chore(release): prepare 26.08.0 release notes

Fold the member directory, profile editor, invite and status banner features into the unreleased 26.08.0 changelog section.
Add profile editor, member invite and status banners (#4 )
2026-10-31 16:22:49 +00:00 · 2026-08-06 13:41:23 +02:00 · 2026-08-06 13:28:24 +02:00 · 2026-08-06 13:10:01 +02:00 · 2026-08-06 10:49:24 +02:00 · 2026-08-06 10:41:22 +02:00
1159 changed files with 12402 additions and 14315 deletions
@@ -0,0 +1,303 @@
+---
+name: releasing-healthchat
+description: Cut a HealthChat Google Play release of element-x-android by tagging release/healthchat. Use when the user asks to release, publish, tag, deploy, ship, or cut a new HealthChat Android version, asks about the Play Store release process, asks about rotating the Android release keystore, or asks about the required GitHub Actions secrets for the release pipeline.
+---
+
+# Releasing HealthChat (element-x-android)
+
+Releases are driven by git tags of the form `healthchat-v<version>` pushed to
+`origin`. The tag triggers `.github/workflows/healthchat-release-playstore.yml`,
+which runs on the self-hosted `novaloop-incus-large` runner, builds a signed
+AAB, and uploads it to the Play Store **internal** track. No GitHub Release is
+created.
+
+**Promotion to production is always a manual step** in Play Console after an
+internal build has been validated — see "Promoting to production" below.
+
+## Preflight checklist
+
+Verify each item before tagging. If any fail, fix and commit first.
+
+- [ ] On branch `release/healthchat` with a clean working tree (`git status`).
+- [ ] `HEALTHCHAT_CHANGES.md` has a section `## Changes in <new-version> (<date>)`
+      at the top of the file. The pipeline's awk extractor matches this exact
+      heading format; no match means a fallback placeholder ships as the Play
+      Store "What's new" text.
+- [ ] `plugins/src/main/kotlin/Versions.kt` `versionYear`, `versionMonth`, and
+      `versionReleaseNumber` produce the tag's core version (format
+      `<year>.<month zero-padded to 2>.<releaseNumber>`, e.g. `26.07.1`).
+      **The workflow hard-fails** if they don't match — this is load-bearing,
+      not cosmetic.
+- [ ] If you edited `HEALTHCHAT_CHANGES.md` or `Versions.kt`, both commits are
+      pushed to `release/healthchat` **before** you push the tag.
+
+## Cutting the release (normal path)
+
+```bash
+# from release/healthchat, fully committed:
+git tag healthchat-v<YEAR>.<MONTH>.<RELEASE>
+git push origin healthchat-v<YEAR>.<MONTH>.<RELEASE>
+```
+
+Examples:
+
+- `git tag healthchat-v26.07.1`        (next release in July 2026)
+- `git tag healthchat-v26.08.0`        (first release in August 2026)
+- `git tag healthchat-v26.07.2-rc1`    (release candidate)
+
+Watch the workflow with `gh run watch` or in the GitHub Actions UI. When it
+finishes, the build appears in Play Console → Internal testing within a few
+minutes (Play Store's processing queue).
+
+## Manual / retry path (workflow_dispatch)
+
+Use when retrying a failed run or rebuilding without moving tags.
+
+1. GitHub → Actions → "HealthChat Release to Google Play Store" → **Run workflow**.
+2. Fill in:
+   - **version** (required): e.g. `26.07.1`. Same regex validation as tag path.
+     Must still match `Versions.kt`.
+   - **track**: default `internal`; pick `alpha`/`beta`/`production` to promote
+     an already-uploaded build to a higher track without rebuilding (note:
+     Play Console is usually a better UX for promotion).
+   - **release_status**: default `completed`; use `draft` for dry-runs that
+     land in Play Console but stay unpublished.
+   - **release_notes_override** (optional): replaces the
+     `HEALTHCHAT_CHANGES.md` lookup. Useful for ad-hoc test builds.
+3. Run. The AAB is built and uploaded exactly as the tag path would.
+
+## Runner and build tuning
+
+The job runs on `novaloop-incus-large` — an incus container with 4 cores and
+24 GiB, not a GitHub-hosted runner. Two consequences the workflow handles, and
+that anyone editing it needs to keep in mind:
+
+- **The image ships no Android SDK.** The `Set up Android SDK` step installs
+  it. Platform packages are minor-versioned, so `COMPILE_SDK = 37` means
+  `platforms;android-37.0`. Build-tools follows AGP's own default
+  (`SdkConstants.CURRENT_BUILD_TOOLS_VERSION`), not `BUILD_TOOLS_VERSION` in
+  `Versions.kt` — nothing sets `buildToolsVersion`, so bump it when AGP is
+  upgraded.
+- **`GRADLE_OPTS` is deliberately smaller than upstream's.** Upstream's
+  workflows use `-Xmx8g` with a 4 GB Kotlin daemon, sized for the 4-core/16GB
+  `ubuntu-latest` that *public* repos get; this repo is private, so its hosted
+  runners are 2-core/7GB and its container is 24 GiB. At upstream's numbers the
+  daemon plus the Kotlin daemon plus four parallel lint/R8 workers exceed the
+  limit and the daemon is SIGKILLed — the symptom is
+  `DaemonDisappearedException` with **no** `OutOfMemoryError` and no heap dump,
+  which is what an external kill looks like. `-Xmx6g` with a 2 GB Kotlin daemon
+  fits.
+
+The `Report runner capacity` step prints `free`, `nproc`, `df` and the enforced
+cgroup limit on every run, so a future failure can be read against the runner's
+actual capacity rather than guessed at. Note `free` reports the container's
+limit only when lxcfs virtualises `/proc/meminfo`; `/sys/fs/cgroup/memory.max`
+is the number the kernel enforces.
+
+## Versioning (calendar scheme — differs from the old Classic repo)
+
+Element X uses calendar versioning, defined in
+`plugins/src/main/kotlin/Versions.kt`:
+
+```
+versionName = <versionYear>.<versionMonth padded to 2>.<versionReleaseNumber>   // e.g. 26.07.1
+versionCode = ((2000 + versionYear) * 10_000 + versionMonth * 100 + versionReleaseNumber) * 10
+```
+
+The trailing `* 10` is the ABI multiplier applied per output APK
+(`app/build.gradle.kts` androidComponents block); the AAB gets ABI code `0`.
+Example: `26.07.1` → versionCode `202607010`.
+
+To bump: edit `versionYear`/`versionMonth`/`versionReleaseNumber` in
+`Versions.kt` (increment `versionReleaseNumber` within a month; reset it to 0
+when the month changes). `versionCode` must be strictly monotonic in Play
+Store across all uploads — the calendar scheme guarantees this as long as you
+never decrease the triple. All HealthChat codes (≥ 202,607,000) supersede the
+old Classic app's last code (40,154,100).
+
+**Keep the same version as the upstream Element X release the branch is based
+on unless HealthChat ships an intermediate build** — then bump
+`versionReleaseNumber` past upstream's. When merging a newer upstream release
+into `release/healthchat`, take upstream's `Versions.kt` if its version is
+higher.
+
+## Release notes
+
+`HEALTHCHAT_CHANGES.md` is the single source. The workflow extracts the
+section matching the version being released, then writes it to
+`fastlane/metadata/android/en-US/changelogs/<versionCode>.txt` and
+`fastlane/metadata/android/de-DE/changelogs/<versionCode>.txt`, which
+`r0adkll/upload-google-play` picks up via its `whatsNewDirectory` input.
+
+Format:
+
+```markdown
+## Changes in 26.07.1 (2026-07-20)
+
+🙌 Improvements
+
+- Bullet one.
+- Bullet two.
+```
+
+Keep the entire section under **500 characters** — Play Store's "What's new"
+hard cap per locale. The workflow emits a warning if you exceed it; Play Store
+will truncate.
+
+Never hand-edit the generated `fastlane/metadata/android/*/changelogs/<N>.txt`
+files for this branch — they'll be overwritten on the next run. Only edit
+`HEALTHCHAT_CHANGES.md`. (Older checked-in files from upstream are harmless.)
+
+If no matching section exists, the pipeline emits a workflow warning and
+falls back to `HealthChat <version> — automated build from <ref>.`. Prefer
+fixing the changelog over relying on the fallback.
+
+## After the release
+
+- [ ] Workflow run is green in GitHub Actions.
+- [ ] Build appears under Play Console → Internal testing within ~10 minutes.
+- [ ] Internal testers get the update automatically if they're enrolled.
+- [ ] AAB + `mapping.txt` are attached to the workflow run, retained 90 days.
+
+**A green "Build Release AAB" step does not mean the release shipped.** The
+upload step logs `Successfully uploaded 1 artifacts` before it commits the Play
+edit; if the commit fails, the AAB is uploaded but no release exists on the
+track. Always check the `Upload to Play Store` step, not just the job's build
+steps.
+
+## Troubleshooting: `changesNotSentForReview must not be set`
+
+```
+Successfully uploaded 1 artifacts
+Committing the Edit
+##[error]Changes are sent for review automatically.
+The query parameter changesNotSentForReview must not be set.
+```
+
+Google flips this per app: once Play sends an app's changes for review
+automatically, the Edits API rejects `changesNotSentForReview` instead of
+ignoring it. The 26.07.0 release (2026-07-27) committed fine with the flag
+set; 26.08.0 (2026-08-03) failed with it. The parameter is no longer passed —
+if it ever needs to come back, gate it rather than setting it unconditionally.
+
+Recovery: the failed edit is never committed, so the `versionCode` is not
+consumed. Re-run via `workflow_dispatch` with the same version — no tag move
+and no version bump needed.
+
+## Required GitHub Actions secrets
+
+The pipeline depends on these repository secrets. Missing any causes the
+workflow to fail at the corresponding step. The values are identical to the
+ones configured on the old `Novaloop-AG/element-android` repository (same
+upload keystore, same Play listing) — except `GOOGLE_SERVICES_JSON_BASE64`,
+which element-x-android does **not** use (Firebase config is compiled in via
+`libraries/pushproviders/firebase/src/main/res/values/firebase.xml`).
+
+| Secret | Source |
+|---|---|
+| `RELEASE_KEYSTORE_BASE64` | `base64 -w0 release.keystore` (the HealthChat upload keystore, alias `healthchat-upload`) |
+| `RELEASE_KEYSTORE_PASSWORD` | Keystore password |
+| `RELEASE_KEY_ALIAS` | Key alias inside the keystore |
+| `RELEASE_KEY_PASSWORD` | Key password |
+| `GOOGLE_PLAY_SERVICE_ACCOUNT_JSON` | Play Console → Users and permissions → invite a service account → download JSON. Needs "Release manager" permissions scoped to `ch.healthchat.element`. |
+
+## Keystore rotation (rare, high-risk)
+
+Unlike Apple Distribution certificates, **Android upload keystores do not
+expire** and should not be rotated casually. The upload key is tied to the
+app's identity in Play Console (Play App Signing is enabled; the repo key is
+the upload key); rotating it is a one-way process that uses Play App
+Signing's "Upload key reset" flow.
+
+If the keystore is lost or believed to be compromised:
+
+1. Play Console → Release → Setup → App integrity → Upload key → **Request
+   upload key reset**. Instructions follow, requiring you to upload a new
+   keystore and wait for Google to rotate.
+2. Generate a fresh keystore on the operator's machine:
+   ```bash
+   keytool -genkey -v -keystore healthchat-upload-new.jks \
+     -keyalg RSA -keysize 2048 -validity 10000 -alias healthchat
+   ```
+3. Once Google confirms the rotation, re-encode and update secrets:
+   `base64 -w0 healthchat-upload-new.jks | pbcopy`, then replace
+   `RELEASE_KEYSTORE_BASE64`, `RELEASE_KEYSTORE_PASSWORD`, `RELEASE_KEY_ALIAS`,
+   `RELEASE_KEY_PASSWORD` in repo settings.
+4. Run the release workflow via `workflow_dispatch` with a throwaway version
+   bump and `release_status: draft` to verify end-to-end. Discard the draft.
+
+**Do not attempt rotation without reading Play App Signing docs end-to-end**
+and coordinating a maintenance window. A botched rotation means users can't
+receive updates until Google completes the reset.
+
+## Promoting internal → production
+
+Internal builds and production builds are the same AAB. To release a
+validated internal build:
+
+1. Play Console → HealthChat → Testing → **Internal testing** → find the
+   release.
+2. Confirm it passed internal testing.
+3. **Promote release** → Production → **Release details** → fill in "What's
+   new" (Play Console copies it from the internal release — verify) →
+   **Review release** → **Start rollout to Production**.
+4. Choose staged rollout % if desired.
+
+**This step is deliberately not automated.** Production releases require
+human judgment on rollout percentage, Play Store listing changes, and
+compliance metadata review.
+
+## Rollback
+
+- **Bad build, release notes fine** → fix the cause, bump
+  `versionReleaseNumber`, commit, tag `healthchat-v<ver>`. The new build
+  supersedes the bad one on the internal track.
+- **Bad release notes only** → edit `HEALTHCHAT_CHANGES.md` on
+  `release/healthchat`, then update the "What's new" text in the Play Console
+  release manually (the pipeline only writes it at upload time).
+- **Completely wrong version number** → treat as burned. Bump
+  `versionReleaseNumber` further, tag a higher `healthchat-v<ver>`. Play
+  Store's `versionCode` rule means the next run naturally supersedes.
+- **Production rollout gone wrong** → Play Console → Production → **Halt
+  rollout** (works during staged rollout), then ship a hotfix as above.
+
+## Known branch divergence when merging upstream
+
+When merging a newer upstream Element X release tag into `release/healthchat`
+(temporarily add `https://github.com/element-hq/element-x-android` as a
+remote, fetch, merge, remove the remote — never keep a permanent upstream
+remote):
+
+- **`.github/workflows/healthchat-release-playstore.yml`**,
+  **`HEALTHCHAT_CHANGES.md`**, and
+  **`.claude/skills/releasing-healthchat/SKILL.md`** are HealthChat-only —
+  any merge conflict here means something upstream accidentally overlaps;
+  keep `--ours`.
+- **`plugins/src/main/kotlin/config/BuildTimeConfig.kt`** —
+  `APPLICATION_ID = "ch.healthchat.element"`, `APPLICATION_NAME = "HealthChat"`,
+  `METADATA_HOST_REVERSED`, and the healthchat.ch URLs must survive merges.
+  Upstream uses `io.element.android.x` / `Element X` / nulls.
+- **`appconfig/.../ApplicationConfig.kt`** — `PRODUCTION_APPLICATION_NAME` /
+  `DESKTOP_APPLICATION_NAME = "HealthChat"` must survive. Upstream: `Element`.
+- **`features/enterprise/impl-foss/.../DefaultEnterpriseService.kt`** —
+  `defaultHomeserverList() = listOf("matrix.healthchat.ch")` must survive.
+  Upstream returns an empty list.
+- **`app/build.gradle.kts`** — the `healthchat` signing config and the
+  `appicon/healthchat` dependency must survive; upstream signs release with
+  the debug keystore and depends on `appicon/element`.
+- **`app/src/gplay/AndroidManifest.xml`** — HealthChat-only file that strips
+  `REQUEST_INSTALL_PACKAGES` and the location permissions
+  (`FOREGROUND_SERVICE_LOCATION`, `ACCESS_FINE_LOCATION`,
+  `ACCESS_COARSE_LOCATION`, plus `LiveLocationSharingService`) from the Play
+  build. Play Console rejects the release at edit-commit time while either is
+  declared but not justified on the listing. Upstream has no `app/src/gplay/`
+  manifest, so this should never conflict. If HealthChat ever ships maps
+  (a MapTiler key in `BuildTimeConfig`), the location removals must come out
+  first — the feature is gated on that key, not on these declarations.
+- **`plugins/src/main/kotlin/Versions.kt`** — take upstream's version when
+  higher (see Versioning above).
+- **`fastlane/metadata/android/`** — HealthChat listing texts (en-US, de-DE)
+  must survive; upstream ships Element X texts. The per-versionCode changelog
+  files generated by this pipeline carry HealthChat text; conflicts there
+  mean a versionCode collided — regenerate from `HEALTHCHAT_CHANGES.md` on
+  the next release run rather than hand-merging.
@@ -69,18 +69,18 @@ body:
      description:  |
        Trigger the defect, then click on the menu from the room list then "Report a bug". Describe the issue, mentioning that you have also filed a bug (it's helpful if you can include a link to the bug). Send the report to submit anonymous logs to the developers.
      options:
-        - 'No'
        - 'Yes'
+        - 'No'
    validations:
      required: true
  - type: dropdown
    id: pr
    attributes:
-      label: Will you submit a Pull Request?
+      label: Are you willing to provide a PR?
      description:  |
-        Submitting a Pull Request can drastically speed up the process of fixing this bug. Don't worry, it's still OK to answer 'No' :).
+        Providing a PR can drastically speed up the process of fixing this bug. Don't worry, it's still OK to answer 'No' :).
      options:
-        - 'No'
        - 'Yes'
+        - 'No'
    validations:
      required: true
@@ -1,11 +1,11 @@
 name: Enhancement request
-description: Do you have a suggestion or feature request? Please open issue on the repo element-hq/element-meta if the request is global to all Element clients.
+description: Do you have a suggestion or feature request?
 labels: [T-Enhancement]
 body:
  - type: markdown
    attributes:
      value: |
-        Thank you for taking the time to propose an enhancement to an existing feature. If you would like to propose a new feature or a major cross-platform change, please open an issue on the [element-meta repository](https://github.com/element-hq/element-meta/issues/new?template=enhancement.yml) instead.
+        Thank you for taking the time to propose an enhancement to an existing feature. If you would like to propose a new feature or a major cross-platform change, please [start a discussion here](https://github.com/element-hq/element-meta/discussions/new?category=ideas).
  - type: textarea
    id: usecase
    attributes:
@@ -7,18 +7,32 @@ on:
  push:
    branches: [ develop ]

