	if !slices.Equal(env.Payload.IDs, []int64{11, 10, 9}) {
+		t.Errorf("payload.ids = %v, want [11 10 9]", env.Payload.IDs)
+	}
+}
+
+func TestBuildChatBulkDeleted_NilIDsEncodesAsEmptyArray(t *testing.T) {
+	msg := buildChatBulkDeleted(5, nil)
+	if !json.Valid(msg) {
+		t.Fatal("buildChatBulkDeleted output is not valid JSON")
+	}
+	// Clients iterate ids unconditionally, so null would be a crash.
+	if !strings.Contains(string(msg), `"ids":[]`) {
+		t.Errorf("nil ids encoded as %s, want an empty array", msg)
+	}
+}
+
 // ─── buildReactionUpdate ──────────────────────────────────────────────────────
 
 func TestBuildReactionUpdate_Type(t *testing.T) {
@@ -699,7 +783,7 @@ func TestBuildMemberJoin_NoIdentityKey_Omitted(t *testing.T) {
 
 func TestBuildUserUpdate_IncludesIdentityKey(t *testing.T) {
 	key := "dXBkYXRlZGtleQ=="
-	msg := buildUserUpdate(9, "rotator", nil, &key)
+	msg := buildUserUpdate(UserUpdate{UserID: 9, Username: "rotator", IdentityPublicKey: &key})
 	var env struct {
 		Type    string `json:"type"`
 		Payload struct {
@@ -721,3 +805,90 @@ func TestBuildUserUpdate_IncludesIdentityKey(t *testing.T) {
 		t.Errorf("identity_public_key = %q, want %q", env.Payload.IdentityPublicKey, key)
 	}
 }
+
+// ─── channel feature flags on the wire ───────────────────────────────────────
+
+// nsfwSampleChannel is a voice channel carrying every field the phase-5 flags
+// added, so a builder that drops one is caught by an explicit assertion rather
+// than by a client behaving oddly.
+func flaggedSampleChannel() *db.Channel {
+	return &db.Channel{
+		ID:            7,
+		Name:          "lounge",
+		Type:          "voice",
+		Category:      "Hangout",
+		Position:      1,
+		SlowMode:      30,
+		NSFW:          true,
+		VoiceMaxUsers: 5,
+		VoiceMaxVideo: 2,
+	}
+}
+
+// Both builders share one payload constructor, so both are asserted: the point
+// is that channel_create and channel_update can never disagree about which
+// fields a client is told about.
+func TestBuildChannelMessages_CarryFeatureFlags(t *testing.T) {
+	ch := flaggedSampleChannel()
+	for name, msg := range map[string][]byte{
+		"channel_create": buildChannelCreate(ch),
+		"channel_update": buildChannelUpdate(ch),
+	} {
+		t.Run(name, func(t *testing.T) {
+			var env struct {
+				Payload channelPayload `json:"payload"`
+			}
+			if err := json.Unmarshal(msg, &env); err != nil {
+				t.Fatalf("unmarshal: %v", err)
+			}
+			p := env.Payload
+			if !p.NSFW {
+				t.Error("payload.nsfw = false, want true")
+			}
+			if p.SlowMode != ch.SlowMode {
+				t.Errorf("payload.slow_mode = %d, want %d", p.SlowMode, ch.SlowMode)
+			}
+			if p.VoiceMaxUsers != ch.VoiceMaxUsers {
+				t.Errorf("payload.voice_max_users = %d, want %d", p.VoiceMaxUsers, ch.VoiceMaxUsers)
+			}
+			if p.VoiceMaxVideo != ch.VoiceMaxVideo {
+				t.Errorf("payload.voice_max_video = %d, want %d", p.VoiceMaxVideo, ch.VoiceMaxVideo)
+			}
+		})
+	}
+}
+
+// The JSON keys are the contract the client reads; a Go-side rename that kept
+// the struct field would pass the assertions above and still break every
+// client, so the wire names are pinned explicitly.
+func TestBuildChannelUpdate_FeatureFlagWireNames(t *testing.T) {
+	var env struct {
+		Payload map[string]any `json:"payload"`
+	}
+	if err := json.Unmarshal(buildChannelUpdate(flaggedSampleChannel()), &env); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	for _, key := range []string{"nsfw", "slow_mode", "voice_max_users", "voice_max_video"} {
+		if _, ok := env.Payload[key]; !ok {
+			t.Errorf("payload is missing %q; got keys %v", key, env.Payload)
+		}
+	}
+}
+
+// An unflagged channel must send the flags as their zero values rather than
+// omitting them: a client that reads `nsfw` as undefined would fall back to
+// its own default, and "absent" would then mean two different things.
+func TestBuildChannelUpdate_UnflaggedChannelSendsZeroes(t *testing.T) {
+	var env struct {
+		Payload map[string]any `json:"payload"`
+	}
+	if err := json.Unmarshal(buildChannelUpdate(sampleChannel()), &env); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if env.Payload["nsfw"] != false {
+		t.Errorf("payload.nsfw = %v, want false", env.Payload["nsfw"])
+	}
+	if env.Payload["voice_max_users"] != float64(0) {
+		t.Errorf("payload.voice_max_users = %v, want 0", env.Payload["voice_max_users"])
+	}
+}
diff --git a/Server/ws/presence_invisible_test.go b/Server/ws/presence_invisible_test.go
new file mode 100644
index 00000000..6523c913
--- /dev/null
+++ b/Server/ws/presence_invisible_test.go
@@ -0,0 +1,283 @@
+package ws_test
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/ws"
+)
+
+// Phase 6 "real invisible". The property under test is a single sentence:
+// an invisible user is offline to everyone but themselves, on every surface —
+// the ready member list, the presence broadcast, and the connect-time
+// announcement that used to stamp everyone online.
+
+// readPresence drains ch until a presence message arrives, returning its
+// payload. Returns nil if none arrives before the deadline.
+func readPresence(ch <-chan []byte, deadline time.Duration) map[string]any {
+	timer := time.NewTimer(deadline)
+	defer timer.Stop()
+	for {
+		select {
+		case raw := <-ch:
+			var env map[string]any
+			if json.Unmarshal(raw, &env) != nil {
+				continue
+			}
+			if env["type"] != "presence" {
+				continue
+			}
+			payload, _ := env["payload"].(map[string]any)
+			return payload
+		case <-timer.C:
+			return nil
+		}
+	}
+}
+
+// readyMembers pulls the members array out of a ready payload, keyed by id.
+func readyMembers(t *testing.T, raw []byte) map[int64]map[string]any {
+	t.Helper()
+	var env struct {
+		Payload struct {
+			Members []map[string]any `json:"members"`
+		} `json:"payload"`
+	}
+	if err := json.Unmarshal(raw, &env); err != nil {
+		t.Fatalf("unmarshal ready: %v", err)
+	}
+	out := make(map[int64]map[string]any, len(env.Payload.Members))
+	for _, m := range env.Payload.Members {
+		id, _ := m["id"].(float64)
+		out[int64(id)] = m
+	}
+	return out
+}
+
+func TestReady_InvisibleMemberIsOfflineToOthersAndTrueToSelf(t *testing.T) {
+	hub, database := newTestHub(t)
+	go hub.Run()
+	t.Cleanup(hub.Stop)
+	ctx := context.Background()
+
+	ghost := seedOwnerUser(t, database, "ghost")
+	watcher := seedOwnerUser(t, database, "watcher")
+	if err := database.UpdateUserStatus(ctx, ghost.ID, db.StatusInvisible); err != nil {
+		t.Fatalf("UpdateUserStatus: %v", err)
+	}
+	if err := database.UpdateUserStatus(ctx, watcher.ID, db.StatusOnline); err != nil {
+		t.Fatalf("UpdateUserStatus: %v", err)
+	}
+
+	// Both must be connected — a member with no live session renders offline
+	// regardless, which would mask the mapping this test is about.
+	gc := ws.NewTestClientWithUser(hub, ghost, 0, make(chan []byte, 8))
+	wc := ws.NewTestClientWithUser(hub, watcher, 0, make(chan []byte, 8))
+	hub.Register(gc)
+	hub.Register(wc)
+	waitRegistered(t, hub, gc)
+	waitRegistered(t, hub, wc)
+
+	forWatcher, err := hub.BuildReadyForTest(database, watcher.ID)
+	if err != nil {
+		t.Fatalf("buildReady(watcher): %v", err)
+	}
+	if got := readyMembers(t, forWatcher)[ghost.ID]["status"]; got != db.StatusOffline {
+		t.Errorf("ghost as seen by watcher = %v, want offline", got)
+	}
+
+	forGhost, err := hub.BuildReadyForTest(database, ghost.ID)
+	if err != nil {
+		t.Fatalf("buildReady(ghost): %v", err)
+	}
+	if got := readyMembers(t, forGhost)[ghost.ID]["status"]; got != db.StatusInvisible {
+		t.Errorf("ghost as seen by themselves = %v, want invisible", got)
+	}
+	// The watcher's own status is unaffected in either payload.
+	if got := readyMembers(t, forGhost)[watcher.ID]["status"]; got != db.StatusOnline {
+		t.Errorf("watcher in ghost's ready = %v, want online", got)
+	}
+}
+
+func TestReady_DisconnectedMemberWithChosenStatusRendersOffline(t *testing.T) {
+	hub, database := newTestHub(t)
+	go hub.Run()
+	t.Cleanup(hub.Stop)
+	ctx := context.Background()
+
+	absent := seedOwnerUser(t, database, "absent")
+	viewer := seedOwnerUser(t, database, "viewer")
+	// A chosen dnd survives a disconnect in the column so the next connect can
+	// honour it — but it must not render as "present" in the meantime.
+	if err := database.UpdateUserStatus(ctx, absent.ID, db.StatusDND); err != nil {
+		t.Fatalf("UpdateUserStatus: %v", err)
+	}
+
+	vc := ws.NewTestClientWithUser(hub, viewer, 0, make(chan []byte, 8))
+	hub.Register(vc)
+	waitRegistered(t, hub, vc)
+
+	raw, err := hub.BuildReadyForTest(database, viewer.ID)
+	if err != nil {
+		t.Fatalf("buildReady: %v", err)
+	}
+	if got := readyMembers(t, raw)[absent.ID]["status"]; got != db.StatusOffline {
+		t.Errorf("disconnected dnd member = %v, want offline", got)
+	}
+}
+
+func TestBroadcastPresence_InvisibleSplitsSelfFromEveryoneElse(t *testing.T) {
+	hub, database := newTestHub(t)
+	go hub.Run()
+	t.Cleanup(hub.Stop)
+
+	ghost := seedOwnerUser(t, database, "bc-ghost")
+	other := seedOwnerUser(t, database, "bc-other")
+	ghostCh := make(chan []byte, 8)
+	otherCh := make(chan []byte, 8)
+	gc := ws.NewTestClientWithUser(hub, ghost, 0, ghostCh)
+	oc := ws.NewTestClientWithUser(hub, other, 0, otherCh)
+	hub.Register(gc)
+	hub.Register(oc)
+	waitRegistered(t, hub, gc)
+	waitRegistered(t, hub, oc)
+
+	text := "heads down"
+	hub.BroadcastPresence(ghost.ID, db.StatusInvisible, &text)
+
+	self := readPresence(ghostCh, 500*time.Millisecond)
+	if self == nil {
+		t.Fatal("owner received no presence message")
+	}
+	if self["status"] != db.StatusInvisible {
+		t.Errorf("owner sees status = %v, want invisible", self["status"])
+	}
+	if self["custom_status"] != text {
+		t.Errorf("owner custom_status = %v, want %q", self["custom_status"], text)
+	}
+
+	seen := readPresence(otherCh, 500*time.Millisecond)
+	if seen == nil {
+		t.Fatal("other client received no presence message")
+	}
+	if seen["status"] != db.StatusOffline {
+		t.Errorf("other sees status = %v, want offline", seen["status"])
+	}
+}
+
+func TestBroadcastPresence_NonInvisibleGoesToEveryoneUnchanged(t *testing.T) {
+	hub, database := newTestHub(t)
+	go hub.Run()
+	t.Cleanup(hub.Stop)
+
+	user := seedOwnerUser(t, database, "bc-dnd")
+	ch := make(chan []byte, 8)
+	c := ws.NewTestClientWithUser(hub, user, 0, ch)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+
+	hub.BroadcastPresence(user.ID, db.StatusDND, nil)
+
+	got := readPresence(ch, 500*time.Millisecond)
+	if got == nil {
+		t.Fatal("no presence message")
+	}
+	if got["status"] != db.StatusDND {
+		t.Errorf("status = %v, want dnd", got["status"])
+	}
+	if got["custom_status"] != nil {
+		t.Errorf("custom_status = %v, want null", got["custom_status"])
+	}
+}
+
+func TestAuthOK_CarriesOwnTrueStatusAndProfileFields(t *testing.T) {
+	hub, database := newTestHub(t)
+	go hub.Run()
+	t.Cleanup(hub.Stop)
+	ctx := context.Background()
+
+	user := seedOwnerUser(t, database, "authok-ghost")
+	name, about, custom := "Ghosty", "boo", "lurking"
+	if err := database.UpdateUserProfile(ctx, user.ID, user.Username, nil, &name, &about); err != nil {
+		t.Fatalf("UpdateUserProfile: %v", err)
+	}
+	if err := database.UpdateUserCustomStatus(ctx, user.ID, &custom); err != nil {
+		t.Fatalf("UpdateUserCustomStatus: %v", err)
+	}
+	if err := database.UpdateUserStatus(ctx, user.ID, db.StatusInvisible); err != nil {
+		t.Fatalf("UpdateUserStatus: %v", err)
+	}
+	fresh, err := database.GetUserByID(ctx, user.ID)
+	if err != nil {
+		t.Fatalf("GetUserByID: %v", err)
+	}
+
+	var env struct {
+		Payload struct {
+			User map[string]any `json:"user"`
+		} `json:"payload"`
+	}
+	if err := json.Unmarshal(hub.BuildAuthOKForTest(fresh, "owner"), &env); err != nil {
+		t.Fatalf("unmarshal auth_ok: %v", err)
+	}
+	u := env.Payload.User
+	if u["status"] != db.StatusInvisible {
+		t.Errorf("auth_ok status = %v, want the owner's true invisible", u["status"])
+	}
+	if u["display_name"] != name {
+		t.Errorf("auth_ok display_name = %v, want %q", u["display_name"], name)
+	}
+	if u["about"] != about {
+		t.Errorf("auth_ok about = %v, want %q", u["about"], about)
+	}
+	if u["custom_status"] != custom {
+		t.Errorf("auth_ok custom_status = %v, want %q", u["custom_status"], custom)
+	}
+}
+
+func TestPresenceUpdate_InvisibleIsAcceptedAndCarriesCustomStatus(t *testing.T) {
+	// The coverage hub carries a real service layer, which the presence
+	// handler needs — newTestHub's hub has none.
+	hub, database := newCoverageHub(t)
+
+	ghost := seedCoverageOwner(t, database, "cmd-ghost")
+	other := seedCoverageOwner(t, database, "cmd-other")
+	ghostCh := make(chan []byte, 16)
+	otherCh := make(chan []byte, 16)
+	gc := ws.NewTestClientWithUser(hub, ghost, 0, ghostCh)
+	oc := ws.NewTestClientWithUser(hub, other, 0, otherCh)
+	hub.Register(gc)
+	hub.Register(oc)
+	waitRegistered(t, hub, gc)
+	waitRegistered(t, hub, oc)
+
+	raw, _ := json.Marshal(map[string]any{
+		"type": "presence_update",
+		"payload": map[string]any{
+			"status":        db.StatusInvisible,
+			"custom_status": "shhh",
+		},
+	})
+	hub.HandleMessageForTest(gc, raw)
+
+	if got := readPresence(otherCh, 500*time.Millisecond); got == nil || got["status"] != db.StatusOffline {
+		t.Errorf("other sees %v, want offline", got)
+	}
+	if got := readPresence(ghostCh, 500*time.Millisecond); got == nil || got["status"] != db.StatusInvisible {
+		t.Errorf("owner sees %v, want invisible", got)
+	}
+
+	stored, err := database.GetUserByID(context.Background(), ghost.ID)
+	if err != nil {
+		t.Fatalf("GetUserByID: %v", err)
+	}
+	if stored.Status != db.StatusInvisible {
+		t.Errorf("stored status = %q, want invisible (uncollapsed)", stored.Status)
+	}
+	if stored.CustomStatus == nil || *stored.CustomStatus != "shhh" {
+		t.Errorf("stored custom_status = %v, want %q", stored.CustomStatus, "shhh")
+	}
+}
diff --git a/Server/ws/protocol_contract_test.go b/Server/ws/protocol_contract_test.go
new file mode 100644
index 00000000..2dc99239
--- /dev/null
+++ b/Server/ws/protocol_contract_test.go
@@ -0,0 +1,228 @@
+package ws_test
+
+// protocol_contract_test.go — locks docs/protocol-schema.json and the
+// generated ws/message_types.go together so the two cannot silently drift.
+//
+// message_types.go is documented as "Code generated by scripts/genprotocol
+// from docs/protocol-schema.json; DO NOT EDIT" and CI runs
+// `make protocol-verify`, but that only re-runs the generator and diffs its
+// output — it says nothing about message-type constants that exist in the ws
+// package outside the generated file (e.g. a handler defining its own
+// MsgTypeFoo instead of adding it to the schema). This test instead parses
+// both the schema and every non-test .go file in this package for `MsgType*`
+// string constants and asserts they agree in both directions:
+//
+//   - every wire value the schema lists has a matching Go constant with the
+//     schema's stated name and value ("schema -> code"), and
+//   - every MsgType* constant declared anywhere in the ws package appears in
+//     the schema ("code -> schema"), with ONE documented exception.
+//
+// The exception: MsgTypeChatCommand ("chat_command", ws/handlers_command.go)
+// is a client->server wire message with no schema entry. It predates the
+// schema/genprotocol pipeline and was deliberately left out — plugin slash
+// commands are dispatched through the plugin registry rather than the fixed
+// handler table the generated constants serve, so it was judged internal
+// wiring rather than part of the documented protocol surface. If a second
+// undocumented constant ever appears, this test fails and names it — that is
+// the drift this test exists to catch, not something to silently allowlist.
+
+import (
+	"encoding/json"
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"strings"
+	"testing"
+)
+
+var knownUndocumentedConstants = map[string]string{
+	"MsgTypeChatCommand": "chat_command",
+}
+
+// protocolSchemaEntry mirrors one element of the client_to_server /
+// server_to_client arrays in docs/protocol-schema.json.
+type protocolSchemaEntry struct {
+	Wire string `json:"wire"`
+	Go   string `json:"go"`
+	TS   string `json:"ts"`
+}
+
+type protocolSchema struct {
+	Version        int                   `json:"version"`
+	ClientToServer []protocolSchemaEntry `json:"client_to_server"`
+	ServerToClient []protocolSchemaEntry `json:"server_to_client"`
+}
+
+// loadProtocolSchema locates and parses docs/protocol-schema.json relative to
+// this test file (ws/ -> Server/ -> repo root -> docs/), so the test does not
+// depend on the working directory `go test` happens to be invoked from.
+func loadProtocolSchema(t *testing.T) protocolSchema {
+	t.Helper()
+	_, thisFile, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("runtime.Caller failed to resolve test file path")
+	}
+	wsDir := filepath.Dir(thisFile)
+	schemaPath := filepath.Join(wsDir, "..", "..", "docs", "protocol-schema.json")
+
+	raw, err := os.ReadFile(schemaPath)
+	if err != nil {
+		t.Fatalf("reading protocol schema at %s: %v", schemaPath, err)
+	}
+
+	var schema protocolSchema
+	if err := json.Unmarshal(raw, &schema); err != nil {
+		t.Fatalf("parsing protocol schema: %v", err)
+	}
+	return schema
+}
+
+// loadGoMsgTypeConstants statically parses every non-test .go file in the ws
+// package directory and returns a map of MsgType* constant name -> its wire
+// string value, for top-level `const ( Name = "value" )` declarations.
+func loadGoMsgTypeConstants(t *testing.T) map[string]string {
+	t.Helper()
+	_, thisFile, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("runtime.Caller failed to resolve test file path")
+	}
+	wsDir := filepath.Dir(thisFile)
+
+	entries, err := os.ReadDir(wsDir)
+	if err != nil {
+		t.Fatalf("reading ws package directory %s: %v", wsDir, err)
+	}
+
+	out := make(map[string]string)
+	fset := token.NewFileSet()
+	for _, e := range entries {
+		name := e.Name()
+		if e.IsDir() || !strings.HasSuffix(name, ".go") || strings.HasSuffix(name, "_test.go") {
+			continue
+		}
+
+		file, err := parser.ParseFile(fset, filepath.Join(wsDir, name), nil, 0)
+		if err != nil {
+			t.Fatalf("parsing %s: %v", name, err)
+		}
+
+		for _, decl := range file.Decls {
+			gen, isGen := decl.(*ast.GenDecl)
+			if !isGen || gen.Tok != token.CONST {
+				continue
+			}
+			for _, spec := range gen.Specs {
+				vspec, isVal := spec.(*ast.ValueSpec)
+				if !isVal {
+					continue
+				}
+				for i, ident := range vspec.Names {
+					if !strings.HasPrefix(ident.Name, "MsgType") {
+						continue
+					}
+					if i >= len(vspec.Values) {
+						continue // no explicit value on this line (e.g. iota-style)
+					}
+					lit, isLit := vspec.Values[i].(*ast.BasicLit)
+					if !isLit || lit.Kind != token.STRING {
+						continue
+					}
+					val, err := strconv.Unquote(lit.Value)
+					if err != nil {
+						t.Fatalf("unquoting %s = %s in %s: %v", ident.Name, lit.Value, name, err)
+					}
+					if existing, dup := out[ident.Name]; dup && existing != val {
+						t.Fatalf("constant %s declared twice with different values (%q vs %q) across ws package files",
+							ident.Name, existing, val)
+					}
+					out[ident.Name] = val
+				}
+			}
+		}
+	}
+	return out
+}
+
+// TestProtocolSchema_MatchesGeneratedGoConstants is the "schema -> code"
+// direction: every wire constant docs/protocol-schema.json lists (in either
+// direction of traffic) must have a same-named Go constant in the ws package
+// carrying exactly the schema's wire string.
+func TestProtocolSchema_MatchesGeneratedGoConstants(t *testing.T) {
+	schema := loadProtocolSchema(t)
+	goConsts := loadGoMsgTypeConstants(t)
+
+	check := func(direction string, entries []protocolSchemaEntry) {
+		for _, e := range entries {
+			got, ok := goConsts[e.Go]
+			if !ok {
+				t.Errorf("%s: schema entry wire=%q go=%q has no matching Go constant in ws package",
+					direction, e.Wire, e.Go)
+				continue
+			}
+			if got != e.Wire {
+				t.Errorf("%s: ws.%s = %q, want %q per protocol-schema.json", direction, e.Go, got, e.Wire)
+			}
+		}
+	}
+
+	if len(schema.ClientToServer) == 0 {
+		t.Fatal("protocol-schema.json client_to_server is empty — schema failed to load")
+	}
+	if len(schema.ServerToClient) == 0 {
+		t.Fatal("protocol-schema.json server_to_client is empty — schema failed to load")
+	}
+
+	check("client_to_server", schema.ClientToServer)
+	check("server_to_client", schema.ServerToClient)
+}
+
+// TestProtocolSchema_NoUndocumentedGoConstants is the "code -> schema"
+// direction: every MsgType* constant declared in the ws package must appear
+// in docs/protocol-schema.json, except the documented exceptions in
+// knownUndocumentedConstants (see its doc comment). This is what catches a
+// handler minting its own wire constant instead of adding it to the schema.
+func TestProtocolSchema_NoUndocumentedGoConstants(t *testing.T) {
+	schema := loadProtocolSchema(t)
+	goConsts := loadGoMsgTypeConstants(t)
+
+	documented := make(map[string]string, len(schema.ClientToServer)+len(schema.ServerToClient))
+	for _, e := range schema.ClientToServer {
+		documented[e.Go] = e.Wire
+	}
+	for _, e := range schema.ServerToClient {
+		documented[e.Go] = e.Wire
+	}
+
+	for name, wire := range goConsts {
+		if _, inSchema := documented[name]; inSchema {
+			continue
+		}
+		exceptWire, isException := knownUndocumentedConstants[name]
+		if !isException {
+			t.Errorf("ws.%s = %q is not in docs/protocol-schema.json and is not a documented exception "+
+				"(knownUndocumentedConstants) — add it to the schema or the exception list", name, wire)
+			continue
+		}
+		if exceptWire != wire {
+			t.Errorf("documented exception ws.%s has wire value %q, but knownUndocumentedConstants says %q — update the exception list",
+				name, wire, exceptWire)
+		}
+	}
+
+	// Guard against the exception list growing silently: it must contain
+	// exactly the constants we can currently account for as intentionally
+	// undocumented, and nothing that has since been added to the schema.
+	for name := range knownUndocumentedConstants {
+		if _, stillMissing := goConsts[name]; !stillMissing {
+			t.Errorf("knownUndocumentedConstants lists %q but no such Go constant exists anymore — remove it from the exception list", name)
+			continue
+		}
+		if _, nowDocumented := documented[name]; nowDocumented {
+			t.Errorf("knownUndocumentedConstants lists %q but it is now in protocol-schema.json — remove it from the exception list", name)
+		}
+	}
+}
diff --git a/Server/ws/registry_test.go b/Server/ws/registry_test.go
index c7cd55ce..4f1ec088 100644
--- a/Server/ws/registry_test.go
+++ b/Server/ws/registry_test.go
@@ -18,6 +18,7 @@ func fullV2Registry() *HandlerRegistry {
 	registerReactionHandlers(r, ReactionDeps{})
 	r.RegisterV2(MsgTypeChatCommand, handleChatCommandV2, PluginDeps{})
 	registerVoiceControlsV2(r, VoiceDeps{})
+	registerCallHandlers(r, CallDeps{})
 	return r
 }
 
@@ -111,6 +112,7 @@ func TestHandlerRegistry_AllExpectedTypesRegistered(t *testing.T) {
 		"typing_start",
 		"presence_update",
 		"channel_focus",
+		"mark_read",
 		"reaction_add",
 		"reaction_remove",
 		"chat_send",
@@ -123,9 +125,15 @@ func TestHandlerRegistry_AllExpectedTypesRegistered(t *testing.T) {
 		"voice_deafen",
 		"voice_camera",
 		"voice_screenshare",
+		"voice_mod_mute",
+		"voice_mod_deafen",
+		"voice_mod_move",
+		"voice_mod_kick",
 		"voice_e2ee_announce",
 		"voice_e2ee_offer",
 		"voice_token_refresh",
+		"call_ring",
+		"call_decline",
 	}
 
 	registered := r.RegisteredV2Types()
@@ -179,6 +187,7 @@ func TestAllV2Types_SmokeDispatch(t *testing.T) {
 		MsgTypeTypingStart:       TypingStartCmd{userID: 1, channelID: 1},
 		MsgTypePresenceUpdate:    PresenceUpdateCmd{userID: 1, status: "online"},
 		MsgTypeChannelFocus:      ChannelFocusCmd{userID: 1, channelID: 1},
+		MsgTypeMarkRead:          MarkReadCmd{userID: 1, channelID: 1},
 		MsgTypeReactionAdd:       ReactionAddCmd{userID: 1, messageID: 1, emoji: "👍"},
 		MsgTypeReactionRemove:    ReactionRemoveCmd{userID: 1, messageID: 1, emoji: "👍"},
 		MsgTypeVoiceJoin:         VoiceJoinCmd{userID: 1, channelID: 1},
@@ -187,9 +196,15 @@ func TestAllV2Types_SmokeDispatch(t *testing.T) {
 		MsgTypeVoiceDeafen:       VoiceDeafenCmd{userID: 1},
 		MsgTypeVoiceCamera:       VoiceCameraCmd{userID: 1},
 		MsgTypeVoiceScreenshare:  VoiceScreenshareCmd{userID: 1},
+		MsgTypeVoiceModMute:      VoiceModMuteCmd{userID: 1, channelID: 1, targetID: 2},
+		MsgTypeVoiceModDeafen:    VoiceModDeafenCmd{userID: 1, channelID: 1, targetID: 2},
+		MsgTypeVoiceModMove:      VoiceModMoveCmd{userID: 1, targetID: 2, toChannelID: 2},
+		MsgTypeVoiceModKick:      VoiceModKickCmd{userID: 1, targetID: 2},
 		MsgTypeVoiceE2EEAnnounce: VoiceE2EEAnnounceCmd{userID: 1},
 		MsgTypeVoiceE2EEOffer:    VoiceE2EEOfferCmd{userID: 1},
 		MsgTypeVoiceTokenRefresh: VoiceTokenRefreshCmd{userID: 1},
+		MsgTypeCallRing:          CallRingCmd{userID: 1, channelID: 1},
+		MsgTypeCallDecline:       CallDeclineCmd{userID: 1, channelID: 1},
 	}
 
 	for _, typ := range r.RegisteredV2Types() {
diff --git a/Server/ws/serve.go b/Server/ws/serve.go
index bcf17620..3dea17ef 100644
--- a/Server/ws/serve.go
+++ b/Server/ws/serve.go
@@ -194,14 +194,39 @@ func (h *Hub) handleReconnect(
 	slog.Info("ws replay completed", "user_id", c.userID, "events_replayed", len(events), "from_seq", lastSeq, "source", replaySource)
 
 	// Update presence but skip member_join — user was already known.
-	if updateErr := database.UpdateUserStatus(ctx, c.userID, "online"); updateErr != nil {
-		slog.Warn("ws UpdateUserStatus", "err", updateErr)
-	}
-	h.BroadcastToAll(buildPresenceMsg(c.userID, "online"))
+	applyConnectStatus(ctx, database, c)
+	h.announceConnectPresence(c)
 
 	return true
 }
 
+// applyConnectStatus writes the status this session comes online as and caches
+// it on the client.
+//
+// It is db.ConnectStatus(saved) rather than a flat "online": stamping online on
+// every connect is what made a saved Do Not Disturb — and, before this phase,
+// an "appear offline" — flash back to online on every reconnect, with the
+// client racing to re-assert its choice afterwards. idle/dnd/invisible are
+// deliberate choices and survive; anything else becomes online. The write still
+// happens when the status is unchanged, because UpdateUserStatus also refreshes
+// last_seen.
+//
+// It runs BEFORE the ready payload is built so the member list the client is
+// handed already agrees with the presence broadcast that follows it.
+func applyConnectStatus(ctx context.Context, database *db.DB, c *Client) {
+	status := db.ConnectStatus(c.user.Status)
+	if updateErr := database.UpdateUserStatus(ctx, c.userID, status); updateErr != nil {
+		slog.Warn("ws UpdateUserStatus", "err", updateErr)
+	}
+	c.user.Status = status
+}
+
+// announceConnectPresence fans out the status applyConnectStatus settled on,
+// with the invisible mapping applied.
+func (h *Hub) announceConnectPresence(c *Client) {
+	h.BroadcastPresence(c.userID, c.user.Status, c.user.CustomStatus)
+}
+
 // computeAllowedChannels returns the set of channel IDs a user may access,
 // including both server channels (filtered by ReadMessages permission) and
 // the user's open DM channels. The server-channel set comes from the single
@@ -224,9 +249,9 @@ func (h *Hub) computeAllowedChannels(ctx context.Context, database *db.DB, user
 	if role != nil {
 		var overrides map[int64]db.ChannelOverride
 		if !permissions.HasAdmin(role.Permissions) {
-			overrides, err = database.GetAllChannelPermissionsForRole(ctx, role.ID)
+			overrides, err = database.GetChannelOverridesFor(ctx, role.ID, user.ID)
 			if err != nil {
-				return nil, fmt.Errorf("computeAllowedChannels GetAllChannelPermissionsForRole: %w", err)
+				return nil, fmt.Errorf("computeAllowedChannels GetChannelOverridesFor: %w", err)
 			}
 		}
 		allowed = h.permChecker.VisibleChannelIDs(role.Permissions, channelRefs(channels), permOverrides(overrides))
@@ -315,6 +340,10 @@ func (h *Hub) handleFreshConnect(
 	}
 	h.registerNow(c, allowedChannelIDs)
 
+	// Settle the session's status before buildReady reads the member list, so
+	// the ready payload and the presence broadcast below cannot disagree.
+	applyConnectStatus(ctx, database, c)
+
 	// Fresh connection or replay fallback: full auth_ok + ready flow.
 	slog.Info("ws sending auth_ok", "user_id", c.userID, "username", c.user.Username, "role", c.roleName)
 	if err := conn.Write(ctx, websocket.MessageText, h.buildAuthOK(ctx, c.user, c.roleName, "none")); err != nil {
@@ -340,13 +369,9 @@ func (h *Hub) handleFreshConnect(
 		return readyErr
 	}
 
-	if updateErr := database.UpdateUserStatus(ctx, c.userID, "online"); updateErr != nil {
-		slog.Warn("ws UpdateUserStatus", "err", updateErr)
-	}
-
 	slog.Info("ws broadcasting member_join and presence", "user_id", c.userID, "username", c.user.Username)
 	h.BroadcastToAll(buildMemberJoin(c.user, c.roleName))
-	h.BroadcastToAll(buildPresenceMsg(c.userID, "online"))
+	h.announceConnectPresence(c)
 
 	return nil
 }
diff --git a/Server/ws/serve_pumps.go b/Server/ws/serve_pumps.go
index 892373cf..c006f37f 100644
--- a/Server/ws/serve_pumps.go
+++ b/Server/ws/serve_pumps.go
@@ -6,6 +6,8 @@ import (
 	"time"
 