-permissions: {}
+permissions:
+  # Private fork: actions/checkout needs contents:read to clone. Upstream is public,
+  # where an empty token can still read the repo, so an empty permissions block works there and
+  # fails here with `fatal: repository not found`.
+  contents: read

 # Enrich gradle.properties for CI/CD
 env:
-  GRADLE_OPTS: -Dorg.gradle.jvmargs=-Xmx8g -XX:MaxMetaspaceSize=512m -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -XX:+UseG1GC -Dkotlin.daemon.jvm.options=-Xmx4g
+  # Reduced from upstream's -Xmx8g / 4 GB Kotlin daemon for the self-hosted runners.
+  # Each incus container reports 48 GiB and 8 cores, so a single build has ample room —
+  # but the containers are oversubscribed against their host, and two concurrent heavy
+  # Gradle jobs get their daemons SIGKILLed ("the daemon has disappeared", no
+  # OutOfMemoryError, no heap dump). Running the same job alone succeeds. Lower heaps
+  # make two builds likelier to coexist; the real fix is sizing the containers to the
+  # host. See the "Report runner capacity" step.
+  GRADLE_OPTS: -Dorg.gradle.jvmargs=-Xmx6g -XX:MaxMetaspaceSize=768m -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -XX:+UseG1GC -Dkotlin.daemon.jvm.options=-Xmx2g
  CI_GRADLE_ARG_PROPERTIES: --stacktrace -Dsonar.gradle.skipCompile=true --no-configuration-cache

 jobs:
  build:
    name: Build APKs
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]
    permissions:
+      # A job-level block replaces the workflow-level one, so contents:read has to be
+      # repeated here or checkout fails on this private fork.
+      contents: read
      # For NejcZdovc/comment-pr
      pull-requests: write
    strategy:
@@ -31,6 +45,9 @@ jobs:
      cancel-in-progress: true
    steps:
      - name: Free Disk Space (Ubuntu)
+        # Only meaningful on GitHub's throwaway VMs. On a persistent self-hosted runner this
+        # would delete dotnet/haskell/docker images from the host on every run.
+        if: runner.environment == 'github-hosted'
        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be
        with:
          # This might remove tools that are actually needed, if set to "true" but frees about 6 GB
@@ -51,7 +68,7 @@ jobs:
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
          persist-credentials: false
      - name: Use JDK 21
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
          java-version: '21'
@@ -104,18 +121,7 @@ jobs:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Compile release sources
        if: ${{ matrix.variant == 'release' }}
-        run: |
-          ./gradlew assembleGplayRelease -PallWarningsAsErrors=true $CI_GRADLE_ARG_PROPERTIES
-          ./gradlew bundleGplayRelease -PallWarningsAsErrors=true $CI_GRADLE_ARG_PROPERTIES
-      - name: Run aapt dump
-        if: ${{ matrix.variant == 'release' }}
-        run: |
-          $ANDROID_HOME/build-tools/37.0.0/aapt dump badging \
-            ./app/build/outputs/apk/gplay/release/app-gplay-universal-release.apk \
-            > /tmp/currentAaptDump.txt
-      - name: Check manifest has not changed
-        if: ${{ matrix.variant == 'release' }}
-        run: diff /tmp/currentAaptDump.txt ./tools/manifest/gplay/release/aaptDump.txt
+        run: ./gradlew bundleGplayRelease -PallWarningsAsErrors=true $CI_GRADLE_ARG_PROPERTIES
      - name: Compile nightly sources
        if: ${{ matrix.variant == 'nightly' }}
        run: ./gradlew compileGplayNightlySources -PallWarningsAsErrors=true $CI_GRADLE_ARG_PROPERTIES
@@ -7,17 +7,28 @@ on:
  push:
    branches: [ develop ]

-permissions: {}
+permissions:
+  # Private fork: actions/checkout needs contents:read to clone. Upstream is public,
+  # where an empty token can still read the repo, so an empty permissions block works there and
+  # fails here with `fatal: repository not found`.
+  contents: read

 # Enrich gradle.properties for CI/CD
 env:
-  GRADLE_OPTS: -Dorg.gradle.jvmargs=-Xmx8g -XX:MaxMetaspaceSize=512m -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -XX:+UseG1GC -Dkotlin.daemon.jvm.options=-Xmx4g
+  # Reduced from upstream's -Xmx8g / 4 GB Kotlin daemon for the self-hosted runners.
+  # Each incus container reports 48 GiB and 8 cores, so a single build has ample room —
+  # but the containers are oversubscribed against their host, and two concurrent heavy
+  # Gradle jobs get their daemons SIGKILLed ("the daemon has disappeared", no
+  # OutOfMemoryError, no heap dump). Running the same job alone succeeds. Lower heaps
+  # make two builds likelier to coexist; the real fix is sizing the containers to the
+  # host. See the "Report runner capacity" step.
+  GRADLE_OPTS: -Dorg.gradle.jvmargs=-Xmx6g -XX:MaxMetaspaceSize=768m -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -XX:+UseG1GC -Dkotlin.daemon.jvm.options=-Xmx2g
  CI_GRADLE_ARG_PROPERTIES: --stacktrace -Dsonar.gradle.skipCompile=true --no-configuration-cache

 jobs:
  build:
    name: Build Enterprise APKs
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]
    # Skip in forks
    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
    strategy:
@@ -30,6 +41,9 @@ jobs:
      cancel-in-progress: true
    steps:
      - name: Free Disk Space (Ubuntu)
+        # Only meaningful on GitHub's throwaway VMs. On a persistent self-hosted runner this
+        # would delete dotnet/haskell/docker images from the host on every run.
+        if: runner.environment == 'github-hosted'
        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be
        with:
          # This might remove tools that are actually needed, if set to "true" but frees about 6 GB
@@ -56,7 +70,7 @@ jobs:
      - name: Clone submodules
        run: git submodule update --init --recursive
      - name: Use JDK 21
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
          java-version: '21'
@@ -2,7 +2,11 @@ name: Danger CI

 on: [pull_request, merge_group]

-permissions: {}
+permissions:
+  # Private fork: actions/checkout needs contents:read to clone. Upstream is public,
+  # where an empty token can still read the repo, so an empty permissions block works there and
+  # fails here with `fatal: repository not found`.
+  contents: read