 	"github.com/coder/websocket"
+
+	"github.com/owncord/server/db"
 )
 
 // writePump drains the client's send channels and writes to the WebSocket.
@@ -122,8 +124,17 @@ func readPump(ctx context.Context, conn *websocket.Conn, hub *Hub, c *Client) {
 			slog.Info("websocket disconnected", attrs...)
 
 			if !replaced {
-				_ = hub.db.UpdateUserStatus(cleanupCtx, c.userID, "offline")
-				hub.BroadcastToAll(buildPresenceMsg(c.userID, "offline"))
+				// A real disconnect is offline for everyone, the user
+				// included, so this path needs no invisible mapping. The row,
+				// however, keeps a *chosen* status (idle/dnd/invisible)
+				// standing — that is what the next connect reads to avoid
+				// stamping the user back online. MarkUserDisconnected clears
+				// only the non-choice "online" and refreshes last_seen; the
+				// stale-choice problem it would otherwise create is handled at
+				// read time, where a member with no live connection renders
+				// offline no matter what the column says.
+				_ = hub.db.MarkUserDisconnected(cleanupCtx, c.userID)
+				hub.BroadcastToAll(buildPresenceMsg(c.userID, db.StatusOffline, c.user.CustomStatus))
 			}
 		}
 	}()
diff --git a/Server/ws/serve_ready.go b/Server/ws/serve_ready.go
index 38d53b42..a320dbf4 100644
--- a/Server/ws/serve_ready.go
+++ b/Server/ws/serve_ready.go
@@ -32,6 +32,17 @@ func (h *Hub) buildAuthOK(ctx context.Context, user *db.User, roleName string, r
 				"username": user.Username,
 				"avatar":   avatarVal,
 				"role":     roleName,
+				// The signed-in user's own profile fields. Null when unset;
+				// display_name falls back to username client-side, and about
+				// is what the "edit my profile" form pre-fills from.
+				"display_name":  user.DisplayName,
+				"about":         user.About,
+				"custom_status": user.CustomStatus,
+				// The user's own true status — invisible included. Only their
+				// own auth_ok ever carries it, which is the whole point: the
+				// picker has to render what they chose, while every other
+				// client is told offline.
+				"status": user.Status,
 			},
 			"server_name":   serverName,
 			"motd":          motd,
@@ -40,21 +51,63 @@ func (h *Hub) buildAuthOK(ctx context.Context, user *db.User, roleName string, r
 	})
 }
 
+// presentableMembers rewrites each member's status into what viewerID may see.
+//
+// Two rules, both applied here so no payload builder can implement only one:
+//
+//  1. A member with no live connection is offline, whatever the row says.
+//     users.status keeps a *chosen* idle/dnd/invisible across a disconnect so
+//     the next connect can honour it, which would otherwise leave a signed-out
+//     user showing as "Do Not Disturb" indefinitely.
+//  2. An invisible member is offline to everyone but themselves
+//     (db.StatusForViewer). The owner keeps their true state so their own
+//     picker renders the status they actually chose.
+func (h *Hub) presentableMembers(members []db.MemberSummary, viewerID int64) []db.MemberSummary {
+	connected := h.connectedUserIDs()
+	out := make([]db.MemberSummary, 0, len(members))
+	for _, m := range members {
+		if !connected[m.ID] {
+			m.Status = db.StatusOffline
+			m.CustomStatus = nil
+		}
+		out = append(out, m.ForViewer(viewerID))
+	}
+	return out
+}
+
+// connectedUserIDs snapshots the ids with a live WebSocket connection.
+func (h *Hub) connectedUserIDs() map[int64]bool {
+	h.mu.RLock()
+	defer h.mu.RUnlock()
+	set := make(map[int64]bool, len(h.clients))
+	for uid := range h.clients {
+		set[uid] = true
+	}
+	return set
+}
+
 // channelRefs maps db channels to the checker's db-agnostic ChannelRef so
 // buildReady and computeAllowedChannels can share permissions.VisibleChannelIDs.
 func channelRefs(channels []db.Channel) []permissions.ChannelRef {
 	refs := make([]permissions.ChannelRef, len(channels))
 	for i := range channels {
-		refs[i] = permissions.ChannelRef{ID: channels[i].ID, Type: channels[i].Type}
+		refs[i] = permissions.ChannelRef{ID: channels[i].ID, Type: channels[i].Type, Archived: channels[i].Archived}
 	}
 	return refs
 }
 
-// permOverrides maps a db override map to the checker's override map.
+// permOverrides maps a db override map to the checker's override map, carrying
+// BOTH layers — the role override and the per-user override — so the checker
+// resolves the full order (base -> role -> user) rather than half of it.
 func permOverrides(overrides map[int64]db.ChannelOverride) map[int64]permissions.ChannelOverride {
 	out := make(map[int64]permissions.ChannelOverride, len(overrides))
 	for id, o := range overrides {
-		out[id] = permissions.ChannelOverride{Allow: o.Allow, Deny: o.Deny}
+		out[id] = permissions.ChannelOverride{
+			Allow:     o.Allow,
+			Deny:      o.Deny,
+			UserAllow: o.UserAllow,
+			UserDeny:  o.UserDeny,
+		}
 	}
 	return out
 }
@@ -70,7 +123,9 @@ func channelCanSend(role *db.Role, o db.ChannelOverride, chanType string) bool {
 	if permissions.HasAdmin(role.Permissions) {
 		return true
 	}
-	eff := permissions.EffectivePerms(role.Permissions, o.Allow, o.Deny)
+	eff := permissions.EffectiveChannelPerms(role.Permissions, permissions.ChannelOverride{
+		Allow: o.Allow, Deny: o.Deny, UserAllow: o.UserAllow, UserDeny: o.UserDeny,
+	})
 	need := permissions.ReadMessages | permissions.SendMessages
 	if eff&need != need {
 		return false
@@ -99,6 +154,7 @@ func (h *Hub) buildReady(ctx context.Context, database *db.DB, userID int64, rol
 		slog.Warn("buildReady ListMembers", "err", err)
 		members = []db.MemberSummary{}
 	}
+	members = h.presentableMembers(members, userID)
 
 	// Filter channels by READ_MESSAGES through the single permissions.Checker
 	// predicate shared with REST ListVisibleChannels and reconnect replay
@@ -108,9 +164,9 @@ func (h *Hub) buildReady(ctx context.Context, database *db.DB, userID int64, rol
 	overrides := map[int64]db.ChannelOverride{}
 	if role != nil && !permissions.HasAdmin(role.Permissions) {
 		var oErr error
-		overrides, oErr = database.GetAllChannelPermissionsForRole(ctx, role.ID)
+		overrides, oErr = database.GetChannelOverridesFor(ctx, role.ID, userID)
 		if oErr != nil {
-			return nil, fmt.Errorf("buildReady GetAllChannelPermissionsForRole: %w", oErr)
+			return nil, fmt.Errorf("buildReady GetChannelOverridesFor: %w", oErr)
 		}
 	}
 	var visibleChannels []db.Channel
@@ -142,6 +198,7 @@ func (h *Hub) buildReady(ctx context.Context, database *db.DB, userID int64, rol
 			"name":     visibleChannels[i].Name,
 			"type":     visibleChannels[i].Type,
 			"category": visibleChannels[i].Category,
+			"topic":    visibleChannels[i].Topic,
 			"position": visibleChannels[i].Position,
 			// can_send drives the client's composer affordance. It mirrors
 			// MessageService.checkSendPermission for non-DM channels: base role
@@ -153,14 +210,24 @@ func (h *Hub) buildReady(ctx context.Context, database *db.DB, userID int64, rol
 			// for the window instead of accepting a send the server refuses
 			// with SLOW_MODE. The server still enforces.
 			"slow_mode": visibleChannels[i].SlowMode,
+			// Age-gate flag. Shipped so a client can label or gate the
+			// channel; the server applies no content behaviour of its own to
+			// a flagged channel (migration 025).
+			"nsfw": visibleChannels[i].NSFW,
+			// Voice capacity limits (0 = unlimited) — the same values the
+			// voice-join path enforces with CHANNEL_FULL / VIDEO_LIMIT.
+			"voice_max_users": visibleChannels[i].VoiceMaxUsers,
+			"voice_max_video": visibleChannels[i].VoiceMaxVideo,
 		}
 		if visibleChannels[i].Type == "text" || visibleChannels[i].Type == "announcement" {
 			if u, ok := unreadMap[visibleChannels[i].ID]; ok {
 				entry["unread_count"] = u.UnreadCount
 				entry["last_message_id"] = u.LastMessageID
+				entry["mention_count"] = u.MentionCount
 			} else {
 				entry["unread_count"] = 0
 				entry["last_message_id"] = 0
+				entry["mention_count"] = 0
 			}
 		}
 		channelPayloads = append(channelPayloads, entry)
@@ -190,6 +257,14 @@ func (h *Hub) buildReady(ctx context.Context, database *db.DB, userID int64, rol
 		slog.Warn("buildReady GetUserDMChannels", "err", err)
 		dmChannels = []db.DMChannelInfo{}
 	}
+	// GetUserDMChannels computes unread from read_states but carries no mention
+	// count, so a DM mention badge used to vanish on every reconnect. The
+	// unread map now includes the user's DM rows — pull mention_count from it.
+	for i := range dmChannels {
+		if u, ok := unreadMap[dmChannels[i].ChannelID]; ok {
+			dmChannels[i].MentionCount = u.MentionCount
+		}
+	}
 
 	serverName, motd := h.getCachedSettings(ctx)
 
diff --git a/Server/ws/serve_test.go b/Server/ws/serve_test.go
index 2500f2f8..ebd943a4 100644
--- a/Server/ws/serve_test.go
+++ b/Server/ws/serve_test.go
@@ -25,6 +25,8 @@ CREATE TABLE IF NOT EXISTS voice_states (
     speaking    INTEGER NOT NULL DEFAULT 0,
     camera      INTEGER NOT NULL DEFAULT 0,
     screenshare INTEGER NOT NULL DEFAULT 0,
+    server_muted    INTEGER NOT NULL DEFAULT 0,
+    server_deafened INTEGER NOT NULL DEFAULT 0,
     joined_at   TEXT    NOT NULL DEFAULT (datetime('now'))
 );
 CREATE INDEX IF NOT EXISTS idx_voice_states_channel_serve ON voice_states(channel_id);
diff --git a/Server/ws/voice_broadcast.go b/Server/ws/voice_broadcast.go
index 3bfe4761..31088bef 100644
--- a/Server/ws/voice_broadcast.go
+++ b/Server/ws/voice_broadcast.go
@@ -14,6 +14,10 @@ const (
 	voiceCameraWindow         = time.Second
 	voiceScreenshareRateLimit = 2
 	voiceScreenshareWindow    = time.Second
+	// Shared by the four voice moderation commands. Each fans a voice_state or
+	// voice_leave broadcast out to everyone who can see the channel.
+	voiceModRateLimit = 5
+	voiceModWindow    = time.Second
 )
 
 // voiceQualities maps accepted voice quality presets to their target bitrate
diff --git a/Server/ws/voice_controls.go b/Server/ws/voice_controls.go
index 39436901..c83ac278 100644
--- a/Server/ws/voice_controls.go
+++ b/Server/ws/voice_controls.go
@@ -24,6 +24,14 @@ func handleVoiceMuteV2(ctx context.Context, cmd Command, info ClientInfo, deps a
 		return Result{Error: ClientError{Code: ErrCodeVoiceError, Message: "not in a voice channel"}}
 	}
 
+	// A moderator-imposed mute is not the user's to lift. Only the unmute
+	// direction reads the row: muting oneself is always allowed.
+	if !muteCmd.Muted() {
+		if r := refuseIfServerSilenced(ctx, d, userID, false); r != nil {
+			return *r
+		}
+	}
+
 	if err := d.DB.UpdateVoiceMute(ctx, userID, muteCmd.Muted()); err != nil {
 		slog.Error("ws handleVoiceMuteV2 UpdateVoiceMute", "err", err, "user_id", userID)
 		return Result{Error: ClientError{Code: ErrCodeInternal, Message: "failed to update mute state"}}
@@ -48,6 +56,13 @@ func handleVoiceDeafenV2(ctx context.Context, cmd Command, info ClientInfo, deps
 		return Result{Error: ClientError{Code: ErrCodeVoiceError, Message: "not in a voice channel"}}
 	}
 
+	// See handleVoiceMuteV2: server deafen is the moderator's to lift.
+	if !deafenCmd.Deafened() {
+		if r := refuseIfServerSilenced(ctx, d, userID, true); r != nil {
+			return *r
+		}
+	}
+
 	if err := d.DB.UpdateVoiceDeafen(ctx, userID, deafenCmd.Deafened()); err != nil {
 		slog.Error("ws handleVoiceDeafenV2 UpdateVoiceDeafen", "err", err, "user_id", userID)
 		return Result{Error: ClientError{Code: ErrCodeInternal, Message: "failed to update deafen state"}}
@@ -142,6 +157,34 @@ func handleVoiceScreenshareV2(ctx context.Context, cmd Command, info ClientInfo,
 	return voiceStateBroadcast(ctx, d, userID)
 }
 