 jobs:
  build:
@@ -24,7 +28,7 @@ jobs:
      - run: |
          npm install --save-dev @babel/plugin-transform-flow-strip-types
      - name: Danger
-        uses: danger/danger-js@e9b58820039524318198d8059ec98b0c02b7875c # 13.0.10
+        uses: danger/danger-js@58355dc2b274a87699c8b7deac01baba16d6f061 # 13.0.8
        with:
          args: "--dangerfile ./tools/danger/dangerfile.js"
        env:
@@ -19,7 +19,7 @@ jobs:
      - name: ⏬ Checkout with LFS
        uses: nschloe/action-cached-lfs-checkout@385a8ecc719e50b8c71af6ab01a624b486b7c3bc # v1.2.5
      - name: Use JDK 21
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
          java-version: '21'
@@ -16,7 +16,7 @@ jobs:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
-      - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+      - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        name: Use JDK 21
        if: (github.event_name == 'pull_request' && github.event.pull_request.fork == null) || github.event_name == 'workflow_dispatch'
        with:
@@ -0,0 +1,248 @@
+name: HealthChat Release to Google Play Store
+
+on:
+  push:
+    tags:
+      - 'healthchat-v*'
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Marketing version (e.g. 26.07.0). Required when running manually.'
+        required: true
+        type: string
+      track:
+        description: 'Play Store track'
+        required: true
+        default: 'internal'
+        type: choice
+        options:
+          - internal
+          - alpha
+          - beta
+          - production
+      release_status:
+        description: 'Release status'
+        required: true
+        default: 'completed'
+        type: choice
+        options:
+          - completed
+          - inProgress
+          - halted
+          - draft
+      release_notes_override:
+        description: 'Optional release notes. If empty, falls back to HEALTHCHAT_CHANGES.md section for the given version.'
+        required: false
+        type: string
+
+permissions:
+  # Only need read access to clone. Upload uses the Play Console service
+  # account JSON from secrets, not GITHUB_TOKEN.
+  contents: read
+
+concurrency:
+  group: healthchat-release-${{ github.event.inputs.version || github.ref_name }}
+  cancel-in-progress: true
+
+env:
+  # Upstream's workflows hardcode -Xmx8g / Kotlin daemon -Xmx4g, sized for the
+  # 4-core/16GB ubuntu-latest that public repos get. On the previous incus
+  # container the daemon kept getting SIGKILLed mid-build
+  # (DaemonDisappearedException, no OutOfMemoryError, no heap dump), so these
+  # values stay well under upstream's ceiling and leave room for the Kotlin
+  # daemon and the parallel lint workers. Re-check them against the "Report
+  # runner capacity" output now that jobs land on the persistent org runners,
+  # whose specs may differ.
+  GRADLE_OPTS: -Dorg.gradle.jvmargs=-Xmx6g -XX:MaxMetaspaceSize=768m -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -XX:+UseG1GC -Dkotlin.daemon.jvm.options=-Xmx2g
+  CI_GRADLE_ARG_PROPERTIES: --stacktrace --no-daemon -Dsonar.gradle.skipCompile=true --no-configuration-cache
+
+jobs:
+  release:
+    name: Build and upload AAB to Play Store
+    # Persistent org runners (github-runner-01, gha-runner-1..3). The previous
+    # novaloop-incus-large label pointed at the GARM ephemeral pool, whose freshly
+    # spawned runners were reaped mid-job — jobs died ~10 minutes in with
+    # "The operation was canceled" and no other diagnostic.
+    runs-on: [self-hosted, Linux, X64]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      # Tag pushes must originate from release/healthchat. Dispatch runs must be
+      # invoked from that branch too. Reject anything else up-front so we don't
+      # ship off main/develop.
+      - name: Verify ref is on release/healthchat
+        run: |
+          set -euo pipefail
+          # On tag pushes, GITHUB_REF_NAME is the tag, not the branch. Resolve
+          # the commit's branch membership instead.
+          if ! git branch -r --contains "$GITHUB_SHA" | grep -qE 'origin/release/healthchat$'; then
+            echo "::error::Commit $GITHUB_SHA is not on origin/release/healthchat. Refusing to release."
+            exit 1
+          fi
+
+      - name: Resolve marketing version
+        id: version
+        run: |
+          set -euo pipefail
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            VERSION="${{ github.event.inputs.version }}"
+          else
+            VERSION="${GITHUB_REF_NAME#healthchat-v}"
+          fi
+          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
+            echo "::error::Invalid marketing version '$VERSION' — expected e.g. 26.07.0"
+            exit 1
+          fi
+          # Drop any pre-release/build suffix (e.g. -rc1, -hotfix1) for the Versions.kt comparison.
+          BASE_VERSION=$(echo "$VERSION" | sed -E 's/([0-9]+\.[0-9]+\.[0-9]+)([.-].*)?$/\1/')
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "base_version=$BASE_VERSION" >> "$GITHUB_OUTPUT"
+          echo "Resolved marketing version: $VERSION (base: $BASE_VERSION)"
+
+      - name: Verify Versions.kt matches tag
+        id: gradle_version
+        env:
+          BASE_VERSION: ${{ steps.version.outputs.base_version }}
+        run: |
+          set -euo pipefail
+          VERSIONS_FILE=plugins/src/main/kotlin/Versions.kt
+          YEAR=$(grep -E 'private const val versionYear' "$VERSIONS_FILE" | sed -E 's/.*=\s*([0-9]+).*/\1/')
+          MONTH=$(grep -E 'private const val versionMonth' "$VERSIONS_FILE" | sed -E 's/.*=\s*([0-9]+).*/\1/')
+          REL=$(grep -E 'private const val versionReleaseNumber' "$VERSIONS_FILE" | sed -E 's/.*=\s*([0-9]+).*/\1/')
+          if [[ -z "$YEAR" || -z "$MONTH" || -z "$REL" ]]; then
+            echo "::error::Could not parse versionYear/versionMonth/versionReleaseNumber from $VERSIONS_FILE"
+            exit 1
+          fi
+          # VERSION_NAME format (see Versions.kt): year on 2 digits, month zero-padded to 2, release number unpadded.
+          GRADLE_VERSION="${YEAR}.$(printf '%02d' "$MONTH").${REL}"
+          echo "Parsed $VERSIONS_FILE: $GRADLE_VERSION"
+          if [[ "$GRADLE_VERSION" != "$BASE_VERSION" ]]; then
+            echo "::error::Tag version $BASE_VERSION does not match Versions.kt ($GRADLE_VERSION). Bump versionYear/versionMonth/versionReleaseNumber and commit before tagging."
+            exit 1
+          fi
+          # Formula (see Versions.kt VERSION_CODE): (2000+year)*10_000 + month*100 + releaseNumber,
+          # then *10 for the AAB output (ABI code 0 — see app/build.gradle.kts androidComponents block).
+          BASE_CODE=$(( (2000 + YEAR) * 10000 + MONTH * 100 + REL ))
+          VERSION_CODE=$(( BASE_CODE * 10 ))
+          echo "version_code=$VERSION_CODE" >> "$GITHUB_OUTPUT"
+          echo "Computed versionCode: $VERSION_CODE"
+
+      - name: Extract release notes
+        id: notes
+        env:
+          VERSION: ${{ steps.version.outputs.base_version }}
+          OVERRIDE: ${{ github.event.inputs.release_notes_override }}
+        run: |
+          set -euo pipefail
+          if [[ -n "${OVERRIDE:-}" ]]; then
+            NOTES="$OVERRIDE"
+            echo "Using release notes from workflow input"
+          else
+            NOTES=$(awk -v ver="$VERSION" '
+              /^## Changes in / {
+                if (found) { exit }
+                if ($0 ~ "## Changes in " ver "( |$|\\()") { found = 1; next }
+              }
+              found { print }
+            ' HEALTHCHAT_CHANGES.md | sed '/^[[:space:]]*$/{N;/^\n$/D;}')
+            if [[ -z "$NOTES" ]]; then
+              NOTES="HealthChat ${VERSION} — automated build from ${GITHUB_REF_NAME}."
+              echo "::warning::No HEALTHCHAT_CHANGES.md section found for $VERSION — using fallback"
+            fi
+          fi
+          # Play Store "What's new" has a 500-character limit per locale.
+          CHAR_COUNT=$(printf '%s' "$NOTES" | wc -c)
+          if (( CHAR_COUNT > 500 )); then
+            echo "::warning::Release notes are $CHAR_COUNT chars; Play Store truncates at 500"
+          fi
+          {
+            echo 'notes<<NOTES_EOF'
+            echo "$NOTES"
+            echo 'NOTES_EOF'
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Generate fastlane changelog files
+        env:
+          VERSION_CODE: ${{ steps.gradle_version.outputs.version_code }}
+          NOTES: ${{ steps.notes.outputs.notes }}
+        run: |
+          set -euo pipefail
+          for locale in en-US de-DE; do
+            dir="fastlane/metadata/android/${locale}/changelogs"
+            mkdir -p "$dir"
+            printf '%s\n' "$NOTES" > "${dir}/${VERSION_CODE}.txt"
+            echo "Wrote ${dir}/${VERSION_CODE}.txt"
+          done
+
+      - name: Use JDK 21
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+
+      # The Android SDK now comes from the self-hosted runner image, so there is no
+      # setup-android step here. The image must provide it AND export ANDROID_HOME to
+      # the job environment — Gradle fails with "SDK location not found" otherwise.
+      # The image also has to carry the platform matching COMPILE_SDK in
+      # plugins/src/main/kotlin/Versions.kt (platform packages are minor-versioned, so
+      # compileSdk 37 means android-37.0) and the build-tools version AGP defaults to
+      # (SdkConstants.CURRENT_BUILD_TOOLS_VERSION), since nothing sets buildToolsVersion
+      # here. Both need refreshing in the image when AGP or COMPILE_SDK moves.
+      - name: Configure gradle
+        uses: gradle/actions/setup-gradle@v4
+
+      - name: Decode keystore
+        run: |
+          echo "${{ secrets.RELEASE_KEYSTORE_BASE64 }}" | base64 -d > app/signature/release.keystore
+
+      # Recorded on every run so build failures can be read against the
+      # runner's actual capacity instead of guessed at.
+      - name: Report runner capacity
+        run: |
+          free -h
+          nproc
+          df -h .
+          # free reads /proc/meminfo, which in a container may report the host's
+          # total rather than the enforced limit. This is what the kernel enforces.
+          cat /sys/fs/cgroup/memory.max 2>/dev/null \
+            || cat /sys/fs/cgroup/memory/memory.limit_in_bytes 2>/dev/null \
+            || echo "no cgroup memory limit visible"
+
+      - name: Build Release AAB
+        run: |
+          ./gradlew bundleGplayRelease $CI_GRADLE_ARG_PROPERTIES
+        env:
+          RELEASE_STORE_FILE: signature/release.keystore
+          RELEASE_STORE_PASSWORD: ${{ secrets.RELEASE_KEYSTORE_PASSWORD }}
+          RELEASE_KEY_ALIAS: ${{ secrets.RELEASE_KEY_ALIAS }}
+          RELEASE_KEY_PASSWORD: ${{ secrets.RELEASE_KEY_PASSWORD }}
+
+      - name: Upload workflow artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: healthchat-${{ steps.version.outputs.version }}
+          path: |
+            app/build/outputs/bundle/gplayRelease/*.aab
+            app/build/outputs/mapping/gplayRelease/mapping.txt
+          retention-days: 90
+          if-no-files-found: warn
+
+      - name: Upload to Play Store
+        uses: r0adkll/upload-google-play@v1
+        with:
+          serviceAccountJsonPlainText: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON }}
+          packageName: ch.healthchat.element
+          releaseFiles: app/build/outputs/bundle/gplayRelease/*.aab
+          tracks: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.track || 'internal' }}
+          status: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.release_status || 'completed' }}
+          whatsNewDirectory: fastlane/metadata/android
+          mappingFile: app/build/outputs/mapping/gplayRelease/mapping.txt
+          # Do NOT set changesNotSentForReview. Play now sends this app's changes for review
+          # automatically, and the Edits API rejects the parameter outright when it does:
+          # "Changes are sent for review automatically. The query parameter
+          # changesNotSentForReview must not be set." The AAB uploads fine and then the commit
+          # fails, so the release silently never lands on the track. See SKILL.md.
@@ -5,11 +5,22 @@ on:
  workflow_dispatch:
  pull_request:

-permissions: {}
+permissions:
+  # Private fork: actions/checkout needs contents:read to clone. Upstream is public,
+  # where an empty token can still read the repo, so an empty permissions block works there and
+  # fails here with `fatal: repository not found`.
+  contents: read

 # Enrich gradle.properties for CI/CD
 env:
-  GRADLE_OPTS: -Dorg.gradle.jvmargs=-Xmx8g -XX:MaxMetaspaceSize=512m -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -XX:+UseG1GC -Dkotlin.daemon.jvm.options=-Xmx4g
+  # Reduced from upstream's -Xmx8g / 4 GB Kotlin daemon for the self-hosted runners.
+  # Each incus container reports 48 GiB and 8 cores, so a single build has ample room —
+  # but the containers are oversubscribed against their host, and two concurrent heavy
+  # Gradle jobs get their daemons SIGKILLed ("the daemon has disappeared", no
+  # OutOfMemoryError, no heap dump). Running the same job alone succeeds. Lower heaps
+  # make two builds likelier to coexist; the real fix is sizing the containers to the
+  # host. See the "Report runner capacity" step.
+  GRADLE_OPTS: -Dorg.gradle.jvmargs=-Xmx6g -XX:MaxMetaspaceSize=768m -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -XX:+UseG1GC -Dkotlin.daemon.jvm.options=-Xmx2g
  CI_GRADLE_ARG_PROPERTIES: --stacktrace --no-daemon -Dsonar.gradle.skipCompile=true --no-configuration-cache
  ARCH: x86_64
  DEVICE: pixel_7_pro
@@ -19,12 +30,15 @@ env:
 jobs:
  build-apk:
    name: Build APK
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]
    concurrency:
      group: ${{ format('maestro-build-{0}', github.ref) }}
      cancel-in-progress: true
    steps:
      - name: Free Disk Space (Ubuntu)
+        # Only meaningful on GitHub's throwaway VMs. On a persistent self-hosted runner this
+        # would delete dotnet/haskell/docker images from the host on every run.
+        if: runner.environment == 'github-hosted'
        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be
        with:
          # This might remove tools that are actually needed, if set to "true" but frees about 6 GB
@@ -44,7 +58,7 @@ jobs:
          # https://github.com/actions/checkout/issues/881
          ref: ${{ github.ref }}
          persist-credentials: false
-      - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+      - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        name: Use JDK 21
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
@@ -36,7 +36,7 @@ jobs:
        with:
          persist-credentials: false
      - name: Use JDK 21
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
          java-version: '21'
@@ -37,7 +37,7 @@ jobs:
        uses: nschloe/action-cached-lfs-checkout@385a8ecc719e50b8c71af6ab01a624b486b7c3bc # v1.2.5

      - name: Use JDK 21
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
          java-version: '21'
@@ -80,7 +80,7 @@ jobs:
        with:
          persist-credentials: false
      - name: Use JDK 21
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
          java-version: '21'
@@ -23,33 +23,38 @@ jobs:
          script: |
            core.setFailed("PR has been labeled with X-Blocked; it cannot be merged.");

-  community-prs:
-    name: Label Community PRs
-    runs-on: ubuntu-latest
-    if: github.event.action == 'opened'
-    permissions:
-      pull-requests: write
-    steps:
-      - name: Check membership
-        if: github.event.pull_request.user.login != 'renovate[bot]'
-        uses: tspascoal/get-user-teams-membership@b2546c5affc730fd8e3d8483ae9ad3621938c2f9 # v4.0.2
-        id: teams
-        with:
-          username: ${{ github.event.pull_request.user.login }}
-          organization: element-hq
-          team: Vector Core
-          GITHUB_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN_READ_ORG }}
-      - name: Add label
-        if: steps.teams.outputs.isTeamMember == 'false'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            github.rest.issues.addLabels({
-              issue_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              labels: ['Z-Community-PR']
-            });
+  # Disabled on the HealthChat fork. This job asks whether the PR author belongs to the
+  # element-hq "Vector Core" team, using secrets.ELEMENT_BOT_TOKEN_READ_ORG — a secret
+  # that only exists upstream. Here it fails on every PR that is opened, and there is no
+  # community to label anyway. Kept commented rather than deleted so upstream changes to
+  # it still conflict visibly on merge.
+  # community-prs:
+  #   name: Label Community PRs
+  #   runs-on: ubuntu-latest
+  #   if: github.event.action == 'opened'
+  #   permissions:
+  #     pull-requests: write
+  #   steps:
+  #     - name: Check membership
+  #       if: github.event.pull_request.user.login != 'renovate[bot]'
+  #       uses: tspascoal/get-user-teams-membership@b2546c5affc730fd8e3d8483ae9ad3621938c2f9 # v4.0.2
+  #       id: teams
+  #       with:
+  #         username: ${{ github.event.pull_request.user.login }}
+  #         organization: element-hq
+  #         team: Vector Core
+  #         GITHUB_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN_READ_ORG }}
+  #     - name: Add label
+  #       if: steps.teams.outputs.isTeamMember == 'false'
+  #       uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+  #       with:
+  #         script: |
+  #           github.rest.issues.addLabels({
+  #             issue_number: context.issue.number,
+  #             owner: context.repo.owner,
+  #             repo: context.repo.repo,
+  #             labels: ['Z-Community-PR']
+  #           });

  close-if-fork-develop:
    name: Forbid develop branch fork contributions
@@ -7,11 +7,22 @@ on:
  push:
    branches: [ main, develop ]

-permissions: {}
+permissions:
+  # Private fork: actions/checkout needs contents:read to clone. Upstream is public,
+  # where an empty token can still read the repo, so an empty permissions block works there and
+  # fails here with `fatal: repository not found`.
+  contents: read

 # Enrich gradle.properties for CI/CD
 env:
-  GRADLE_OPTS: -Dorg.gradle.jvmargs=-Xmx8g -XX:MaxMetaspaceSize=512m -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -XX:+UseG1GC -Dkotlin.daemon.jvm.options=-Xmx4g
+  # Reduced from upstream's -Xmx8g / 4 GB Kotlin daemon for the self-hosted runners.
+  # Each incus container reports 48 GiB and 8 cores, so a single build has ample room —
+  # but the containers are oversubscribed against their host, and two concurrent heavy
+  # Gradle jobs get their daemons SIGKILLed ("the daemon has disappeared", no
+  # OutOfMemoryError, no heap dump). Running the same job alone succeeds. Lower heaps
+  # make two builds likelier to coexist; the real fix is sizing the containers to the
+  # host. See the "Report runner capacity" step.
+  GRADLE_OPTS: -Dorg.gradle.jvmargs=-Xmx6g -XX:MaxMetaspaceSize=768m -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -XX:+UseG1GC -Dkotlin.daemon.jvm.options=-Xmx2g
  CI_GRADLE_ARG_PROPERTIES: --stacktrace --no-daemon -Dsonar.gradle.skipCompile=true --no-configuration-cache

 jobs:
@@ -20,6 +31,9 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Free Disk Space (Ubuntu)
+        # Only meaningful on GitHub's throwaway VMs. On a persistent self-hosted runner this
+        # would delete dotnet/haskell/docker images from the host on every run.
+        if: runner.environment == 'github-hosted'
        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be
        with:
          # This might remove tools that are actually needed, if set to "true" but frees about 6 GB
@@ -63,13 +77,13 @@ jobs:

  checkDependencies:
    name: Search for invalid dependencies
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Use JDK 21
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
          java-version: '21'
@@ -87,7 +101,7 @@ jobs:
  # Code checks
  konsist:
    name: Konsist tests
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]
    # Allow all jobs on main and develop. Just one per PR.
    concurrency:
      group: ${{ github.ref == 'refs/heads/main' && format('check-konsist-main-{0}', github.sha) || github.ref == 'refs/heads/develop' && format('check-konsist-develop-{0}', github.sha) || format('check-konsist-{0}', github.ref) }}
@@ -108,7 +122,7 @@ jobs:
        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
        run: git submodule update --init --recursive
      - name: Use JDK 21
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
          java-version: '21'
@@ -128,12 +142,21 @@ jobs:

  compose:
    name: Compose tests
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]
    # Allow all jobs on main and develop. Just one per PR.
    concurrency:
      group: ${{ github.ref == 'refs/heads/main' && format('check-compose-main-{0}', github.sha) || github.ref == 'refs/heads/develop' && format('check-compose-develop-{0}', github.sha) || format('check-compose-{0}', github.ref) }}
      cancel-in-progress: true
    steps:
+      # Records the container's real limits so heap settings can be read against them
+      # instead of guessed at. Mirrors healthchat-release-playstore.yml.
+      - name: Report runner capacity
+        if: runner.environment == 'self-hosted'
+        run: |
+          free -h; nproc; df -h .
+          cat /sys/fs/cgroup/memory.max 2>/dev/null \
+            || cat /sys/fs/cgroup/memory/memory.limit_in_bytes 2>/dev/null \
+            || echo "no cgroup memory limit visible"
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          # Ensure we are building the branch and not the branch after being merged on develop
@@ -149,7 +172,7 @@ jobs:
        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
        run: git submodule update --init --recursive
      - name: Use JDK 21
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
          java-version: '21'
@@ -162,7 +185,7 @@ jobs:

  lint:
    name: Android lint check
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]
    # Allow all jobs on main and develop. Just one per PR.
    concurrency:
      group: ${{ github.ref == 'refs/heads/main' && format('check-lint-main-{0}', github.sha) || github.ref == 'refs/heads/develop' && format('check-lint-develop-{0}', github.sha) || format('check-lint-{0}', github.ref) }}
@@ -183,7 +206,7 @@ jobs:
        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
        run: git submodule update --init --recursive
      - name: Use JDK 21
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
          java-version: '21'
@@ -207,7 +230,7 @@ jobs:

  detekt:
    name: Detekt checks
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]
    # Allow all jobs on main and develop. Just one per PR.
    concurrency:
      group: ${{ github.ref == 'refs/heads/main' && format('check-detekt-main-{0}', github.sha) || github.ref == 'refs/heads/develop' && format('check-detekt-develop-{0}', github.sha) || format('check-detekt-{0}', github.ref) }}
@@ -228,7 +251,7 @@ jobs:
        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
        run: git submodule update --init --recursive
      - name: Use JDK 21
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
          java-version: '21'
@@ -248,7 +271,7 @@ jobs:

  ktlint:
    name: Ktlint checks
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]
    # Allow all jobs on main and develop. Just one per PR.
    concurrency:
      group: ${{ github.ref == 'refs/heads/main' && format('check-ktlint-main-{0}', github.sha) || github.ref == 'refs/heads/develop' && format('check-ktlint-develop-{0}', github.sha) || format('check-ktlint-{0}', github.ref) }}
@@ -269,7 +292,7 @@ jobs:
        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
        run: git submodule update --init --recursive
      - name: Use JDK 21
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
          java-version: '21'
@@ -331,6 +354,10 @@ jobs:
    name: Run zizmor
    runs-on: ubuntu-latest
    permissions:
+      # A job-level block replaces the workflow-level one, so contents:read has to be
+      # repeated here or checkout fails on this private fork.
+      contents: read
+      actions: read # Required for zizmor to read workflow files.
      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -360,7 +387,7 @@ jobs:
          yarn add danger-plugin-lint-report --dev
      - name: Danger lint
        if: always()
-        uses: danger/danger-js@e9b58820039524318198d8059ec98b0c02b7875c # 13.0.10
+        uses: danger/danger-js@58355dc2b274a87699c8b7deac01baba16d6f061 # 13.0.8
        with:
          args: "--dangerfile ./tools/danger/dangerfile-lint.js"
        env:
@@ -5,12 +5,27 @@ on:
  pull_request:
    types: [ labeled ]

-permissions: {}
+permissions:
+  # Private fork: actions/checkout needs contents:read to clone. Upstream is public,
+  # where an empty token can still read the repo, so an empty permissions block works there and
+  # fails here with `fatal: repository not found`.
+  contents: read

 # Enrich gradle.properties for CI/CD
 env:
-  GRADLE_OPTS: -Dorg.gradle.jvmargs=-Xmx8g -XX:MaxMetaspaceSize=512m -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -XX:+UseG1GC -Dkotlin.daemon.jvm.options=-Xmx4g -Dsonar.gradle.skipCompile=true
-  CI_GRADLE_ARG_PROPERTIES: --no-configuration-cache
+  # Reduced from upstream's -Xmx8g / 4 GB Kotlin daemon for the self-hosted runners.
+  # Each incus container reports 48 GiB and 8 cores, so a single build has ample room —
+  # but the containers are oversubscribed against their host, and two concurrent heavy
+  # Gradle jobs get their daemons SIGKILLed ("the daemon has disappeared", no
+  # OutOfMemoryError, no heap dump). Running the same job alone succeeds. Lower heaps
+  # make two builds likelier to coexist; the real fix is sizing the containers to the
+  # host. See the "Report runner capacity" step.
+  # Kept character-identical to tests.yml so the record path and the verify path cannot drift
+  # apart again. These only affect the Gradle daemon — Paparazzi renders in forked test workers
+  # configured entirely by build.gradle.kts — but keeping them aligned removes a whole class of
+  # "did record and verify run the same way?" questions.
+  GRADLE_OPTS: -Dorg.gradle.jvmargs="-Xmx6g -XX:MaxMetaspaceSize=768m -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError" -Dkotlin.daemon.jvm.options=-Xmx2g -XX:+UseG1GC
+  CI_GRADLE_ARG_PROPERTIES: --stacktrace --no-daemon -Dsonar.gradle.skipCompile=true --no-configuration-cache --max-workers=4

 jobs:
  record:
@@ -19,11 +34,14 @@ jobs:
      pull-requests: write
      contents: write
    name: Record screenshots on branch ${{ github.event.pull_request.head.ref || github.ref_name }}
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]
    if: github.event_name == 'workflow_dispatch' || github.event.label.name == 'Record-Screenshots'

    steps:
      - name: Free Disk Space (Ubuntu)
+        # Only meaningful on GitHub's throwaway VMs. On a persistent self-hosted runner this
+        # would delete dotnet/haskell/docker images from the host on every run.
+        if: runner.environment == 'github-hosted'
        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be
        with:
          # This might remove tools that are actually needed, if set to "true" but frees about 6 GB
@@ -54,7 +72,7 @@ jobs:
        with:
          persist-credentials: false
      - name: ☕️ Use JDK 21
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
          java-version: '21'
@@ -68,5 +86,9 @@ jobs:
        run: ./.github/workflows/scripts/recordScreenshots.sh
        env:
          GITHUB_TOKEN: ${{ secrets.DANGER_GITHUB_API_TOKEN || secrets.GITHUB_TOKEN }}
-          GITHUB_REPOSITORY: ${{ secrets.GITHUB_REPOSITORY }}
+          # Must be the `github.repository` context, not a secret. There is no
+          # GITHUB_REPOSITORY secret on this fork, so `secrets.GITHUB_REPOSITORY` expands to ""
+          # and overrides the built-in env var of the same name — recordScreenshots.sh then
+          # exits 1 with "No repo specified" before Gradle ever runs.
+          GITHUB_REPOSITORY: ${{ github.repository }}
          GRADLE_ARGS: ${{ env.CI_GRADLE_ARG_PROPERTIES }}
@@ -38,7 +38,7 @@ jobs:
        with:
          persist-credentials: false
      - name: Use JDK 21
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
          java-version: '21'
@@ -82,7 +82,7 @@ jobs:
      - name: Clone submodules
        run: git submodule update --init --recursive
      - name: Use JDK 21
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
          java-version: '21'
@@ -126,7 +126,7 @@ jobs:
        with:
          persist-credentials: false
      - name: Use JDK 21
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
          java-version: '21'
@@ -7,24 +7,38 @@ on:
  push:
    branches: [ main, develop ]

-permissions: {}
+permissions:
+  # Private fork: actions/checkout needs contents:read to clone. Upstream is public,
+  # where an empty token can still read the repo, so an empty permissions block works there and
+  # fails here with `fatal: repository not found`.
+  contents: read

 # Enrich gradle.properties for CI/CD
 env:
-  GRADLE_OPTS: -Dorg.gradle.jvmargs=-Xmx8g -XX:MaxMetaspaceSize=512m -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -XX:+UseG1GC -Dkotlin.daemon.jvm.options=-Xmx4g
+  # Reduced from upstream's -Xmx8g / 4 GB Kotlin daemon for the self-hosted runners.
+  # Each incus container reports 48 GiB and 8 cores, so a single build has ample room —
+  # but the containers are oversubscribed against their host, and two concurrent heavy
+  # Gradle jobs get their daemons SIGKILLed ("the daemon has disappeared", no
+  # OutOfMemoryError, no heap dump). Running the same job alone succeeds. Lower heaps
+  # make two builds likelier to coexist; the real fix is sizing the containers to the
+  # host. See the "Report runner capacity" step.
+  GRADLE_OPTS: -Dorg.gradle.jvmargs=-Xmx6g -XX:MaxMetaspaceSize=768m -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -XX:+UseG1GC -Dkotlin.daemon.jvm.options=-Xmx2g
  CI_GRADLE_ARG_PROPERTIES: --stacktrace --warn -Dsonar.gradle.skipCompile=true --no-configuration-cache
  GROUP: ${{ format('sonar-{0}', github.ref) }}

 jobs:
  sonar:
    name: Sonar Quality Checks
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]
    # Allow all jobs on main and develop. Just one per PR.
    concurrency:
      group: ${{ format('sonar-{0}', github.ref) }}
      cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/develop' }}
    steps:
      - name: Free Disk Space (Ubuntu)
+        # Only meaningful on GitHub's throwaway VMs. On a persistent self-hosted runner this
+        # would delete dotnet/haskell/docker images from the host on every run.
+        if: runner.environment == 'github-hosted'
        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be
        with:
          # This might remove tools that are actually needed, if set to "true" but frees about 6 GB
@@ -45,7 +59,7 @@ jobs:
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
          persist-credentials: false
      - name: Use JDK 21
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
          java-version: '21'
@@ -17,7 +17,7 @@ jobs:
        with:
          persist-credentials: false
      - name: Use JDK 21
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
          java-version: '21'
@@ -39,7 +39,6 @@ jobs:
          ./tools/localazy/downloadStrings.sh --all
          ./tools/localazy/importSupportedLocalesFromLocalazy.py
          ./tools/test/generateAllScreenshots.py
-          ./tools/manifest/aaptDump.sh
      - name: Create Pull Request for Strings
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
@@ -7,24 +7,53 @@ on:
  push:
    branches: [ main, develop ]