+// refuseIfServerSilenced refuses a self-unmute (deafen=false) or self-undeafen
+// (deafen=true) while the corresponding moderator-imposed flag is set. A read
+// error is not a denial: it is reported as INTERNAL so an operator sees it
+// rather than the user seeing a permission-shaped refusal.
+func refuseIfServerSilenced(ctx context.Context, d VoiceDeps, userID int64, deafen bool) *Result {
+	state, err := d.DB.GetVoiceState(ctx, userID)
+	if err != nil {
+		slog.Error("ws refuseIfServerSilenced GetVoiceState", "err", err, "user_id", userID)
+		return &Result{Error: ClientError{Code: ErrCodeInternal, Message: "failed to read voice state"}}
+	}
+	if state == nil {
+		return nil
+	}
+	if deafen && state.ServerDeafened {
+		return &Result{Error: ClientError{
+			Code:    ErrCodeServerDeafened,
+			Message: "you were deafened by a moderator",
+		}}
+	}
+	if !deafen && state.ServerMuted {
+		return &Result{Error: ClientError{
+			Code:    ErrCodeServerMuted,
+			Message: "you were muted by a moderator",
+		}}
+	}
+	return nil
+}
+
 // voiceStateBroadcast reads the current voice state from DB and returns a
 // BroadcastAll event. Shared by all voice control V2 handlers.
 func voiceStateBroadcast(ctx context.Context, d VoiceDeps, userID int64) Result {
diff --git a/Server/ws/voice_dm_access_test.go b/Server/ws/voice_dm_access_test.go
index 5cac6357..58d7dbab 100644
--- a/Server/ws/voice_dm_access_test.go
+++ b/Server/ws/voice_dm_access_test.go
@@ -140,3 +140,96 @@ func TestVoiceTokenRefresh_DMParticipant_StillRefreshes(t *testing.T) {
 		t.Error("a DM participant must still be able to refresh their voice token")
 	}
 }
+
+// Group DMs need no separate voice authorization path: dm_participants holds
+// one row per participant and the gate is a lookup on (user_id, channel_id).
+// These two pin that the existing path genuinely covers the N-participant case
+// — a third member gets in, and an outsider still does not.
+func TestVoiceJoin_GroupDMParticipant_Joins(t *testing.T) {
+	hub, database := newVoiceHub(t)
+	alice := seedMemberUser(t, database, "grpvoice-alice")
+	bob := seedMemberUser(t, database, "grpvoice-bob")
+	carol := seedMemberUser(t, database, "grpvoice-carol")
+	chID := seedGroupDM(t, database, "Callers", alice.ID, bob.ID, carol.ID)
+
+	send := make(chan []byte, 32)
+	c := ws.NewTestClientWithUser(hub, carol, 0, send)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+
+	hub.HandleMessageForTest(c, voiceJoinMsg(chID))
+
+	if !hasVoiceToken(t, drainChanTimeout(send, 200*time.Millisecond)) {
+		t.Error("the third member of a group DM must receive a voice token")
+	}
+
+	state, err := database.GetVoiceState(context.Background(), carol.ID)
+	if err != nil {
+		t.Fatalf("GetVoiceState: %v", err)
+	}
+	if state == nil || state.ChannelID != chID {
+		t.Fatalf("group participant voice state = %+v, want channel %d", state, chID)
+	}
+}
+
+// channelReadAudience used to resolve a DM's audience via the role scan (DMs
+// carry no channel_overrides), so any connected user whose base role held
+// READ_MESSAGES received the DM call's voice_state/voice_leave events —
+// leaking who is in a private call and their mute/camera state to the whole
+// server. The audience must be the DM's participants, not a role-wide scan.
+func TestVoiceJoin_DMCall_VoiceStateNotLeakedToThirdConnectedUser(t *testing.T) {
+	hub, database := newVoiceHub(t)
+	alice := seedMemberUser(t, database, "dmleak-alice")
+	bob := seedMemberUser(t, database, "dmleak-bob")
+	mallory := seedMemberUser(t, database, "dmleak-mallory") // connected, has READ_MESSAGES, NOT a participant
+	dmID := seedDMChannel(t, database, alice.ID, bob.ID)
+
+	aliceSend := make(chan []byte, 32)
+	bobSend := make(chan []byte, 32)
+	mallorySend := make(chan []byte, 32)
+	aliceClient := ws.NewTestClientWithUser(hub, alice, 0, aliceSend)
+	bobClient := ws.NewTestClientWithUser(hub, bob, 0, bobSend)
+	malloryClient := ws.NewTestClientWithUser(hub, mallory, 0, mallorySend)
+	hub.Register(aliceClient)
+	hub.Register(bobClient)
+	hub.Register(malloryClient)
+	waitRegistered(t, hub, malloryClient)
+
+	hub.HandleMessageForTest(aliceClient, voiceJoinMsg(dmID))
+
+	bobMsgs := drainChanTimeout(bobSend, 300*time.Millisecond)
+	foundVoiceState := false
+	for _, m := range bobMsgs {
+		if extractType(t, m) == "voice_state" {
+			foundVoiceState = true
+		}
+	}
+	if !foundVoiceState {
+		t.Error("a DM participant must still receive voice_state for their own DM call")
+	}
+
+	malloryMsgs := drainChanTimeout(mallorySend, 300*time.Millisecond)
+	for _, m := range malloryMsgs {
+		if extractType(t, m) == "voice_state" {
+			t.Fatal("voice_state for a DM call leaked to a connected non-participant")
+		}
+	}
+}
+
+func TestVoiceJoin_GroupDMNonParticipant_Refused(t *testing.T) {
+	hub, database := newVoiceHub(t)
+	alice := seedMemberUser(t, database, "grpvoice-x-alice")
+	bob := seedMemberUser(t, database, "grpvoice-x-bob")
+	carol := seedMemberUser(t, database, "grpvoice-x-carol")
+	mallory := seedMemberUser(t, database, "grpvoice-x-mallory")
+	chID := seedGroupDM(t, database, "Callers", alice.ID, bob.ID, carol.ID)
+
+	send := make(chan []byte, 32)
+	c := ws.NewTestClientWithUser(hub, mallory, 0, send)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+
+	hub.HandleMessageForTest(c, voiceJoinMsg(chID))
+
+	assertNoVoiceToken(t, drainChanTimeout(send, 200*time.Millisecond))
+}
diff --git a/Server/ws/voice_handlers_test.go b/Server/ws/voice_handlers_test.go
index c158effa..4942ef8d 100644
--- a/Server/ws/voice_handlers_test.go
+++ b/Server/ws/voice_handlers_test.go
@@ -23,6 +23,8 @@ CREATE TABLE IF NOT EXISTS voice_states (
     speaking    INTEGER NOT NULL DEFAULT 0,
     camera      INTEGER NOT NULL DEFAULT 0,
     screenshare INTEGER NOT NULL DEFAULT 0,
+    server_muted    INTEGER NOT NULL DEFAULT 0,
+    server_deafened INTEGER NOT NULL DEFAULT 0,
     joined_at   TEXT    NOT NULL DEFAULT (datetime('now'))
 );
 CREATE INDEX IF NOT EXISTS idx_voice_states_channel ON voice_states(channel_id);
diff --git a/Server/ws/voice_join.go b/Server/ws/voice_join.go
index 73138ae5..88dd80c1 100644
--- a/Server/ws/voice_join.go
+++ b/Server/ws/voice_join.go
@@ -193,7 +193,7 @@ func (h *Hub) handleVoiceJoin(ctx context.Context, c *Client, payload json.RawMe
 			var overrides map[int64]db.ChannelOverride
 			var oErr error
 			if !permissions.HasAdmin(role.Permissions) {
-				overrides, oErr = h.db.GetAllChannelPermissionsForRole(ctx, role.ID)
+				overrides, oErr = h.db.GetChannelOverridesFor(ctx, role.ID, c.userID)
 			}
 			if oErr == nil {
 				po := permOverrides(overrides)
diff --git a/Server/ws/voice_moderation.go b/Server/ws/voice_moderation.go
new file mode 100644
index 00000000..21dd9697
--- /dev/null
+++ b/Server/ws/voice_moderation.go
@@ -0,0 +1,378 @@
+package ws
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+
+	"github.com/owncord/server/auth"
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/permissions"
+)
+
+// Voice moderation handlers: server mute, server deafen, move, disconnect.
+//
+// All four share one authorization contract, enforced by voiceModTarget:
+// MUTE_MEMBERS on the actor's role (Administrator bypasses), the actor must
+// strictly outrank the target by role position (mirroring
+// ModerationService.requireOutranks), and the target must currently be in a
+// voice channel. Effects that reach past the acting connection — the SFU and
+// the target's own socket — go through VoiceDeps.Mod.
+
+// registerVoiceModerationV2 registers the four moderator voice commands.
+// Called from registerVoiceControlsV2 so the deps struct is built once.
+func registerVoiceModerationV2(r *HandlerRegistry, deps VoiceDeps) {
+	r.RegisterV2(MsgTypeVoiceModMute, handleVoiceModMuteV2, deps)
+	r.RegisterV2(MsgTypeVoiceModDeafen, handleVoiceModDeafenV2, deps)
+	r.RegisterV2(MsgTypeVoiceModMove, handleVoiceModMoveV2, deps)
+	r.RegisterV2(MsgTypeVoiceModKick, handleVoiceModKickV2, deps)
+}
+
+// voiceModRole loads a role through the permission cache when one is wired and
+// falls back to the live DB otherwise. Every failure is a denial: an
+// unresolvable role must never authorize a moderation action.
+func voiceModRole(ctx context.Context, d VoiceDeps, userID int64) (*db.Role, bool) {
+	if d.PermSvc != nil {
+		role, err := d.PermSvc.GetRoleForUser(ctx, userID)
+		if err == nil && role != nil {
+			return role, true
+		}
+		return nil, false
+	}
+	if d.DB == nil {
+		return nil, false
+	}
+	role, err := d.DB.GetRoleForUser(ctx, userID)
+	if err != nil || role == nil {
+		return nil, false
+	}
+	return role, true
+}
+
+// voiceModTarget runs the shared gate and returns the target's live voice
+// state. Authorization is checked before the voice-state lookup so an actor
+// without authority always sees FORBIDDEN and never learns who is in voice.
+func voiceModTarget(ctx context.Context, d VoiceDeps, actorID, targetID int64) (*db.VoiceState, *Result) {
+	if actorID == targetID {
+		return nil, &Result{Error: ClientError{Code: ErrCodeBadRequest, Message: "cannot moderate yourself"}}
+	}
+
+	actorRole, ok := voiceModRole(ctx, d, actorID)
+	if !ok {
+		return nil, &Result{Error: ClientError{Code: ErrCodeForbidden, Message: "failed to load actor role"}}
+	}
+	if !permissions.HasServerPerm(actorRole.Permissions, permissions.MuteMembers) {
+		return nil, &Result{Error: ClientError{Code: ErrCodeForbidden, Message: "missing MUTE_MEMBERS permission"}}
+	}
+	targetRole, ok := voiceModRole(ctx, d, targetID)
+	if !ok {
+		return nil, &Result{Error: ClientError{Code: ErrCodeForbidden, Message: "failed to load target role"}}
+	}
+	// Administrator bypasses permission bits, never the hierarchy.
+	if actorRole.Position <= targetRole.Position {
+		return nil, &Result{Error: ClientError{
+			Code:    ErrCodeForbidden,
+			Message: "cannot moderate a user of equal or higher rank",
+		}}
+	}
+
+	state, err := d.DB.GetVoiceState(ctx, targetID)
+	if err != nil {
+		slog.Error("ws voiceModTarget GetVoiceState", "err", err, "target_id", targetID)
+		return nil, &Result{Error: ClientError{Code: ErrCodeInternal, Message: "failed to read voice state"}}
+	}
+	if state == nil {
+		return nil, &Result{Error: ClientError{Code: ErrCodeVoiceError, Message: "user is not in a voice channel"}}
+	}
+
+	// MUTE_MEMBERS authorizes moderating server voice channels, not a private
+	// DM call the actor happens not to be part of — voice_mod_kick and friends
+	// carry no channel id from the client, so without this a moderator could
+	// reach into any two users' DM call by targeting a user id alone. Refused
+	// with the exact same shape as "target not in voice" so the actor learns
+	// nothing about a DM call they are not in.
+	ch, err := d.DB.GetChannel(ctx, state.ChannelID)
+	if err != nil {
+		slog.Error("ws voiceModTarget GetChannel", "err", err, "channel_id", state.ChannelID)
+		return nil, &Result{Error: ClientError{Code: ErrCodeInternal, Message: "failed to read channel"}}
+	}
+	if ch != nil && ch.Type == "dm" {
+		participant, err := d.DB.IsDMParticipant(ctx, actorID, state.ChannelID)
+		if err != nil {
+			slog.Error("ws voiceModTarget IsDMParticipant", "err", err, "channel_id", state.ChannelID)
+			return nil, &Result{Error: ClientError{Code: ErrCodeInternal, Message: "failed to verify DM membership"}}
+		}
+		if !participant {
+			return nil, &Result{Error: ClientError{Code: ErrCodeVoiceError, Message: "user is not in a voice channel"}}
+		}
+	}
+
+	return state, nil
+}
+
+// voiceModRateLimited applies the shared per-action rate limit. Each of these
+// commands fans a voice_state broadcast out to every client that can see the
+// channel, so a moderator must not be able to drive them in a tight loop.
+func voiceModRateLimited(d VoiceDeps, action string, userID int64) *Result {
+	if d.Limiter == nil {
+		return nil
+	}
+	if d.Limiter.Allow(auth.Key(action, userID), voiceModRateLimit, voiceModWindow) {
+		return nil
+	}
+	return &Result{Error: ClientError{Code: ErrCodeRateLimited, Message: "too many voice moderation actions"}}
+}
+
+// requireTargetInChannel refuses when the target has moved on since the
+// moderator's client rendered the row that produced this command.
+func requireTargetInChannel(state *db.VoiceState, channelID int64) *Result {
+	if state.ChannelID == channelID {
+		return nil
+	}
+	return &Result{Error: ClientError{Code: ErrCodeVoiceError, Message: "user is not in that voice channel"}}
+}
+
+// handleVoiceModMuteV2 processes a voice_mod_mute command. The DB row is the
+// authority for the UI; the SFU mute is what makes it more than cosmetic, so a
+// LiveKit failure is logged but does not fail the action — the persisted
+// server_muted still blocks the target's own unmute and is re-applied whenever
+// the moderator retries.
+func handleVoiceModMuteV2(ctx context.Context, cmd Command, info ClientInfo, deps any) Result {
+	d := deps.(VoiceDeps)
+	c := cmd.(VoiceModMuteCmd)
+
+	if r := voiceModRateLimited(d, "voice_mod_mute", info.UserID); r != nil {
+		return *r
+	}
+	state, r := voiceModTarget(ctx, d, info.UserID, c.TargetID())
+	if r != nil {
+		return *r
+	}
+	if r := requireTargetInChannel(state, c.ChannelID()); r != nil {
+		return *r
+	}
+
+	if err := d.DB.SetVoiceServerMute(ctx, c.TargetID(), c.Muted()); err != nil {
+		slog.Error("ws handleVoiceModMuteV2 SetVoiceServerMute", "err", err, "target_id", c.TargetID())
+		return Result{Error: ClientError{Code: ErrCodeInternal, Message: "failed to update server mute"}}
+	}
+	if d.Mod != nil {
+		if err := d.Mod.MuteParticipant(ctx, state.ChannelID, c.TargetID(), state.JoinedAt, c.Muted()); err != nil {
+			slog.Warn("ws handleVoiceModMuteV2 MuteParticipant failed",
+				"err", err, "target_id", c.TargetID(), "channel_id", state.ChannelID)
+		}
+	}
+
+	writeVoiceModAudit(ctx, d, info.UserID, "voice_mod_mute", c.TargetID(),
+		fmt.Sprintf("server mute %s in channel %d", onOff(c.Muted()), state.ChannelID))
+	slog.Info("voice server mute", "actor_id", info.UserID, "target_id", c.TargetID(),
+		"channel_id", state.ChannelID, "muted", c.Muted())
+
+	return voiceStateBroadcast(ctx, d, c.TargetID())
+}
+
+// handleVoiceModDeafenV2 processes a voice_mod_deafen command. Deafen has no
+// SFU equivalent (it is about what the target plays back), so it is enforced by
+// the target's client honoring server_deafened plus the server refusing their
+// own undeafen while it is set.
+func handleVoiceModDeafenV2(ctx context.Context, cmd Command, info ClientInfo, deps any) Result {
+	d := deps.(VoiceDeps)
+	c := cmd.(VoiceModDeafenCmd)
+
+	if r := voiceModRateLimited(d, "voice_mod_deafen", info.UserID); r != nil {
+		return *r
+	}
+	state, r := voiceModTarget(ctx, d, info.UserID, c.TargetID())
+	if r != nil {
+		return *r
+	}
+	if r := requireTargetInChannel(state, c.ChannelID()); r != nil {
+		return *r
+	}
+
+	if err := d.DB.SetVoiceServerDeafen(ctx, c.TargetID(), c.Deafened()); err != nil {
+		slog.Error("ws handleVoiceModDeafenV2 SetVoiceServerDeafen", "err", err, "target_id", c.TargetID())
+		return Result{Error: ClientError{Code: ErrCodeInternal, Message: "failed to update server deafen"}}
+	}
+	// A server deafen implies a server mute at the SFU: a deafened user must
+	// not keep talking into a room they cannot hear. Lifting the deafen must
+	// lift that implied mute too, or the target stays SFU-muted and refused
+	// their own unmute even after the deafen is gone. server_muted is a
+	// single bool with no way to tell "explicit" from "deafen-implied" apart,
+	// so an explicit-mute-then-deafen sequence has both lifted together by an
+	// undeafen — accepted as the simplest correct behavior given the schema.
+	if err := d.DB.SetVoiceServerMute(ctx, c.TargetID(), c.Deafened()); err != nil {
+		slog.Error("ws handleVoiceModDeafenV2 SetVoiceServerMute", "err", err, "target_id", c.TargetID())
+		return Result{Error: ClientError{Code: ErrCodeInternal, Message: "failed to update server deafen"}}
+	}
+	if d.Mod != nil {
+		if err := d.Mod.MuteParticipant(ctx, state.ChannelID, c.TargetID(), state.JoinedAt, c.Deafened()); err != nil {
+			slog.Warn("ws handleVoiceModDeafenV2 MuteParticipant failed",
+				"err", err, "target_id", c.TargetID(), "channel_id", state.ChannelID)
+		}
+	}
+
+	writeVoiceModAudit(ctx, d, info.UserID, "voice_mod_deafen", c.TargetID(),
+		fmt.Sprintf("server deafen %s in channel %d", onOff(c.Deafened()), state.ChannelID))
+	slog.Info("voice server deafen", "actor_id", info.UserID, "target_id", c.TargetID(),
+		"channel_id", state.ChannelID, "deafened", c.Deafened())
+
+	return voiceStateBroadcast(ctx, d, c.TargetID())
+}
+
+// handleVoiceModMoveV2 processes a voice_mod_move command.
+//
+// The move is a server-driven leave followed by a client-driven re-join: the
+// hub runs its voice-leave routine for the target (DB row, LiveKit participant,
+// voice_leave broadcast) and then sends voice_moved, which the target's client
+// answers with an ordinary voice_join for the destination. That keeps one
+// implementation of the join sequence — capacity, token minting, key-holder
+// election, existing-state fan-out — instead of a second, divergent copy here.
+// The checks below are the pre-flight: they refuse a move the re-join would
+// only bounce, so the target is never dropped from voice for nothing.
+func handleVoiceModMoveV2(ctx context.Context, cmd Command, info ClientInfo, deps any) Result {
+	d := deps.(VoiceDeps)
+	c := cmd.(VoiceModMoveCmd)
+
+	if r := voiceModRateLimited(d, "voice_mod_move", info.UserID); r != nil {
+		return *r
+	}
+	state, r := voiceModTarget(ctx, d, info.UserID, c.TargetID())
+	if r != nil {
+		return *r
+	}
+	if state.ChannelID == c.ToChannelID() {
+		return Result{Error: ClientError{Code: ErrCodeBadRequest, Message: "user is already in that voice channel"}}
+	}
+
+	dest, err := d.DB.GetChannel(ctx, c.ToChannelID())
+	if err != nil {
+		slog.Error("ws handleVoiceModMoveV2 GetChannel", "err", err, "channel_id", c.ToChannelID())
+		return Result{Error: ClientError{Code: ErrCodeInternal, Message: "failed to read destination channel"}}
+	}
+	if dest == nil {
+		return Result{Error: ClientError{Code: ErrCodeNotFound, Message: "channel not found"}}
+	}
+	if dest.Type != "voice" {
+		return Result{Error: ClientError{Code: ErrCodeBadRequest, Message: "destination is not a voice channel"}}
+	}
+	// The destination is gated on the TARGET's access, not the moderator's:
+	// a move must not become a way to place someone in a channel they could
+	// not join themselves.
+	if !hasChannelAccess(ctx, d.DB, d.Permissions, d.PermSvc, c.TargetID(), c.ToChannelID(), permissions.ConnectVoice) {
+		return Result{Error: ClientError{
+			Code:    ErrCodeForbidden,
+			Message: "user cannot connect to that voice channel",
+		}}
+	}
+	// Advisory capacity check with JoinVoiceChannelIfCapacity's semantics. The
+	// atomic one still runs on the re-join; this one keeps the common case from
+	// dropping the target into a channel that is already full.
+	if dest.VoiceMaxUsers > 0 {
+		count, cErr := d.DB.CountChannelVoiceUsers(ctx, c.ToChannelID())
+		if cErr != nil {
+			slog.Error("ws handleVoiceModMoveV2 CountChannelVoiceUsers", "err", cErr, "channel_id", c.ToChannelID())
+			return Result{Error: ClientError{Code: ErrCodeInternal, Message: "failed to check channel capacity"}}
+		}
+		if count >= dest.VoiceMaxUsers {
+			return Result{Error: ClientError{Code: ErrCodeChannelFull, Message: "voice channel is full"}}
+		}
+	}
+
+	if d.Mod == nil {
+		return Result{Error: ClientError{Code: ErrCodeInternal, Message: "voice moderation unavailable"}}
+	}
+	if !d.Mod.DisconnectFromVoice(ctx, c.TargetID()) {
+		// No live connection on this node — the voice_states row is a ghost the
+		// sweeper owns, and there is nobody to send voice_moved to.
+		return Result{Error: ClientError{Code: ErrCodeVoiceError, Message: "user is not connected"}}
+	}
+	d.Mod.SendToUser(c.TargetID(), buildVoiceMoved(c.ToChannelID()))
+
+	writeVoiceModAudit(ctx, d, info.UserID, "voice_mod_move", c.TargetID(),
+		fmt.Sprintf("moved from channel %d to channel %d", state.ChannelID, c.ToChannelID()))
+	slog.Info("voice moderator move", "actor_id", info.UserID, "target_id", c.TargetID(),
+		"from_channel_id", state.ChannelID, "to_channel_id", c.ToChannelID())
+
+	// handleVoiceLeave already broadcast voice_leave for the old channel; the
+	// re-join broadcasts voice_state for the new one.
+	return Result{}
+}
+
+// handleVoiceModKickV2 processes a voice_mod_kick command: the target is
+// removed from the LiveKit room, their voice_states row is deleted and
+// voice_leave is broadcast (all by the hub's voice-leave routine), then they
+// are told why.
+func handleVoiceModKickV2(ctx context.Context, cmd Command, info ClientInfo, deps any) Result {
+	d := deps.(VoiceDeps)
+	c := cmd.(VoiceModKickCmd)
+
+	if r := voiceModRateLimited(d, "voice_mod_kick", info.UserID); r != nil {
+		return *r
+	}
+	state, r := voiceModTarget(ctx, d, info.UserID, c.TargetID())
+	if r != nil {
+		return *r
+	}
+
+	if d.Mod == nil {
+		return Result{Error: ClientError{Code: ErrCodeInternal, Message: "voice moderation unavailable"}}
+	}
+	if !d.Mod.DisconnectFromVoice(ctx, c.TargetID()) {
+		return Result{Error: ClientError{Code: ErrCodeVoiceError, Message: "user is not connected"}}
+	}
+	d.Mod.SendToUser(c.TargetID(),
+		buildVoiceDisconnected(state.ChannelID, "You were disconnected from voice by a moderator"))
+
+	writeVoiceModAudit(ctx, d, info.UserID, "voice_mod_kick", c.TargetID(),
+		fmt.Sprintf("disconnected from channel %d", state.ChannelID))
+	slog.Info("voice moderator disconnect", "actor_id", info.UserID, "target_id", c.TargetID(),
+		"channel_id", state.ChannelID)
+
+	return Result{}
+}
+
+// writeVoiceModAudit records a moderation action. The row must survive a
+// connection that dies right after the effect landed, so the write is detached
+// from the dispatching context.
+func writeVoiceModAudit(ctx context.Context, d VoiceDeps, actorID int64, action string, targetID int64, detail string) {
+	if d.DB == nil {
+		return
+	}
+	db.WriteAudit(context.WithoutCancel(ctx), d.DB, actorID, action, "user", targetID, detail)
+}
+
+// onOff renders a boolean for an audit detail string.
+func onOff(v bool) string {
+	if v {
+		return "on"
+	}
+	return "off"
+}
+
+// ── Hub-side effects ────────────────────────────────────────────────────────
+
+// MuteParticipant mutes or unmutes the target's published audio at the SFU.
+// Satisfies VoiceModerator; reads h.livekit at call time so SetLiveKit's late
+// wiring is picked up (same reason as GenerateToken).
+func (h *Hub) MuteParticipant(ctx context.Context, channelID, userID int64, voiceJoinToken string, muted bool) error {
+	if h.livekit == nil {
+		return fmt.Errorf("voice not configured")
+	}
+	return h.livekit.MuteParticipantAudio(ctx, channelID, userID, voiceJoinToken, muted)
+}
+
+// DisconnectFromVoice runs the hub's voice-leave routine for another user's
+// connection, which is what a moderator move or disconnect needs: DB row,
+// LiveKit participant, topic unsubscribe, key-holder re-election and the
+// voice_leave broadcast, in the one implementation that also serves the
+// disconnect and channel-switch paths. Reports false when the user has no
+// connection on this node.
+func (h *Hub) DisconnectFromVoice(ctx context.Context, userID int64) bool {
+	c := h.GetClient(userID)
+	if c == nil {
+		return false
+	}
+	h.handleVoiceLeave(ctx, c)
+	return true
+}
diff --git a/Server/ws/voice_moderation_test.go b/Server/ws/voice_moderation_test.go
new file mode 100644
index 00000000..9bb2fcb4
--- /dev/null
+++ b/Server/ws/voice_moderation_test.go
@@ -0,0 +1,603 @@
+package ws_test
+
+import (
+	"context"
+	"encoding/json"
+	"slices"
+	"testing"
+	"testing/fstest"
+	"time"
+
+	"github.com/owncord/server/auth"
+	"github.com/owncord/server/config"
+	"github.com/owncord/server/db"
+	"github.com/owncord/server/ws"
+)
+
+// voiceModSchema is voiceSchema plus audit_log, so the moderation handlers'
+// db.WriteAudit calls land in a real table instead of erroring out.
+var voiceModSchema = append(append([]byte{}, voiceSchema...), []byte(`
+CREATE TABLE IF NOT EXISTS audit_log (
+    id          INTEGER PRIMARY KEY AUTOINCREMENT,
+    actor_id    INTEGER NOT NULL REFERENCES users(id),
+    action      TEXT    NOT NULL,
+    target_type TEXT    NOT NULL DEFAULT '',
+    target_id   INTEGER NOT NULL DEFAULT 0,
+    detail      TEXT    NOT NULL DEFAULT '',
+    created_at  TEXT    NOT NULL DEFAULT (datetime('now'))
+);
+`)...)
+
+// newVoiceModHub mirrors newVoiceHub but on the audit-capable schema.
+func newVoiceModHub(t *testing.T) (*ws.Hub, *db.DB) {
+	t.Helper()
+	database, err := db.Open(":memory:")
+	if err != nil {
+		t.Fatalf("db.Open: %v", err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	migrFS := fstest.MapFS{"001_schema.sql": {Data: voiceModSchema}}
+	if err := db.MigrateFS(database, migrFS); err != nil {
+		t.Fatalf("MigrateFS: %v", err)
+	}
+
+	limiter := auth.NewRateLimiter()
+	hub := ws.NewHub(database, limiter, nil)
+	lk, err := ws.NewLiveKitClient(&config.VoiceConfig{
+		LiveKitAPIKey:    "test-api-key-12345",
+		LiveKitAPISecret: "test-api-secret-67890abcdef",
+		LiveKitURL:       "ws://localhost:7880",
+	})
+	if err != nil {
+		t.Fatalf("NewLiveKitClient: %v", err)
+	}
+	hub.SetLiveKit(lk)
+
+	go hub.Run()
+	t.Cleanup(func() { hub.Stop() })
+	return hub, database
+}
+
+// seedVoiceUserWithRole inserts a user with an explicit role id from the
+// default role table (1 Owner/pos 100, 2 Admin/pos 80, 3 Moderator/pos 60,
+// 4 Member/pos 40). Admin holds MUTE_MEMBERS without ADMINISTRATOR; Moderator
+// holds neither, which is what the denial cases below rely on.
+func seedVoiceUserWithRole(t *testing.T, database *db.DB, username string, roleID int) *db.User {
+	t.Helper()
+	if _, err := database.CreateUser(context.Background(), username, "hash", roleID); err != nil {
+		t.Fatalf("seedVoiceUserWithRole CreateUser: %v", err)
+	}
+	user, err := database.GetUserByUsername(context.Background(), username)
+	if err != nil || user == nil {
+		t.Fatalf("seedVoiceUserWithRole GetUserByUsername: %v", err)
+	}
+	return user
+}
+
+// joinVoice registers a client for user and puts them in chanID via voice_join,
+// returning the client and its send channel drained of the join traffic.
+func joinVoice(t *testing.T, hub *ws.Hub, user *db.User, chanID int64) (*ws.Client, chan []byte) {
+	t.Helper()
+	send := make(chan []byte, 32)
+	c := ws.NewTestClientWithUser(hub, user, chanID, send)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+	hub.HandleMessageForTest(c, voiceJoinMsg(chanID))
+	drainChanTimeout(send, 30*time.Millisecond)
+	return c, send
+}
+
+func voiceModMuteMsg(channelID, userID int64, muted bool) []byte {
+	raw, _ := json.Marshal(map[string]any{
+		"type":    "voice_mod_mute",
+		"payload": map[string]any{"channel_id": channelID, "user_id": userID, "muted": muted},
+	})
+	return raw
+}
+
+func voiceModDeafenMsg(channelID, userID int64, deafened bool) []byte {
+	raw, _ := json.Marshal(map[string]any{
+		"type":    "voice_mod_deafen",
+		"payload": map[string]any{"channel_id": channelID, "user_id": userID, "deafened": deafened},
+	})
+	return raw
+}
+
+func voiceModMoveMsg(userID, toChannelID int64) []byte {
+	raw, _ := json.Marshal(map[string]any{
+		"type":    "voice_mod_move",
+		"payload": map[string]any{"user_id": userID, "to_channel_id": toChannelID},
+	})
+	return raw
+}
+
+func voiceModKickMsg(userID int64) []byte {
+	raw, _ := json.Marshal(map[string]any{
+		"type":    "voice_mod_kick",
+		"payload": map[string]any{"user_id": userID},
+	})
+	return raw
+}
+
+// auditActions returns the actions recorded in the audit log, newest first.
+func auditActions(t *testing.T, database *db.DB) []string {
+	t.Helper()
+	entries, err := database.GetAuditLog(context.Background(), 50, 0)
+	if err != nil {
+		t.Fatalf("GetAuditLog: %v", err)
+	}
+	actions := make([]string, 0, len(entries))
+	for _, e := range entries {
+		actions = append(actions, e.Action)
+	}
+	return actions
+}
+
+// ─── authorization ────────────────────────────────────────────────────────────
+
+func TestVoiceMod_Mute_WithoutMutePermission_Forbidden(t *testing.T) {
+	hub, database := newVoiceModHub(t)
+	chanID := seedVoiceChan(t, database, "vc-perm")
+	actor := seedVoiceUserWithRole(t, database, "mod-noperm", 3)   // Moderator: no MUTE_MEMBERS
+	target := seedVoiceUserWithRole(t, database, "target-perm", 4) // Member
+
+	joinVoice(t, hub, target, chanID)
+
+	send := make(chan []byte, 16)
+	c := ws.NewTestClientWithUser(hub, actor, chanID, send)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+
+	hub.HandleMessageForTest(c, voiceModMuteMsg(chanID, target.ID, true))
+
+	if code := receiveErrorCode(send, waitTimeout); code != "FORBIDDEN" {
+		t.Fatalf("error code = %q, want FORBIDDEN", code)
+	}
+	state, _ := database.GetVoiceState(context.Background(), target.ID)
+	if state == nil || state.ServerMuted {
+		t.Error("target must not be server muted after a refused action")
+	}
+}
+
+func TestVoiceMod_Mute_TargetOutranksActor_Forbidden(t *testing.T) {
+	hub, database := newVoiceModHub(t)
+	chanID := seedVoiceChan(t, database, "vc-rank")
+	actor := seedVoiceUserWithRole(t, database, "admin-rank", 2)  // Admin, position 80
+	target := seedVoiceUserWithRole(t, database, "owner-rank", 1) // Owner, position 100
+
+	joinVoice(t, hub, target, chanID)
+
+	send := make(chan []byte, 16)
+	c := ws.NewTestClientWithUser(hub, actor, chanID, send)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+
+	hub.HandleMessageForTest(c, voiceModMuteMsg(chanID, target.ID, true))
+
+	if code := receiveErrorCode(send, waitTimeout); code != "FORBIDDEN" {
+		t.Fatalf("error code = %q, want FORBIDDEN", code)
+	}
+	state, _ := database.GetVoiceState(context.Background(), target.ID)
+	if state == nil || state.ServerMuted {
+		t.Error("higher-ranked target must not be server muted")
+	}
+}
+
+func TestVoiceMod_Mute_TargetNotInVoice_VoiceError(t *testing.T) {
+	hub, database := newVoiceModHub(t)
+	chanID := seedVoiceChan(t, database, "vc-absent")
+	actor := seedVoiceUserWithRole(t, database, "admin-absent", 2)
+	target := seedVoiceUserWithRole(t, database, "member-absent", 4)
+
+	send := make(chan []byte, 16)
+	c := ws.NewTestClientWithUser(hub, actor, chanID, send)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+
+	hub.HandleMessageForTest(c, voiceModMuteMsg(chanID, target.ID, true))
+
+	if code := receiveErrorCode(send, waitTimeout); code != "VOICE_ERROR" {
+		t.Fatalf("error code = %q, want VOICE_ERROR", code)
+	}
+}
+
+func TestVoiceMod_Mute_WrongChannel_VoiceError(t *testing.T) {
+	hub, database := newVoiceModHub(t)
+	chanA := seedVoiceChan(t, database, "vc-wrong-a")
+	chanB := seedVoiceChan(t, database, "vc-wrong-b")
+	actor := seedVoiceUserWithRole(t, database, "admin-wrong", 2)
+	target := seedVoiceUserWithRole(t, database, "member-wrong", 4)
+
+	joinVoice(t, hub, target, chanA)
+
+	send := make(chan []byte, 16)
+	c := ws.NewTestClientWithUser(hub, actor, chanA, send)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+
+	hub.HandleMessageForTest(c, voiceModMuteMsg(chanB, target.ID, true))
+
+	if code := receiveErrorCode(send, waitTimeout); code != "VOICE_ERROR" {
+		t.Fatalf("error code = %q, want VOICE_ERROR", code)
+	}
+}
+
+func TestVoiceMod_Kick_Self_BadRequest(t *testing.T) {
+	hub, database := newVoiceModHub(t)
+	chanID := seedVoiceChan(t, database, "vc-self")
+	actor := seedVoiceUserWithRole(t, database, "admin-self", 2)
+
+	c, send := joinVoice(t, hub, actor, chanID)
+	hub.HandleMessageForTest(c, voiceModKickMsg(actor.ID))
+
+	if code := receiveErrorCode(send, waitTimeout); code != "BAD_REQUEST" {
+		t.Fatalf("error code = %q, want BAD_REQUEST", code)
+	}
+}
+
+// voice_mod_kick and friends carry no channel id for the target, so
+// MUTE_MEMBERS alone let a moderator reach into a private DM call they are
+// not a participant of by targeting a user id. The refusal must look exactly
+// like "target not in voice" — a VOICE_ERROR, not FORBIDDEN — so the actor
+// cannot use the response to learn the target is in a DM call at all.
+func TestVoiceMod_Mute_TargetInDMCallActorNotParticipant_VoiceError(t *testing.T) {
+	hub, database := newVoiceModHub(t)
+	alice := seedVoiceUserWithRole(t, database, "dm-alice", 4)     // Member, DM participant
+	bob := seedVoiceUserWithRole(t, database, "dm-bob", 4)         // Member, DM participant (target)
+	mallory := seedVoiceUserWithRole(t, database, "dm-mallory", 2) // Admin: has MUTE_MEMBERS, not a participant
+	dmID := seedDMChannel(t, database, alice.ID, bob.ID)
+
+	joinVoice(t, hub, bob, dmID)
+
+	send := make(chan []byte, 16)
+	c := ws.NewTestClientWithUser(hub, mallory, 0, send)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+
+	hub.HandleMessageForTest(c, voiceModMuteMsg(dmID, bob.ID, true))
+
+	if code := receiveErrorCode(send, waitTimeout); code != "VOICE_ERROR" {
+		t.Fatalf("error code = %q, want VOICE_ERROR (must not disclose the DM call via FORBIDDEN)", code)
+	}
+	state, _ := database.GetVoiceState(context.Background(), bob.ID)
+	if state == nil || state.ServerMuted {
+		t.Error("target in a DM call the actor is not part of must not be server muted")
+	}
+}
+
+// A MUTE_MEMBERS holder who genuinely IS a participant of the DM call may
+// still moderate it, same as any other voice channel.
+func TestVoiceMod_Mute_TargetInDMCallActorIsParticipant_Allowed(t *testing.T) {
+	hub, database := newVoiceModHub(t)
+	admin := seedVoiceUserWithRole(t, database, "dm-admin", 2)   // Admin: MUTE_MEMBERS, DM participant
+	member := seedVoiceUserWithRole(t, database, "dm-member", 4) // Member (target)
+	dmID := seedDMChannel(t, database, admin.ID, member.ID)
+
+	joinVoice(t, hub, member, dmID)
+
+	send := make(chan []byte, 16)
+	c := ws.NewTestClientWithUser(hub, admin, 0, send)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+
+	hub.HandleMessageForTest(c, voiceModMuteMsg(dmID, member.ID, true))
+
+	state, err := database.GetVoiceState(context.Background(), member.ID)
+	if err != nil || state == nil || !state.ServerMuted {
+		t.Fatalf("expected target to be server muted, state=%+v err=%v", state, err)
+	}
+}
+
+// ─── happy paths ──────────────────────────────────────────────────────────────
+
+func TestVoiceMod_Mute_SetsServerMutedAndBroadcasts(t *testing.T) {
+	hub, database := newVoiceModHub(t)
+	chanID := seedVoiceChan(t, database, "vc-mute")
+	actor := seedVoiceUserWithRole(t, database, "admin-mute", 2)
+	target := seedVoiceUserWithRole(t, database, "member-mute", 4)
+
+	_, targetSend := joinVoice(t, hub, target, chanID)
+
+	send := make(chan []byte, 16)
+	c := ws.NewTestClientWithUser(hub, actor, chanID, send)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+
+	hub.HandleMessageForTest(c, voiceModMuteMsg(chanID, target.ID, true))
+
+	state, err := database.GetVoiceState(context.Background(), target.ID)
+	if err != nil || state == nil {
+		t.Fatalf("GetVoiceState: %v", err)
+	}
+	if !state.ServerMuted {
+		t.Error("ServerMuted = false, want true")
+	}
+	if !state.Muted {
+		t.Error("Muted = false, want true (server mute implies muted)")
+	}
+
+	payload := receiveMsgOfType(targetSend, "voice_state", waitTimeout)
+	if payload == nil {
+		t.Fatal("no voice_state broadcast after voice_mod_mute")
+	}
+	if payload["server_muted"] != true {
+		t.Errorf("broadcast server_muted = %v, want true", payload["server_muted"])
+	}
+
+	if !slices.Contains(auditActions(t, database), "voice_mod_mute") {
+		t.Error("voice_mod_mute audit entry missing")
+	}
+}
+
+func TestVoiceMod_Mute_Clear_LeavesSelfMuteAlone(t *testing.T) {
+	hub, database := newVoiceModHub(t)
+	chanID := seedVoiceChan(t, database, "vc-unmute")
+	actor := seedVoiceUserWithRole(t, database, "admin-unmute", 2)
+	target := seedVoiceUserWithRole(t, database, "member-unmute", 4)
+
+	joinVoice(t, hub, target, chanID)
+
+	send := make(chan []byte, 16)
+	c := ws.NewTestClientWithUser(hub, actor, chanID, send)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+
+	hub.HandleMessageForTest(c, voiceModMuteMsg(chanID, target.ID, true))
+	hub.HandleMessageForTest(c, voiceModMuteMsg(chanID, target.ID, false))
+
+	state, err := database.GetVoiceState(context.Background(), target.ID)
+	if err != nil || state == nil {
+		t.Fatalf("GetVoiceState: %v", err)
+	}
+	if state.ServerMuted {
+		t.Error("ServerMuted = true after clear, want false")
+	}
+	if !state.Muted {
+		t.Error("Muted = false, want true: clearing a server mute must not unmute for the user")
+	}
+}
+
+func TestVoiceMod_Deafen_SetsServerDeafenedAndMutes(t *testing.T) {
+	hub, database := newVoiceModHub(t)
+	chanID := seedVoiceChan(t, database, "vc-deafen")
+	actor := seedVoiceUserWithRole(t, database, "admin-deafen", 2)
+	target := seedVoiceUserWithRole(t, database, "member-deafen", 4)
+
+	_, targetSend := joinVoice(t, hub, target, chanID)
+
+	send := make(chan []byte, 16)
+	c := ws.NewTestClientWithUser(hub, actor, chanID, send)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+
+	hub.HandleMessageForTest(c, voiceModDeafenMsg(chanID, target.ID, true))
+
+	state, err := database.GetVoiceState(context.Background(), target.ID)
+	if err != nil || state == nil {
+		t.Fatalf("GetVoiceState: %v", err)
+	}
+	if !state.ServerDeafened || !state.Deafened {
+		t.Errorf("ServerDeafened=%v Deafened=%v, want both true", state.ServerDeafened, state.Deafened)
+	}
+	if !state.ServerMuted {
+		t.Error("ServerMuted = false, want true: a server deafen also silences the microphone")
+	}
+
+	payload := receiveMsgOfType(targetSend, "voice_state", waitTimeout)
+	if payload == nil {
+		t.Fatal("no voice_state broadcast after voice_mod_deafen")
+	}
+	if payload["server_deafened"] != true {
+		t.Errorf("broadcast server_deafened = %v, want true", payload["server_deafened"])
+	}
+	if !slices.Contains(auditActions(t, database), "voice_mod_deafen") {
+		t.Error("voice_mod_deafen audit entry missing")
+	}
+}
+
+// Lifting a server deafen must also lift the mute it implied, or the target
+// stays SFU-muted (and refused their own unmute) after the deafen is gone.
+func TestVoiceMod_Deafen_ClearingRestoresSelfUnmute(t *testing.T) {
+	hub, database := newVoiceModHub(t)
+	chanID := seedVoiceChan(t, database, "vc-undeafen")
+	actor := seedVoiceUserWithRole(t, database, "admin-undeafen", 2)
+	target := seedVoiceUserWithRole(t, database, "member-undeafen", 4)
+
+	targetClient, targetSend := joinVoice(t, hub, target, chanID)
+
+	send := make(chan []byte, 16)
+	c := ws.NewTestClientWithUser(hub, actor, chanID, send)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+
+	// Server-deafen the target: implies a server mute too.
+	hub.HandleMessageForTest(c, voiceModDeafenMsg(chanID, target.ID, true))
+	drainChanTimeout(targetSend, 30*time.Millisecond)
+
+	state, err := database.GetVoiceState(context.Background(), target.ID)
+	if err != nil || state == nil || !state.ServerDeafened || !state.ServerMuted {
+		t.Fatalf("precondition: expected server_deafened and server_muted both set, state=%+v err=%v", state, err)
+	}
+
+	// Lift the deafen.
+	hub.HandleMessageForTest(c, voiceModDeafenMsg(chanID, target.ID, false))
+	drainChanTimeout(targetSend, 30*time.Millisecond)
+
+	state, err = database.GetVoiceState(context.Background(), target.ID)
+	if err != nil || state == nil {
+		t.Fatalf("GetVoiceState: %v", err)
+	}
+	if state.ServerDeafened {
+		t.Error("ServerDeafened = true after clearing, want false")
+	}
+	if state.ServerMuted {
+		t.Error("ServerMuted = true after clearing the deafen that implied it, want false")
+	}
+
+	// The target must now be able to self-unmute without SERVER_MUTED.
+	hub.HandleMessageForTest(targetClient, voiceMuteMsg(false))
+	if code := receiveErrorCode(targetSend, 200*time.Millisecond); code != "" {
+		t.Fatalf("self-unmute refused with %q after deafen was cleared, want no error", code)
+	}
+}
+
+func TestVoiceMod_Kick_RemovesFromVoiceAndNotifiesTarget(t *testing.T) {
+	hub, database := newVoiceModHub(t)
+	chanID := seedVoiceChan(t, database, "vc-kick")
+	actor := seedVoiceUserWithRole(t, database, "admin-kick", 2)
+	target := seedVoiceUserWithRole(t, database, "member-kick", 4)
+
+	_, targetSend := joinVoice(t, hub, target, chanID)
+
+	send := make(chan []byte, 16)
+	c := ws.NewTestClientWithUser(hub, actor, chanID, send)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+
+	hub.HandleMessageForTest(c, voiceModKickMsg(target.ID))
+
+	waitFor(t, waitTimeout, func() bool {
+		state, err := database.GetVoiceState(context.Background(), target.ID)
+		return err == nil && state == nil
+	}, "target's voice_states row to be deleted")
+
+	if receiveMsgOfType(targetSend, "voice_disconnected", waitTimeout) == nil {
+		t.Error("target did not receive voice_disconnected")
+	}
+	if !slices.Contains(auditActions(t, database), "voice_mod_kick") {
+		t.Error("voice_mod_kick audit entry missing")
+	}
+}
+
+func TestVoiceMod_Move_DisconnectsAndSendsVoiceMoved(t *testing.T) {
+	hub, database := newVoiceModHub(t)
+	fromID := seedVoiceChan(t, database, "vc-move-from")
+	toID := seedVoiceChan(t, database, "vc-move-to")
+	actor := seedVoiceUserWithRole(t, database, "admin-move", 2)
+	target := seedVoiceUserWithRole(t, database, "member-move", 4)
+
+	_, targetSend := joinVoice(t, hub, target, fromID)
+
+	send := make(chan []byte, 16)
+	c := ws.NewTestClientWithUser(hub, actor, fromID, send)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+
+	hub.HandleMessageForTest(c, voiceModMoveMsg(target.ID, toID))
+
+	payload := receiveMsgOfType(targetSend, "voice_moved", waitTimeout)
+	if payload == nil {
+		t.Fatal("target did not receive voice_moved")
+	}
+	if int64(payload["to_channel_id"].(float64)) != toID {
+		t.Errorf("to_channel_id = %v, want %d", payload["to_channel_id"], toID)
+	}
+	waitFor(t, waitTimeout, func() bool {
+		state, err := database.GetVoiceState(context.Background(), target.ID)
+		return err == nil && state == nil
+	}, "target to be removed from the old channel pending re-join")
+
+	if !slices.Contains(auditActions(t, database), "voice_mod_move") {
+		t.Error("voice_mod_move audit entry missing")
+	}
+}
+
+func TestVoiceMod_Move_TextChannelDestination_BadRequest(t *testing.T) {
+	hub, database := newVoiceModHub(t)
+	fromID := seedVoiceChan(t, database, "vc-move-bad")
+	textID, err := database.CreateChannel(context.Background(), "general-move", "text", "", "", 0)
+	if err != nil {
+		t.Fatalf("CreateChannel: %v", err)
+	}
+	actor := seedVoiceUserWithRole(t, database, "admin-move-bad", 2)
+	target := seedVoiceUserWithRole(t, database, "member-move-bad", 4)
+
+	joinVoice(t, hub, target, fromID)
+
+	send := make(chan []byte, 16)
+	c := ws.NewTestClientWithUser(hub, actor, fromID, send)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+
+	hub.HandleMessageForTest(c, voiceModMoveMsg(target.ID, textID))
+
+	if code := receiveErrorCode(send, waitTimeout); code != "BAD_REQUEST" {
+		t.Fatalf("error code = %q, want BAD_REQUEST", code)
+	}
+	state, _ := database.GetVoiceState(context.Background(), target.ID)
+	if state == nil {
+		t.Error("a refused move must leave the target in voice")
+	}
+}
+
+// ─── self-service controls under a server mute ───────────────────────────────
+
+func TestVoiceMute_SelfUnmuteWhileServerMuted_Refused(t *testing.T) {
+	hub, database := newVoiceModHub(t)
+	chanID := seedVoiceChan(t, database, "vc-selfunmute")
+	actor := seedVoiceUserWithRole(t, database, "admin-selfunmute", 2)
+	target := seedVoiceUserWithRole(t, database, "member-selfunmute", 4)
+
+	targetClient, targetSend := joinVoice(t, hub, target, chanID)
+
+	send := make(chan []byte, 16)
+	c := ws.NewTestClientWithUser(hub, actor, chanID, send)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+	hub.HandleMessageForTest(c, voiceModMuteMsg(chanID, target.ID, true))
+	drainChanTimeout(targetSend, 30*time.Millisecond)
+
+	hub.HandleMessageForTest(targetClient, voiceMuteMsg(false))
+
+	if code := receiveErrorCode(targetSend, waitTimeout); code != "SERVER_MUTED" {
+		t.Fatalf("error code = %q, want SERVER_MUTED", code)
+	}
+	state, _ := database.GetVoiceState(context.Background(), target.ID)
+	if state == nil || !state.Muted {
+		t.Error("target must still be muted after a refused self-unmute")
+	}
+}
+
+func TestVoiceDeafen_SelfUndeafenWhileServerDeafened_Refused(t *testing.T) {
+	hub, database := newVoiceModHub(t)
+	chanID := seedVoiceChan(t, database, "vc-selfundeaf")
+	actor := seedVoiceUserWithRole(t, database, "admin-selfundeaf", 2)
+	target := seedVoiceUserWithRole(t, database, "member-selfundeaf", 4)
+
+	targetClient, targetSend := joinVoice(t, hub, target, chanID)
+
+	send := make(chan []byte, 16)
+	c := ws.NewTestClientWithUser(hub, actor, chanID, send)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+	hub.HandleMessageForTest(c, voiceModDeafenMsg(chanID, target.ID, true))
+	drainChanTimeout(targetSend, 30*time.Millisecond)
+
+	hub.HandleMessageForTest(targetClient, voiceDeafenMsg(false))
+
+	if code := receiveErrorCode(targetSend, waitTimeout); code != "SERVER_DEAFENED" {
+		t.Fatalf("error code = %q, want SERVER_DEAFENED", code)
+	}
+}
+
+func TestVoiceMute_SelfMuteWhileServerMuted_Allowed(t *testing.T) {
+	hub, database := newVoiceModHub(t)
+	chanID := seedVoiceChan(t, database, "vc-selfmute-ok")
+	actor := seedVoiceUserWithRole(t, database, "admin-selfmute-ok", 2)
+	target := seedVoiceUserWithRole(t, database, "member-selfmute-ok", 4)
+
+	targetClient, targetSend := joinVoice(t, hub, target, chanID)
+
+	send := make(chan []byte, 16)
+	c := ws.NewTestClientWithUser(hub, actor, chanID, send)
+	hub.Register(c)
+	waitRegistered(t, hub, c)
+	hub.HandleMessageForTest(c, voiceModMuteMsg(chanID, target.ID, true))
+	drainChanTimeout(targetSend, 30*time.Millisecond)
+
+	hub.HandleMessageForTest(targetClient, voiceMuteMsg(true))
+
+	if code := receiveErrorCode(targetSend, 200*time.Millisecond); code != "" {
+		t.Fatalf("self-mute refused with %q, want no error", code)
+	}
+}
diff --git a/docs/api.md b/docs/api.md
index 70a3fc81..24a80bda 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -87,6 +87,9 @@ Create a new account using an invite code. The first user is created via `/admin
     "id": 2,
     "username": "alex",
     "avatar": "",
+    "display_name": null,
+    "about": null,
+    "custom_status": null,
     "status": "offline",
     "role_id": 4,
     "totp_enabled": false,
@@ -95,6 +98,8 @@ Create a new account using an invite code. The first user is created via `/admin
 }
 ```
 
+See [GET /api/v1/auth/me](#get-apiv1authme) for the full user-object field table.
+
 #### Errors
 
 | Status | Code | Cause |
@@ -134,7 +139,10 @@ If the account does not have TOTP enabled:
   "user": {
     "id": 1,
     "username": "alex",
-    "avatar": "uuid.png",
+    "avatar": "/api/v1/files/uuid",
+    "display_name": "Alex",
+    "about": null,
+    "custom_status": null,
     "status": "offline",
     "role_id": 4,
     "totp_enabled": false,
@@ -143,6 +151,8 @@ If the account does not have TOTP enabled:
 }
 ```
 