-permissions: {}
+permissions:
+  # Private fork: actions/checkout needs contents:read to clone. Upstream is public,
+  # where an empty token can still read the repo, so an empty permissions block works there and
+  # fails here with `fatal: repository not found`.
+  contents: read

 # Enrich gradle.properties for CI/CD
 env:
-  GRADLE_OPTS: -Dorg.gradle.jvmargs="-Xmx7g -XX:MaxMetaspaceSize=512m -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError" -Dkotlin.daemon.jvm.options=-Xmx2g -XX:+UseG1GC
-  CI_GRADLE_ARG_PROPERTIES: --stacktrace --no-daemon -Dsonar.gradle.skipCompile=true --no-configuration-cache
+  # Reduced from upstream's -Xmx8g / 4 GB Kotlin daemon for the self-hosted runners.
+  # Each incus container reports 48 GiB and 8 cores, so a single build has ample room —
+  # but the containers are oversubscribed against their host, and two concurrent heavy
+  # Gradle jobs get their daemons SIGKILLed ("the daemon has disappeared", no
+  # OutOfMemoryError, no heap dump). Running the same job alone succeeds. Lower heaps
+  # make two builds likelier to coexist; the real fix is sizing the containers to the
+  # host. See the "Report runner capacity" step.
+  GRADLE_OPTS: -Dorg.gradle.jvmargs="-Xmx6g -XX:MaxMetaspaceSize=768m -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError" -Dkotlin.daemon.jvm.options=-Xmx2g -XX:+UseG1GC
+  # --max-workers caps how many test tasks run at once. build.gradle.kts sets
+  # maxParallelForks = cores/2 and screenshot tests fork at maxHeapSize=2g, so on these
+  # 8-core containers the default (workers = cores = 8) allows 8 x 4 x 2g = 64 GB of test
+  # JVMs against a 48 GiB cgroup limit, with no swap — the daemon gets OOM-killed and
+  # Gradle reports "the daemon has disappeared". GitHub's 4-core hosted runners reach only
+  # 2 x 2 x 2g = 16 GB and additionally have the 8 GB swapfile added above.
+  CI_GRADLE_ARG_PROPERTIES: --stacktrace --no-daemon -Dsonar.gradle.skipCompile=true --no-configuration-cache --max-workers=4

 jobs:
  tests:
    name: Runs unit tests
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64]

    # Allow all jobs on main and develop. Just one per PR.
    concurrency:
      group: ${{ github.ref == 'refs/heads/main' && format('unit-tests-main-{0}', github.sha) || github.ref == 'refs/heads/develop' && format('unit-tests-develop-{0}', github.sha) || format('unit-tests-{0}', github.ref) }}
      cancel-in-progress: true
    steps:
+      # Records the container's real limits so heap settings can be read against them
+      # instead of guessed at. Mirrors healthchat-release-playstore.yml.
+      - name: Report runner capacity
+        if: runner.environment == 'self-hosted'
+        run: |
+          free -h; nproc; df -h .
+          cat /sys/fs/cgroup/memory.max 2>/dev/null \
+            || cat /sys/fs/cgroup/memory/memory.limit_in_bytes 2>/dev/null \
+            || echo "no cgroup memory limit visible"
      - name: Free Disk Space (Ubuntu)
+        # Only meaningful on GitHub's throwaway VMs. On a persistent self-hosted runner this
+        # would delete dotnet/haskell/docker images from the host on every run.
+        if: runner.environment == 'github-hosted'
        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be
        with:
          # This might remove tools that are actually needed, if set to "true" but frees about 6 GB
@@ -41,6 +70,9 @@ jobs:
      # Increase swapfile size to prevent screenshot tests getting terminated
      # https://github.com/actions/runner-images/discussions/7188#discussioncomment-6750749
      - name: 💽 Increase swapfile size
+        # /mnt/swapfile is a GitHub runner-image path and this needs passwordless sudo,
+        # so it only applies to the hosted VMs.
+        if: runner.environment == 'github-hosted'
        run: |
          sudo swapoff -a
          sudo fallocate -l 8G /mnt/swapfile
@@ -63,7 +95,7 @@ jobs:
        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'element-hq/element-x-android' }}
        run: git submodule update --init --recursive
      - name: ☕️ Use JDK 21
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        with:
          distribution: 'temurin' # See 'Supported distributions' for available options
          java-version: '21'
@@ -107,7 +139,14 @@ jobs:
          echo "---" >> $GITHUB_STEP_SUMMARY

      # https://github.com/codecov/codecov-action
+      # This fork has no CODECOV_TOKEN, and Codecov rejects tokenless uploads from private
+      # repositories ("Token required - not valid tokenless upload"). With
+      # fail_ci_if_error: true that failed the whole job *after* the tests had passed, so
+      # skip the upload unless a token is configured. Adding the secret re-enables it.
      - name: ☂️ Upload coverage reports to codecov
+        if: env.CODECOV_TOKEN != ''
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          fail_ci_if_error: true
@@ -2,7 +2,11 @@ name: Validate Git LFS

 on: [pull_request, merge_group]

-permissions: {}
+permissions:
+  # Private fork: actions/checkout needs contents:read to clone. Upstream is public,
+  # where an empty token can still read the repo, so an empty permissions block works there and
+  # fails here with `fatal: repository not found`.
+  contents: read

 jobs:
  build:
@@ -82,6 +82,9 @@ captures/
 #*.jks
 #*.keystore

+# HealthChat upload keystore, materialized from a CI secret — never commit it
+app/signature/release.keystore
+
 # External native build folder generated in Android Studio 2.2 and later
 .externalNativeBuild
 .cxx/
@@ -1,21 +0,0 @@
-appId: ${MAESTRO_APP_ID}
---
-# Clean up the room list if it was left in a bad state by previous tests
- runFlow:
-    when:
-      visible: 'aRoomName'
-    commands:
-      - longPressOn: 'aRoomName'
-      - tapOn:
-          text: "Leave room"
-          index: 0
-      - tapOn: "Leave"
- runFlow:
-    when:
-      visible: ${MAESTRO_INVITEE1_MXID}
-    commands:
-      - longPressOn: ${MAESTRO_INVITEE1_MXID}
-      - tapOn:
-          text: "Leave room"
-          index: 0
-      - tapOn: "Leave"
@@ -7,16 +7,7 @@ appId: ${MAESTRO_APP_ID}
 - tapOn:
    text: ${MAESTRO_INVITEE1_MXID}
    index: 1
- runFlow:
-    when:
-      visible: 'Start a chat with this new contact?'
-    commands:
-      - tapOn: 'Continue'
- runFlow:
-    when:
-      visible: 'Send invite?'
-    commands:
-      - tapOn: 'Send invite'
+- tapOn: "Continue"
 - takeScreenshot: build/maestro/330-createAndDeleteDM
 - tapOn: "maestroelement2"
 - scroll
@@ -15,12 +15,6 @@ appId: ${MAESTRO_APP_ID}
    text: ${MAESTRO_INVITEE1_MXID}
    index: 1
 - tapOn: "Finish"
- runFlow:
-    when:
-      visible: 'Invite new contact to this room?'
-    commands:
-      - tapOn:
-          id: "confirm_invite_unknown"
 - tapOn: "aRoomName"
 - tapOn: "Invite"
 # assert there's 1 member and 1 invitee
@@ -29,10 +23,6 @@ appId: ${MAESTRO_APP_ID}
 - tapOn:
    text: ${MAESTRO_INVITEE2_MXID}
    index: 1
-# Hide keyboard by tapping on an external element in case it's displayed, otherwise it will 'eat' the back button press
- tapOn:
-    # Navigation title
-    text: "Invite people"
 - tapOn: "Invite"
 - runFlow:
    when:
@@ -40,6 +30,10 @@ appId: ${MAESTRO_APP_ID}
    commands:
      - tapOn:
          id: "confirm_invite_unknown"
+# Close the keyboard if it's still open
+- tapOn: "Back"
+# Go back to the room details screen
+- tapOn: "Back"
 - scrollUntilVisible:
    direction: DOWN
    element:
@@ -1,6 +1,5 @@
 appId: ${MAESTRO_APP_ID}
 ---
- runFlow: cleanUpRoomList.yaml
 - runFlow: searchRoomList.yaml
 - takeScreenshot: build/maestro/300-RoomList
 - runFlow: timeline/timeline.yaml
@@ -1,52 +1,3 @@
-Changes in Element X v26.07.0
-=============================
-
-<!-- Release notes generated using configuration in .github/release.yml at v26.07.0 -->
-
-## What's Changed
-### ✨ Features
-* Add read all messages feature by @hghgrtut in https://github.com/element-hq/element-x-android/pull/7049
-### 🐛 Bugfixes
-* Detect RTL text in events and adjust the text rendering by @jmartinesp in https://github.com/element-hq/element-x-android/pull/6994
-### 🗣 Translations
-* Sync Strings by @ElementBot in https://github.com/element-hq/element-x-android/pull/7071
-* Sync Strings by @ElementBot in https://github.com/element-hq/element-x-android/pull/7115
-### 🧱 Build
-* Fix Sonar with AGP 9 (some workarounds) by @jmartinesp in https://github.com/element-hq/element-x-android/pull/7055
-* Disable periodically generating the screenshot gallery by @jmartinesp in https://github.com/element-hq/element-x-android/pull/7110
-* Try a different workaround for flaky `ScanQrCodeViewTest` by @jmartinesp in https://github.com/element-hq/element-x-android/pull/7109
-### 🚧 In development 🚧
-* Protect link new device by @bmarty in https://github.com/element-hq/element-x-android/pull/6992
-### Dependency upgrades
-* Update metro to v1.2.1 by @renovate[bot] in https://github.com/element-hq/element-x-android/pull/7057
-* Update gradle/actions action to v6.2.0 by @renovate[bot] in https://github.com/element-hq/element-x-android/pull/7063
-* Update roborazzi to v1.64.0 by @renovate[bot] in https://github.com/element-hq/element-x-android/pull/7068
-* Update rnkdsh/action-upload-diawi action to v1.5.13 by @renovate[bot] in https://github.com/element-hq/element-x-android/pull/7067
-* Update dependency io.element.android:element-call-embedded to v0.20.2 by @renovate[bot] in https://github.com/element-hq/element-x-android/pull/7075
-* Update dependency com.github.matrix-org:matrix-analytics-events to v0.37.0 by @renovate[bot] in https://github.com/element-hq/element-x-android/pull/7079
-* Update actions/setup-java action to v5.3.0 by @renovate[bot] in https://github.com/element-hq/element-x-android/pull/7088
-* Update dependency org.matrix.rustcomponents:sdk-android to v26.06.18 by @renovate[bot] in https://github.com/element-hq/element-x-android/pull/7052
-* Update firebaseAppDistribution to v5.3.0 by @renovate[bot] in https://github.com/element-hq/element-x-android/pull/7096
-* Update dependency com.google.firebase:firebase-bom to v34.15.0 by @renovate[bot] in https://github.com/element-hq/element-x-android/pull/7089
-* Update dependency com.google.crypto.tink:tink-android to v1.22.0 by @renovate[bot] in https://github.com/element-hq/element-x-android/pull/7105
-* Update actions/checkout action to v7 by @renovate[bot] in https://github.com/element-hq/element-x-android/pull/7098
-* Update lifecycle to v2.11.0 by @renovate[bot] in https://github.com/element-hq/element-x-android/pull/7097
-* Update danger/danger-js action to v13.0.8 by @renovate[bot] in https://github.com/element-hq/element-x-android/pull/7104
-* Update dependency org.matrix.rustcomponents:sdk-android to v26.06.25 by @renovate[bot] in https://github.com/element-hq/element-x-android/pull/7107
-* Update dependency androidx.compose:compose-bom to v2026.06.00 by @renovate[bot] in https://github.com/element-hq/element-x-android/pull/7095
-* Update dependency io.element.android:element-call-embedded to v0.20.3 by @renovate[bot] in https://github.com/element-hq/element-x-android/pull/7117
-* Update zizmorcore/zizmor-action action to v0.5.7 by @renovate[bot] in https://github.com/element-hq/element-x-android/pull/7116
-* Update dependency org.matrix.rustcomponents:sdk-android to v26.06.30 by @renovate[bot] in https://github.com/element-hq/element-x-android/pull/7127
-* Update dependency com.posthog:posthog-android to v3.51.1 by @renovate[bot] in https://github.com/element-hq/element-x-android/pull/7128
-### Others
-* Fix small code smell by @bmarty in https://github.com/element-hq/element-x-android/pull/7058
-* Hide message notification content when the app is locked by @bxdxnn in https://github.com/element-hq/element-x-android/pull/6902
-
-## New Contributors
-* @hghgrtut made their first contribution in https://github.com/element-hq/element-x-android/pull/7049
-
-**Full Changelog**: https://github.com/element-hq/element-x-android/compare/v26.06.4...v26.07.0
-
 Changes in Element X v26.06.4
 =============================