+See [GET /api/v1/auth/me](#get-apiv1authme) for the full user-object field table.
+
 If the account has TOTP enabled:
 
 ```json
@@ -188,7 +198,10 @@ Complete a TOTP login challenge started by `POST /api/v1/auth/login`.
   "user": {
     "id": 1,
     "username": "alex",
-    "avatar": "uuid.png",
+    "avatar": "/api/v1/files/uuid",
+    "display_name": "Alex",
+    "about": null,
+    "custom_status": null,
     "status": "offline",
     "role_id": 4,
     "totp_enabled": true,
@@ -197,6 +210,8 @@ Complete a TOTP login challenge started by `POST /api/v1/auth/login`.
 }
 ```
 
+See [GET /api/v1/auth/me](#get-apiv1authme) for the full user-object field table.
+
 #### Errors
 
 | Status | Code | Cause |
@@ -219,7 +234,10 @@ Get the current authenticated user's profile.
 {
   "id": 1,
   "username": "alex",
-  "avatar": "uuid.png",
+  "avatar": "/api/v1/files/uuid",
+  "display_name": "Alex",
+  "about": "A short bio.",
+  "custom_status": "building things",
   "status": "online",
   "role_id": 2,
   "totp_enabled": true,
@@ -227,12 +245,18 @@ Get the current authenticated user's profile.
 }
 ```
 
+This is the canonical **user object**, also returned as `user` by register,
+login and the TOTP challenge.
+
 | Field | Type | Description |
 | ----- | ---- | ----------- |
 | `id` | int64 | User ID |
-| `username` | string | Display name |
-| `avatar` | string | Avatar filename (UUID) or empty string |
-| `status` | string | One of: `online`, `idle`, `dnd`, `offline` |
+| `username` | string | Unique handle; the name `@mentions` resolve against |
+| `avatar` | string | Avatar URL (`/api/v1/files/{id}` after an upload, or an `https://` URL), or empty string |
+| `display_name` | string\|null | Nickname rendered instead of `username`; null when unset |
+| `about` | string\|null | Profile bio, max 300 characters; null when unset |
+| `custom_status` | string\|null | Free-text status line, max 128 characters; null when unset. Set over WebSocket (`presence_update`), not over REST |
+| `status` | string | One of: `online`, `idle`, `dnd`, `invisible`, `offline`. **This is the caller's own true status**, so `invisible` appears here; every payload describing this user to *anyone else* reports `offline` instead |
 | `role_id` | int64 | Numeric role ID (1=Owner, 2=Admin, 3=Moderator, 4=Member) |
 | `totp_enabled` | bool | Whether the user has a confirmed TOTP secret |
 | `created_at` | string | ISO 8601 timestamp |
@@ -348,8 +372,9 @@ Disable TOTP for the authenticated user.
 
 ### PATCH /api/v1/users/me
 
-Update the authenticated user's profile (username and/or avatar).
-Broadcasts a `user_update` WebSocket message to all clients on success.
+Update the authenticated user's profile. Broadcasts a `user_update` WebSocket
+message to all clients on success, carrying the full profile snapshot (the
+event replaces the client's copy rather than patching it).
 
 **Auth:** Required
 **Rate limit:** 10 requests/minute
@@ -359,11 +384,22 @@ Broadcasts a `user_update` WebSocket message to all clients on success.
 ```json
 {
   "username": "newname",
-  "avatar": "upload-uuid.png"
+  "avatar": "https://example.com/pic.png",
+  "display_name": "New Name",
+  "about": "A short bio."
 }
 ```
 
-Both fields optional; `avatar` may be `null` to clear it.
+| Field          | Rules                                                                                                                                                                                      |
+| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `username`     | Required. The unique handle; `@mentions` resolve against it.                                                                                                                               |
+| `avatar`       | Optional. Must be an `https://` URL (max 512 chars) or `""` to clear. Upload a file instead with `POST /api/v1/users/me/avatar`.                                                           |
+| `display_name` | Optional, 1–32 characters. Shown instead of `username` everywhere; `""` clears it and falls back to the username. Rejected if it contains control or invisible (bidi-override) characters. |
+| `about`        | Optional, max 300 characters. `""` clears it.                                                                                                                                              |
+
+Omitting a field leaves it unchanged; sending `""` clears the nullable ones.
+`display_name` and `about` are HTML-sanitized and trimmed server-side, and the
+length caps count characters, not bytes.
 
 #### Response 200 OK
 
@@ -371,6 +407,62 @@ Returns the updated user object (same shape as `GET /api/v1/auth/me`).
 
 ---
 
+### POST /api/v1/users/me/avatar
+
+Upload an avatar image and point the authenticated user's avatar at it.
+Broadcasts a `user_update` on success, exactly like the PATCH above.
+
+The bytes are stored as an ordinary attachment with no channel, and
+`users.avatar` is set to `/api/v1/files/{id}`. That URL is what makes the
+picture readable: `GET /api/v1/files/{id}` normally serves an unlinked
+attachment only to its uploader, and additionally admits one that some user's
+avatar currently points at — so an avatar is readable by every authenticated
+user for exactly as long as it is in use, and stops being readable the moment
+it is replaced.
+
+Not registered when the server has no working storage backend.
+
+**Auth:** Required
+**Rate limit:** 5 uploads/minute per user
+
+#### Request
+
+`multipart/form-data` with a single `file` part.
+
+| Rule       | Value                                                                                                                 |
+| ---------- | --------------------------------------------------------------------------------------------------------------------- |
+| Type       | `image/png`, `image/jpeg` or `image/webp`, sniffed from the file's own bytes (the client's `Content-Type` is ignored) |
+| Size       | 1 MiB                                                                                                                 |
+| Dimensions | 1024x1024, measured from the sniffed image                                                                            |
+
+GIF is refused (an animated avatar renders in every message row), and so is
+SVG — it is markup with script and external-fetch capability, and an avatar is
+rendered inline by definition. The server does not re-encode or crop; the
+client is expected to downscale and square-crop before uploading.
+
+#### Response 201 Created
+
+```json
+{
+  "id": "5f2c...",
+  "filename": "me.png",
+  "size": 20481,
+  "mime": "image/png",
+  "url": "/api/v1/files/5f2c...",
+  "width": 256,
+  "height": 256
+}
+```
+
+#### Errors
+
+| Status | Code           | Cause                                                          |
+| ------ | -------------- | -------------------------------------------------------------- |
+| 400    | `BAD_REQUEST`  | Missing `file` part, wrong type, too large, or too many pixels |
+| 429    | `RATE_LIMITED` | Too many uploads                                               |
+
+---
+
 ### PUT /api/v1/users/me/password
 
 Change the authenticated user's password. Verifies the old password, enforces
@@ -461,7 +553,10 @@ List all channels the authenticated user has `READ_MESSAGES` permission for. DM
     "category": "Text Channels",
     "position": 0,
     "slow_mode": 0,
-    "archived": false
+    "archived": false,
+    "nsfw": false,
+    "voice_max_users": 0,
+    "voice_max_video": 0
   }
 ]
 ```
@@ -476,6 +571,21 @@ List all channels the authenticated user has `READ_MESSAGES` permission for. DM
 | `position` | int | Sort order within category |
 | `slow_mode` | int | Slow-mode delay in seconds (0 = disabled) |
 | `archived` | bool | Whether the channel is archived |
+| `nsfw` | bool | Age-restriction label. **Stored and shipped only** — the server applies no content behaviour to a flagged channel (see below) |
+| `voice_max_users` | int | Voice capacity, 0 = unlimited. Enforced on join (`CHANNEL_FULL`) |
+| `voice_max_video` | int | Simultaneous cameras/screen shares, 0 = unlimited. Enforced on publish (`VIDEO_LIMIT`) |
+
+#### The `nsfw` flag
+
+`nsfw` is metadata and nothing else. The server stores it, ships it in `ready`
+and in the `channel_create` / `channel_update` broadcasts, and audits an
+operator flipping it — and does **not** filter content, check anyone's age, or
+restrict who may read or post in a flagged channel. Every consequence is the
+client's: the desktop client shows a one-time-per-session "may contain
+sensitive content" gate before rendering a flagged channel's messages
+(remembered in `sessionStorage`, so a new session asks again) and marks the
+channel in its sidebar. A client that ignores the field behaves exactly as it
+did before the field existed.
 
 ---
 
@@ -529,13 +639,23 @@ Paginated message history for a channel.
       "pinned": false,
       "edited_at": null,
       "deleted": false,
-      "timestamp": "2026-03-14T10:30:00Z"
+      "timestamp": "2026-03-14T10:30:00Z",
+      "mentions": [7],
+      "mentions_everyone": false
     }
   ],
   "has_more": true
 }
 ```
 
+`mentions` is the server-resolved list of mentioned user IDs (always present,
+empty when the message mentions nobody) and `mentions_everyone` reports an
+`@everyone`/`@here` that cleared the `MENTION_EVERYONE` permission. Both are
+resolved at send time and re-resolved on edit; an `@word` that matches no
+username, or an `@everyone` from a user without the bit, carries no mention
+semantics and stays plain text. The same two fields appear on pinned-message
+responses and on the WebSocket `chat_message`/`chat_edited` payloads.
+
 #### Pagination
 
 Use cursor-based pagination by passing the `id` of the last message as the `before` parameter:
@@ -548,6 +668,146 @@ When `has_more` is `false`, you have reached the beginning of the channel histor
 
 ---
 
+### GET /api/v1/channels/{id}/messages/around/{messageId}
+
+The window of channel history centred on one message, for jumping to a message
+that is not in the client's loaded page — a search hit, a pinned entry, a reply
+reference, or an `owncord://message/{channelId}/{messageId}` permalink.
+
+**Auth:** Required
+**Permission:** `READ_MESSAGES` on the channel (or DM participant membership) — the same gate as `GET /messages`
+
+#### Query Parameters
+
+| Param | Type | Default | Range | Description |
+| ----- | ---- | ------- | ----- | ----------- |
+| `limit` | int | 50 | 1-100 | Total window size, centre included |
+
+Half the window sits before the centre and the remainder after it: `limit=50`
+returns up to 25 older messages, the centre, and up to 24 newer ones. Near the
+start or end of a channel the window is simply shorter — it is not re-balanced
+toward the other side.
+
+#### Response 200 OK
+
+```json
+{
+  "messages": [],
+  "has_more_before": true,
+  "has_more_after": true
+}
+```
+
+`messages` holds the same message objects as `GET /messages` (user, attachments,
+reactions with the `me` flag, `mentions`, `mentions_everyone`), but is ordered
+**oldest-first**, not newest-first like the paginated history endpoint.
+
+`has_more_before` / `has_more_after` report whether the channel holds further
+live history on each side of the returned window. A client that renders an
+around-window is *detached* from the live tail while `has_more_after` is true:
+newly broadcast messages belong below the window and are not part of it, so the
+client should offer a "jump to present" affordance that refetches the normal
+`GET /messages` tail.
+
+#### Errors
+
+| Status | Code | When |
+|--------|------|------|
+| 400 | `BAD_REQUEST` | `id` or `messageId` is not a positive integer, or `limit` is not a positive integer |
+| 403 | `FORBIDDEN` | The channel exists but `READ_MESSAGES` is denied |
+| 404 | `NOT_FOUND` | The channel does not exist, the caller is not a participant of the DM, or the message does not live in this channel |
+
+Soft-deleted messages are 404 here, not an empty window: history omits deleted
+rows, so there is no row to centre on. Deleted messages are also excluded from
+the window itself, exactly as in `GET /messages`.
+
+---
+
+### POST /api/v1/channels/{id}/messages/purge
+
+Bulk soft-delete the newest messages in a channel.
+
+**Auth:** Required
+**Permission:** `READ_MESSAGES` **and** `MANAGE_MESSAGES` on the channel (per-channel overrides apply)
+
+Not available in DM channels — a DM has no `MANAGE_MESSAGES` gate, so those
+requests are rejected with 403.
+
+#### Request Body
+
+```json
+{
+  "limit": 50,
+  "before": 1042
+}
+```
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `limit` | integer | Yes | How many messages to delete, 1--100. Values above 100 are clamped; 0 or negative is a 400. |
+| `before` | integer | No | Only delete messages with an id below this one. Omit or `0` to start from the newest. |
+
+#### Response 200 OK
+
+```json
+{
+  "channel_id": 5,
+  "ids": [1042, 1041, 1040],
+  "count": 3
+}
+```
+
+`ids` is newest-first and may hold fewer than `limit` entries when the channel
+has less history; already-deleted messages are skipped. Deletion is soft: the
+rows stay as tombstones, exactly as with a single delete. A single
+[`chat_bulk_deleted`](protocol.md#chat_bulk_deleted-server---client-broadcast)
+WebSocket event is broadcast to the channel (not one `chat_deleted` per
+message), and one `message_purge` audit entry is written.
+
+Rate limited to 5/sec per user.
+
+---
+
+### GET /api/v1/channels/{id}/messages/{messageId}/reactions/{emoji}/users
+
+List the users who reacted to a message with a specific emoji — the "who
+reacted" tooltip behind a reaction pill.
+
+**Auth:** Required
+**Permission:** `READ_MESSAGES` on the channel (DM: participant)
+
+The reactor list is a separate endpoint rather than `user_ids` inline on every
+reaction summary, so message payloads stay small: a busy channel carries dozens
+of pills per page and almost none of them are ever hovered.
+
+`{emoji}` is a path segment and must be percent-encoded (`👍` → `%F0%9F%91%8D`).
+The message must belong to `{id}`; a message in another channel is a 404, so the
+channel in the URL is always the one the permission check ran against.
+
+#### Response 200 OK
+
+```json
+{
+  "users": [
+    { "id": 3, "username": "alice", "avatar": "" },
+    { "id": 7, "username": "bob", "avatar": "/api/v1/files/abc123" }
+  ]
+}
+```
+
+Ordered oldest reaction first and capped at **100** reactors — the list is for a
+tooltip, not an audit. `users` is always an array (`[]` when nobody used that
+emoji, which is also the answer for an emoji that does not exist). `avatar` is
+`""` when the user has none.
+
+| Status | Error | When |
+|--------|-------|------|
+| 400 | `BAD_REQUEST` | Non-positive `id`/`messageId`, or an empty / over-32-rune / control-character emoji |
+| 403 | `FORBIDDEN` | No `READ_MESSAGES` on the channel |
+| 404 | `NOT_FOUND` | Channel or message not found, the message lives in another channel, or a DM the caller is not in |
+
+---
+
 ### GET /api/v1/channels/{id}/pins
 
 Get all pinned messages for a channel.
@@ -614,7 +874,9 @@ Full-text search across messages in channels the user can read. Uses SQLite FTS5
         "username": "alex"
       },
       "content": "...matched text...",
-      "timestamp": "2026-03-14T10:30:00Z"
+      "timestamp": "2026-03-14T10:30:00Z",
+      "mentions": [7],
+      "mentions_everyone": false
     }
   ]
 }
@@ -738,12 +1000,31 @@ List all open DM channels for the authenticated user, ordered by most recent act
   "dm_channels": [
     {
       "channel_id": 100,
+      "name": "Lunch crew",
+      "is_group": true,
       "recipient": {
         "id": 2,
         "username": "jordan",
-        "avatar": "uuid.png",
+        "display_name": "Jo",
+        "avatar": "/api/v1/files/uuid",
         "status": "online"
       },
+      "recipients": [
+        {
+          "id": 2,
+          "username": "jordan",
+          "display_name": "Jo",
+          "avatar": "/api/v1/files/uuid",
+          "status": "online"
+        },
+        {
+          "id": 3,
+          "username": "sam",
+          "display_name": "",
+          "avatar": "",
+          "status": "idle"
+        }
+      ],
       "last_message_id": 5042,
       "last_message": "Hey, how's it going?",
       "last_message_at": "2026-03-28T14:30:00Z",
@@ -753,16 +1034,120 @@ List all open DM channels for the authenticated user, ordered by most recent act
 }
 ```
 
+| Field        | Description                                                                                                            |
+| ------------ | ---------------------------------------------------------------------------------------------------------------------- |
+| `recipient`  | The other participant of a 1:1 DM. **Backward compatibility only** — for a group it carries the first of `recipients`. |
+| `recipients` | Every participant except the caller. What group-aware clients read.                                                    |
+| `name`       | Optional group name; `""` for a 1:1 DM and for an unnamed group.                                                       |
+| `is_group`   | True for a group DM. Stored, not derived from the live participant count.                                              |
+
+`status` is viewer-adjusted: an `invisible` participant reads as `offline`.
+
+---
+
+### POST /api/v1/dms/group
+
+Create a group DM between the caller and 2–8 other users (3–10 total).
+
+Unlike `POST /api/v1/dms` this **always creates**: the same set of people may
+reasonably want more than one group, so there is no "the group for these users"
+to look up.
+
+Blocks are enforced in both directions, per recipient — a user may neither pull
+someone they have blocked into a room with them nor use a group to reach
+someone who has blocked them. The check is creation-time only; see
+`docs/protocol.md` § DM Authorization for why sending into a group is not
+block-checked.
+
+**Auth:** Required
+
+#### Request
+
+```json
+{
+  "recipient_ids": [2, 3],
+  "name": "Lunch crew"
+}
+```
+
+| Field           | Type   | Required | Description                                                                     |
+| --------------- | ------ | -------- | ------------------------------------------------------------------------------- |
+| `recipient_ids` | int[]  | Yes      | 2–8 other users. De-duplicated; the caller is dropped if named.                 |
+| `name`          | string | No       | Group name, ≤ 100 characters. HTML-stripped. Omit or `""` for an unnamed group. |
+
+#### Response 201 Created
+
+The same DM summary shape `GET /api/v1/dms` returns, from the creator's seat.
+Every participant — the creator included — also receives a `dm_channel_open`.
+
+#### Errors
+
+| Status | Code          | Reason                                                                |
+| ------ | ------------- | --------------------------------------------------------------------- |
+| 400    | `BAD_REQUEST` | Fewer than 2 or more than 8 recipients, or a name over 100 characters |
+| 403    | `FORBIDDEN`   | A recipient is blocked by, or has blocked, the caller                 |
+| 404    | `NOT_FOUND`   | A recipient does not exist                                            |
+
+---
+
+### PATCH /api/v1/dms/{channelId}
+
+Set or clear a group DM's name.
+
+Any participant may rename it. That is Discord's rule and the only one that
+works here: a group DM has no owner column and no roles, so "who may rename" has
+exactly one answer that does not require inventing an ownership model. A 1:1 DM
+refuses — its name is who is in it.
+
+**Auth:** Required (participant)
+
+#### Request
+
+```json
+{ "name": "Lunch crew" }
+```
+
+An empty name clears it, and the group falls back to listing its members.
+
+#### Response 200 OK
+
+The DM summary shape, from the caller's seat. Every participant also receives a
+`dm_channel_open` carrying the new name.
+
+#### Errors
+
+| Status | Code          | Reason                                                      |
+| ------ | ------------- | ----------------------------------------------------------- |
+| 400    | `BAD_REQUEST` | The channel is a 1:1 DM, or the name exceeds 100 characters |
+| 404    | `NOT_FOUND`   | Not a participant of this DM                                |
+
 ---
 
 ### DELETE /api/v1/dms/{channelId}
 
-Close a DM channel for the authenticated user (hides it from their sidebar). The channel and messages remain in the database. If the other user sends a new message, the channel is automatically re-opened.
+Remove a DM from the caller's sidebar. What that means depends on the kind of DM,
+and the route is shared because the _gesture_ is shared:
 
-**Auth:** Required
+- **1:1 DM** — a hide. The channel and messages remain, the caller remains a
+  participant, and a new message from either side re-opens it.
+- **Group DM** — a **leave**. The caller comes out of `dm_participants`, stops
+  receiving the group's messages, and cannot return unaided. When the last
+  participant leaves, the channel row is deleted (a DM nobody is in is reachable
+  by nobody, and its messages cascade off the channel).
+
+The caller receives `dm_channel_close`; after a group leave the remaining
+participants receive a fresh `dm_channel_open` with the new membership.
+
+**Auth:** Required (participant)
 
 #### Response 204 No Content
 
+#### Errors
+
+| Status | Code        | Reason                       |
+| ------ | ----------- | ---------------------------- |
+| 404    | `NOT_FOUND` | Not a participant of this DM |
+
 ---
 
 ## User Blocks
@@ -912,6 +1297,126 @@ execute under the app origin (HTML, SVG, XML, PDF) are served with
 
 ---
 
+## Custom Emoji
+
+Server-wide custom emoji, usable as `:shortcode:` in message content and as
+reaction strings.
+
+**Permission model.** Reading the set is open to any authenticated member —
+an emoji nobody can render is not an emoji, and the set is server-wide with no
+per-channel scope to leak. Adding and removing require **MANAGE_SERVER**.
+
+That is a deliberate reuse rather than a new permission bit: a bit is a
+schema-visible, forever decision, and "who may change server-wide branding" is
+exactly what MANAGE_SERVER already answers for the server name, icon and
+settings. There is no `MANAGE_EMOJI`.
+
+### GET /api/v1/emoji
+
+List every custom emoji, ordered by shortcode.
+
+**Auth:** Required
+
+#### Response 200 OK
+
+```json
+[
+  { "id": 3, "shortcode": "wave", "url": "/api/v1/emoji/3/image" },
+  { "id": 7, "shortcode": "party_blob", "url": "/api/v1/emoji/7/image" }
+]
+```
+
+`url` is server-relative and authenticated — see GET /api/v1/emoji/{id}/image.
+
+---
+
+### POST /api/v1/emoji
+
+Upload one custom emoji as multipart form data.
+
+**Auth:** Required — **MANAGE_SERVER**
+**Rate limit:** 10 requests/minute per user
+**Body size limit:** 1 MiB (the image itself is capped at 512 KiB)
+**Content-Type:** `multipart/form-data`
+
+| Field       | Type   | Notes                                                                                                                                           |
+| ----------- | ------ | ----------------------------------------------------------------------------------------------------------------------------------------------- |
+| `shortcode` | string | `[a-z0-9_]{2,32}`; surrounding colons are stripped and the value is lowercased before validation, so `:WAVE:` and `wave` are the same shortcode |
+| `file`      | file   | PNG, JPEG, GIF or WebP                                                                                                                          |
+
+Validation, in the order it is applied — the permission check runs before the
+multipart body is read, so a member without the bit never causes a spool to
+disk:
+
+1. MANAGE_SERVER, then the rate limit, then the shortcode format.
+2. At most **512 KiB** of image bytes.
+3. The MIME type is **sniffed from the file's own bytes**, never taken from the
+   client's part header. Only `image/png`, `image/jpeg`, `image/gif` and
+   `image/webp` are accepted. SVG is refused outright: it is markup with script
+   and external-fetch capability, and an emoji is by definition rendered inline.
+4. Dimensions are re-read from the sniffed image (WebP headers are parsed
+   directly, since the standard library has no WebP decoder) and must be at
+   most **128 x 128**.
+5. Shortcodes are unique case-insensitively; a collision is `409 CONFLICT`.
+6. A server holds at most 200 emoji.
+
+On success the full set is broadcast as `emoji_update` (see protocol.md), so
+every connected client converges without a reconnect.
+
+#### Response 201 Created
+
+```json
+{ "id": 3, "shortcode": "wave", "url": "/api/v1/emoji/3/image" }
+```
+
+#### Errors
+
+| Status | Code           | Cause                                           |
+| ------ | -------------- | ----------------------------------------------- |
+| 400    | `BAD_REQUEST`  | bad shortcode, wrong format, too large, too big |
+| 403    | `FORBIDDEN`    | caller lacks MANAGE_SERVER                      |
+| 409    | `CONFLICT`     | an emoji with that shortcode already exists     |
+| 429    | `RATE_LIMITED` | upload rate limit exceeded                      |
+
+---
+
+### GET /api/v1/emoji/{id}/image
+
+Serve one emoji's image bytes.
+
+**Auth:** Required (Bearer token)
+**Caching:** `Cache-Control: private, max-age=86400, immutable`
+
+Authenticated rather than public so an emoji cannot be used as an
+unauthenticated tracking pixel hosted on someone else's server. There is no
+per-channel ACL to apply — emoji are server-wide by construction, so
+authentication is the whole check. An emoji's bytes never change for a given
+id (a replacement is a new row), which is what lets the response be cached
+hard. Unknown ids answer 404.
+
+---
+
+### DELETE /api/v1/emoji/{id}
+
+Delete one custom emoji and unlink its stored file.
+
+**Auth:** Required — **MANAGE_SERVER**
+
+Messages and reactions that used the shortcode fall back to rendering the
+literal `:shortcode:` text. Broadcasts `emoji_update` on success.
+
+#### Response 204 No Content
+
+#### Errors
+
+| Status | Code          | Cause                        |
+| ------ | ------------- | ---------------------------- |
+| 400    | `BAD_REQUEST` | id is not a positive integer |
+| 403    | `FORBIDDEN`   | caller lacks MANAGE_SERVER   |
+| 404    | `NOT_FOUND`   | no emoji with that id        |
+
+---
+
 ## Health Check
 
 ### GET /health
@@ -971,10 +1476,343 @@ Runtime server metrics. Restricted to admin-allowed CIDRs.
 
 ---
 
+## Admin API Authorization
+
+The admin panel API lives under `/admin/api` (not `/api/v1`) and takes the same
+`Authorization: Bearer {token}` header — a login session or an API token, which
+inherits its owning user's role.
+
+Authorization is two-layered:
+
+1. **Perimeter.** The request is rejected with `403 FORBIDDEN` unless the
+   principal's role holds at least one bit of `permissions.AdminPerimeter`
+   (`ADMINISTRATOR`, `MANAGE_CHANNELS`, `MANAGE_ROLES`, `MANAGE_SERVER`,
+   `VIEW_AUDIT_LOG`, `KICK_MEMBERS`, `BAN_MEMBERS`, `MUTE_MEMBERS`). Banned
+   users are rejected here even while their session is still valid.
+2. **Per-route bit.** Route groups then require the specific permission below.
+   `ADMINISTRATOR` bypasses every one of them; owner-only routes gate on role
+   *position* (`>= 100`) instead of on a bit, so not even `ADMINISTRATOR`
+   substitutes for being the owner.
+
+| Route | Requires |
+| ----- | -------- |
+| `GET /admin/api/me` | perimeter only |
+| `GET /admin/api/stats` | perimeter only |
+| `GET /admin/api/users` | perimeter only |
+| `PATCH /admin/api/users/{id}` | perimeter; `BAN_MEMBERS` for `banned`, `MANAGE_ROLES` for `role_id` (checked in the service) |
+| `DELETE /admin/api/users/{id}/sessions` | `KICK_MEMBERS` |
+| `GET/POST/PATCH/DELETE /admin/api/channels…` (incl. `/permissions` and `/user-permissions`) | `MANAGE_CHANNELS` |
+| `GET/POST/PATCH/DELETE /admin/api/roles…` (incl. `/roles/reorder`) | `MANAGE_ROLES` |
+| `GET /admin/api/audit-log` | `VIEW_AUDIT_LOG` |
+| `GET/PATCH /admin/api/settings` | `MANAGE_SERVER` |
+| `POST /admin/api/logs/ticket`, `GET /admin/api/logs/stream` | `ADMINISTRATOR` |
+| `/api/v1/admin/plugins…` | `ADMINISTRATOR` |
+| `/admin/api/tokens…`, `/admin/api/backup(s)…`, `/admin/api/updates…` | Owner role (position 100) |
+
+Moderation routes additionally enforce the **role hierarchy**: the actor must
+strictly outrank the target (`actor.position > target.position`), and a role
+assignment may only grant a role positioned strictly below the actor's own —
+so an admin cannot promote anyone to Owner, and a moderator cannot demote an
+admin. Violations return `403 FORBIDDEN`.
+
+### GET /admin/api/me
+
+Describes the calling principal so a panel can hide what the role cannot use.
+Every route still re-checks its bit server-side.
+
+#### Response 200 OK
+
+```json
+{
+  "id": 7,
+  "username": "mod",
+  "role_id": 3,
+  "role_name": "Moderator",
+  "role_position": 60,
+  "permissions": 1048575,
+  "is_owner": false
+}
+```
+
+---
+
+## Role Management
+
+Create, edit, delete and reorder roles. The whole group requires
+`MANAGE_ROLES`; `RoleService` then enforces the hierarchy rules below, so a
+principal that clears the bit still cannot escalate through it.
+
+**Rules, all measured against the *actor's* role position:**
+
+- You may only create, edit, delete or reorder roles positioned **strictly
+  below** your own. Equal rank is refused too, so a role cannot rewrite itself.
+  Nothing sits above position 100, which makes the seeded Owner role
+  immutable and undeletable for everyone, owner included.
+- You may never **grant** a permission bit your own role lacks. Removing one is
+  allowed — de-escalation is always safe. `ADMINISTRATOR` bypasses this check
+  entirely (it is what lets the owner hand out anything).
+- The default role (`is_default = 1`) cannot be deleted: every member falls
+  back to it.
+- Deleting a role moves its members onto the default role in one `UPDATE`,
+  drops the role's `channel_overrides` rows, invalidates the moved members'
+  cached permissions, and broadcasts a `member_update` per member.
+- Names are unique **case-insensitively** (migration `023`), matching the
+  case-insensitive lookup the desktop client does. Max 32 characters.
+- Colors are `#rgb` or `#rrggbb`, normalized to uppercase. `""` clears the
+  color. Anything else is `400`.
+- Unknown permission bits are masked off rather than rejected.
+- Every mutation writes an audit row (`role_create`, `role_update`,
+  `role_delete`, `role_reorder`) and broadcasts `roles_update` (see
+  `docs/protocol.md`) carrying the full new list.
+
+### GET /admin/api/roles
+
+Roles ordered by position descending, each with its member count.
+
+#### Response 200 OK
+
+```json
+[
+  { "id": 1, "name": "Owner", "color": "#E74C3C", "permissions": 2147483647, "position": 100, "is_default": false, "member_count": 1 },
+  { "id": 4, "name": "Member", "color": null, "permissions": 1635, "position": 40, "is_default": true, "member_count": 12 }
+]
+```
+
+### POST /admin/api/roles
+
+#### Request
+
+```json
+{
+  "name": "Helper",
+  "color": "#5865F2",
+  "permissions": 3,
+  "position": 50
+}
+```
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `name` | string | Yes | 1–32 characters, unique case-insensitively |
+| `color` | string | No | `#rgb`/`#rrggbb`, or `""` for none |
+| `permissions` | integer | No | Bitfield; defaults to `0` |
+| `position` | integer | No | Defaults to one below the actor's own position |
+
+#### Response 201 Created
+
+The created role (`id`, `name`, `color`, `permissions`, `position`,
+`is_default` — always `false`; the default role is seeded, never created).
+
+#### Errors
+
+| Status | Code | When |
+|--------|------|------|
+| 400 | `BAD_REQUEST` | Missing/blank/over-long name, duplicate name, bad color, negative position |
+| 403 | `FORBIDDEN` | Missing `MANAGE_ROLES`, position at or above your own, or a permission bit you lack |
+
+### PATCH /admin/api/roles/{id}
+
+Partial update — every field is optional and an omitted one is left alone.
+Same body and same errors as `POST`, plus `404 NOT_FOUND` for a missing role.
+Editing a role at or above your own position is `403`.
+
+A permission change additionally invalidates the cached permissions of that
+role's members and re-syncs their channel visibility (the server sends targeted
+`channel_create`/`channel_delete`), because a role's mask is the base every
+channel's effective permission derives from.
+
+#### Response 200 OK
+
+The updated role.
+
+### DELETE /admin/api/roles/{id}
+
+#### Response 204 No Content
+
+#### Errors
+
+| Status | Code | When |
+|--------|------|------|
+| 400 | `BAD_REQUEST` | The role is the default role, or is the seeded Owner role |
+| 403 | `FORBIDDEN` | Missing `MANAGE_ROLES`, or the role is at or above your own position |
+| 404 | `NOT_FOUND` | No such role |
+
+### PATCH /admin/api/roles/reorder
+
+#### Request
+
+```json
+{ "role_ids": [2, 9, 3, 4] }
+```
+
+`role_ids` is highest-rank-first and must name **exactly** the set of roles
+strictly below your own position — a partial list is refused rather than
+silently leaving the omitted roles at positions that now collide. Positions are
+normalized to `N…1`, so they stay unique, stay below the actor, and never
+collide with the untouched roles above.
+
+#### Response 200 OK
+
+The full role list after the reorder, position descending.
+
+#### Errors
+
+| Status | Code | When |
+|--------|------|------|
+| 400 | `BAD_REQUEST` | Wrong number of ids, or a duplicate id |
+| 403 | `FORBIDDEN` | Missing `MANAGE_ROLES`, or an id that is unknown or not below your rank |
+
+---
+
+## Channel Management (admin)
+
+`POST /admin/api/channels` takes `{name, type, category, topic, position}`;
+`PATCH /admin/api/channels/{id}` takes `{name, topic, category, slow_mode,
+position, archived, nsfw, voice_max_users, voice_max_video}` and seeds every
+omitted field from the current row, so a partial body is safe.
+
+The numeric fields are bounds-checked before anything is written, and an
+out-of-range value is refused with `400 INVALID_INPUT` rather than clamped —
+a caller that sent `-1` meant something, and storing `0` would hide it. A
+refused body writes nothing at all:
+
+| Field | Range | Meaning |
+|-------|-------|---------|
+| `slow_mode` | 0…21600 | Cooldown in seconds; 0 = off (6-hour ceiling, as Discord) |
+| `voice_max_users` | 0…99 | Voice capacity; 0 = unlimited |
+| `voice_max_video` | 0…99 | Simultaneous cameras/screen shares; 0 = unlimited |
+
+`nsfw` is a bool and is stored, broadcast and audited only — the server applies
+no content behaviour to a flagged channel (see `GET /api/v1/channels`). The
+audit detail names the transition: `updated #foo (marked NSFW)` /
+`(unmarked NSFW)`, and plain `updated #foo` when the flag did not move.
+
+The voice limits are stored on a channel of any type but are only meaningful on
+a voice one; the desktop client offers them for voice channels alone and omits
+the keys entirely elsewhere, so a text-channel edit cannot wipe limits the row
+happens to hold.
+
+`type` must be `text`, `voice` or `announcement` (`400 INVALID_INPUT`
+otherwise). **`category` constrains nothing.** Categories are free text and a
+channel of any type may live under any of them — a voice channel under
+"Gaming", a text channel under "Voice Channels". Grouping is a display concern:
+the desktop client groups by whatever category a channel carries and falls back
+to a synthetic "Voice" group only for voice channels with no category at all.
+(Before phase 5 the server refused any non-voice channel under a category
+literally named "Voice Channels", and any voice channel outside it.)
+
+`PATCH` accepts `category`, so moving a channel between categories is an edit
+rather than a delete-and-recreate. An empty string makes it uncategorized.
+
+---
+
+## Channel Permission Overrides
+
+Two override layers per channel, both gated on `MANAGE_CHANNELS` and both
+audit-logged. They resolve in Discord's order:
+
+```
+base role permissions -> role override -> user override
+```
+
+The later, narrower layer wins: a **user** deny beats a **role** allow, a user
+allow beats a role deny, and within one layer allow beats deny. `ADMINISTRATOR`
+bypasses both layers entirely. See `docs/schema.md` ("Permission Checking
+Logic") for the formula and `permissions.EffectiveChannelPerms` for the single
+implementation.
+
+Denying `READ_MESSAGES` hides the channel outright — from the WS `ready`
+payload, from `GET /api/v1/channels`, from reconnect replay and from live
+broadcasts. Every write below invalidates the affected permission cache entries
+and then re-syncs connected clients with targeted `channel_create` /
+`channel_delete` messages, so sidebars converge without a reconnect.
+
+DM channels have no override surface: `400 INVALID_INPUT`.
+
+### GET /admin/api/channels/{id}/permissions
+
+Both layers for one channel. `roles` lists **every** role (zero masks when it
+carries no override) so the panel can render a complete grid; `users` lists
+**only** members who actually have an override row.
+
+#### Response 200 OK
+
+```json
+{
+  "channel_id": 4,
+  "roles": [
+    { "role_id": 1, "role_name": "Owner", "position": 100, "permissions": 2147483647, "allow": 0, "deny": 0 },
+    { "role_id": 4, "role_name": "Member", "position": 40, "permissions": 1635, "allow": 0, "deny": 514 }
+  ],
+  "users": [
+    { "user_id": 12, "username": "alice", "role_id": 4, "allow": 2, "deny": 0 }
+  ]
+}
+```
+
+### PUT /admin/api/channels/{id}/permissions/{roleId}
+
+### PUT /admin/api/channels/{id}/user-permissions/{userId}
+
+Write one override row. Same body for both layers:
+
+```json
+{ "allow": 2, "deny": 1 }
+```
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `allow` | integer | Bits granted in this channel |
+| `deny` | integer | Bits refused in this channel |
+
+Bits outside `permissions.AllPerms` are masked off rather than rejected, so an
+unknown bit can never be persisted. A row with both masks `0` is meaningless —
+the admin panel sends `DELETE` for that case instead.
+
+#### Response 200 OK
+
+The stored row: `{role_id, role_name, position, permissions, allow, deny}` for
+the role layer, `{user_id, username, role_id, allow, deny}` for the user layer.
+
+#### Cache and fan-out
+
+- Role layer: `InvalidateAll` (any member of that role is affected), then
+  `RefreshChannelVisibility`.
+- User layer: `InvalidateUser(userId)` only — a per-user override cannot change
+  anyone else's verdict, and dropping the whole cache for one member would cost
+  every connected client a repopulate — then `RefreshChannelVisibility`, which
+  resolves visibility per user through the full order.
+
+#### Audit
+
+`channel_perms_update` / `channel_user_perms_update`, target `channel`.
+
+#### Errors
+
+| Status | Code | When |
+|--------|------|------|
+| 400 | `BAD_REQUEST` | Unparseable id or body |
+| 400 | `INVALID_INPUT` | The channel is a DM |
+| 403 | `FORBIDDEN` | Missing `MANAGE_CHANNELS` |
+| 404 | `NOT_FOUND` | Unknown channel, role or user |
+
+### DELETE /admin/api/channels/{id}/permissions/{roleId}
+
+### DELETE /admin/api/channels/{id}/user-permissions/{userId}
+
+Clear the override row, returning the target to the layer above it. `204 No
+Content`; deleting a row that does not exist is a no-op, not a `404`. Same
+cache/fan-out behavior as the writes; audits as `channel_perms_clear` /
+`channel_user_perms_clear`.
+
+---
+
 ## Plugin Administration
 
 Manage WASM plugins. These endpoints sit behind **both** the admin IP
-restriction (allowed CIDRs) **and** admin bearer-token authentication.
+restriction (allowed CIDRs) **and** admin bearer-token authentication, and
+require the `ADMINISTRATOR` bit specifically (the widened admin perimeter does
+not open them).
 Plugin execution additionally requires a server built with `-tags wazero`
 and `plugins.enabled: true` in config.
 
diff --git a/docs/architecture/data-model.md b/docs/architecture/data-model.md
index 423a449b..15bc60f8 100644
--- a/docs/architecture/data-model.md
+++ b/docs/architecture/data-model.md
@@ -31,6 +31,8 @@ erDiagram
     messages ||--o{ attachments : "message_id"
     messages ||--o{ reactions : "message_id"
     users ||--o{ reactions : "user_id"
+    messages ||--o{ message_mentions : "message_id"
+    users ||--o{ message_mentions : "mentioned_user_id"
     users ||--o{ read_states : "user_id"
     channels ||--o{ read_states : "channel_id"
 
@@ -98,7 +100,7 @@ erDiagram
 | Domain | Tables | Notes |
 |--------|--------|-------|
 | Identity & access | `roles`, `users`, `sessions`, `channel_overrides`, `user_blocks`, `invites`, `login_attempts`, `rate_lockouts` | Sessions store only SHA-256 token hashes. Permissions are a bitfield on `roles.permissions`; channel overrides use Discord semantics `(role &^ deny) \| allow`. `rate_lockouts` (011) persists rate-limiter lockouts across restarts. |
-| Messaging | `channels`, `messages`, `attachments`, `reactions`, `read_states`, `emoji` | `channels.type` is constrained to `text \| voice \| announcement \| dm` by INSERT/UPDATE triggers (migration 013, extended by 016 to allow `announcement`). Announcement channels read like text but require `MANAGE_MESSAGES` to post. `attachments.uploader_id` (010) backs upload-ownership checks. |
+| Messaging | `channels`, `messages`, `attachments`, `reactions`, `read_states`, `message_mentions`, `emoji` | `message_mentions` (022) stores server-resolved `@username` mentions per message; `messages.mentions_everyone` flags an authorized `@everyone`/`@here`, and `read_states.mention_count` is the per-user unread badge those two drive. `channels.type` is constrained to `text \| voice \| announcement \| dm` by INSERT/UPDATE triggers (migration 013, extended by 016 to allow `announcement`). Announcement channels read like text but require `MANAGE_MESSAGES` to post. `attachments.uploader_id` (010) backs upload-ownership checks. |
 | Direct messages | `dm_participants`, `dm_open_state` | DMs are `channels` rows with `type='dm'`; these tables track membership and per-user open/closed UI state (009). |
 | Voice | `voice_states` | One row per user (`user_id` is the PK) — a user occupies at most one voice channel. |
 | Real-time replay | `events` | Cold tier of the 3-tier reconnect replay ([websocket.md](websocket.md)); written by the async `EventPersister`, pruned by retention. Hub seq counter is seeded from `MAX(events.seq)` at startup so seqs stay monotonic across restarts. |
diff --git a/docs/architecture/ux/messaging.md b/docs/architecture/ux/messaging.md
index ef990fe0..149ae571 100644
--- a/docs/architecture/ux/messaging.md
+++ b/docs/architecture/ux/messaging.md
@@ -155,6 +155,16 @@ so surrounding context and reply references stay intact.
 > (`messages.store.ts:282`); there is no local optimistic toggle. Target adds the
 > optimistic toggle for immediacy, consistent with §3.
 
+**Who reacted (✓ implemented 2026-08):** hovering (or focusing) a reaction pill
+for 300 ms fetches the reactor list and shows a tooltip reading
+*"alice, bob, carol and 4 others reacted with 👍"*. The debounce mirrors
+`lib/streamPreview.ts` so a pointer crossing a row of pills fires no requests.
+The list comes from `GET /channels/{id}/messages/{messageId}/reactions/{emoji}/users`
+(oldest first, capped at 100 server-side) and is cached per message+emoji in
+`message-list/reaction-tooltip.ts`; a `reaction_update` for that message evicts
+every one of its lists, since the event names only the emoji that changed.
+Usernames are inserted as text nodes — never markup.
+
 ---
 
 ## 6. Attachments
@@ -175,6 +185,26 @@ Upload goes through `POST /uploads` (multipart). **✓ Implemented (2026-07):**
 calls `onUnauthorized` (clearAuth → connect page with "Your session expired —
 sign in again.") and throws `ApiClientError(401)`.
 
+**Inline players (✓ implemented 2026-08):** a received attachment renders by MIME
+family, not as a download chip for everything but images:
+
+| MIME | Rendering |
+|------|-----------|
+| `image/*` except `image/svg+xml` | Inline `<img>` (existing) |
+| `video/mp4`, `video/webm`, `video/ogg` | Inline `<video controls preload="metadata">` in the same max box as an image, with the download button on hover |
+| `audio/mpeg`/`mp3`, `audio/ogg`, `audio/opus`, `audio/wav`, `audio/webm` | Inline `<audio controls preload="metadata">` row with filename, size and download |
+| anything else, including `image/svg+xml` | Download chip |
+
+Both player families are allowlists, not `video/`/`audio/` prefix tests: an
+unknown container gets a chip rather than a player that fails to decode. SVG is
+excluded from every inline path because it can carry script.
+
+`/api/v1/files/{id}` is permission-checked, so a player cannot point at the raw
+URL. The source is fetched through the same cert-pinned proxy with the session
+bearer token that images use, then handed over as a `blob:` URL — deliberately
+not the image path's base64 data URI, which would inflate a 50 MB video into a
+string and park it in the LRU + IndexedDB caches.
+
 ---
 
 ## 7. Replies, pins, search, read/unread
@@ -190,6 +220,114 @@ sign in again.") and throws `ApiClientError(401)`.
 replay (already handled via `isReplaying()`), so catching up 500 buffered
 messages doesn't light every channel red.
 
+**New-messages divider (✓ implemented 2026-08):** opening a channel that had
+unread messages renders a red **NEW** line above the first one. Opening the
+channel clears the badge, which destroys the only record of where the reader had
+got to, so `setActiveChannel` snapshots the count first
+(`channels.store.getUnreadOnOpen`); MessageList reads it once at mount and places
+the line above the last *N* loaded messages. Consequences of that derivation: the
+line is suppressed while the message window is detached (a slice around some old
+message is not the tail), and it clears on the next visit, when the snapshot is 0.
+The message under the line never renders as a grouped continuation of the one
+above it.
+
+**Explicit mark-as-read (✓ implemented 2026-08):** the channel context menu gains
+**Mark as Read** (disabled when the channel is already read, absent for voice
+channels), and the sidebar's server header gains **Mark All as Read**, which
+appears only while something is unread. Both go through `lib/read-state.ts`,
+which sends the `mark_read` WS message and clears the local badges. `mark_read`
+rather than `channel_focus`: focus also rebinds the connection's focused channel,
+which would misroute unread bookkeeping for the channel actually on screen.
+
+**DM badges (✓ implemented 2026-08):** the DM sidebar renders the real unread
+count (and a red mention count that outranks it) instead of a bare dot. The ready
+payload's `dm_channels[]` now carries `mention_count` — `GetChannelUnreadCounts`
+includes the caller's DM rows — so a DM mention badge survives a reconnect
+instead of resetting to 0.
+
+---
+
+## 7a. Jumping to a message
+
+Every affordance that can jump — a search hit, a pinned entry, the quoted
+reply bar above a reply, an `owncord://message/…` permalink pasted into chat or
+opened from the OS — goes through one path (`lib/message-navigation.ts`
+registry → `main-page/MessageJump.ts`), so they behave identically.
+
+| Step | Target UX |
+|------|-----------|
+| Target loaded | Scroll to the row and flash it (`.highlight-flash`, 1.5s) |
+| Target not loaded | Fetch `GET /channels/{id}/messages/around/{messageId}`, replace the channel's window with it, then scroll + flash |
+| Target in another channel | Open that channel first, then the above — the jumper owns the switch so the fetch is sequenced after it, not racing it |
+| Channel not visible / message deleted | Toast and stay put; never blank the chat area on an unresolvable link |
+
+**Detached windows.** An around-window whose `has_more_after` is true is
+*detached*: the bottom of the list is history, not "now". While detached the
+store refuses to append live broadcasts (they belong below a gap, and splicing
+them on would be a lie about ordering) and the message list shows a **Jump to
+Present** pill. Clicking it reattaches and refetches the live tail. Scrolling
+further up (`prependMessages`) keeps the window detached; only a fresh tail
+fetch reattaches.
+
+**Permalinks.** The hover action bar's *Copy Message Link* yields
+`owncord://message/{channelId}/{messageId}`. Pasted back into chat, that link
+renders as a compact chip (channel name + *Jump*) rather than a bare URL; a
+link to a channel the reader cannot see stays plain text.
+
+---
+
+## 7b. Mentions
+
+The server resolves mentions at send time and ships `mentions` (user IDs) +
+`mentions_everyone` on `chat_message`, `chat_edited` and REST history, plus a
+per-channel `mention_count` in `ready`. The client treats those fields as
+authoritative and only falls back to parsing `@tokens` locally when an older
+server omits them.
+
+| Surface | Target UX |
+|---------|-----------|
+| `@username` | Highlighted **only** when it resolves — against the server's `mentions` list or `membersStore` (case-insensitive). An unresolvable `@nobody`, an email local part (`mail@example`) or an address-shaped `@bob@example.com` stays plain text |
+| `@everyone` / `@here` | Highlighted only when `mentions_everyone` is true; a sender without `MENTION_EVERYONE` produces ordinary text with no mention semantics anywhere in the client |
+| Mention of *you* | The `@token` gets `.mention-self` **and** the whole row gets `.mentioned` (left accent + tinted background) |
+| `#channel-name` | Rendered as a clickable chip when the name resolves in `channelsStore` (DM channels excluded); click / Enter routes through `navigateToChannel`, the same activation path the sidebar and quick switcher use |
+| Channel badge | `mentionCount` per channel, seeded from `ready`, incremented on an incoming `chat_message` that mentions you, cleared on activation alongside unread. The red `.mention-badge` replaces the plain unread badge — never both on one row |
+| Notification | "*X* mentioned you in #channel" for a direct mention or an honoured `@everyone`. The **Suppress @everyone** preference drops only `mentions_everyone`-driven notifications; a message that also names you still notifies. DND still silences the popup and the chime |
+| Composer | Typing `@` opens `MentionAutocomplete` (up/down/enter/tab/escape), filtered by username; `@everyone`/`@here` appear only when your role holds `MENTION_EVERYONE`. Selection inserts `@username ` and the popup owns Enter so a half-typed mention never sends |
+
+**Editing rule:** an edit re-resolves mentions (the row's highlight follows the
+new text) but never re-notifies and never re-increments a badge — that is
+enforced server-side and mirrored here by never incrementing off `chat_edited`.
+
+---
+
+## 7c. Markdown
+
+Message text is rendered as Discord-flavoured markdown. Parsing is entirely
+client-side — the server stores and ships the raw text — and the renderer
+builds DOM nodes only: `innerHTML` is never used with message content, and
+every `href` passes `isSafeUrl` first.
+
+| Construct | Syntax | Notes |
+|-----------|--------|-------|
+| Bold / italic / underline / strike | `**b**`, `*i*` or `_i_`, `__u__`, `~~s~~` | Nest freely (`**bold *and italic***`). `_` only opens on a word boundary, so `snake_case_names` stay literal |
+| Spoiler | `\|\|hidden\|\|` | Obscured `role="button"` span with `aria-pressed`; revealing is per-span and one-way, and the revealing click is swallowed so a link underneath cannot open with it |
+| Escape | `\*literal\*` | A backslash neutralises any markdown punctuation; escapes are inert inside code |
+| Block quote | `> line` at line start | Contiguous `>` lines merge into one quote; `>>>` quotes the rest of the message. Quotes may contain other blocks, one level deep |
+| Heading | `# `, `## `, `### ` at line start | h1–h3; the space is required, so `#nospace` and `#channel` are untouched |
+| Lists | `- ` / `* ` bullets, `1. ` ordered | Contiguous items form one list; two leading spaces nest a single level; an ordered list keeps its starting number |
+| Masked link | `[text](url)` | `http(s)` absolute URLs only — `javascript:`, `data:` and relative URLs render as literal source text. Shows `title=url`, and produces **no** link embed (an author who hid the address does not get it previewed back) |
+| Inline code | `` `code` ``, ``` ``code`` ``` | Markdown, mentions and autolinking are all dead inside |
+| Code fence | ` ```lang ` … ` ``` ` | The tag renders as a label and selects a lightweight highlighter (js/ts, go, python, rust, json, bash, css, html — anything else falls back to plain). Copy button unchanged |
+
+Bare URLs are still autolinked, and mention/`#channel` chips render inside
+styled spans — a URL's own `_` and `*` are treated as address, not markup.
+
+**Composer:** Ctrl+B / Ctrl+I / Ctrl+U wrap the selection in `**`, `*` and
+`__` (and unwrap it when it is already wrapped); with an empty selection the
+markers are inserted around the caret. The composer stops propagation on those
+keys, so Ctrl+U formats while typing and only opens the file picker when the
+message box does not have focus.
+
 ---
 
 ## 8. Slow-mode
@@ -228,5 +366,10 @@ the same signal in future.
 (+ `message-input/`), `src/pages/main-page/ChannelController.ts`,
 `src/pages/main-page/MessageController.ts`, `src/pages/main-page/ReactionController.ts`,
 `src/stores/messages.store.ts`, `src/lib/dispatcher.ts`, `src/lib/ws.ts`,
-`src/components/SearchOverlay.ts`, `src/components/PinnedMessages.ts`;
-server `Server/service/message.go`, `Server/ws/handlers_chat.go`.
+`src/components/SearchOverlay.ts`, `src/components/PinnedMessages.ts`,
+`src/components/MentionAutocomplete.ts`, `src/lib/mentions.ts`,
+`src/components/message-list/content-parser.ts` (+ `markdown.ts`,
+`syntax-highlight.ts`),
+`src/lib/channel-navigation.ts`, `src/lib/notifications.ts`;
+server `Server/service/message.go`, `Server/service/mentions.go`,
+`Server/ws/handlers_chat.go`.
diff --git a/docs/architecture/ux/voice-and-e2ee.md b/docs/architecture/ux/voice-and-e2ee.md
index baf855fa..00a89df3 100644
--- a/docs/architecture/ux/voice-and-e2ee.md
+++ b/docs/architecture/ux/voice-and-e2ee.md
@@ -94,7 +94,7 @@ All four are optimistic with rollback; each also emits a WS control message.
 | Control | Local state | WS message | Rollback |
 |---------|-------------|-----------|----------|
 | **Mute** | `localMuted` (`setLocalMuted`) — fully unpublishes the mic track | `voice_mute{muted}` | n/a (local-authoritative) |
-| **Deafen** | `localDeafened` + forces mute | `voice_deafen` + `voice_mute` | implies mute |
+| **Deafen** | `localDeafened` + forces mute — unsubscribes remote *voice* audio only; screen-share/stream audio keeps playing (it has its own per-tile mute/volume) | `voice_deafen` + `voice_mute` | implies mute |
 | **Camera** | `localCamera` set optimistically, rolled back on device failure (`screenShare.ts:177,204`) | `voice_camera{enabled}` | revert on failure + toast |
 | **Screenshare** | `localScreenshare` optimistic, rollback on failure (`screenShare.ts:265,311`); rate-limited | `voice_screenshare{enabled}` | revert + toast |
 
diff --git a/docs/credential-storage.md b/docs/credential-storage.md
index 7cb3341c..2aa41c7f 100644
--- a/docs/credential-storage.md
+++ b/docs/credential-storage.md
@@ -166,20 +166,32 @@ silently dropped.
 success. A store that accepts a write and does not return it is the one failure
 a `Result` cannot express, and it is exactly what caused this incident.
 
-When that check fails **on Windows**, the secret is encrypted with DPAPI
-(`CryptProtectData`, user-scoped, `CRYPTPROTECT_UI_FORBIDDEN`) and parked in
-`credential_fallback.json` in the app data dir. The account name is mixed into
-the DPAPI entropy, so a blob cannot be moved between entries and still decrypt.
-The fallback:
+When that check fails, the secret is sealed and parked in
+`credential_fallback.json` in the app data dir:
+
+- **Windows**: DPAPI (`CryptProtectData`, user-scoped,
+  `CRYPTPROTECT_UI_FORBIDDEN`). The encryption key is held by the OS.
+- **macOS / Linux**: ChaCha20-Poly1305 under a per-install random key stored in
+  `credential_fallback.key` beside it (owner-only, 0600). There is no OS-held
+  key available on these platforms when the OS secret store is itself the thing
+  that failed, so this is honest damage control rather than a vault: same-user
+  malware that can read both files has the secrets, exactly as it could invoke
+  DPAPI on Windows. What it guarantees is that secrets at rest are never
+  plaintext, that a copied `credential_fallback.json` is useless without the key
+  file next to it, and that the common no-Secret-Service Linux desktop (no
+  gnome-keyring / KWallet, e.g. a bare window manager) can still persist
+  credentials and the voice-E2EE identity key at all — previously those
+  machines had nowhere to save, so logins and identity keys silently vanished
+  on every restart.
+
+In both cases the account name is mixed in (DPAPI entropy / AEAD associated
+data), so a blob cannot be moved between entries and still decrypt. The
+fallback:
 
 - engages **only** after a write has been proven not to round-trip — never as
   the default;
 - is cleared automatically as soon as the OS credential store works again, so a
-  repaired machine returns to the real store with no migration step;
-- exists on Windows only. On macOS and Linux a failing Keychain / Secret Service
-  is reported as an error instead, because writing a login password or an
-  identity private key to a plaintext file there would be a worse outcome than
-  not persisting it.
+  repaired machine returns to the real store with no migration step.
 
 None of this weakens the fail-closed E2EE posture: a peer whose announce
 signature does not verify is still rejected. The fallback only affects whether
diff --git a/docs/mcp-introspect.md b/docs/mcp-introspect.md
index b2876674..681636f1 100644
--- a/docs/mcp-introspect.md
+++ b/docs/mcp-introspect.md
@@ -213,9 +213,9 @@ All optional except the token (which only the two server-backed tools need).
 |---------|-------------|
 | `OWNCORD_API_TOKEN is not set` | Mint a token and set the env var; restart the shell/Claude Code so it's inherited. |
 | `OwnCord cert not found at …` | Start the server once to generate `Server/data/cert.pem`, or set `OWNCORD_CERT_PATH` / `OWNCORD_BASE_URL`. |
-| `api_request` returns `401` | Token missing/revoked/expired, or (for `/admin/*`) the token's user lacks ADMINISTRATOR. Mint a fresh owner-bound token. |
-| `api_request` returns `403` on `/admin/*` | The request didn't come from an allowed IP — the tool must run on the same host as the server (localhost is allowed by default). |
-| `server_logs` fails at the ticket step | The token can't reach `/admin/api/*` (needs ADMINISTRATOR), or the server isn't the current build. |
+| `api_request` returns `401` | Token missing/revoked/expired. Mint a fresh owner-bound token. |
+| `api_request` returns `403` on `/admin/*` | Either the request didn't come from an allowed IP (the tool must run on the same host as the server; localhost is allowed by default), or the token's user lacks the permission that route requires — see the route table in `docs/api.md`. |
+| `server_logs` fails at the ticket step | The log stream still needs ADMINISTRATOR (the widened `/admin/api/*` perimeter does not open it), or the server isn't the current build. |
 | `client_logs` → `found: false` | The desktop client hasn't run yet, or the path differs — set `OWNCORD_CLIENT_LOG`. |
 