@@ -0,0 +1,29 @@
+# HealthChat Android changelog
+
+This file is the single source for Play Store "What's new" texts. The release
+pipeline (`.github/workflows/healthchat-release-playstore.yml`) extracts the
+top section matching the released version — the heading must have the exact
+form `## Changes in <version> (<date>)` and the whole section must stay under
+500 characters. See `.claude/skills/releasing-healthchat/SKILL.md`.
+
+## Changes in 26.08.0 (2026-08-06)
+
+🎉 Neue Funktionen
+
+- Mitgliederverzeichnis: Alle Mitglieder durchsuchen und direkt einen Chat starten.
+- Profil bearbeiten: Angaben und Profilbild direkt in der App pflegen.
+- Neue Mitglieder per E-Mail einladen.
+- Statushinweise zeigen den Stand der Kontofreigabe.
+
+🙌 Verbesserungen
+
+- HealthChat-Links öffnen sich neu direkt in der App statt im Browser.
+- Geteilte Profillinks verweisen neu auf HealthChat statt auf Element.
+
+## Changes in 26.07.0 (2026-07-16)
+
+🎉 Komplett neue App-Generation
+
+- HealthChat basiert neu auf Element X: schnellere Synchronisation, moderne Oberfläche und verbesserte Verschlüsselung.
+- Anmeldung neu über den sicheren HealthChat Login (SSO).
+- Hinweis: Nach dem Update ist eine einmalige Neuanmeldung erforderlich.
@@ -96,6 +96,18 @@ android {
            storePassword = System.getenv("ELEMENT_ANDROID_NIGHTLY_STOREPASSWORD")
                ?: project.property("signing.element.nightly.storePassword") as? String?
        }
+        // HealthChat Play Store upload key. The keystore is not in the repo:
+        // CI decodes it from the RELEASE_KEYSTORE_BASE64 secret (see
+        // .github/workflows/healthchat-release-playstore.yml).
+        register("healthchat") {
+            keyAlias = System.getenv("RELEASE_KEY_ALIAS")
+                ?: project.property("signing.healthchat.keyId") as? String?
+            keyPassword = System.getenv("RELEASE_KEY_PASSWORD")
+                ?: project.property("signing.healthchat.keyPassword") as? String?
+            storeFile = file(System.getenv("RELEASE_STORE_FILE") ?: "./signature/release.keystore")
+            storePassword = System.getenv("RELEASE_STORE_PASSWORD")
+                ?: project.property("signing.healthchat.storePassword") as? String?
+        }
    }

    val baseAppName = BuildTimeConfig.APPLICATION_NAME
@@ -122,7 +134,13 @@ android {
                "login_redirect_scheme",
                oAuthRedirectSchemeBase,
            )
-            signingConfig = signingConfigs.getByName("debug")
+            // Sign with the HealthChat upload key when it is available (CI),
+            // fall back to the debug key for local release builds.
+            signingConfig = if (System.getenv("RELEASE_STORE_FILE") != null || file("./signature/release.keystore").exists()) {
+                signingConfigs.getByName("healthchat")
+            } else {
+                signingConfigs.getByName("debug")
+            }

            optimization {
                enable = true
@@ -261,7 +279,7 @@ dependencies {
        implementation(projects.appicon.enterprise)
    } else {
        implementation(projects.features.enterprise.implFoss)
-        implementation(projects.appicon.element)
+        implementation(projects.appicon.healthchat)
    }
    allFeaturesImpl(project)
    implementation(projects.features.migration.api)
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="utf-8"?><!--
+  ~ Copyright (c) 2026 Novaloop AG
+  ~
+  ~ SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial.
+  ~ Please see LICENSE files in the repository root for full details.
+  -->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools">
+
+    <!--
+      HealthChat does not want APK sideloading from chat. Upstream declares
+      REQUEST_INSTALL_PACKAGES so that tapping an .apk attachment in the media
+      viewer deep-links to "Install unknown apps" and hands the file to the
+      system installer (see AndroidLocalMediaActions.open) — a workflow aimed at
+      Element's nightly/F-Droid audience, and not one we want in a healthcare
+      messenger. Play Console also rejects releases carrying this permission
+      unless it is declared and justified on the listing.
+
+      Removing it is a configuration upstream supports: the media viewer checks
+      for the permission before using it and otherwise falls through to the
+      normal system open path, so .apk attachments still open, just without the
+      in-app install shortcut.
+    -->
+    <uses-permission
+        android:name="android.permission.REQUEST_INSTALL_PACKAGES"
+        tools:node="remove" />
+
+    <!--
+      HealthChat ships no location features, so it should not ask for location.
+      They are already unreachable at runtime: DefaultLocationService gates the
+      whole feature on BuildConfig.MAPTILER_API_KEY, and HealthChat sets no
+      MapTiler key (BuildTimeConfig.SERVICES_MAPTILER_APIKEY = null, and the
+      ELEMENT_ANDROID_MAPTILER_API_KEY fallback is unset in CI). The composer's
+      "Share location" action and the location viewer are both hidden as a
+      result, so LiveLocationSharingService can never start — only these
+      declarations survive, and FOREGROUND_SERVICE_LOCATION forces a foreground
+      service declaration on the Play listing for a feature we do not ship.
+
+      Removing the declarations changes nothing users can reach, and keeps the
+      location module in the dependency graph so upstream merges stay clean.
+
+      The service must be named fully qualified: the library declares it
+      relative to its own namespace (io.element.android.features.location.impl),
+      whereas a leading dot here would resolve against the app's namespace.
+
+      FOREGROUND_SERVICE itself stays — the call and push modules need it.
+    -->
+    <uses-permission
+        android:name="android.permission.FOREGROUND_SERVICE_LOCATION"
+        tools:node="remove" />
+    <uses-permission
+        android:name="android.permission.ACCESS_FINE_LOCATION"
+        tools:node="remove" />
+    <uses-permission
+        android:name="android.permission.ACCESS_COARSE_LOCATION"
+        tools:node="remove" />
+
+    <application>
+        <service
+            android:name="io.element.android.features.location.impl.live.service.LiveLocationSharingService"
+            tools:node="remove" />
+    </application>
+</manifest>
@@ -8,6 +8,9 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:tools="http://schemas.android.com/tools">

+    <!-- To be able to install APK from the application -->
+    <uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" />
+
    <application
        android:name=".ElementXApplication"
        android:allowBackup="false"
@@ -49,7 +52,7 @@
        Using launchMode singleTask to avoid multiple instances of the Activity
        when the app is already open. This is important for incoming share (see
        https://github.com/element-hq/element-x-android/issues/4074) and for opening
-        the application from a mobile.element.io link.
+        the application from a permalink.
        -->
        <activity
            android:name=".MainActivity"
@@ -69,7 +72,7 @@
                <category android:name="android.intent.category.DEFAULT" />
                <data
                    android:host="open"
-                    android:scheme="elementx" />
+                    android:scheme="healthchat" />
            </intent-filter>
            <!--
              OAuth redirection
@@ -83,7 +86,9 @@
                <data android:scheme="@string/login_redirect_scheme" />
            </intent-filter>
            <!--
-              Element web links
+              HealthChat web links
+              Note: hosts are listed one by one on purpose, a "*.healthchat.ch" wildcard would
+              also intercept the homeserver and authentication domains.
            -->
            <intent-filter android:autoVerify="true">
                <action android:name="android.intent.action.VIEW" />
@@ -92,28 +97,12 @@
                <category android:name="android.intent.category.BROWSABLE" />

                <data android:scheme="https" />
-                <!-- Note: we can't use "*.element.io" here because it'll intercept the "mas.element.io" domain too. -->
-                <!-- Matching asset file: https://app.element.io/.well-known/assetlinks.json -->
-                <data android:host="app.element.io" />
-                <!-- Matching asset file: https://develop.element.io/.well-known/assetlinks.json -->
-                <data android:host="develop.element.io" />
-                <!-- Matching asset file: https://staging.element.io/.well-known/assetlinks.json -->
-                <data android:host="staging.element.io" />
-            </intent-filter>
-            <!--
-              Element mobile links
-              Example: https://mobile.element.io/element/?account_provider=example.org&login_hint=mxid:@alice:example.org
-            -->
-            <intent-filter android:autoVerify="true">
-                <action android:name="android.intent.action.VIEW" />
-
-                <category android:name="android.intent.category.DEFAULT" />
-                <category android:name="android.intent.category.BROWSABLE" />
-
-                <data android:scheme="https" />
-                <!-- Matching asset file: https://mobile.element.io/.well-known/assetlinks.json -->
-                <data android:host="mobile.element.io" />
-                <data android:path="/element/" />
+                <!-- HealthChat web client permalinks, example: https://app.healthchat.ch/#/room/#room:healthchat.ch -->
+                <!-- Matching asset file: https://app.healthchat.ch/.well-known/assetlinks.json -->
+                <data android:host="app.healthchat.ch" />
+                <!-- HealthChat matrix.to deployment, example: https://to.healthchat.ch/#/#room:healthchat.ch -->
+                <!-- Matching asset file: https://to.healthchat.ch/.well-known/assetlinks.json -->
+                <data android:host="to.healthchat.ch" />
            </intent-filter>
            <!--
              matrix: links
@@ -127,7 +116,7 @@
                <data android:scheme="matrix" />
            </intent-filter>
            <!--
-              links from matrix.to website
+              links from the HealthChat matrix.to website, example: healthchat://room/%23room%3Ahealthchat.ch
            -->
            <intent-filter>
                <action android:name="android.intent.action.VIEW" />
@@ -135,7 +124,7 @@
                <category android:name="android.intent.category.DEFAULT" />
                <category android:name="android.intent.category.BROWSABLE" />

-                <data android:scheme="element" />
+                <data android:scheme="healthchat" />
                <data android:host="user" />
                <data android:host="room" />
            </intent-filter>
@@ -15,7 +15,7 @@ import io.element.android.libraries.matrix.api.MatrixClient

@ContributesBinding(AppScope::class)
 class DefaultSessionGraphFactory(
-    private val appGraph: AppGraph,
+    private val appGraph: AppGraph
 ) : SessionGraphFactory {
    override fun create(client: MatrixClient): Any {
        return appGraph.sessionGraphFactory.create(client)
@@ -24,12 +24,12 @@ object ApplicationConfig {
     * Cannot be empty.
     * For Element, the value is "Element".
     */
-    const val PRODUCTION_APPLICATION_NAME: String = "Element"
+    const val PRODUCTION_APPLICATION_NAME: String = "HealthChat"

    /**
     * Used in the strings to reference the Element Desktop client, for instance Element Web.
     * Cannot be empty.
     * For Element, the value is "Element". We use the same name for desktop and mobile for now.
     */
-    const val DESKTOP_APPLICATION_NAME: String = "Element"
+    const val DESKTOP_APPLICATION_NAME: String = "HealthChat"
 }
@@ -10,5 +10,19 @@ package io.element.android.appconfig

 object MatrixConfiguration {
    const val MATRIX_TO_PERMALINK_BASE_URL: String = "https://matrix.to/#/"
+
+    /**
+     * HealthChat's own matrix.to deployment (https://github.com/Novaloop-AG/healthchat-matrix.to).
+     * It uses the exact same URL format as matrix.to, so links can be translated by swapping the
+     * base URL. Used both to recognise incoming links and to build links shared outside of Matrix.
+     */
+    const val HEALTHCHAT_TO_PERMALINK_BASE_URL: String = "https://to.healthchat.ch/#/"
+
+    /**
+     * Base URL of the HealthChat web client, which is what the healthchat:// custom scheme
+     * handed out by [HEALTHCHAT_TO_PERMALINK_BASE_URL] points to.
+     */
+    const val HEALTHCHAT_WEB_BASE_URL: String = "https://app.healthchat.ch/#/"
+
    val clientPermalinkBaseUrl: String? = null
 }
@@ -0,0 +1,17 @@
+/*
+ * Copyright (c) 2026 Novaloop AG
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial.
+ * Please see LICENSE files in the repository root for full details.
+ */
+plugins {
+    id("io.element.android-compose-library")
+}
+
+android {
+    namespace = "io.element.android.appicon.healthchat"
+
+    buildTypes {
+        register("nightly")
+    }
+}
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?><!--
+  ~ Copyright (c) 2026 Novaloop AG
+  ~
+  ~ SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial.
+  ~ Please see LICENSE files in the repository root for full details.
+  -->
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="108dp"
+    android:height="108dp"
+    android:viewportWidth="108"
+    android:viewportHeight="108">
+    <path
+        android:fillColor="#12325C"
+        android:fillType="evenOdd"
+        android:pathData="m0,0h108v108h-108z" />
+</vector>
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?><!--
+  ~ Copyright (c) 2026 Novaloop AG
+  ~
+  ~ SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial.
+  ~ Please see LICENSE files in the repository root for full details.
+  -->
+<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
+    <background android:drawable="@drawable/ic_launcher_background" />
+    <foreground android:drawable="@mipmap/ic_launcher_foreground" />
+    <monochrome android:drawable="@mipmap/ic_launcher_monochrome" />
+</adaptive-icon>
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?><!--
+  ~ Copyright (c) 2026 Novaloop AG
+  ~
+  ~ SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial.
+  ~ Please see LICENSE files in the repository root for full details.
+  -->
+<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
+    <background android:drawable="@drawable/ic_launcher_background" />
+    <foreground android:drawable="@mipmap/ic_launcher_foreground" />
+    <monochrome android:drawable="@mipmap/ic_launcher_monochrome" />
+</adaptive-icon>
@@ -34,7 +34,6 @@ dependencies {
    implementation(projects.libraries.featureflag.api)
    implementation(projects.libraries.matrix.api)
    implementation(projects.libraries.oauth.api)
-    implementation(projects.libraries.permissions.api)
    implementation(projects.libraries.preferences.api)
    implementation(projects.libraries.push.api)
    implementation(projects.libraries.pushproviders.api)
@@ -62,7 +61,6 @@ dependencies {
    testImplementation(projects.features.share.test)
    testImplementation(projects.libraries.matrix.test)
    testImplementation(projects.libraries.oauth.test)
-    testImplementation(projects.libraries.permissions.test)
    testImplementation(projects.libraries.preferences.test)
    testImplementation(projects.libraries.push.test)
    testImplementation(projects.libraries.pushproviders.test)
@@ -373,6 +373,11 @@ class LoggedInFlowNode(
                    override fun navigateToBugReport() {
                        callback.navigateToBugReport()
                    }
+
+                    // HealthChat fork: open a user profile from the member directory tab.
+                    override fun navigateToUserProfile(userId: UserId) {
+                        backstack.push(NavTarget.UserProfile(userId))
+                    }
                }
                homeEntryPoint.createNode(
                    parentNode = this,
@@ -12,7 +12,4 @@ sealed interface LoggedInEvents {
    data class CloseErrorDialog(val doNotShowAgain: Boolean) : LoggedInEvents
    data object CheckSlidingSyncProxyAvailability : LoggedInEvents
    data object LogoutAndMigrateToNativeSlidingSync : LoggedInEvents
-    data object DismissLocalNetworkPermissionPrompt : LoggedInEvents
-
-    data object RequestLocationNetworkPermission : LoggedInEvents
 }
@@ -8,7 +8,6 @@