 ---
diff --git a/docs/plans/discord-parity.md b/docs/plans/discord-parity.md
new file mode 100644
index 00000000..16e7d71b
--- /dev/null
+++ b/docs/plans/discord-parity.md
@@ -0,0 +1,126 @@
+# Discord feature parity — gap analysis and plan
+
+Status: phase 6 complete (2026-08-01)
+
+This is a depth audit of features OwnCord already has, compared against what
+Discord's version of the same feature can do (free tier, with Nitro notes where
+relevant). Wholly absent features (threads, forums, polls, soundboard, …) are
+listed at the end for reference but are out of scope here — the focus is
+finishing the features we have.
+
+## Where OwnCord already meets or beats Nitro
+
+- Uploads: 100 MB default (free Discord: 10 MB, Nitro Basic: 50 MB, Nitro: 500 MB) — and `max_upload_bytes` is operator-configurable.
+- Message length: 4000 runes, equal to Nitro's limit (free Discord: 2000).
+- Streaming: source-quality preset and up to 120 fps, above Nitro's 1080p60/4K60.
+- Client themes: full custom CSS-var theming with import/export — a paid perk on Discord.
+- E2EE voice with TOFU identity verification — Discord has no equivalent at any tier.
+
+## Phase 1 — quick wins (this branch)
+
+Features where one side is already built and the other was never finished.
+
+| # | Item | What exists | What's missing |
+|---|------|-------------|----------------|
+| 1 | Block/unblock UI | Full server enforcement (`user_blocks`, DM create + send checks), `GET /blocks` client call | Client never calls `PUT/DELETE /api/v1/blocks/{userId}`; no menu items |
+| 2 | Channel topics in client | `channels.topic` column, admin-panel editing | Not in WS `ready` payload; chat header never renders it; client edit modal is name-only |
+| 3 | Role colors | `roles.color` stored and shipped in `ready` | Client hardcodes a switch on 4 role names (`formatting.ts`) |
+| 4 | Profile popup | `UserProfilePopup.ts` built and unit-tested | Never mounted; member click opens only the admin context menu |
+| 5 | Temp bans | `users.ban_expires`, `BanUser(..., expires)`, `IsEffectivelyBanned` all honor expiry | Every caller passes `nil`; no API field, no UI |
+| 6 | Archived channels | `channels.archived` stored, settable in admin panel | No read path filters on it — archived channels appear everywhere |
+
+## Phase 2 — moderation depth
+
+- **DONE (2026-07-31)** — Honest kick semantics. There is no membership model, so `DELETE /admin/api/users/{id}/sessions` cannot remove anyone; it revokes the target's sessions and they can sign straight back in. Rather than invent a membership table, the user-facing action is renamed to what it does: the desktop member-list menu item is now **Force Logout** (confirm "Log them out?", pending "Logging out...", toast "Forced {name} to log out"), and the admin panel's row button, modal and toast say Force Logout too, with the modal spelling out that the user can sign back in. The endpoint, the `KICK_MEMBERS` bit and the `onKick`/`adminKickMember` call sites are unchanged.
+- **DONE (2026-07-31)** — Enforce the decorative permission bits. The `/admin/api` perimeter now admits any role holding a bit of `permissions.AdminPerimeter` instead of requiring `ADMINISTRATOR`, and each route group re-checks its own bit: channels + channel overrides → `MANAGE_CHANNELS`, audit log → `VIEW_AUDIT_LOG`, settings → `MANAGE_SERVER`, force-logout → `KICK_MEMBERS`; ban/unban (`BAN_MEMBERS`) and role assignment (`MANAGE_ROLES`) are authorized inside `ModerationService`. Stats/users/`GET /me` stay perimeter-level; backups, updates, API tokens, plugins and the log stream are unchanged. `GET /admin/api/me` reports the caller's mask so the admin panel hides tabs and row actions it cannot use, and the desktop member-list context menu gates Kick/Ban/Change Role on the bits from the `ready` role list instead of on the role *name*. `MUTE_MEMBERS` admits to the perimeter but still has no route behind it (see voice moderation below).
+- **DONE (2026-07-31)** — Hierarchy checks beyond ban/unban: `ModerationService.ChangeUserRole` requires the actor to strictly outrank the target *and* refuses to assign a role positioned at or above the actor's own, closing the "any admin can promote anyone to Owner" hole. `ModerationService.ForceLogout` enforces the same outranks rule.
+- **DONE (2026-07-31)** — Voice moderation on `MUTE_MEMBERS` (the bit is now live): `voice_mod_mute`, `voice_mod_deafen`, `voice_mod_move` and `voice_mod_kick`, each requiring the bit plus a strict role-position outrank of the target, rate limited 5/sec and audit-logged. `voice_states` gained `server_muted` / `server_deafened`, which the `voice_state` broadcast now carries; a server mute is also applied to the target's published audio track via the LiveKit RoomService, and the target's own `voice_mute` / `voice_deafen` unmute attempts are refused with `SERVER_MUTED` / `SERVER_DEAFENED`. Move and disconnect run the hub's voice-leave routine for the target and then send them `voice_moved` (client re-joins the destination through the ordinary join path) or `voice_disconnected`. The desktop client's voice-user context menu grows a moderation section gated on the bit, renders a distinct server-muted icon, and disables the widget's mute/deafen buttons with a reason while server muted.
+- **DONE (2026-07-31)** — Bulk message delete. `POST /api/v1/channels/{id}/messages/purge` takes `{limit: 1-100, before?}` and soft-deletes the newest matching messages, gated on `READ_MESSAGES|MANAGE_MESSAGES` for that channel (per-channel overrides apply, DMs rejected — a DM has no MANAGE_MESSAGES gate to answer to). Deletion is the same soft delete a single delete performs, so tombstones and `reply_to` targets survive; already-deleted rows are skipped and the select+update run in one writer transaction. One `message_purge` audit entry per call carries the count, and the fan-out is a single new `chat_bulk_deleted {channel_id, ids}` server->client message instead of N `chat_deleted` events. The desktop channel context menu grows a "Purge Messages…" item — gated on the actor's `MANAGE_MESSAGES` bit and hidden on voice channels — opening an inline 1-100 count prompt with a confirm step; the dispatcher marks every id in the broadcast as deleted.
+
+## Phase 3 — mentions done right
+
+The largest single messaging gap: `@word` was regex-highlighted with no
+resolution, no notification and no badge, and `read_states.mention_count` was a
+dead column. The server is now the authority on what a mention is — the client
+highlights and badges from the resolved fields rather than re-parsing content.
+
+- **DONE (2026-07-31)** — Server-side mention resolution and storage. `MessageService.resolveMentions` parses `@token`s out of sanitized content with a word-boundary rule (`mentionTokenRe`) that refuses address-shaped text: `mail@example` and `@@name` never match, and `@bob@example.com` is rejected whole rather than half-matched. Tokens are lowercased, deduplicated, ordered by first appearance and resolved case-insensitively against `users.username` (`UNIQUE COLLATE NOCASE`), with a second spelling that drops trailing `.`/`-` so "@bob." resolves to bob when nobody is literally named "bob.". A token matching no username resolves to nothing and stays plain text. Two caps bound the work one send can cause: at most 60 distinct tokens are looked up (`maxMentionCandidates`) and at most 20 resolve (`maxMentionsPerMessage`). Resolved IDs land in the new `message_mentions` table (migration `022`, PK `(message_id, mentioned_user_id)` plus `idx_message_mentions_user` for the per-user direction), written in the same writer transaction as the message row and rewritten wholesale on edit. Resolution failures are logged and degrade to "no mentions" — a message is never rejected because its mention lookup failed. `mentions` and `mentions_everyone` now ride on the `chat_message` and `chat_edited` broadcasts, on `GET /channels/{id}/messages`, on pinned-message responses and on FTS search results; `mentions` is always present and empty rather than null. `buildChatMessage` took a `chatMessageArgs` struct in the process — the positional list had outgrown a readable call site.
+- **DONE (2026-07-31)** — `read_states.mention_count` is live. `applyMentionCounts` raises it on message insert for every mentioned user who can actually read the channel — the role walk applies channel overrides, and DMs skip it entirely since participation is membership, not permissions. The author is always excluded, and users who have blocked the author are dropped (fail-closed: a `ListBlockersOf` error skips the whole increment, because a badge from a blocked user is worse than no badge). Edits deliberately never increment: only the original send can raise a badge, which is the simplest rule that makes double-counting a re-added mention impossible. `channel_focus` resets the count to 0 via the `UpdateReadState` upsert, and the `ready` payload ships `mention_count` per channel. Because `GetChannelUnreadCounts` covers `text`/`announcement` channels, a DM mention badge is raised live by the dispatcher but starts at 0 on reconnect — DM unreads are surfaced separately in the DM sidebar.
+- **DONE (2026-07-31)** — Client rendering, badges and notifications. `@lib/mentions` is the single source of truth shared by the renderer, the badge path and the notification gate, so all three agree on what counts as a mention; its regex mirrors the server's, and the server's `mentions`/`mentions_everyone` decide the outcome whenever present (the local token parse only stands in for servers predating the fields). Resolved mentions render as a highlighted `.mention` span, with `.mention-self` when the mention is the current user; an unresolvable token renders as plain text. In the channel sidebar a red `.mention-badge` outranks the plain unread badge — only one shows, and it counts mentions rather than messages. Desktop notifications retitle to "{user} mentioned you in #{channel}", and "Suppress @everyone" now means exactly that: it drops only a notification the `@everyone`/`@here` alone caused, so a message that also names you still notifies, and an `@everyone` the sender lacked the bit for was never a mention to suppress. No OS dock/taskbar count badge was added — the existing taskbar *flash* is the only OS-level signal; a real badge count needs a Tauri-side API and is left for a later pass.
+- **DONE (2026-07-31)** — `@everyone`/`@here` behind a permission, plus composer autocomplete. New `MENTION_EVERYONE` bit (21, `0x200000`); migration `022` grants it to the seeded Owner/Admin/Moderator roles, moving the Moderator mask from `0x000FFFFF` to `0x002FFFFF`. Without the bit the token carries no mention semantics at all — no highlight, no badge, no notification — and DM channels have no `@everyone` semantics since there is no permission surface to answer to. `@here` narrows the fan-out to readers whose status is not `offline`; `@everyone` reaches every reader. The composer opens an inline member picker on `@` (`MentionAutocomplete`, max 10 rows) whose active-token rule mirrors the server's, so it never offers a completion for text a send would not resolve; `@everyone`/`@here` appear as rows only for users who hold the bit.
+- **DONE (2026-07-31)** — Clickable `#channel` links. `#name` tokens in message content resolve case-insensitively against the channel store (DM channels excluded — they have no user-visible `#name`) and render as links; unresolvable tokens stay plain text. Navigation funnels through the new `@lib/channel-navigation.navigateToChannel`, now the single entry point shared by the sidebar item and `#channel` links, so every affordance clears the same unread and mention badges. Role mentions remain out of scope by design — they need role management, which is phase 5.
+
+## Phase 4 — markdown and message polish
+
+- **DONE (2026-08-01)** — Full markdown rendering, client-side. The content parser grew a real tokenizer (`message-list/markdown.ts`): one left-to-right scan with recursive descent into matched delimiter pairs, which is what makes nesting (`**bold *and italic***`), backslash escaping and "markdown is dead inside code" fall out of a single rule set instead of a pile of regexes fighting over overlaps. Inline: bold, italic (`*`/`_`, with a word-boundary rule so `snake_case_names` stay literal), underline, strikethrough and spoilers; blocks (line-start only): `>` quotes that merge contiguous lines, `>>>` for the rest of the message, `#`–`###` headings that require the space, `-`/`*`/`1.` lists with one level of nesting. Masked links accept absolute `http(s)` only — `javascript:`, `data:` and relatives render as their literal source — and are excluded from `extractUrls`, so hiding an address does not get it previewed back. Code fences take a language tag that renders as a label and drives a hand-rolled highlighter (`syntax-highlight.ts`: comments/strings/numbers/keywords for js/ts, go, python, rust, json, bash, css, html, plain fallback) — no highlighting dependency was added. Spoilers are per-span `role="button"` elements with `aria-pressed`, and the revealing click is swallowed so a link underneath cannot open with it. Rendering stays a strict DOM builder: no `innerHTML` anywhere, every `href` through `isSafeUrl`. Composer: Ctrl+B/I/U wrap (and unwrap) the selection, stopping propagation so Ctrl+U formats while typing and still uploads elsewhere.
+- **DONE (2026-08-01)** — Message navigation: fetch-around, reply jumps, permalinks. Server gained `GET /api/v1/channels/{id}/messages/around/{messageId}?limit=50` — the same read gate as history (READ_MESSAGES / DM membership), the window split half-and-half around the centre and returned **oldest-first**, with `has_more_before`/`has_more_after` derived by over-fetching one row per side rather than two extra count queries. A centre that is soft-deleted is a 404, not an empty window: history omits deleted rows, so there is nothing to centre on. The three duplicated read-permission blocks in `MessageService` collapsed into one `requireChannelRead`, and the three copies of limit parsing in the handlers into one `parseLimitParam`. Client-side every jump affordance — search hit, pinned entry, the quoted reply bar, a permalink chip, an `owncord://message/…` link from the OS — now routes through a single jumper (`lib/message-navigation.ts` registry → `main-page/MessageJump.ts`): scroll + flash when the target is loaded, otherwise fetch the around-window, swap it in, scroll + flash. A window with newer messages below it is *detached*: the store refuses to append live broadcasts onto it (they belong below a gap) and the list shows a **Jump to Present** pill that reattaches and refetches the tail. Permalinks are `owncord://message/{channelId}/{messageId}` — copied from the hover bar, parsed by the same `deep-link.ts` that owns the invite scheme (whose bare-code form now refuses the `message` route), and rendered as a compact channel-name chip when pasted into chat; a link to a channel the reader cannot see stays plain text.
+- **DONE (2026-08-01)** — Who-reacted list. Server added `GET /api/v1/channels/{id}/messages/{messageId}/reactions/{emoji}/users` (emoji percent-encoded; chi routes on `RawPath`, so the handler unescapes it) behind the same `requireChannelRead` gate as history, returning up to 100 reactors oldest-first. A separate endpoint rather than `user_ids` inline on every reaction summary: a page of chat carries dozens of pills and almost none are hovered, so the payload stays small. A message that lives in another channel is a 404 — the channel in the URL is the one the permission check ran against. Client: hovering or focusing a pill for 300 ms (the `lib/streamPreview.ts` debounce, so a pointer crossing a row fires nothing) fetches and shows *"alice, bob, carol and 4 others reacted with 👍"*. Lists are cached per message+emoji and evicted wholesale for a message on `reaction_update`, which names only the emoji that changed; a response that lands after an invalidation or after the pointer left is discarded rather than repopulating the cache or popping a tooltip nobody is hovering. Usernames go in as text nodes.
+- **DONE (2026-08-01)** — Inline video/audio players. `video/mp4|webm|ogg` render as `<video controls preload="metadata">` inside the same max box as an image (download button on hover); the common audio containers render as an `<audio controls preload="metadata">` row with filename, size and download. Both are allowlists, not `video/`/`audio/` prefix tests — an unknown container gets the download chip rather than a player that fails to decode — and `image/svg+xml` is now excluded from the image path too (it can carry script, and the data-URI allowlist already refused it, so inlining only ever produced a stuck placeholder). `/api/v1/files/{id}` is permission-checked, so the source is fetched through the same cert-pinned proxy with the session bearer token images use, then handed over as a `blob:` URL rather than the image path's base64 data URI, which would inflate a 50 MB video into a string and cache it in IndexedDB.
+- **DONE (2026-08-01)** — Read-state polish. A red **NEW** divider marks the first unread message when a channel is opened with unread; because opening clears the badge, `setActiveChannel` snapshots the count first (`getUnreadOnOpen`) and the list places the line above the last *N* loaded messages — suppressed while the window is detached (a slice around an old message is not the tail) and gone on the next visit. Explicit mark-as-read arrived as a new client→server WS message `mark_read`: `channel_focus` already advances read state but also rebinds the connection's focused channel, which is wrong when marking a channel the user is not looking at. It backs **Mark as Read** in the channel context menu (disabled when already read, absent for voice) and **Mark All as Read** on the sidebar's server header, which only appears while something is unread. DM sidebar rows now show real unread counts and a red mention count that outranks them; `GetChannelUnreadCounts` includes the caller's DM rows so `ready` ships a DM `mention_count` — previously absent, which silently reset every DM mention badge on reconnect.
+
+## Phase 5 — roles & channels management
+
+- **DONE (2026-08-01)** — Role CRUD. Roles were four seeded rows whose permission masks were frozen at migration time; they are now real entities behind `/admin/api/roles` (`GET`, `POST`, `PATCH /{id}`, `DELETE /{id}`, `PATCH /roles/reorder`), gated on `MANAGE_ROLES` with the whole rule set in a new `service.RoleService` rather than in the handlers. Every rule is measured against the **actor's** role position: you may only create/edit/delete/reorder roles strictly *below* your own (equality is refused too, so a role cannot rewrite itself, and nothing outranks position 100 — which is what makes the seeded Owner role immutable and undeletable for everyone including the owner), and you may never *grant* a bit your own role lacks, though removing one is allowed because de-escalation is always safe (`ADMINISTRATOR` bypasses). The default role is undeletable — every member falls back to it — and deleting a role moves its members onto that fallback in one `UPDATE`, drops the role's `channel_overrides` rows and deletes the role in a single writer transaction, then invalidates exactly the moved members' cached permissions. Names are unique **case-insensitively** (migration `023` adds `idx_roles_name_nocase`; the column's own `UNIQUE` is BINARY, so "Moderator" and "moderator" used to be two roles the client's case-insensitive lookup could not tell apart), colors are `#rgb`/`#rrggbb` normalized to uppercase, and unknown permission bits are masked off rather than rejected. Reorder takes an ordered id list that must name exactly the roles below the actor — a partial list is refused rather than leaving the omitted ones at positions that now collide — and normalizes them to `N…1`. Every mutation audits (`role_create`/`role_update`/`role_delete`/`role_reorder`).
+  Cache and client sync follow the existing patterns rather than inventing one: the permission cache is invalidated *before* the hub calls (as the channel-override handlers do), a permission change runs the new `Hub.RefreshAllChannelVisibility` — `RefreshChannelVisibility` across every non-DM channel, because a role's mask is the base every channel's effective permission derives from, where an override edit touches exactly one — and a delete additionally sends one `member_update` per reassigned member. A new `roles_update` server→client message (schema + `make protocol-generate` + `docs/protocol.md`) carries the **full** new list, so clients refresh `channelsStore.roles` without reconnecting; replacing rather than patching means a dropped intermediate event can never leave a deleted role on screen. The member list now subscribes to that list too — grouping, labels and name colors all derive from it, and before this they only re-rendered when some unrelated member change happened along. The admin panel grows a Roles section (nav gated on `MANAGE_ROLES`) listing roles by position with a color swatch and member count, up/down reorder arrows scoped to the manageable slice, a create/edit modal with a permission checkbox grid grouped as `docs/schema.md` groups the bitfield — bits the caller's own role lacks are rendered disabled — and a delete confirmation that names how many members move and where. Hoist and mentionable are still out of scope: neither has a column, and role mentions need the mention resolver to learn about roles.
+- Role CRUD leftovers: hoist and mentionable flags (no columns yet), role mentions (`@RoleName`).
+- **DONE (2026-08-01)** — Per-user channel overrides + the full override matrix UI. New table `channel_user_overrides` (migration `024`, PK `(channel_id, user_id)` plus `idx_channel_user_overrides_user` for the per-user direction) makes the resolution order Discord's: **base role permissions → role override → user override**, with the narrower layer last, so a user deny beats a role allow and a user allow beats a user deny; `ADMINISTRATOR` still bypasses both. The formula has exactly one implementation, `permissions.EffectiveChannelPerms`, which `Checker.HasChannelPerm`, `Checker.HasChannelPermBatch` and through it `VisibleChannelIDs` all route through — so extending the order was a change to one function plus the fetch, not to the dozens of `HasChannelPerm` call sites. `HasChannelPerm` grew a `userID` parameter (`0` = "no member in hand", skip the user layer), and both layers are loaded together by `db.GetChannelOverridesFor(roleID, userID)` — two batch queries, never per channel — which is now the single fetch behind `buildReady`, `computeAllowedChannels`, REST `ListVisibleChannels`, `MessageService.GetAccessibleChannelIDs`, the voice-join publish grants and the cached `service.PermissionService`. `channelCanSend` resolves both layers too, and the `@everyone` fan-out (`mentionReaders`) folds the user layer in *both* directions: a user deny drops a reader the role walk admitted (unless they hold `ADMINISTRATOR`), a user allow adds one it excluded. `Hub.RefreshChannelVisibility` and `channelReadAudience` stopped memoising visibility per role — two members of one role can now legitimately disagree about a channel, which is exactly what a per-user override edit creates. `Server/ws/channel_visibility_agreement_test.go` grew a second case proving REST, `ready` and replay filtering still agree for three members of the *same* role carrying different overrides.
+  API: `PUT`/`DELETE /admin/api/channels/{id}/user-permissions/{userId}` with `{allow, deny}` masks, gated `MANAGE_CHANNELS` like the role layer, unknown bits masked off, audited as `channel_user_perms_update`/`channel_user_perms_clear`. They invalidate only the **target's** cache (`InvalidateUser`) rather than the whole cache the role layer must drop — a per-user override cannot change anyone else's verdict — before the hub re-sync. `GET .../permissions` now returns `users` alongside `roles`: every role (zero masks when unset) but only the members who actually carry an override row. The admin panel's single "Can access" checkbox survives as the quick private-channel shortcut, writing exactly the mask it always did, and gained a real matrix editor beneath it: pick a role **or** a member, then set allow / inherit / deny per channel-scoped bit (READ, SEND, ATTACH_FILES, ADD_REACTIONS, MANAGE_MESSAGES, MENTION_EVERYONE, CONNECT, SPEAK, VIDEO, SHARE_SCREEN). An all-inherit row is sent as a `DELETE`, because storing `(0,0)` would leave a row that resolves to nothing. `perm_grid_test.go` ties the matrix's bit list to `permissions` the same way it already tied the role grid.
+- **DONE (2026-08-01)** — Categories stopped being magic strings. The server refused any non-voice channel under a category literally named "Voice Channels" and any voice channel outside it (`validateCategoryType`), and the client mirrored the rule with a substring test on the category name. Both are gone: `POST /admin/api/channels` validates the **type** alone, categories are free text, and any type lives under any name. `PATCH /admin/api/channels/{id}` accepts `category`, so moving a channel between categories is an edit rather than a delete-and-recreate. The desktop `CreateChannelModal`'s read-only category display became an editable text input with a `<datalist>` of the categories in use (`channelsStore.getKnownCategories`), offering all three types; `EditChannelModal` gained the same field; the admin panel's create and edit forms got the same input plus datalist. The sidebar groups voice channels under whatever category they carry — sharing a group with text channels is fine — and falls back to a synthetic "Voice" group only for voice channels with no category at all (`displayCategoryOf`). Collapse persistence stays client-side, unchanged.
+- Categories as real entities (own permissions, ordering).
+- **DONE (2026-08-01)** — Channel management moved into the desktop client. `EditChannelModal` offered name, topic and category; it now also carries **slow mode** (a preset `<select>` from Off to the server's 6-hour ceiling — a free number field mostly produces typos like "300" meant as minutes, and a stored off-preset value set through the admin panel is kept as its own option rather than silently rounded), an **NSFW** toggle, and a **voice section** (User Limit / Video Limit, 0–99, 0 = unlimited) rendered for voice channels alone — the columns exist on every row, but on a text channel they are values nothing reads, so a text-channel edit omits the keys entirely rather than sending `0` and wiping limits the row happens to hold. Every control pre-fills from `channelsStore` (which `channel_update` writes into), not from the sidebar row, so the modal opens on current values. `PATCH /admin/api/channels/{id}` and `db.AdminUpdateChannel` grew `nsfw`, `voice_max_users` and `voice_max_video`; the positional argument list became `db.ChannelUpdate` once it reached nine fields, four of them ints. Bounds (`slow_mode` 0…21600, both voice limits 0…99) are validated *before* the write and refused with `400 INVALID_INPUT` rather than clamped — a caller that sent `-1` meant something — so a rejected body writes nothing at all. The whole UI is gated on **MANAGE_CHANNELS**, not on role names: `permissions.canManageChannels()` is now the single derivation behind the category "+" and the context menu's Edit/Delete, which were still asking whether the role was literally called "owner" or "admin" (a custom role the server would happily let edit a channel saw no way to, and a role merely *called* "admin" with no channel bit saw items every click would be refused for). `channel_create`/`channel_update` and `ready` all carry `slow_mode`, `nsfw` and both voice limits — always present with their zero values, never omitted, so "absent" never means two things — built by one `channelPayloadFrom` constructor so the two events cannot drift. The store applies a partial `channel_update` field by field (an absent key is left alone, not cleared) and finally handles `category`, so a category move regroups the sidebar without a reconnect.
+- **DONE (2026-08-01)** — NSFW flag end-to-end, and the voice limits surfaced. Migration `025` adds `channels.nsfw` (0/1, like `archived`). **The server does nothing with it** and says so in `schema.md`, `api.md`, `protocol.md` and the migration itself: it stores, broadcasts and audits the flag (`updated #foo (marked NSFW)` / `(unmarked NSFW)`, plain when it did not move) and applies no filtering, no age check and no restriction on who may read or post — a client ignoring the field behaves exactly as before it existed. Every consequence is the desktop client's: `@lib/nsfw-gate` remembers acknowledgement per channel in **sessionStorage** (the promise is "once per session", so localStorage would quietly make it "once ever"; a throwing storage reads as *not* acknowledged, erring toward asking again), and `NsfwGate` mounts over the messages slot — not as a modal, since the channel is live underneath and the sidebar stays usable — with "This channel may contain sensitive content — Continue?", a note stating plainly that nothing is filtered, and a Go Back that leaves the channel rather than stranding the reader. The sidebar marks flagged channels with a shield beside the name (not a recolour: unread/mention/active already own the row's colour). Voice limits: the row shows "3/5" when a user limit is set and nothing when unlimited ("3/0" would read as a bug), and the client still never pre-blocks a join — its participant list can lag and an invented refusal would be uncorrectable, so the server answers `CHANNEL_FULL`, which the dispatcher now surfaces as a toast (it was logged and otherwise silent, as was `VIDEO_LIMIT`).
+- **DONE (2026-08-01)** — The audit log stays admin-panel-only — it is a paginated, filterable table over an endpoint the desktop client otherwise never calls, and a second implementation would be a second thing to keep correct — but it stopped being unreachable. The sidebar's server header grows an "Audit Log" entry gated on `VIEW_AUDIT_LOG` (kept in sync with `authStore` *and* the role list, because `ready` can land after the header is built), opening `https://{host}/admin#audit` in the user's browser via the opener plugin. Deliberately not through the loopback TOFU proxy the REST client uses: that origin means nothing to an external browser, so a self-signed deployment shows the browser's certificate warning, which is the honest outcome. The admin panel learned to honour a `#section` fragment on load (falling back to the dashboard when the principal may not open it, exactly as a stale stored section does), so the entry lands on the log rather than on the dashboard with a tab still to find.
+
+## Phase 6 — social & profiles
+
+- **DONE (2026-08-01)** — Custom emoji end-to-end. The `emoji` table had shipped in migration `001` with zero server code, and the client carried `getEmoji`/`deleteEmoji` methods aimed at routes nobody had registered plus an `EmojiPicker` option nothing ever passed; all three are now real. Server: `GET /api/v1/emoji` (open to any member — an emoji nobody can render is not an emoji, and the set is server-wide with no per-channel scope to leak), `POST /api/v1/emoji` and `DELETE /api/v1/emoji/{id}` gated on **MANAGE_SERVER**. No new permission bit was added, and that is the decision rather than an omission: a bit is a schema-visible, forever choice, and "who may change server-wide branding" is exactly what MANAGE_SERVER already answers for the server name, icon and settings. The gate runs _before_ the multipart body is read, so a member without it never causes a spool to disk. Uploads are capped at 512 KiB, sniffed from their own bytes (`image/png|jpeg|gif|webp` only — SVG is refused outright: it is markup with script and external-fetch capability, and an emoji is by definition rendered inline), and re-measured from the sniffed image against a 128×128 ceiling; WebP headers are parsed by hand (`webpDimensions`, all three of VP8/VP8L/VP8X) because the standard library has no WebP decoder and none was vendored for a dimension read. Shortcodes are `[a-z0-9_]{2,32}`, lowercased on the way in — which is what makes the table's plain `UNIQUE` index a case-insensitive one without a `COLLATE` change — with a collision answering `409 CONFLICT` and a 200-emoji cap per server. Bytes go through the existing storage layer under a UUID; migration `026` adds the one column the table lacked, `mime_type`, so `GET /api/v1/emoji/{id}/image` can set a Content-Type without re-sniffing the file on every request. That route is authenticated (an emoji must not be usable as an unauthenticated tracking pixel) but has no per-channel ACL to apply, and is `immutable`-cacheable because an emoji's bytes never change for a given id. A failed insert unlinks the orphaned file; a failed unlink after a successful delete is logged rather than failing the delete.
+  New `emoji_update` server→client message (schema + `make protocol-generate` + `docs/protocol.md`) carries the **whole** set after every mutation, for the same reason `roles_update` does: replacing rather than patching means a dropped event can never leave a deleted emoji rendering in the messages that name it. It is deliberately _not_ in the `ready` payload — the set belongs to the server, not the session, so clients load it once over REST on ready and keep it fresh from the event. Client: a new `emojiStore` whose `resolveEmoji` is the single answer to "is `:name:` a real emoji here", consulted by message rendering, the picker, the composer autocomplete and reaction pills so none of them can disagree. `:shortcode:` renders as a 22px inline image — jumbo 48px when the message is nothing but emoji (unicode included, capped at Discord's 27, and an _unresolved_ shortcode is plain text so it never earns jumbo) — via a `.msg-text-jumbo` class that sizes glyphs and images together rather than threading a flag through four render functions. It is added in the same token pass as `@mentions` and `#channels`, so code spans and fenced blocks are excluded for free: inline code never reaches the token pass, and fences are split off before it. Images are fetched through the same cert-pinned, bearer-token path attachments use and swapped in as a data URI — assigning the server URL to `img.src` would 401 — with the shortcode as `alt`, so a message reads correctly before (and if) the bytes arrive. Reactions are free-form strings already, so a custom reaction is stored as the literal `:shortcode:` and the pill renders the image when it resolves and the text when it does not (a deleted emoji leaves a working, if plain, reaction). The reaction length cap stopped being a bare `32` and is now derived as `MaxShortcodeLen + 2`: a 31- or 32-character shortcode was a legal emoji that rendered in messages and was silently refused as a reaction, which is exactly the kind of gap a hardcoded constant on each side produces. The composer's picker finally gets its `customEmoji` option, showing a **Server** category that inserts `:shortcode:`, and gained a `:`-autocomplete mirroring the `@`-mention one — colon plus 2+ characters, custom emoji ranked above the built-in unicode set, only one popup open at a time. The admin panel grows an Emoji section (nav gated on `MANAGE_SERVER`) with upload, list and delete; it calls the ordinary member API rather than a duplicate `/admin/api` handler set, and loads thumbnails as blob URLs because `<img src>` cannot send an Authorization header (the panel's CSP gained `img-src 'self' blob:` for exactly that).
+- **DONE (2026-08-01)** — Profiles & presence depth: avatar upload, display names, about-me, custom status, real invisible, auto-idle. Migration `027` adds `users.display_name` (32), `about` (300) and `custom_status` (128) — all nullable, all bounded and HTML-sanitized in `UserService`/`ChannelService` rather than in a handler, so every transport gets the same rules and "omitted = unchanged, empty string = cleared" is one decision rather than four. `display_name` is display-only on purpose: `@mentions` keep resolving against `username`, because it is the unique case-insensitive key and a non-unique nickname would make `@alice` ambiguous the moment two people pick the same one.
+  `POST /api/v1/users/me/avatar` takes a multipart PNG/JPEG/WebP (1 MiB, 1024×1024, both re-measured from the sniffed bytes; GIF is refused because an animated avatar renders in every message row, SVG for the reason emoji refuse it). The bytes land in the ordinary attachments table with no channel and `users.avatar` is pointed at `/api/v1/files/{id}` — which is what makes the picture readable: an unlinked attachment is uploader-only, and the file route now _also_ admits one that some user's avatar column currently equals (covered by a partial index added in the same migration). An avatar is public exactly while it is somebody's avatar and stops being readable the instant it is replaced; the previous file's bytes are deliberately left on disk, since a blind delete would race any request already in flight for a message rendered with it. `PATCH /users/me` still takes an https URL, and both paths end at the same column.
+  **Real invisible** is the load-bearing change. `users.status` stores the status the user _chose_, invisible included; the collapse to `offline` happens at read time in exactly two functions (`db.BroadcastStatus`, `db.StatusForViewer`) that every payload builder delegates to, so a new payload cannot leak it by forgetting. A presence change to invisible splits into two events — a global broadcast excluding the owner that says `offline`, and a targeted one carrying their true state — because a client told it was offline would render its own picker wrong and re-announce online on the next reconnect. That reconnect flash is gone at the source too: `ws serve` no longer stamps `online` on connect, it reads the saved status (`db.ConnectStatus`: idle/dnd/invisible survive, anything else becomes online) and announces _that_, before `buildReady` runs so the member list and the broadcast cannot disagree. A chosen status now survives a disconnect (`MarkUserDisconnected` clears only `online`) and a restart, and the stale-choice problem that would otherwise create is handled at read time: a member with no live connection renders offline whatever the column says. The client's `restoreSavedPresence` shrank to a no-op safeguard that only speaks up when the server genuinely disagrees. The one place that read the column as a *value* rather than through the two collapse functions was the `@here` fan-out, which tested `status == "offline"` literally and so would have pinged exactly the people who had asked not to be seen; it now collapses through `db.BroadcastStatus` first, so `@here` skips invisible readers and `@everyone` still reaches them.
+  Custom status rides the presence payload rather than getting its own message: `presence_update` takes an optional `custom_status` where **omitted means "leave it alone"** and `""` clears — a distinction that exists because the auto-idle timer sends a bare status flip several times an hour and must not blank the text the user typed. It persists across reconnects and is cleared on logout (a "what I am doing right now" note that outlives the session states something no longer true, unlike the status itself, which is a preference).
+  **Auto-idle** is client-side (`@lib/autoIdle`): ten quiet minutes → idle, any input → online, input listening throttled to 1 Hz because mousemove fires hundreds of times a second against a timer measured in minutes. Its whole safety property is one function, `nextAutoStatus`: only a _manual_ Online becomes an automatic Idle, and only an _automatic_ Idle goes back to Online — a manually chosen Idle is a statement, and dnd/invisible are never touched in either direction. That needed `userStatus` to record who chose the status ("auto" vs "manual"), which is also what lets a stored pre-phase-6 `"offline"` be migrated to `invisible` on read.
+  Client: a shared `@lib/avatar` helper is now the single answer to "how do I draw this user" — message rows, the reply preview, the member list, the user bar, the profile popup and the account card all went through it, and it fetches the authenticated file through the same cert-pinned bearer-token path attachments and emoji use (an `<img src>` cannot carry an Authorization header, so the URL would 401) while keeping the letter as the fallback until and unless the bytes arrive. Display names render everywhere with a username fallback, resolved from the _member store_ first so a rename patches messages already on screen; the popup shows the `@handle` underneath so the thing you would actually type is still one glance away. The `about` section the popup has rendered since the quick-wins phase finally has real data behind it. The Account tab grew an avatar uploader (client-side type/size/dimension check mirroring the server's, so a refusal costs no upload) plus display-name and about fields, and the StatusPicker gained a custom-status input and sends `invisible` as its own value.
+- **DONE (2026-08-01)** — Group DMs. `dm_participants` always held N rows per channel; what was missing was a create path, a way to tell a group from a two-person DM, and a client that did not assume one recipient. Server: `POST /api/v1/dms/group` (2–8 others, 3–10 total), `PATCH /api/v1/dms/{id}` to set or clear the name (any participant may — a group DM has no owner column and no roles, so that is the only rule that does not require inventing an ownership model; a 1:1 refuses, since its name is who is in it), and `DELETE /api/v1/dms/{id}` which is now two operations behind one gesture: a _hide_ for a 1:1 (unchanged) and a **leave** for a group, deleting the channel when the last participant goes.
+  Migration `028` adds `channels.is_group`, and that column rather than a participant count is the load-bearing decision. A group of three that two people leave has two participants, and the 1:1 lookup — "the dm channel both of these users are in" — would then match it, so "message Bob" would silently deliver into the remnants of a group in front of whoever was still there. The same count would also make leaving destructive for the third-from-last leaver and non-destructive for the second-from-last. Group-ness is therefore decided once at creation and never recomputed.
+  `db.DMChannelInfo` grew `recipients`, `name` and `is_group`, and `recipient` stayed as the first of `recipients` so a pre-group client still renders somebody; `db.NewDMChannelInfo` is the single place that answers "which of these is the recipient", so `GET /dms`, the `ready` payload and `dm_channel_open` cannot disagree about a channel. `dm_channel_open` is now built **per viewer** — `recipient` and `recipients` are defined relative to who is reading, so one shared payload would list a group member as their own DM partner. `GetUserDMChannels` became two queries (channel rows + every participant of every open DM) rather than one, because a single joined query returns one row per (channel, participant) pair and the caller has to de-duplicate anyway.
+  **Blocks are a 1:1 rule**, which is Discord's semantics and the only coherent one for a shared room: `requireDMNotBlocked` exempts groups, because dropping one member's messages for one other member would leave the two of them reading different conversations under the same name. They are enforced at _creation_ instead — a user may neither add someone they have blocked nor add someone who has blocked them — where "may these two be in a room together" still has one answer. The client's composer gate follows the same line and applies to 1:1 DMs alone.
+  Message/typing/read fan-out already went through `dm_participants` and needed no change; the tests pin that it genuinely reaches the third member. Voice in a group DM works through the existing participant check (`hasChannelAccess` → `IsDMParticipant`), also unchanged. Client: DM rows are keyed on the **channel**, not the recipient — a group has no single recipient, and the same person can be in both a 1:1 and a group with you — with stacked avatars, a participant count, and `dmDisplayName` as the one answer to "what is this conversation called" (a group's name, else its members joined and capped at three plus a count, else the other person). The New DM picker became multi-select with one button relabelled by the selection size, because "new conversation" is one intent and making the user pick "DM" or "group" before choosing who is in it asks them to declare it twice.
+- **DONE (2026-08-01)** — DM calls with ringing. New `call_ring`/`call_decline` (client→server) and `call_incoming`/`call_declined` (server→client) via the schema + `make protocol-generate`. **No new DB state**: a call in a DM _is_ presence in that DM's voice channel, which `voice_state` already broadcasts, and ringing is transient signalling on top. A persisted call row would be one more thing a crashed client can leave dangling in exchange for information the presence already carries. `call_ring` is participant-gated and rate limited to one every 3 seconds per _user_ (not per channel — the abuse is spamming somebody with banners); the fan-out reaches whichever participants are connected, since a targeted event to an offline user is a no-op by construction and a ring that arrives after the fact is worse than no ring. `call_decline` is addressed to all other participants rather than "the ringer", because with no call state the server does not know who that was, and in a group more than one person may be ringing.
+  Client: the DM header gained a Call button that **joins the voice channel before ringing** — the ring is only truthful once the caller is actually there. Incoming calls draw a banner (not a modal: a ring is an offer, and blocking the app until a 30s timer expires is not one) with Accept/Decline and a repeating chime. The whole lifetime is a statechart in `@lib/call-ring` with no DOM in it — accept, decline, 30s timeout, `call_declined`, and the ringer's `voice_leave` all exit through one `stopRinging`, so there is exactly one place that can leave the chime playing. A timeout deliberately sends no decline: it means "nobody was there", and claiming a refusal that did not happen would be a lie to the ringer.
+- **DONE (2026-08-01)** — Friends list: the dead nav item is **removed**, which is the option this plan already listed. It was a row in the DM sidebar whose `onFriendsClick` no call site ever passed and whose `friendsActive` no call site ever set; building a friends list behind it would have meant a follow/request model, a table, and a second notion of "who can DM whom" alongside blocks. The item, both dead props and its CSS are gone, and a test pins the deletion.
+- **DONE (2026-08-01)** — Per-channel notification mutes. Client-side prefs in `localStorage` (`@lib/channel-mutes`), because the server has no per-user channel settings table and "which of my devices bothers me" is a property of the device, not the account — the same reason `desktopNotifications` and `notificationSounds` live next to it. Discord's semantics exactly: a muted channel fires no desktop notification, no chime and no taskbar flash (a flashing taskbar is precisely the interruption the mute was asked for); its unread badge **still counts** but renders dimmed, because the channel has not stopped existing, it has stopped shouting; and **a message that mentions you still notifies and still shows the red mention badge**. That last rule is what makes a mute safe to use, and it lives in one function (`notificationAllowed`) so the popup, the chime and the flash cannot end up applying three slightly different copies of it. Channel and DM context menus gained Mute/Unmute (until turned off — a timed mute needs a stored expiry the client would have to sweep, to buy an affordance the user can reproduce by unmuting), and the Notifications tab lists what is muted with unmute buttons, including mutes that outlived their channel, since otherwise there is no way to clear them.
+
+## Absent wholesale (not planned here)
+
+Threads, forum/stage channels, webhooks, bot accounts, stickers, polls,
+message forwarding, TTS, soundboard (dead `sounds` table), priority speaker,
+streamer mode, video backgrounds, multi-guild, email/account recovery,
+slash commands (separate plan: `slash-commands.md`).
+
+## Known dead code to reconcile as phases land
+
+**Still dead after phase 6** (nothing in this plan reconciles them):
+
+- `sounds` table — the soundboard is absent wholesale, so the table has no
+  feature to belong to; it and the client's `getSounds`/`deleteSound`, which
+  still call unregistered routes, are the largest remaining piece.
+- `voice_speakers` reserved WS type (never sent).
+- `voice_config.bitrate` — sent to clients, never applied client-side.
+- PTT stub on macOS.
+
+**Came off the list:**
+
+- `read_states.mention_count` (phase 3) — now written, shipped in `ready` and
+  cleared by `channel_focus`.
+- The `emoji` table and the client's `getEmoji`/`deleteEmoji` (phase 6) — the
+  table is written by `/api/v1/emoji`, and the two dead methods were replaced
+  by `listEmoji`/`uploadEmoji`/`deleteEmoji` against the real routes.
+- `UserProfilePopup`'s `about` section (phase 6) — built, styled and tested
+  while every call site passed a hardcoded `null`; `users.about` now feeds it.
+- The DM sidebar's **Friends** nav item (phase 6) — *deleted rather than
+  implemented*. Its `onFriendsClick` was never passed by any call site and its
+  `friendsActive` was never set; giving it a destination would have meant a
+  follow/request model, a table and a second notion of "who may DM whom"
+  alongside blocks. The item, both dead props and its CSS are gone, and a test
+  pins the deletion.
diff --git a/docs/protocol-schema.json b/docs/protocol-schema.json
index 6ed92348..abfb5967 100644
--- a/docs/protocol-schema.json
+++ b/docs/protocol-schema.json
@@ -10,6 +10,7 @@
     { "wire": "reaction_remove", "go": "MsgTypeReactionRemove", "ts": "REACTION_REMOVE" },
     { "wire": "typing_start", "go": "MsgTypeTypingStart", "ts": "TYPING_START" },
     { "wire": "channel_focus", "go": "MsgTypeChannelFocus", "ts": "CHANNEL_FOCUS" },
+    { "wire": "mark_read", "go": "MsgTypeMarkRead", "ts": "MARK_READ" },
     { "wire": "presence_update", "go": "MsgTypePresenceUpdate", "ts": "PRESENCE_UPDATE" },
     { "wire": "voice_join", "go": "MsgTypeVoiceJoin", "ts": "VOICE_JOIN" },
     { "wire": "voice_leave", "go": "MsgTypeVoiceLeave", "ts": "VOICE_LEAVE" },
@@ -17,6 +18,10 @@
     { "wire": "voice_deafen", "go": "MsgTypeVoiceDeafen", "ts": "VOICE_DEAFEN" },
     { "wire": "voice_camera", "go": "MsgTypeVoiceCamera", "ts": "VOICE_CAMERA" },
     { "wire": "voice_screenshare", "go": "MsgTypeVoiceScreenshare", "ts": "VOICE_SCREENSHARE" },
+    { "wire": "voice_mod_mute", "go": "MsgTypeVoiceModMute", "ts": "VOICE_MOD_MUTE" },
+    { "wire": "voice_mod_deafen", "go": "MsgTypeVoiceModDeafen", "ts": "VOICE_MOD_DEAFEN" },
+    { "wire": "voice_mod_move", "go": "MsgTypeVoiceModMove", "ts": "VOICE_MOD_MOVE" },
+    { "wire": "voice_mod_kick", "go": "MsgTypeVoiceModKick", "ts": "VOICE_MOD_KICK" },
     { "wire": "ping", "go": "MsgTypePing", "ts": "PING" },
     {
       "wire": "voice_token_refresh",
@@ -25,7 +30,9 @@
       "go_trailing_comment": "//nolint:gosec // G101: false positive — message type constant, not a credential"
     },
     { "wire": "voice_e2ee_announce", "go": "MsgTypeVoiceE2EEAnnounce", "ts": "VOICE_E2EE_ANNOUNCE" },
-    { "wire": "voice_e2ee_offer", "go": "MsgTypeVoiceE2EEOffer", "ts": "VOICE_E2EE_OFFER" }
+    { "wire": "voice_e2ee_offer", "go": "MsgTypeVoiceE2EEOffer", "ts": "VOICE_E2EE_OFFER" },
+    { "wire": "call_ring", "go": "MsgTypeCallRing", "ts": "CALL_RING" },
+    { "wire": "call_decline", "go": "MsgTypeCallDecline", "ts": "CALL_DECLINE" }
   ],
   "server_to_client": [
     { "wire": "auth_ok", "go": "MsgTypeAuthOK", "ts": "AUTH_OK" },
@@ -35,6 +42,7 @@
     { "wire": "chat_send_ok", "go": "MsgTypeChatSendOK", "ts": "CHAT_SEND_OK" },
     { "wire": "chat_edited", "go": "MsgTypeChatEdited", "ts": "CHAT_EDITED" },
     { "wire": "chat_deleted", "go": "MsgTypeChatDeleted", "ts": "CHAT_DELETED" },
+    { "wire": "chat_bulk_deleted", "go": "MsgTypeChatBulkDeleted", "ts": "CHAT_BULK_DELETED" },
     { "wire": "reaction_update", "go": "MsgTypeReactionUpdate", "ts": "REACTION_UPDATE" },
     { "wire": "typing", "go": "MsgTypeTyping", "ts": "TYPING" },
     { "wire": "presence", "go": "MsgTypePresence", "ts": "PRESENCE" },
@@ -51,16 +59,22 @@
       "ts": "VOICE_LEAVE",
       "note": "broadcast (same string as client msg)"
     },
+    { "wire": "voice_moved", "go": "MsgTypeVoiceMoved", "ts": "VOICE_MOVED" },
+    { "wire": "voice_disconnected", "go": "MsgTypeVoiceDisconnected", "ts": "VOICE_DISCONNECTED" },
     { "wire": "member_join", "go": "MsgTypeMemberJoin", "ts": "MEMBER_JOIN" },
     { "wire": "member_leave", "go": "MsgTypeMemberLeave", "ts": "MEMBER_LEAVE" },
     { "wire": "member_update", "go": "MsgTypeMemberUpdate", "ts": "MEMBER_UPDATE" },
     { "wire": "user_update", "go": "MsgTypeUserUpdate", "ts": "USER_UPDATE" },
     { "wire": "member_ban", "go": "MsgTypeMemberBan", "ts": "MEMBER_BAN" },
+    { "wire": "roles_update", "go": "MsgTypeRolesUpdate", "ts": "ROLES_UPDATE" },
+    { "wire": "emoji_update", "go": "MsgTypeEmojiUpdate", "ts": "EMOJI_UPDATE" },
     { "wire": "server_restart", "go": "MsgTypeServerRestart", "ts": "SERVER_RESTART" },
     { "wire": "error", "go": "MsgTypeError", "ts": "ERROR" },
     { "wire": "pong", "go": "MsgTypePong", "ts": "PONG" },
     { "wire": "dm_channel_open", "go": "MsgTypeDMChannelOpen", "ts": "DM_CHANNEL_OPEN" },
     { "wire": "dm_channel_close", "go": "MsgTypeDMChannelClose", "ts": "DM_CHANNEL_CLOSE" },
+    { "wire": "call_incoming", "go": "MsgTypeCallIncoming", "ts": "CALL_INCOMING" },
+    { "wire": "call_declined", "go": "MsgTypeCallDeclined", "ts": "CALL_DECLINED" },
     {
       "wire": "voice_e2ee_announce",
       "go": "MsgTypeVoiceE2EEAnnounceBC",
diff --git a/docs/protocol.md b/docs/protocol.md
index 75629ce2..d5164a81 100644
--- a/docs/protocol.md
+++ b/docs/protocol.md
@@ -21,16 +21,17 @@ All client-server real-time communication happens over a single WebSocket connec
 9. [Reactions](#reactions)
 10. [Typing Indicators](#typing-indicators)
 11. [Presence](#presence)
-12. [Channel Focus](#channel-focus)
+12. [Channel Focus and Read State](#channel-focus-and-read-state)
 13. [Channel Updates](#channel-updates)
 14. [Member Updates](#member-updates)
 15. [Voice Signaling](#voice-signaling)
-16. [Voice End-to-End Encryption](#voice-end-to-end-encryption)
-17. [Direct Messages](#direct-messages)
-18. [Server Restart](#server-restart)
-19. [Error Handling](#error-handling)
-20. [Rate Limits](#rate-limits)
-21. [Message Type Reference Table](#message-type-reference-table)
+16. [Voice Moderation](#voice-moderation)
+17. [Voice End-to-End Encryption](#voice-end-to-end-encryption)
+18. [Direct Messages](#direct-messages)
+19. [Server Restart](#server-restart)
+20. [Error Handling](#error-handling)
+21. [Rate Limits](#rate-limits)
+22. [Message Type Reference Table](#message-type-reference-table)
 
 ---
 
@@ -91,10 +92,11 @@ The sequence number system enables reconnection with state recovery.
 
 | Category | Has seq? | Examples |
 |----------|----------|---------|
-| Channel broadcasts | Yes | `chat_message`, `chat_edited`, `chat_deleted`, `reaction_update` |
-| Global broadcasts | Yes | `presence`, `member_join`, `member_leave`, `member_update`, `member_ban`, `voice_state`, `voice_leave`, `channel_create`, `channel_update`, `channel_delete`, `server_restart` |
+| Channel broadcasts | Yes | `chat_message`, `chat_edited`, `chat_deleted`, `chat_bulk_deleted`, `reaction_update` |
+| Global broadcasts | Yes | `presence` (except the invisible split, see Presence), `member_join`, `member_leave`, `member_update`, `member_ban`, `roles_update`, `emoji_update`, `voice_state`, `voice_leave`, `channel_create`, `channel_update`, `channel_delete`, `server_restart` |
 | Ephemeral | No | `typing` |
 | DM messages | No | DM `chat_message`, `chat_edited`, `chat_deleted`, `reaction_update`, `dm_channel_open`, `dm_channel_close` |
+| Call signalling | No | `call_incoming`, `call_declined` |
 | Direct responses | No | `auth_ok`, `auth_error`, `chat_send_ok`, `error`, `voice_config`, `voice_token`, `pong` |
 
 ---
@@ -129,8 +131,12 @@ After the WebSocket connection is established, the client sends the first messag
     "user": {
       "id": 1,
       "username": "alex",
-      "avatar": "uuid.png",
-      "role": "admin"
+      "avatar": "/api/v1/files/5f2c...",
+      "role": "admin",
+      "display_name": "Alex A.",
+      "about": "A short bio.",
+      "custom_status": "shipping phase 6",
+      "status": "invisible"
     },
     "server_name": "My Server",
     "motd": "Welcome!",
@@ -139,6 +145,18 @@ After the WebSocket connection is established, the client sends the first messag
 }
 ```
 
+`display_name`, `about` and `custom_status` are the signed-in user's own
+profile fields, `null` when unset. `display_name` is what clients render
+instead of `username`; `@mentions` still resolve against `username`, which is
+the unique handle.
+
+`status` is the user's **own true status**, `"invisible"` included. Only this
+message and their own `ready` entry ever carry it — every other client is told
+`"offline"` for an invisible user (see Presence). The connection comes online
+as the status saved from the last session when that was `idle`, `dnd` or
+`invisible`, and as `online` otherwise; a client should not re-assert a status
+the server already agreed with.
+
 `replay_source` reports which replay tier served this (re)connection:
 `"none"` (fresh connection / full re-sync), `"buffer"` (in-memory ring
 buffer), or `"db"` (persistent `events` table). See
@@ -167,7 +185,7 @@ The server broadcasts to all connected clients:
 
 ```json
 { "type": "member_join", "payload": { "user": { "id": 1, "username": "alex", "avatar": "uuid.png", "role": "admin" } } }
-{ "type": "presence", "payload": { "user_id": 1, "status": "online" } }
+{ "type": "presence", "payload": { "user_id": 1, "status": "online", "custom_status": null } }
 ```
 
 ### Periodic Session Revalidation
@@ -242,13 +260,39 @@ Sent once after `auth_ok` (fresh connection or replay fallback).
 
 ### Payload Fields
 
-**channels[]:** `id`, `name`, `type` (`text`/`voice`/`announcement`), `category`, `position`, `unread_count` (text + announcement), `last_message_id` (text + announcement)
+**channels[]:** `id`, `name`, `type` (`text`/`voice`/`announcement`), `category`, `topic`, `position`, `can_send`, `slow_mode`, `nsfw`, `voice_max_users`, `voice_max_video`, `unread_count` (text + announcement), `last_message_id` (text + announcement), `mention_count` (text + announcement)
 
-**dm_channels[]:** `channel_id`, `recipient` (user object with `id`, `username`, `avatar`, `status`), `last_message_id`, `last_message`, `last_message_at`, `unread_count`
+`nsfw`, `voice_max_users` and `voice_max_video` are always present, with their
+zero values (`false`, `0`, `0`) on an unconfigured channel — never omitted, so
+"absent" never has to mean two different things. `nsfw` is a label the server
+never acts on (see below); the two voice limits are the values the voice-join
+path enforces with `CHANNEL_FULL` / `VIDEO_LIMIT`, shipped so a client can show
+"3/5" and explain a refusal it could have predicted.
 
-**members[]:** All registered users with `id`, `username`, `avatar`, `role` (lowercase name), `status`, `identity_public_key` (base64 long-term E2EE identity key, omitted when the user has not published one — see voice E2EE TOFU)
+`mention_count` is the number of unread messages that mention this user — a
+direct `@username` or an authorized `@everyone`/`@here` — in that channel. It is
+raised by the send that mentions them (never by an edit) and reset to 0 by
+`channel_focus` or `mark_read`.
 
-**voice_states[]:** All users currently in any voice channel: `channel_id`, `user_id`, `muted`, `deafened`
+**dm_channels[]:** `channel_id`, `recipient` (user object with `id`, `username`, `avatar`, `status`), `last_message_id`, `last_message`, `last_message_at`, `unread_count`, `mention_count`
+
+A DM's `mention_count` is the same `read_states.mention_count` the channel list
+carries. It used to be absent here, so a DM mention badge silently reset to 0 on
+every reconnect; the ready payload now ships the stored value.
+
+**members[]:** All registered users with `id`, `username`, `avatar`, `role` (lowercase name), `status`, `display_name` (`null` when unset — render it instead of `username`), `custom_status` (`null` when unset), `identity_public_key` (base64 long-term E2EE identity key, omitted when the user has not published one — see voice E2EE TOFU)
+
+`status` is per-viewer. Two rules apply, in this order, so a client never has
+to reconstruct them:
+
+1. A member with no live connection is `"offline"`, whatever status they last
+   chose — a chosen `idle`/`dnd`/`invisible` is preserved server-side across a
+   disconnect so the next connect can honour it, but it must not render as
+   "present" in the meantime.
+2. An `"invisible"` member is `"offline"` to everyone but themselves. The
+   viewer's own entry carries their true status.
+
+**voice_states[]:** All users currently in any voice channel: `channel_id`, `user_id`, `muted`, `deafened`, `server_muted`, `server_deafened`
 
 **roles[]:** All server roles with `id`, `name`, `color`, `permissions` (bitfield)
 
@@ -313,11 +357,25 @@ Direct response to sender (no seq):
     "timestamp": "2026-03-14T10:30:00Z",
     "attachments": [],
     "reactions": [],
-    "pinned": false
+    "pinned": false,
+    "mentions": [7, 9],
+    "mentions_everyone": true
   }
 }
 ```
 
+| Field | Type | Description |
+|-------|------|-------------|
+| `mentions` | number[] | User IDs the server resolved from `@username` tokens. Always present; empty when nothing resolved. |
+| `mentions_everyone` | bool | `true` when the message carried `@everyone` or `@here` **and** the author holds `MENTION_EVERYONE` on that channel. |
+
+Mentions are resolved server-side at send time against existing usernames
+(case-insensitive, whole-word, capped at 20 per message). An `@word` that
+matches no username, and an `@everyone`/`@here` from an author without
+`MENTION_EVERYONE`, resolve to nothing and stay plain text — clients must
+highlight from these fields rather than re-parsing the content. DMs never carry
+`mentions_everyone`.
+
 ### chat_edit (Client -> Server)
 
 ```json
@@ -343,11 +401,18 @@ Own messages only. Max 4000 runes.
     "message_id": 1042,
     "channel_id": 5,
     "content": "Hello everyone! (edited)",
-    "edited_at": "2026-03-14T10:31:00Z"
+    "edited_at": "2026-03-14T10:31:00Z",
+    "mentions": [7],
+    "mentions_everyone": false
   }
 }
 ```
 
+`mentions`/`mentions_everyone` are re-resolved from the edited content and
+replace the stored set. Editing never raises anyone's `mention_count`: a badge
+is only ever raised by the original send, so re-adding an already-counted
+mention cannot double-count it.
+
 ### chat_delete (Client -> Server)
 
 ```json
@@ -375,6 +440,25 @@ Moderators with `MANAGE_MESSAGES` can delete others' messages (non-DM channels o
 }
 ```
 
+### chat_bulk_deleted (Server -> Client, broadcast)
+
+Emitted by the REST bulk delete (`POST /api/v1/channels/{id}/messages/purge`,
+gated on `READ_MESSAGES|MANAGE_MESSAGES`, non-DM channels only) instead of one
+`chat_deleted` per message. `ids` is newest-first and never null; the deletes
+are soft, so clients mark each id as a tombstone exactly as they do for
+`chat_deleted`.
+
+```json
+{
+  "seq": 45,
+  "type": "chat_bulk_deleted",
+  "payload": {
+    "channel_id": 5,
+    "ids": [1042, 1041, 1040]
+  }
+}
+```
+
 ---
 
 ## Reactions
@@ -393,6 +477,13 @@ Moderators with `MANAGE_MESSAGES` can delete others' messages (non-DM channels o
 
 Rate limited at 5/sec. Requires `ADD_REACTIONS` permission (or DM participant).
 
+`emoji` is a free-form string, not a fixed enum: it is a unicode emoji, or the
+literal `:shortcode:` of a custom emoji (see api.md). It must be non-empty, at
+most **34 runes** — the longest custom shortcode (32) plus its two colons —
+carry no control characters, and survive the HTML sanitizer unchanged. A
+reaction whose `:shortcode:` no longer names an existing emoji stays a valid
+reaction and renders as its plain text.
+
 ### reaction_update (Server -> Client, broadcast)
 
 ```json
@@ -445,10 +536,26 @@ Typing broadcasts are ephemeral -- they are NOT stored in the replay ring buffer
 ### presence_update (Client -> Server)
 
 ```json
-{ "type": "presence_update", "payload": { "status": "online" } }
+{
+  "type": "presence_update",
+  "payload": { "status": "invisible", "custom_status": "heads down" }
+}
 ```
 
-Valid values: `"online"`, `"idle"`, `"dnd"`, `"offline"`. Rate limited: 1 per 10 seconds.
+Valid `status` values: `"online"`, `"idle"`, `"dnd"`, `"invisible"`.
+`"offline"` is still accepted from older clients (which used it to mean
+"appear offline") and is treated as the plain offline it says. Rate limited:
+1 per 10 seconds.
+
+`custom_status` is optional and max 128 characters, HTML-sanitized and trimmed
+server-side. **Omitting the field leaves the stored text alone**; sending `""`
+clears it. The distinction matters because a client's auto-idle timer sends a
+bare status flip several times an hour and must not blank the text the user
+typed.
+
+The chosen status is stored as chosen, `invisible` included, and persists
+across reconnects (see `auth_ok`). A custom status persists too, and is
+cleared on `POST /api/v1/auth/logout`.
 
 ### presence (Server -> Client, broadcast)
 
@@ -458,14 +565,26 @@ Valid values: `"online"`, `"idle"`, `"dnd"`, `"offline"`. Rate limited: 1 per 10
   "type": "presence",
   "payload": {
     "user_id": 1,
-    "status": "online"
+    "status": "online",
+    "custom_status": "shipping phase 6"
   }
 }
 ```
 
+`custom_status` is always present (`null` when unset), so "cleared it" is
+distinguishable from "this event does not mention it"; every presence
+broadcast carries the current value.
+
+**Invisible splits this message in two.** When a user's status is
+`"invisible"`, everyone else receives a broadcast that says `"offline"`, and
+the user themselves receives a separate, targeted `presence` carrying their
+true `"invisible"`. A client must therefore not assume it sees the same
+presence value for a user that everyone else does — and must not "correct" its
+own status back to online on the strength of a broadcast it did not receive.
+
 ---
 
-## Channel Focus
+## Channel Focus and Read State
 
 ### channel_focus (Client -> Server)
 
@@ -473,7 +592,26 @@ Valid values: `"online"`, `"idle"`, `"dnd"`, `"offline"`. Rate limited: 1 per 10
 { "type": "channel_focus", "payload": { "channel_id": 5 } }
 ```
 
-Tells the server which channel the user is currently viewing. Affects broadcast delivery and unread tracking.
+Tells the server which channel the user is currently viewing. Affects broadcast delivery and unread tracking: it advances the caller's read state to the channel's latest message and resets that channel's `mention_count` to 0.
+
+### mark_read (Client -> Server)
+
+```json
+{ "type": "mark_read", "payload": { "channel_id": 5 } }
+```
+
+Advances the caller's read state for `channel_id` to that channel's latest
+message and resets its `mention_count` to 0 — exactly what `channel_focus` does
+to unread state — **without** changing which channel the connection is focused
+on. This is what backs "Mark as Read" in the channel context menu and "Mark All
+as Read": marking a channel the user is *not* looking at must not rebind the
+connection's focused channel, which would misroute unread bookkeeping for the
+channel actually on screen.
+
+Same access check as `channel_focus`: `READ_MESSAGES` on the channel, or DM
+participation. A denied channel answers `FORBIDDEN`; a non-positive
+`channel_id` answers `BAD_REQUEST`. There is no response on success — the client
+clears its local badge optimistically and the next `ready` confirms.
 
 ---
 
@@ -493,14 +631,32 @@ All channel update messages are broadcast to all connected clients. Triggered by
     "type": "text",
     "category": "Hangout",
     "topic": "",
-    "position": 3
+    "position": 3,
+    "slow_mode": 0,
+    "nsfw": false,
+    "voice_max_users": 0,
+    "voice_max_video": 0
   }
 }
 ```
 
 ### channel_update (Server -> Client, broadcast)
 
-Full channel object (all fields).
+Full channel object — the same payload shape as `channel_create`, built by the
+same constructor so the two events can never disagree about which fields a
+client is told about. Sent on every admin `PATCH`, so a client applies channel
+edits (rename, topic, category move, slow mode, `nsfw`, voice limits) without
+reconnecting.
+
+`nsfw` is shipped so clients can gate or label a channel; **the server applies
+no content behaviour of its own to a flagged channel** — no filtering, no age
+check, no restriction on who may read or post. The desktop client shows a
+one-time-per-session warning before rendering the channel and marks it in the
+sidebar; a client that ignores the field behaves exactly as before it existed.
+
+Archiving or unarchiving additionally triggers targeted `channel_create` /
+`channel_delete` sends (`Hub.RefreshChannelVisibility`), because it changes who
+may see the channel rather than only how it looks.
 
 ### channel_delete (Server -> Client, broadcast)
 
@@ -532,14 +688,16 @@ Sent when a user first connects (fresh connection, not reconnect replay).
       "username": "newuser",
       "avatar": null,
       "role": "member",
+      "display_name": "New User",
       "identity_public_key": "base64-identity-pubkey"
     }
   }
 }
 ```
 
-`identity_public_key` is the user's long-term E2EE identity public key (see
-voice E2EE TOFU); omitted when the user has not published one.
+`display_name` is the nickname to render instead of `username`; omitted when
+unset. `identity_public_key` is the user's long-term E2EE identity public key
+(see voice E2EE TOFU); omitted when the user has not published one.
 
 ### member_update (Server -> Client, broadcast)
 
@@ -566,10 +724,69 @@ Triggered when an admin changes a user's role.
 }
 ```
 
+### roles_update (Server -> Client, broadcast)
+
+Sent to every connected client after any role mutation (create, edit, delete or
+reorder) through `/admin/api/roles`. The payload is the **whole** role list in
+the same shape and order the `ready` payload uses — position descending —
+rather than a delta: the client replaces `channelsStore.roles` wholesale, so a
+dropped intermediate event can never leave a deleted role on screen.
+
+```json
+{
+  "seq": 73,
+  "type": "roles_update",
+  "payload": {
+    "roles": [
+      { "id": 1, "name": "Owner", "color": "#E74C3C", "permissions": 2147483647, "position": 100, "is_default": false },
+      { "id": 4, "name": "Member", "color": null, "permissions": 1635, "position": 40, "is_default": true }
+    ]
+  }
+}
+```
+
+Unfiltered on purpose — the same list already ships in every client's `ready`
+payload, so it discloses nothing new. A role permission change that alters
+channel visibility is delivered separately, as targeted
+`channel_create`/`channel_delete` messages, and a role deletion additionally
+sends one `member_update` per reassigned member.
+
+### emoji_update (Server -> Client, broadcast)
+
+Sent to every connected client after a custom emoji is uploaded or deleted
+through `/api/v1/emoji`. Like `roles_update` this carries the **whole** set
+rather than a delta — the client replaces its shortcode map wholesale, so a
+dropped intermediate event can never leave a deleted emoji rendering in the
+messages that name it.
+
+```json
+{
+  "seq": 74,
+  "type": "emoji_update",
+  "payload": {
+    "emoji": [
+      { "id": 3, "shortcode": "wave", "url": "/api/v1/emoji/3/image" },
+      { "id": 7, "shortcode": "party_blob", "url": "/api/v1/emoji/7/image" }
+    ]
+  }
+}
+```
+
+`emoji` is always an array, `[]` when the last emoji was deleted. Shortcodes
+are lowercase and `[a-z0-9_]{2,32}`; `url` is a server-relative path that
+requires the session token (see api.md). Ordered by shortcode.
+
+Unfiltered on purpose, for the same reason `roles_update` is: emoji are
+server-wide with no channel scope, and every client may already `GET
+/api/v1/emoji` for the same list. The set is **not** in the `ready` payload —
+it changes rarely and belongs to the server, not the session, so clients load
+it once over REST and keep it fresh from this event.
+
 ### user_update (Server -> Client, broadcast)
 
 Broadcast when a user changes their own profile via `PATCH /api/v1/users/me`
-(username, avatar and/or identity key).
+or `POST /api/v1/users/me/avatar` (username, avatar, display name, about
+and/or identity key).
 
 ```json
 {
@@ -578,15 +795,21 @@ Broadcast when a user changes their own profile via `PATCH /api/v1/users/me`
   "payload": {
     "user_id": 5,
     "username": "newname",
-    "avatar": "uuid.png",
+    "avatar": "/api/v1/files/5f2c...",
+    "display_name": "New Name",
+    "about": "A short bio.",
     "identity_public_key": "base64-identity-pubkey"
   }
 }
 ```
 
-`avatar` may be `null` when unset. `identity_public_key` carries the user's
-current long-term E2EE identity key and is omitted when none is published;
-peers that pinned a different key must surface a TOFU mismatch.
+The payload is a full snapshot, not a delta: it **replaces** the client's copy
+of that user's profile. `avatar`, `display_name` and `about` are always present
+and may be `null` (unset/cleared) — a profile edit that removes a field has to
+be distinguishable from one that leaves it alone.
+`identity_public_key` carries the user's current long-term E2EE identity key
+and is omitted when none is published; peers that pinned a different key must
+surface a TOFU mismatch.
 
 ### member_leave (reserved)
 
@@ -696,11 +919,18 @@ already handle it. Reserved for active-speaker signaling.
     "deafened": false,
     "speaking": false,
     "camera": false,
-    "screenshare": false
+    "screenshare": false,
+    "server_muted": false,
+    "server_deafened": false
   }
 }
 ```
 
+`server_muted` / `server_deafened` are moderator-imposed (see [Voice
+Moderation](#voice-moderation)). `muted` / `deafened` are always set alongside
+them, so a client that ignores the two new fields still renders the user as
+silenced; they exist so the UI can show that the user may not lift it.
+
 ### voice_mute / voice_deafen (Client -> Server)
 
 ```json
@@ -708,6 +938,11 @@ already handle it. Reserved for active-speaker signaling.
 { "type": "voice_deafen", "payload": { "deafened": true } }
 ```
 
+Rate limited: 2/sec each. While the sender is `server_muted`, an unmute
+(`muted: false`) is refused with `SERVER_MUTED`; while `server_deafened`, an
+undeafen is refused with `SERVER_DEAFENED`. Muting or deafening oneself is
+always allowed.
+
 ### voice_camera (Client -> Server)
 
 ```json
@@ -734,6 +969,91 @@ Rate limited: 1 per 60 seconds. Must be in a voice channel.
 