 package io.element.android.appnav.loggedin

-import android.Manifest
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.MutableState
@@ -16,7 +15,6 @@ import androidx.compose.runtime.collectAsState
 import androidx.compose.runtime.derivedStateOf
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.produceState
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.runtime.setValue
@@ -38,10 +36,6 @@ import io.element.android.libraries.matrix.api.sync.SlidingSyncVersion
 import io.element.android.libraries.matrix.api.sync.SyncService
 import io.element.android.libraries.matrix.api.verification.SessionVerificationService
 import io.element.android.libraries.matrix.api.verification.SessionVerifiedStatus
-import io.element.android.libraries.permissions.api.PermissionsEvent
-import io.element.android.libraries.permissions.api.PermissionsPresenter
-import io.element.android.libraries.permissions.api.localnetwork.LocalNetworkPermissionAdvisor
-import io.element.android.libraries.permissions.api.localnetwork.LocalNetworkPermissionDialog
 import io.element.android.libraries.push.api.PushService
 import io.element.android.libraries.push.api.PusherRegistrationFailure
 import io.element.android.services.analytics.api.AnalyticsService
@@ -64,12 +58,7 @@ class LoggedInPresenter(
    private val encryptionService: EncryptionService,
    private val buildMeta: BuildMeta,
    private val networkMonitor: NetworkMonitor,
-    private val localNetworkPermissionAdvisor: LocalNetworkPermissionAdvisor,
-    permissionsPresenterFactory: PermissionsPresenter.Factory,
 ) : Presenter<LoggedInState> {
-    private val localNetworkPermissionsPresenter: PermissionsPresenter =
-        permissionsPresenterFactory.create(Manifest.permission.ACCESS_LOCAL_NETWORK)
-
    @Composable
    override fun present(): LoggedInState {
        val coroutineScope = rememberCoroutineScope()
@@ -128,21 +117,6 @@ class LoggedInPresenter(
            }
        }

-        val localNetworkPermissionState = localNetworkPermissionsPresenter.present()
-        var localNetworkPromptDismissedThisSession by remember { mutableStateOf(false) }
-        val advisorRequestsPrompt by produceState(initialValue = false, localNetworkPermissionState.permissionGranted) {
-            value = localNetworkPermissionAdvisor.shouldRequestPermissionFor(matrixClient.homeserverUrl)
-        }
-        LaunchedEffect(localNetworkPermissionState.permissionGranted) {
-            if (localNetworkPermissionState.permissionGranted) localNetworkPromptDismissedThisSession = false
-        }
-        val localNetworkPermissionDialog = when {
-            !advisorRequestsPrompt -> LocalNetworkPermissionDialog.None
-            localNetworkPromptDismissedThisSession -> LocalNetworkPermissionDialog.None
-            localNetworkPermissionState.shouldShowRationale -> LocalNetworkPermissionDialog.Rationale
-            else -> LocalNetworkPermissionDialog.Settings
-        }
-
        fun handleEvent(event: LoggedInEvents) {
            when (event) {
                is LoggedInEvents.CloseErrorDialog -> {
@@ -160,17 +134,6 @@ class LoggedInPresenter(
                    // Force the logout since Native Sliding Sync is already enforced by the SDK
                    matrixClient.logout(userInitiated = true, ignoreSdkError = true)
                }
-                LoggedInEvents.DismissLocalNetworkPermissionPrompt -> {
-                    localNetworkPromptDismissedThisSession = true
-                }
-                LoggedInEvents.RequestLocationNetworkPermission -> {
-                    if (localNetworkPermissionDialog == LocalNetworkPermissionDialog.Settings) {
-                        localNetworkPermissionState.eventSink(PermissionsEvent.OpenSystemSettingAndCloseDialog)
-                    } else {
-                        localNetworkPermissionState.eventSink(PermissionsEvent.RequestPermissions)
-                    }
-                    localNetworkPromptDismissedThisSession = true
-                }
            }
        }

@@ -180,7 +143,6 @@ class LoggedInPresenter(
            ignoreRegistrationError = ignoreRegistrationError,
            forceNativeSlidingSyncMigration = forceNativeSlidingSyncMigration,
            appName = buildMeta.applicationName,
-            localNetworkPermissionDialog = localNetworkPermissionDialog,
            eventSink = ::handleEvent,
        )
    }
@@ -9,7 +9,6 @@
 package io.element.android.appnav.loggedin

 import io.element.android.libraries.architecture.AsyncData
-import io.element.android.libraries.permissions.api.localnetwork.LocalNetworkPermissionDialog

 data class LoggedInState(
    val showSyncSpinner: Boolean,
@@ -17,6 +16,5 @@ data class LoggedInState(
    val ignoreRegistrationError: Boolean,
    val forceNativeSlidingSyncMigration: Boolean,
    val appName: String,
-    val localNetworkPermissionDialog: LocalNetworkPermissionDialog,
    val eventSink: (LoggedInEvents) -> Unit,
 )
@@ -10,7 +10,6 @@ package io.element.android.appnav.loggedin

 import androidx.compose.ui.tooling.preview.PreviewParameterProvider
 import io.element.android.libraries.architecture.AsyncData
-import io.element.android.libraries.permissions.api.localnetwork.LocalNetworkPermissionDialog
 import io.element.android.libraries.push.api.PusherRegistrationFailure

 open class LoggedInStateProvider : PreviewParameterProvider<LoggedInState> {
@@ -20,8 +19,6 @@ open class LoggedInStateProvider : PreviewParameterProvider<LoggedInState> {
            aLoggedInState(showSyncSpinner = true),
            aLoggedInState(pusherRegistrationState = AsyncData.Failure(PusherRegistrationFailure.NoDistributorsAvailable())),
            aLoggedInState(forceNativeSlidingSyncMigration = true),
-            aLoggedInState(localNetworkPermissionDialog = LocalNetworkPermissionDialog.Rationale),
-            aLoggedInState(localNetworkPermissionDialog = LocalNetworkPermissionDialog.Settings),
        )
 }

@@ -30,13 +27,11 @@ fun aLoggedInState(
    pusherRegistrationState: AsyncData<Unit> = AsyncData.Uninitialized,
    forceNativeSlidingSyncMigration: Boolean = false,
    appName: String = "Element X",
-    localNetworkPermissionDialog: LocalNetworkPermissionDialog = LocalNetworkPermissionDialog.None,
 ) = LoggedInState(
    showSyncSpinner = showSyncSpinner,
    pusherRegistrationState = pusherRegistrationState,
    ignoreRegistrationError = false,
    forceNativeSlidingSyncMigration = forceNativeSlidingSyncMigration,
    appName = appName,
-    localNetworkPermissionDialog = localNetworkPermissionDialog,
    eventSink = {},
 )
@@ -25,7 +25,6 @@ import io.element.android.libraries.designsystem.preview.ElementPreview
 import io.element.android.libraries.designsystem.preview.PreviewsDayNight
 import io.element.android.libraries.designsystem.utils.OnLifecycleEvent
 import io.element.android.libraries.matrix.api.exception.isNetworkError
-import io.element.android.libraries.permissions.api.localnetwork.LocalNetworkPermissionDialogView
 import io.element.android.libraries.push.api.PusherRegistrationFailure
 import io.element.android.libraries.ui.strings.CommonStrings

@@ -83,12 +82,6 @@ fun LoggedInView(
            }
        )
    }
-
-    LocalNetworkPermissionDialogView(
-        dialog = state.localNetworkPermissionDialog,
-        onSubmit = { state.eventSink(LoggedInEvents.RequestLocationNetworkPermission) },
-        onDismiss = { state.eventSink(LoggedInEvents.DismissLocalNetworkPermissionPrompt) },
-    )
 }

 private fun Throwable.getReason(): String? {
@@ -36,8 +36,6 @@ import io.element.android.libraries.matrix.test.encryption.FakeEncryptionService
 import io.element.android.libraries.matrix.test.roomlist.FakeRoomListService
 import io.element.android.libraries.matrix.test.sync.FakeSyncService
 import io.element.android.libraries.matrix.test.verification.FakeSessionVerificationService
-import io.element.android.libraries.permissions.test.FakeLocalNetworkPermissionAdvisor
-import io.element.android.libraries.permissions.test.FakePermissionsPresenterFactory
 import io.element.android.libraries.push.api.PushService
 import io.element.android.libraries.push.api.PusherRegistrationFailure
 import io.element.android.libraries.push.test.FakePushService
@@ -126,8 +124,6 @@ class LoggedInPresenterTest {
            encryptionService = encryptionService,
            buildMeta = buildMeta,
            networkMonitor = networkMonitor,
-            localNetworkPermissionAdvisor = FakeLocalNetworkPermissionAdvisor(),
-            permissionsPresenterFactory = FakePermissionsPresenterFactory(),
        ).test {
            encryptionService.emitRecoveryState(RecoveryState.UNKNOWN)
            encryptionService.emitRecoveryState(RecoveryState.INCOMPLETE)
@@ -372,8 +368,6 @@ class LoggedInPresenterTest {
            encryptionService = encryptionService,
            buildMeta = buildMeta,
            networkMonitor = networkMonitor,
-            localNetworkPermissionAdvisor = FakeLocalNetworkPermissionAdvisor(),
-            permissionsPresenterFactory = FakePermissionsPresenterFactory(),
        )
    }
 }
@@ -156,6 +156,17 @@ allprojects {
        if (isScreenshotTest) {
            // Increase heap size for screenshot tests
            maxHeapSize = "2g"
+            // Give every screenshot test class its own JVM.
+            //
+            // There are 5 screenshot classes (PreviewShard1..4Test + PreviewA11yTest) and each
+            // shard renders ~770 previews in a single process. Gradle reuses a forked JVM for the
+            // next class once maxParallelForks is exhausted, so on a 6-core runner (forks = 3) two
+            // classes run second, in a process that has already rendered a full shard — and they
+            // render differently from how the goldens were recorded. That is exactly the observed
+            // failure: shards 2 and 4 fail 100% while 1 and 3 pass 100%, deterministically, for
+            // byte-identical states. The 8-core runner (forks = 4) reused only one JVM and was green
+            // on the same tree. Restarting per class costs 5 JVM startups and no extra peak memory.
+            forkEvery = 1L
            // Record all the languages?
            if (project.hasProperty("allLanguagesNoEnglish")) {
                // Do not record English language
@@ -1,4 +1,4 @@
-# Element X Android deeplink
+# HealthChat Android deeplink

 <!--- TOC -->

@@ -12,31 +12,45 @@

 ## Introduction

-Element X Android supports deep linking to specific screens in the application. This document explains how to use deep links in Element X Android.
+HealthChat Android supports deep linking to specific screens in the application. This document explains how to use deep links in HealthChat Android.

 ### Asset Links

-The asset links file is available at https://element.io/.well-known/assetlinks.json
+Two hosts are claimed as verified Android App Links, and each one must serve a matching asset links
+file listing `ch.healthchat.element` and the SHA-256 of the Play app signing certificate:
+
+| Host | Asset links file | Served from |
+|---|---|---|
+| `app.healthchat.ch` | https://app.healthchat.ch/.well-known/assetlinks.json | the `element-web` fork (`apps/web/res/.well-known/assetlinks.json`) |
+| `to.healthchat.ch` | https://to.healthchat.ch/.well-known/assetlinks.json | the `healthchat-matrix.to` fork (generated by `scripts/build.js`) |

 ### Supported links

-Element Call link: 
-> https://call.element.io/Example
-
 Link to a user:
-> https://app.element.io/#/user/@alice:matrix.org
+> https://to.healthchat.ch/#/@alice:healthchat.ch
+> https://app.healthchat.ch/#/user/@alice:healthchat.ch

 Link to a room by id or alias:
-> https://app.element.io/#/room/!roomid:matrix.org
-> https://app.element.io/#/room/#element-x-android:matrix.org
+> https://to.healthchat.ch/#/!roomid:healthchat.ch
+> https://app.healthchat.ch/#/room/#healthchat:healthchat.ch

 Link to a room with a specific event:
-> https://app.element.io/#/room/!roomid:matrix.org/$eventid
+> https://app.healthchat.ch/#/room/!roomid:healthchat.ch/$eventid

-Note that it will also work with other domain such as:
-> https://mobile.element.io
-> https://develop.element.io
-> https://staging.element.io
+The HealthChat matrix.to deployment hands out a custom scheme to Android, which is registered too:
+> healthchat://room/%23healthchat%3Ahealthchat.ch
+> healthchat://user/%40alice%3Ahealthchat.ch
+
+Standard Matrix URIs also work:
+> matrix:r/healthchat:healthchat.ch
+
+Only the two hosts above are declared in the manifest, so only those open the app from a browser.
+`DefaultMatrixToConverter` is host-agnostic though: any URL using the `/#/room/`, `/#/user/` or
+`/#/group/` path, as well as plain matrix.to links, are still resolved once they reach the app
+(for instance when tapped inside a message).
+
+Finally, notifications use an internal deep link that is not browsable:
+> healthchat://open/{sessionId}/{roomId}/{eventId}

 ## Developer tools

@@ -44,28 +58,34 @@ Using an Android 12 or higher emulator

 Ensure links verification is enabled
 ```bash
-adb shell am compat enable 175408749 io.element.android.x.debug  
+adb shell am compat enable 175408749 ch.healthchat.element.debug  
 ```