 ---
 
+## Voice Moderation
+
+Four moderator commands act on another user's voice session. All four require
+`MUTE_MEMBERS` on the actor's role (`ADMINISTRATOR` bypasses the bit, never the
+hierarchy), the actor must strictly outrank the target by role position, and
+the target must currently be in a voice channel. Each is rate limited to 5/sec
+and written to the audit log (`voice_mod_mute`, `voice_mod_deafen`,
+`voice_mod_move`, `voice_mod_kick`, target type `user`).
+
+Failures: `FORBIDDEN` (missing bit, or target of equal/higher rank),
+`VOICE_ERROR` (target not in voice, not in the named channel, or not
+connected), `BAD_REQUEST` (self-target, non-voice destination),
+`NOT_FOUND` (unknown destination channel), `CHANNEL_FULL` (destination at
+capacity).
+
+### voice_mod_mute (Client -> Server)
+
+```json
+{ "type": "voice_mod_mute", "payload": { "channel_id": 10, "user_id": 7, "muted": true } }
+```
+
+`channel_id` is the channel the moderator believes the target is in; the action
+is refused when the target has since moved. Sets `server_muted` (and `muted`)
+and mutes the target's published audio track at the SFU, then broadcasts
+`voice_state`. Clearing it leaves `muted` as-is, so a user who was already
+self-muted stays muted until they unmute themselves.
+
+Server mute is scoped to the voice session: it survives a channel switch but
+not a leave and re-join, because the `voice_states` row is deleted on leave.
+
+### voice_mod_deafen (Client -> Server)
+
+```json
+{ "type": "voice_mod_deafen", "payload": { "channel_id": 10, "user_id": 7, "deafened": true } }
+```
+
+Sets `server_deafened` (and `deafened`) and broadcasts `voice_state`. Deafen has
+no SFU equivalent — it governs what the target plays back — so it is enforced by
+the target's client honoring the flag plus the server refusing their own
+undeafen. Deafening also applies a server mute, so a user who cannot hear the
+room cannot keep talking into it.
+
+### voice_mod_move (Client -> Server)
+
+```json
+{ "type": "voice_mod_move", "payload": { "user_id": 7, "to_channel_id": 12 } }
+```
+
+The destination is checked against the TARGET's `CONNECT_VOICE` (a move must not
+place someone where they could not go themselves) and against the destination's
+`voice_max_users`. The server then runs its voice-leave routine for the target —
+`voice_leave` is broadcast, the LiveKit participant is removed, the row deleted
+— and sends the target `voice_moved`. The target's client answers with an
+ordinary `voice_join` for the destination, so capacity, token minting and
+key-holder election keep their single implementation.
+
+### voice_moved (Server -> Client, direct)
+
+```json
+{ "type": "voice_moved", "payload": { "to_channel_id": 12 } }
+```
+
+Sent only to the moved user. The client tears down its LiveKit session and joins
+`to_channel_id`.
+
+### voice_mod_kick (Client -> Server)
+
+```json
+{ "type": "voice_mod_kick", "payload": { "user_id": 7 } }
+```
+
+Removes the target from the LiveKit room, deletes their `voice_states` row and
+broadcasts `voice_leave`, then sends them `voice_disconnected`.
+
+### voice_disconnected (Server -> Client, direct)
+
+```json
+{
+  "type": "voice_disconnected",
+  "payload": { "channel_id": 10, "reason": "You were disconnected from voice by a moderator" }
+}
+```
+
+---
+
 ## Voice End-to-End Encryption
 
 Voice/video media can be end-to-end encrypted. The server never holds the room
@@ -830,23 +1150,63 @@ Delivered only to `target_user_id`, with the sender attached:
 
 ### dm_channel_open (Server -> Client)
 
-Sent when a DM is opened, created, or auto-reopened by an incoming message.
+Sent when a DM is opened, created, auto-reopened by an incoming message, or has
+its membership changed (a group created, renamed, or left).
+
+The payload is the same shape as one entry of the `ready` payload's
+`dm_channels` and of `GET /api/v1/dms`, so a client has exactly one DM shape to
+parse. It is built **per viewer**: `recipient` and `recipients` are both defined
+relative to who is reading them, and the reader never appears in their own
+`recipients`.
 
 ```json
 {
   "type": "dm_channel_open",
   "payload": {
     "channel_id": 100,
+    "name": "Lunch crew",
+    "is_group": true,
     "recipient": {
       "id": 2,
       "username": "jordan",
-      "avatar": "uuid.png",
+      "display_name": "Jo",
+      "avatar": "/api/v1/files/uuid",
       "status": "online"
-    }
+    },
+    "recipients": [
+      {
+        "id": 2,
+        "username": "jordan",
+        "display_name": "Jo",
+        "avatar": "/api/v1/files/uuid",
+        "status": "online"
+      },
+      {
+        "id": 3,
+        "username": "sam",
+        "display_name": "",
+        "avatar": "",
+        "status": "idle"
+      }
+    ],
+    "last_message_id": null,
+    "last_message": "",
+    "last_message_at": "",
+    "unread_count": 0
   }
 }
 ```
 
+| Field        | Type   | Description                                                                                                                                                    |
+| ------------ | ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `recipient`  | object | The other participant of a 1:1 DM. **Backward compatibility only** — for a group it carries the first of `recipients` so a pre-group client renders something. |
+| `recipients` | array  | Every participant except the reader. The field group-aware clients read.                                                                                       |
+| `name`       | string | Optional group name. `""` for a 1:1 DM and for an unnamed group.                                                                                               |
+| `is_group`   | bool   | True for a group DM. Stored (`channels.is_group`), not derived from the live participant count — a group people have left stays a group.                       |
+
+`status` is viewer-adjusted: an `invisible` participant reads as `offline` to
+everyone but themselves.
+
 ### dm_channel_close (Server -> Client)
 
 ```json
@@ -856,9 +1216,81 @@ Sent when a DM is opened, created, or auto-reopened by an incoming message.
 }
 ```
 
+Sent to the caller of `DELETE /api/v1/dms/{id}`. For a group that is a _leave_,
+and the remaining participants receive a fresh `dm_channel_open` carrying the
+new membership.
+
 ### DM Authorization
 
-All handlers that touch a channel check the channel type and branch to participant-based authorization for DMs instead of role-based permissions. This applies to: `chat_send`, `chat_edit`, `chat_delete`, `reaction_add`/`remove`, `typing_start`, `channel_focus`.
+All handlers that touch a channel check the channel type and branch to participant-based authorization for DMs instead of role-based permissions. This applies to: `chat_send`, `chat_edit`, `chat_delete`, `reaction_add`/`remove`, `typing_start`, `channel_focus`, `mark_read`, `call_ring`, `call_decline`.
+
+Group DMs need no special case: `dm_participants` holds one row per
+participant, and every check is a lookup on `(user_id, channel_id)`.
+
+**Blocks are a 1:1 rule.** A block refuses DM creation and gates every
+interaction sink in a two-person DM, but is _not_ consulted inside a group: a
+group is a shared room, and dropping one member's messages for one other member
+would leave the two of them reading different conversations under the same
+name. Blocks are instead enforced when the group is created — a user may
+neither add someone they have blocked nor add someone who has blocked them.
+
+---
+
+## DM Calls
+
+A "call" in a DM is **not** a server-side object. It is somebody being present
+in that DM's voice channel — which `voice_state` already broadcasts — and
+ringing is transient signalling on top of it. There is no call id and no call
+record: a persisted call would be one more thing a crashed client can leave
+dangling, in exchange for information the presence already carries.
+
+### call_ring (Client -> Server)
+
+```json
+{
+  "type": "call_ring",
+  "payload": { "channel_id": 100 }
+}
+```
+
+Only a participant of the DM may ring it (`FORBIDDEN` otherwise). Rate limited
+to one ring every 3 seconds per user — per _user_, not per channel, because the
+abuse it prevents is spamming somebody with call banners.
+
+The client joins the DM's voice channel **before** ringing: the ring is only
+truthful once the caller is actually there.
+
+### call_incoming (Server -> Client)
+
+Forwarded to every other participant that is connected. An offline addressee is
+a no-op by construction — a ring that arrives after the fact is worse than no
+ring.
+
+```json
+{
+  "type": "call_incoming",
+  "payload": { "channel_id": 100, "from_user": 2, "username": "jordan" }
+}
+```
+
+### call_decline (Client -> Server) / call_declined (Server -> Client)
+
+```json
+{
+  "type": "call_decline",
+  "payload": { "channel_id": 100 }
+}
+```
+
+Answered with `call_declined` (same payload shape as `call_incoming`) to the
+DM's other participants. It is addressed to all of them rather than to "the
+ringer" because the server does not know who that was — no call state, by
+design — and in a group more than one person may be ringing.
+
+A declining client stops its own ring; a ringing client stops on
+`call_declined`, on the ringer's `voice_leave`, or after a 30 second timeout.
+A timeout deliberately sends **no** `call_decline`: it means "nobody was there",
+and the ringer's own 30s window already covers it.
 
 ---
 
@@ -912,6 +1344,8 @@ All handlers that touch a channel check the channel type and branch to participa
 | `UNKNOWN_TYPE` | Unrecognized message type |
 | `SLOW_MODE` | Channel has slow mode enabled |
 | `CONFLICT` | Duplicate reaction or constraint violation |
+| `SERVER_MUTED` | Self-unmute refused: a moderator imposed the mute |
+| `SERVER_DEAFENED` | Self-undeafen refused: a moderator imposed the deafen |
 
 After 10 consecutive invalid JSON messages, the connection is forcibly closed.
 
@@ -933,6 +1367,7 @@ All rate limits are enforced server-side using a token bucket rate limiter.
 | Voice screenshare | 2 | 1 second | `RATE_LIMITED` error |
 | Voice token refresh | 1 | 60 seconds | `RATE_LIMITED` error |
 | Voice E2EE announce/offer | 5 | 1 second | `RATE_LIMITED` error |
+| Voice moderation (mute/deafen/move/kick) | 5 | 1 second | `RATE_LIMITED` error |
 
 ---
 
@@ -943,7 +1378,7 @@ from which the Go and TypeScript constant files are generated
 (`make protocol-generate` / verified in CI by `make protocol-verify`). The
 tables below add per-type behavioral notes.
 
-### Client -> Server (19 types)
+### Client -> Server (24 types)
 
 | Type | Rate Limit | Notes |
 |------|-----------|-------|
@@ -955,19 +1390,24 @@ tables below add per-type behavioral notes.
 | `reaction_remove` | 5/sec | |
 | `typing_start` | 1/3sec/channel | Silently dropped |
 | `channel_focus` | None | Updates read state |
+| `mark_read` | None | Updates read state without moving focus |
 | `presence_update` | 1/10sec | |
 | `voice_join` | None | |
 | `voice_leave` | None | Empty payload |
-| `voice_mute` | None | |
-| `voice_deafen` | None | |
+| `voice_mute` | 2/sec | Refused with `SERVER_MUTED` while server muted |
+| `voice_deafen` | 2/sec | Refused with `SERVER_DEAFENED` while server deafened |
 | `voice_camera` | 2/sec | Requires USE_VIDEO |
 | `voice_screenshare` | 2/sec | Requires SHARE_SCREEN |
+| `voice_mod_mute` | 5/sec | Requires MUTE_MEMBERS + outranks target |
+| `voice_mod_deafen` | 5/sec | Requires MUTE_MEMBERS + outranks target |
+| `voice_mod_move` | 5/sec | Requires MUTE_MEMBERS + outranks target |
+| `voice_mod_kick` | 5/sec | Requires MUTE_MEMBERS + outranks target |
 | `voice_token_refresh` | 1/60sec | Must be in voice |
 | `voice_e2ee_announce` | 5/sec | ECDH pubkey announce |
 | `voice_e2ee_offer` | 5/sec | Wrapped room key to target |
 | `ping` | None | Heartbeat |
 
-### Server -> Client (30 types)
+### Server -> Client (33 types)
 
 | Type | Has seq? | Delivery |
 |------|----------|----------|
@@ -978,6 +1418,7 @@ tables below add per-type behavioral notes.
 | `chat_send_ok` | No | Direct to sender |
 | `chat_edited` | Non-DM only | Channel or DM participants |
 | `chat_deleted` | Non-DM only | Channel or DM participants |
+| `chat_bulk_deleted` | Yes | Channel |
 | `reaction_update` | Non-DM only | Channel or DM participants |
 | `typing` | No | Channel (excl. sender) or DM |
 | `presence` | Yes | All clients |
@@ -986,6 +1427,8 @@ tables below add per-type behavioral notes.
 | `channel_delete` | Yes | All clients |
 | `voice_state` | Yes | All clients |
 | `voice_leave` | Yes | All clients |
+| `voice_moved` | No | Direct to moved user |
+| `voice_disconnected` | No | Direct to disconnected user |
 | `voice_config` | No | Direct to joiner |
 | `voice_token` | No | Direct to joiner |
 | `voice_speakers` | No | Reserved — not currently emitted |
@@ -994,6 +1437,7 @@ tables below add per-type behavioral notes.
 | `member_update` | Yes | All clients |
 | `user_update` | Yes | All clients (profile changes) |
 | `member_ban` | Yes | All clients |
+| `roles_update` | Yes | All clients (full role list) |
 | `dm_channel_open` | No | Direct to participant |
 | `dm_channel_close` | No | Direct to participant |
 | `voice_e2ee_announce` | No | Voice channel (excl. sender) |
diff --git a/docs/schema.md b/docs/schema.md
index 8212df2f..be7d2df8 100644
--- a/docs/schema.md
+++ b/docs/schema.md
@@ -61,6 +61,16 @@ CREATE TABLE IF NOT EXISTS schema_versions (
 | `016_announcement_channel_type.sql` | Recreates the channel-type triggers to allow `announcement` |
 | `017_user_identity_key.sql` | Adds `users.identity_public_key` (long-term E2EE identity key for voice TOFU) |
 | `018_api_tokens.sql` | Adds `api_tokens` — long-lived, revocable bearer tokens for headless clients (bot/service auth) |
+| `019_perf_indexes.sql` | Adds hot-path indexes |
+| `020_drop_redundant_indexes.sql` | Drops indexes duplicating UNIQUE auto-indexes |
+| `021_voice_server_moderation.sql` | Adds `server_muted`, `server_deafened` to voice_states (moderator-imposed) |
+| `022_message_mentions.sql` | Adds `message_mentions` + `messages.mentions_everyone`, and grants `MENTION_EVERYONE` (bit 21) to the seeded Owner/Admin/Moderator roles |
+| `023_role_management.sql` | Adds `idx_roles_name_nocase` — role names become unique case-insensitively, matching how they are looked up |
+| `024_channel_user_overrides.sql` | Adds `channel_user_overrides` — per-member channel permission overrides, the last layer of the resolution order |
+| `025_channel_nsfw.sql` | Adds `channels.nsfw` — the age-gate flag the server stores and broadcasts but imposes no behaviour of its own on |
+| `026_emoji_mime.sql` | Adds `emoji.mime_type` — the sniffed image type, so the emoji image route can send a Content-Type without re-reading the file |
+| `027_user_profile_fields.sql` | Adds `users.display_name`, `users.about`, `users.custom_status`, and a partial index on `users(avatar)` for the file route's avatar-authorization probe |
+| `028_group_dms.sql` | Adds `channels.is_group` + a partial index — marks a DM channel as a group so group-ness survives people leaving |
 
 ---
 
@@ -81,7 +91,8 @@ CREATE TABLE roles (
 );
 ```
 
-**Default roles:**
+**Default roles** (seeded by migration `001`, but no longer fixed — see
+*Role semantics* below):
 
 | id | name | color | permissions | position | Notes |
 |----|------|-------|-------------|----------|-------|
@@ -90,6 +101,33 @@ CREATE TABLE roles (
 | 3 | Moderator | `#3498DB` | `0x000FFFFF` | 60 | All message + voice + moderation |
 | 4 | Member | NULL | `0x1E63` | 40 | Send, read, attach, react, voice, video, screen share |
 
+**Role semantics:**
+
+- **`name`** is unique case-insensitively. The column's own `UNIQUE` constraint
+  uses SQLite's default BINARY collation, so migration `023` adds
+  `idx_roles_name_nocase` (`UNIQUE … ON roles(name COLLATE NOCASE)`) —
+  otherwise "Moderator" and "moderator" would be two roles the client, which
+  resolves names case-insensitively, could not tell apart. Max 32 characters.
+- **`color`** is `#rgb` or `#rrggbb` (stored uppercase) or `NULL`. It is
+  rendered directly into a style attribute by the desktop client and the admin
+  panel, so no other form is accepted.
+- **`position`** is the hierarchy rank — higher outranks lower. Every
+  moderation and role-management check is "actor's position strictly greater
+  than the target's". Positions are not required to be contiguous, but
+  `PATCH /admin/api/roles/reorder` normalizes the roles below the actor to
+  `N…1`, which keeps them unique. Position `100`
+  (`permissions.OwnerRolePosition`) is the top: nothing outranks it, which is
+  what makes the seeded Owner role uneditable and undeletable.
+- **`is_default`** marks the single fallback role. New users are created on it
+  and members of a deleted role are moved onto it, so it cannot itself be
+  deleted. It is set by migration and is not writable through the API — which
+  role is the fallback is a schema decision, not an operator one.
+- Roles are created, edited, deleted and reordered through
+  `/admin/api/roles` (`MANAGE_ROLES` + hierarchy; see `docs/api.md`). Deleting
+  a role reassigns its members and drops its `channel_overrides` rows in one
+  transaction. `users.role_id` is a single role per user — there is no
+  many-to-many membership table.
+
 ---
 
 ### users
@@ -108,16 +146,48 @@ CREATE TABLE users (
     banned      INTEGER NOT NULL DEFAULT 0,
     ban_reason  TEXT,
     ban_expires TEXT,
-    identity_public_key TEXT
+    identity_public_key TEXT,
+    display_name  TEXT,
+    about         TEXT,
+    custom_status TEXT
 );
+
+CREATE INDEX idx_users_avatar ON users(avatar) WHERE avatar IS NOT NULL;
 ```
 
-Valid status values: `online`, `idle`, `dnd`, `offline`. All statuses are reset to `offline` on server startup.
+Valid status values: `online`, `idle`, `dnd`, `invisible`, `offline`.
+
+`status` holds the status the user **chose**, `invisible` included — it is
+deliberately not collapsed to `offline` at the write, because the server has to
+be able to tell "chose to appear offline" from "is not connected" on the next
+connect. The collapse happens at read time instead (`db.BroadcastStatus` /
+`StatusForViewer`): every payload another user can see maps `invisible` to
+`offline`, while the owner's own payloads keep the true value.
+
+A chosen `idle`/`dnd`/`invisible` therefore survives a disconnect (only
+`online` is cleared, by `MarkUserDisconnected`) and survives a server restart
+(`ResetAllUserStatuses` clears only `online`). It cannot render as "present" in
+the meantime because the ready payload treats a member with no live connection
+as `offline` regardless of the column.
 
 `identity_public_key` (added in migration 017) is the user's long-term E2EE
 identity public key (base64 ECDSA P-256) used for TOFU pinning of voice E2EE
 announces; `NULL` = not published (legacy client).
 
+`display_name`, `about` and `custom_status` (migration 027) are the profile
+fields, all `NULL` when unset. Bounds — 32, 300 and 128 characters
+respectively — are enforced in the service layer, where the HTML sanitizer runs
+and a violation can answer `400` instead of a constraint error. `display_name`
+is display only: `@mentions` resolve against `username`, which is the unique,
+case-insensitive key.
+
+`idx_users_avatar` covers the file route's authorization probe. An avatar
+uploaded through `POST /api/v1/users/me/avatar` is an attachment with no
+channel — private to its uploader by default — and `GET /api/v1/files/{id}`
+additionally admits one that some user's `avatar` currently equals, so an
+avatar is readable by every authenticated user for exactly as long as it is in
+use.
+
 ---
 
 ### sessions
@@ -179,7 +249,9 @@ CREATE TABLE channels (
     voice_max_users  INTEGER NOT NULL DEFAULT 0,
     voice_quality    TEXT,
     mixing_threshold INTEGER,
-    voice_max_video  INTEGER NOT NULL DEFAULT 25
+    voice_max_video  INTEGER NOT NULL DEFAULT 25,
+    nsfw             INTEGER NOT NULL DEFAULT 0,
+    is_group         INTEGER NOT NULL DEFAULT 0
 );
 ```
 
@@ -189,6 +261,40 @@ INSERT/UPDATE triggers restricting the value to this set (migration 016 added
 posting is restricted to users with `MANAGE_MESSAGES` (enforced in the service
 layer, `Server/service/message.go`).
 
+`nsfw` (migration 025) is the age-restriction flag, stored 0/1 like `archived`
+because SQLite has no boolean type. **It drives nothing server-side.** The
+server stores it, ships it in `ready` and in the `channel_create` /
+`channel_update` broadcasts, and audits an operator flipping it — it does not
+filter content, check anyone's age, or restrict who may read or post in a
+flagged channel. Clients decide what the flag means to them; the desktop client
+shows a one-time-per-session warning before rendering the channel and marks it
+in the sidebar.
+
+`voice_max_users` and `voice_max_video` (0 = unlimited) are the only channel
+columns that *are* enforced by the server, on voice join and on video publish
+respectively (`CHANNEL_FULL` / `VIDEO_LIMIT`). They exist on every row but are
+meaningless on a non-voice channel.
+
+`is_group` (migration 028) marks a `dm` channel as a group DM. It is decided
+once at creation and **never recomputed from the live participant count**,
+because that count changes underneath you:
+
+- A group of three that two people leave has two participants, and the 1:1
+  lookup — "the dm channel both of these users are in" — would then match it.
+  "Message Bob" would silently deliver into the remnants of a group, in front of
+  whoever else is still there.
+- Leaving is destructive for a group (removal from `dm_participants`) and
+  non-destructive for a 1:1 (hide only). Deriving which one to run from the live
+  count means the third-from-last leaver runs a different operation than the
+  second-from-last, for no reason the user can see.
+
+`name` carries the optional group name; it is `''` for every 1:1 DM (a
+two-person DM is named by who is in it) and for an unnamed group.
+
+`PATCH /admin/api/channels/{id}` (`MANAGE_CHANNELS`) is the write path for
+`slow_mode` (0…21600), `nsfw` and both voice limits (0…99 each); values outside
+those ranges are refused rather than clamped.
+
 ---
 
 ### channel_overrides
@@ -206,7 +312,38 @@ CREATE TABLE channel_overrides (
 );
 ```
 
-Effective permission calculation: `effective = (base_permissions & ~deny) | allow`
+Effective permission calculation for this layer:
+`effective = (base_permissions & ~deny) | allow`
+
+This is the ROLE layer. The per-member layer (`channel_user_overrides`) is
+applied on top of the result — see "Permission Checking Logic" below.
+
+---
+
+### channel_user_overrides
+
+Per-channel permission overrides for a single **member**, independent of their
+role. This is Discord's narrowest override layer: it grants or refuses one
+person a bit in one channel without minting a role for them.
+
+```sql
+CREATE TABLE channel_user_overrides (
+    channel_id INTEGER NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
+    user_id    INTEGER NOT NULL REFERENCES users(id)    ON DELETE CASCADE,
+    allow      INTEGER NOT NULL DEFAULT 0,
+    deny       INTEGER NOT NULL DEFAULT 0,
+    PRIMARY KEY (channel_id, user_id)
+);
+```
+
+The shape mirrors `channel_overrides` (allow/deny masks, cascade on both
+parents) so both layers are fetched and merged by the same code
+(`db.GetChannelOverridesFor`). The composite PRIMARY KEY replaces the surrogate
+`id` + `UNIQUE` pair `channel_overrides` carries — nothing references an
+override row by id.
+
+Only members who actually carry an override have a row: an all-inherit override
+is deleted rather than stored as `(0, 0)`.
 
 ---
 
@@ -222,12 +359,40 @@ CREATE TABLE messages (
     edited_at  TEXT,
     deleted    INTEGER NOT NULL DEFAULT 0,
     pinned     INTEGER NOT NULL DEFAULT 0,
-    timestamp  TEXT    NOT NULL DEFAULT (datetime('now'))
+    timestamp  TEXT    NOT NULL DEFAULT (datetime('now')),
+    mentions_everyone INTEGER NOT NULL DEFAULT 0
 );
 ```
 
 Messages are soft-deleted (`deleted = 1`), never physically removed by user action.
 
+`mentions_everyone` (migration 022) is set when the message carried `@everyone`
+or `@here` **and** the author held `MENTION_EVERYONE` on that channel. It is a
+column rather than a sentinel row in `message_mentions` so that table never
+holds a `mentioned_user_id` that is not a real user. The message row and its
+mention rows are written in one writer transaction, and an edit rewrites both.
+
+---
+
+### message_mentions
+
+```sql
+CREATE TABLE message_mentions (
+    message_id        INTEGER NOT NULL REFERENCES messages(id) ON DELETE CASCADE,
+    mentioned_user_id INTEGER NOT NULL REFERENCES users(id)    ON DELETE CASCADE,
+    PRIMARY KEY (message_id, mentioned_user_id)
+);
+
+CREATE INDEX idx_message_mentions_user ON message_mentions(mentioned_user_id);
+```
+
+The user IDs a message resolved from its `@username` tokens, capped at 20 rows
+per message. Resolution is case-insensitive whole-word matching against
+`users.username` (which is `UNIQUE COLLATE NOCASE`); a token that matches no
+username is not stored and stays plain text. The primary key serves the
+per-message lookup that message history and search batch on; the index serves
+the per-user direction.
+
 ---
 
 ### messages_fts (FTS5 Virtual Table)
@@ -315,6 +480,16 @@ CREATE TABLE read_states (
 );
 ```
 
+`mention_count` is incremented on message insert for every mentioned user who
+can read the channel, except the author and except users who have blocked the
+author. `@everyone` counts every reader; `@here` counts only readers whose
+*broadcast* status is not `offline` — the column stores the status the user
+chose, so a reader who picked `invisible` is collapsed to `offline` here and is
+skipped, exactly as they appear to everyone else. Edits never increment it — a badge is only
+raised by the original send, so an edit cannot double-count a mention. The
+`channel_focus` read-state upsert resets it to 0, and the `ready` payload ships
+it per channel.
+
 ---
 
 ### audit_log
@@ -346,10 +521,17 @@ CREATE TABLE voice_states (
     speaking    INTEGER NOT NULL DEFAULT 0,
     camera      INTEGER NOT NULL DEFAULT 0,
     screenshare INTEGER NOT NULL DEFAULT 0,
+    server_muted    INTEGER NOT NULL DEFAULT 0,
+    server_deafened INTEGER NOT NULL DEFAULT 0,
     joined_at   TEXT    NOT NULL DEFAULT (datetime('now'))
 );
 ```
 
+`server_muted` / `server_deafened` are moderator-imposed (`MUTE_MEMBERS`) and,
+unlike `muted` / `deafened`, the user cannot clear them. They survive a channel
+switch (the join upsert does not reset them) but not a leave, which deletes the
+row.
+
 ---
 
 ### dm_participants
@@ -362,6 +544,15 @@ CREATE TABLE dm_participants (
 );
 ```
 
+N rows per channel: two for a 1:1 DM, three to ten for a group
+(`db.MaxGroupDMParticipants`). Every DM authorization check is a lookup on
+`(user_id, channel_id)`, which is why group DMs needed no new authorization
+path — only `channels.is_group` to tell the two kinds apart.
+
+A group leave deletes the row. When the last one goes, the `channels` row is
+deleted with it: a DM nobody is in is reachable by nobody, and its messages and
+attachments cascade off the channel.
+
 ---
 
 ### dm_open_state
@@ -410,7 +601,7 @@ CREATE TABLE settings (
 
 ### emoji
 
-Custom emoji metadata.
+Server-wide custom emoji: one row per `:shortcode:`.
 
 ```sql
 CREATE TABLE emoji (
@@ -418,10 +609,30 @@ CREATE TABLE emoji (
     shortcode   TEXT    NOT NULL UNIQUE,
     filename    TEXT    NOT NULL,
     uploaded_by INTEGER NOT NULL REFERENCES users(id),
-    created_at  TEXT    NOT NULL DEFAULT (datetime('now'))
+    created_at  TEXT    NOT NULL DEFAULT (datetime('now')),
+    mime_type   TEXT    NOT NULL DEFAULT 'image/png'   -- migration 026
 );
 ```
 
+`filename` holds the **storage UUID** the image bytes were written under (the
+same convention as `attachments.stored_as`); the column name is inherited from
+the initial schema. It is never derived from anything the uploader sent and is
+never shown to a user.
+
+`shortcode` is always lowercase — `[a-z0-9_]{2,32}` is the only spelling the
+validator admits — which is what makes the plain `UNIQUE` index a
+case-insensitive one without a `COLLATE NOCASE` change.
+
+`mime_type` (migration 026) is the type **sniffed from the file's own bytes** at
+upload, restricted to `image/png`, `image/jpeg`, `image/gif` and `image/webp`.
+It exists so `GET /api/v1/emoji/{id}/image` can set a Content-Type without
+opening and re-sniffing the file on every request. The `DEFAULT` is only there
+to make the `ALTER` legal; nothing had ever written to this table before
+migration 026, because the table shipped in 001 with no server code at all.
+
+Writes are gated on `MANAGE_SERVER` (see api.md for why no new permission bit
+was added), and every mutation broadcasts the whole set as `emoji_update`.
+
 ---
 
 ### sounds
@@ -538,12 +749,17 @@ CREATE TABLE plugin_kv (
 | `idx_user_blocks_blocked` | user_blocks | `(blocked_id, blocker_id)` | Reverse block lookup |
 | `idx_events_channel_seq` | events | `(channel_id, seq)` | Cold-tier replay per channel |
 | `idx_events_created_at` | events | `(created_at)` | Retention pruning |
+| `idx_message_mentions_user` | message_mentions | `(mentioned_user_id)` | Per-user mention lookup |
+| `idx_channel_user_overrides_user` | channel_user_overrides | `(user_id)` | "every override this member carries" — the direction the permission cache populates from (the PK covers the per-channel direction) |
+| `idx_roles_name_nocase` | roles | `(name COLLATE NOCASE)` UNIQUE | Case-insensitive role-name uniqueness |
 
 ---
 
 ## Permission Bitfield System
 
-Permissions are stored as an integer bitfield (31 bits used) in `roles.permissions`, `channel_overrides.allow`, and `channel_overrides.deny`.
+Permissions are stored as an integer bitfield (31 bits used) in
+`roles.permissions`, `channel_overrides.allow`/`deny`, and
+`channel_user_overrides.allow`/`deny`.
 
 ### Bit Map
 
@@ -558,31 +774,81 @@ Permissions are stored as an integer bitfield (31 bits used) in `roles.permissio
 | 11 | `0x800` | `USE_VIDEO` | Enable camera in voice channels |
 | 12 | `0x1000` | `SHARE_SCREEN` | Share screen in voice channels |
 | 16 | `0x10000` | `MANAGE_MESSAGES` | Delete others' messages, pin/unpin |
-| 17 | `0x20000` | `MANAGE_CHANNELS` | Create, edit, delete channels |
-| 18 | `0x40000` | `KICK_MEMBERS` | Kick users |
-| 19 | `0x80000` | `BAN_MEMBERS` | Ban/unban users |
-| 20 | `0x100000` | `MUTE_MEMBERS` | Server-side mute/deafen in voice |
-| 24 | `0x1000000` | `MANAGE_ROLES` | Create, edit, delete roles |
-| 25 | `0x2000000` | `MANAGE_SERVER` | Modify server settings |
+| 17 | `0x20000` | `MANAGE_CHANNELS` | Create, edit, delete channels, edit channel permission overrides (`/admin/api/channels*`) |
+| 18 | `0x40000` | `KICK_MEMBERS` | Force-logout a lower-ranked user (`DELETE /admin/api/users/{id}/sessions`) |
+| 19 | `0x80000` | `BAN_MEMBERS` | Ban/unban a lower-ranked user (`PATCH /admin/api/users/{id}`) |
+| 20 | `0x100000` | `MUTE_MEMBERS` | Server-side mute/deafen in voice — admits to the admin perimeter; no route enforces it yet |
+| 21 | `0x200000` | `MENTION_EVERYONE` | Give `@everyone`/`@here` real mention semantics (highlight + mention badge). Without it the token stays plain text |
+| 24 | `0x1000000` | `MANAGE_ROLES` | Assign a role below the actor's own rank to a lower-ranked user (`PATCH /admin/api/users/{id}`), and create/edit/delete/reorder roles below the actor's own (`/admin/api/roles…`) |
+| 25 | `0x2000000` | `MANAGE_SERVER` | Read and modify server settings (`/admin/api/settings`) |
 | 26 | `0x4000000` | `MANAGE_INVITES` | Create and revoke invite codes |
-| 27 | `0x8000000` | `VIEW_AUDIT_LOG` | View the audit log |
+| 27 | `0x8000000` | `VIEW_AUDIT_LOG` | Read the audit log (`GET /admin/api/audit-log`) |
 | 30 | `0x40000000` | `ADMINISTRATOR` | Bypasses ALL permission checks |
 
-Bits 2-4, 7, 13-15, 21-23, 28-29, 31 are reserved.
+Bits 2-4, 7, 13-15, 22-23, 28-29, 31 are reserved.
+
+### Permission groups
+
+The bit map above is the authority on what each bit *does*; this grouping is
+how the bits are *presented* — it is the layout of the admin panel's role
+permission grid (`PERM_GROUPS` in `Server/admin/static/index.html`). It carries
+no semantics, but the two must stay in step: every defined bit belongs to
+exactly one group, and a bit missing from the grouping is a bit no operator can
+grant through the panel.
+
+| Group | Bits |
+|-------|------|
+| General | `MANAGE_CHANNELS`, `MANAGE_ROLES`, `MANAGE_INVITES`, `MANAGE_SERVER`, `VIEW_AUDIT_LOG`, `ADMINISTRATOR` |
+| Text | `READ_MESSAGES`, `SEND_MESSAGES`, `ATTACH_FILES`, `ADD_REACTIONS`, `MENTION_EVERYONE`, `MANAGE_MESSAGES` |
+| Voice | `CONNECT_VOICE`, `SPEAK_VOICE`, `USE_VIDEO`, `SHARE_SCREEN` |
+| Moderation | `KICK_MEMBERS`, `BAN_MEMBERS`, `MUTE_MEMBERS` |
+
+### Admin perimeter
+
+`permissions.AdminPerimeter` is the ANY-of mask that admits a principal to
+`/admin/api/*`: `ADMINISTRATOR | MANAGE_CHANNELS | MANAGE_ROLES |
+MANAGE_SERVER | VIEW_AUDIT_LOG | KICK_MEMBERS | BAN_MEMBERS | MUTE_MEMBERS`.
+Holding one bit only gets a principal through the door — each route group
+re-checks the specific bit it needs, so the seeded Moderator role can manage
+channels and ban members without reading settings or the audit log. Owner-only
+routes (backups, updates, API tokens) still gate on role *position*, not on a
+bit. See `docs/api.md` for the per-route mapping.
 
 ### Permission Checking Logic
 
 ```
 1. Get the user's role -> role.Permissions (base)
 2. If (base & ADMINISTRATOR) != 0 -> ALLOW everything
-3. Get channel_overrides for (channel_id, role_id) -> allow, deny
-4. effective = (base & ~deny) | allow
-5. Check: (effective & required_permission) != 0
+3. Get channel_overrides      for (channel_id, role_id) -> allow,  deny
+4. Get channel_user_overrides for (channel_id, user_id) -> uAllow, uDeny
+5. roleLayer = (base      & ~deny)  | allow
+6. effective = (roleLayer & ~uDeny) | uAllow
+7. Check: (effective & required_permission) == required_permission
 ```
 
-Deny is applied first (strips bits), then allow (adds bits), so allow wins
-when both target the same bit — matching Discord's channel-override semantics
-(`permissions.EffectivePerms`).
+The order is Discord's: **base role permissions -> role override -> user
+override**. Within a layer deny is applied first (strips bits) then allow (adds
+bits), so allow wins when both target the same bit. Across layers the later,
+narrower layer wins:
+
+| Situation | Outcome |
+|-----------|---------|
+| role override allows, user override denies | denied |
+| role override denies, user override allows | allowed |
+| user override allows and denies the same bit | allowed |
+| holder has `ADMINISTRATOR` | allowed regardless of either layer |
+
+`permissions.EffectiveChannelPerms` is the single implementation of steps 5-6,
+and `permissions.EffectivePerms` the one-layer primitive it is built from. The
+`ADMINISTRATOR` bypass lives at the call sites (`Checker.HasChannelPerm`,
+`Checker.HasChannelPermBatch`, and through it `VisibleChannelIDs`), not inside
+the formula — it is a bypass, not a bit that survives an override.
+
+Both layers are fetched together and per member, never per channel:
+`db.GetChannelOverridesFor(roleID, userID)` runs two batch queries and merges
+them, which is what keeps `buildReady`, REST `ListVisibleChannels`, reconnect
+replay filtering and the cached `service.PermissionService` free of N+1 lookups
+and unable to drift from each other.
 
 DM channels bypass role permissions entirely and use participant-based authorization instead.
 
@@ -592,5 +858,5 @@ DM channels bypass role permissions entirely and use participant-based authoriza
 |------|-----|-------------|
 | Owner | `0x7FFFFFFF` | Everything including ADMINISTRATOR |
 | Admin | `0x3FFFFFFF` | Everything except ADMINISTRATOR |
-| Moderator | `0x000FFFFF` | All message + voice + moderation |
+| Moderator | `0x002FFFFF` | All message + voice + moderation, plus `MENTION_EVERYONE` (granted by migration 022) |
 | Member | `0x1E63` | Send, read, attach, react, voice, video, screen share |