 Reset link verifications for the given package id
 ```bash
-adb shell pm set-app-links --package io.element.android.x.debug 0 all 
+adb shell pm set-app-links --package ch.healthchat.element.debug 0 all 
 ```

 Force the package id links to be verified
 ```bash
-adb shell pm verify-app-links --re-verify io.element.android.x.debug 
+adb shell pm verify-app-links --re-verify ch.healthchat.element.debug 
 ```

 Print the link verification of the package id
 ```bash
-adb shell pm get-app-links io.element.android.x.debug
+adb shell pm get-app-links ch.healthchat.element.debug
 ```

 ```
-  io.element.android.x.debug:
+  ch.healthchat.element.debug:
    ID: e2ece472-c266-4bf0-829c-be79959a6270
    Signatures: [B0:B0:51:DC:56:5C:81:2F:E1:7F:6F:3E:94:5B:4D:79:04:71:23:AB:0D:A6:12:86:76:9E:B2:94:91:97:13:0E]
    Domain verification state:
-      *.element.io: 1024
+      app.healthchat.ch: verified
+      to.healthchat.ch: verified
 ```
+
+Verification only succeeds if the signature above is listed in the asset links files. Release builds
+are signed by Google Play, so use the app signing certificate SHA-256 from the Play Console. For a
+debug build, add the fingerprint of `app/signature/debug.keystore` (alias `androiddebugkey`) to both
+files, or test with `healthchat://` links instead, which need no verification.
@@ -0,0 +1,3 @@
+HealthChat ist die durchgehend verschlüsselte (Ende-zu-Ende-verschlüsselte, E2EE) Kommunikationslösung für HealthProfessionals – entwickelt in der Schweiz, für das Schweizer Gesundheitssystem.
+
+Ob Ärztinnen und Ärzte, Pflegefachpersonen, Medizinische Praxisassistentinnen, Spitex-Fachkräfte oder Therapeutinnen – HealthChat ermöglicht eine sichere, einfache und effiziente Kommunikation innerhalb und zwischen interprofessionellen Teams.
@@ -0,0 +1 @@
+Sichere Kommunikation für Gesundheitsfachpersonen
@@ -0,0 +1 @@
+HealthChat
@@ -1,2 +0,0 @@
-Main changes in this version: bug fixes and improvements, including fixing the local network permission usage in Android 17.
-Full changelog: https://github.com/element-hq/element-x-android/releases
@@ -1,29 +1,3 @@
-Freedom to communicate on your own terms
+HealthChat ist die durchgehend verschlüsselte (Ende-zu-Ende-verschlüsselte, E2EE) Kommunikationslösung für HealthProfessionals – entwickelt in der Schweiz, für das Schweizer Gesundheitssystem.

-For individuals and communities - private communication between family, friends, hobby groups, clubs, etc.
-
-Element X gives you fast, secure and private instant messaging and video calls built on Matrix, the open standard for real-time communication. This is a free and open-source app maintained at https://github.com/element-hq/element-x-android.
-
-Stay in touch with friends, family and communities with:
- • Real time messaging & video calls
- • Public rooms for open group communication
- • Private rooms for closed group communication
- • Rich messaging features: emoji reactions, replies, polls, pinned messages and more.
- • Video calling while browsing messages.
- • Interoperability with other Matrix-based apps such as FluffyChat, Cinny and many more.
-
-<b>Privacy-first<b>
-Unlike some other messengers from Big Tech companies, we don’t mine your data or monitor your communications.
-
-<b>Own your conversations</b>
-Choose where to host your data - from any public server (the largest free server is matrix.org, but there are plenty of others to choose from) to creating your own personal server and hosting it on your own domain. This ability to choose a server is a large part of what differentiates us from other real time communication apps. However you host, you have ownership; it’s your data. You’re not the product. You’re in control.
-
-<b>Communicate in real time, all the time</b>
-Use Element everywhere. Stay in touch wherever you are with fully synchronised message history across all your devices, including on the web at https://app.element.io
-
-<b>Element X is our next-generation app</b>
-If you’re using the previous-generation Element Classic app, it’s time to try Element X! It’s faster, easier to use, and more powerful than the classic app. It’s better in every way and we’re adding new features all the time.
-
-The application requires the android.permission.REQUEST_INSTALL_PACKAGES permission to enable the installation of applications received as attachments, ensuring seamless and convenient access to new software within the app.
-
-The application requires the USE_FULL_SCREEN_INTENT permission to ensure our users can effectively receive call notifications even when their devices are locked.
+Ob Ärztinnen und Ärzte, Pflegefachpersonen, Medizinische Praxisassistentinnen, Spitex-Fachkräfte oder Therapeutinnen – HealthChat ermöglicht eine sichere, einfache und effiziente Kommunikation innerhalb und zwischen interprofessionellen Teams.
@@ -1 +1 @@
-Sovereign. Seamless. On Matrix
+Sichere Kommunikation für Gesundheitsfachpersonen
@@ -1 +1 @@
-Element X - Secure Chat & Call
+HealthChat
@@ -31,12 +31,12 @@ import io.element.android.compound.tokens.generated.CompoundIcons
 import io.element.android.features.analytics.api.AnalyticsOptInEvents
 import io.element.android.libraries.designsystem.atomic.molecules.ButtonColumnMolecule
 import io.element.android.libraries.designsystem.atomic.molecules.IconTitleSubtitleMolecule
+import io.element.android.libraries.designsystem.atomic.organisms.InfoListItem
+import io.element.android.libraries.designsystem.atomic.organisms.InfoListOrganism
 import io.element.android.libraries.designsystem.atomic.pages.HeaderFooterPage
 import io.element.android.libraries.designsystem.background.OnboardingBackground
 import io.element.android.libraries.designsystem.components.BigIcon
 import io.element.android.libraries.designsystem.components.ClickableLinkText
-import io.element.android.libraries.designsystem.components.visuallist.VisualList
-import io.element.android.libraries.designsystem.components.visuallist.VisualListItemData
 import io.element.android.libraries.designsystem.preview.ElementPreview
 import io.element.android.libraries.designsystem.preview.PreviewsDayNight
 import io.element.android.libraries.designsystem.text.buildAnnotatedStringWithStyledPart
@@ -129,21 +129,22 @@ private fun AnalyticsOptInContent() {
            verticalBias = -0.4f
        )
    ) {
-        VisualList(
+        InfoListOrganism(
            items = persistentListOf(
-                VisualListItemData(
+                InfoListItem(
                    message = stringResource(id = R.string.screen_analytics_prompt_data_usage),
                    iconVector = CompoundIcons.CheckCircle(),
                ),
-                VisualListItemData(
+                InfoListItem(
                    message = stringResource(id = R.string.screen_analytics_prompt_third_party_sharing),
                    iconVector = CompoundIcons.CheckCircle(),
                ),
-                VisualListItemData(
+                InfoListItem(
                    message = stringResource(id = R.string.screen_analytics_prompt_settings),
                    iconVector = CompoundIcons.CheckCircle(),
                ),
            ),
+            textStyle = ElementTheme.typography.fontBodyLgMedium,
            iconTint = ElementTheme.colors.iconSuccessPrimary,
        )
    }
@@ -36,10 +36,10 @@ import io.element.android.features.announcement.impl.AnnouncementState
 import io.element.android.features.announcement.impl.AnnouncementStateProvider
 import io.element.android.libraries.designsystem.atomic.molecules.ButtonColumnMolecule
 import io.element.android.libraries.designsystem.atomic.molecules.IconTitleSubtitleMolecule
+import io.element.android.libraries.designsystem.atomic.organisms.InfoListItem
+import io.element.android.libraries.designsystem.atomic.organisms.InfoListOrganism
 import io.element.android.libraries.designsystem.atomic.pages.HeaderFooterPage
 import io.element.android.libraries.designsystem.components.BigIcon
-import io.element.android.libraries.designsystem.components.visuallist.VisualList
-import io.element.android.libraries.designsystem.components.visuallist.VisualListItemData
 import io.element.android.libraries.designsystem.preview.ElementPreview
 import io.element.android.libraries.designsystem.preview.PreviewsDayNight
 import io.element.android.libraries.designsystem.theme.components.Button
@@ -134,9 +134,11 @@ private fun FullscreenAnnouncementContent(
    Column(
        modifier = modifier.fillMaxSize(),
    ) {
-        VisualList(
+        InfoListOrganism(
            modifier = Modifier.fillMaxWidth(),
            items = announcement.items(),
+            textStyle = ElementTheme.typography.fontBodyLgMedium,
+            iconTint = ElementTheme.colors.iconSecondary,
            iconSize = 24.dp
        )
        announcement.notice()?.let { notice ->
@@ -184,25 +186,25 @@ private fun Announcement.Fullscreen.icon() = when (this) {
 }

@Composable
-private fun Announcement.Fullscreen.items(): ImmutableList<VisualListItemData> = when (this) {
+private fun Announcement.Fullscreen.items(): ImmutableList<InfoListItem> = when (this) {
    Announcement.Fullscreen.Space -> persistentListOf(
-        VisualListItemData(
+        InfoListItem(
            message = "View spaces you\'ve created or joined",
            iconVector = CompoundIcons.VisibilityOn(),
        ),
-        VisualListItemData(
+        InfoListItem(
            message = "Accept or decline invites to spaces",
            iconVector = CompoundIcons.Email(),
        ),
-        VisualListItemData(
+        InfoListItem(
            message = "Discover any rooms you can join in your spaces",
            iconVector = CompoundIcons.Search(),
        ),
-        VisualListItemData(
+        InfoListItem(
            message = "Join public spaces",
            iconVector = CompoundIcons.Explore(),
        ),
-        VisualListItemData(
+        InfoListItem(
            message = "Leave any spaces you’ve joined",
            iconVector = CompoundIcons.Leave(),
        ),
@@ -14,7 +14,6 @@
        android:name="android.hardware.microphone"
        android:required="false" />

-    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
    <uses-permission android:name="android.permission.RECORD_AUDIO" />
    <uses-permission android:name="android.permission.CAMERA" />
@@ -22,6 +22,7 @@ import dev.zacsweers.metro.Assisted
 import dev.zacsweers.metro.AssistedFactory
 import dev.zacsweers.metro.AssistedInject
 import im.vector.app.features.analytics.plan.MobileScreen
+import io.element.android.compound.theme.ElementTheme
 import io.element.android.features.call.api.CallData
 import io.element.android.features.call.impl.data.WidgetMessage
 import io.element.android.features.call.impl.utils.ActiveCallManager
@@ -83,7 +84,7 @@ class CallScreenPresenter(
        var ignoreWebViewError by rememberSaveable { mutableStateOf(false) }
        var webViewError by remember { mutableStateOf<String?>(null) }
        val languageTag = languageTagProvider.provideLanguageTag()
-        val theme = "dark"
+        val theme = if (ElementTheme.isLightTheme) "light" else "dark"

        DisposableEffect(Unit) {
            coroutineScope.launch {
@@ -38,7 +38,6 @@ import androidx.core.view.WindowInsetsControllerCompat
 import androidx.lifecycle.Lifecycle
 import dev.zacsweers.metro.Inject
 import io.element.android.compound.colors.SemanticColorsLightDark
-import io.element.android.compound.theme.ForcedDarkElementTheme
 import io.element.android.features.call.api.CallData
 import io.element.android.features.call.impl.DefaultElementCallEntryPoint
 import io.element.android.features.call.impl.di.CallBindings
@@ -144,28 +143,24 @@ class ElementCallActivity :
                compoundDark = colors.dark,
                buildMeta = buildMeta,
            ) {
-                ForcedDarkElementTheme(
-                    colors = colors,
-                ) {
-                    val state = presenter.present()
-                    eventSink = state.eventSink
-                    LaunchedEffect(state.isCallActive) {
-                        if (state.isCallActive) {
-                            setCallIsActive()
-                        }
+                val state = presenter.present()
+                eventSink = state.eventSink
+                LaunchedEffect(state.isCallActive) {
+                    if (state.isCallActive) {
+                        setCallIsActive()
                    }
-                    CallScreenView(
-                        state = state,
-                        pipState = pipState,
-                        onConsoleMessage = {
-                            consoleMessageLogger.log("ElementCall", it)
-                        },
-                        requestPermissions = { permissions, callback ->
-                            requestPermissionCallback = callback
-                            requestPermissionsLauncher.launch(permissions)
-                        }
-                    )
                }
+                CallScreenView(
+                    state = state,
+                    pipState = pipState,
+                    onConsoleMessage = {
+                        consoleMessageLogger.log("ElementCall", it)
+                    },
+                    requestPermissions = { permissions, callback ->
+                        requestPermissionCallback = callback
+                        requestPermissionsLauncher.launch(permissions)
+                    }
+                )
            }
        }
    }
@@ -1,23 +0,0 @@
-plugins {
-    id("io.element.android-compose-library")
-    id("kotlin-parcelize")
-}
-
-android {
-    namespace = "io.element.android.features.contentscanner.api"
-}
-
-dependencies {
-    implementation(projects.libraries.core)
-    implementation(projects.libraries.architecture)
-    implementation(projects.libraries.matrix.api)
-    implementation(projects.libraries.matrixui)
-    implementation(projects.libraries.designsystem)
-
-    testImplementation(libs.test.junit)
-    testImplementation(libs.coroutines.test)
-    testImplementation(libs.molecule.runtime)
-    testImplementation(libs.test.truth)
-    testImplementation(libs.test.turbine)
-    testImplementation(projects.libraries.matrix.test)
-}
@@ -1,35 +0,0 @@
-/*
- * Copyright (c) 2026 Element Creations Ltd.
- *
- * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial.
- * Please see LICENSE files in the repository root for full details.
- */
-
-import extension.setupDependencyInjection
-
-plugins {
-    id("io.element.android-compose-library")
-    id("kotlin-parcelize")
-}
-
-android {
-    namespace = "io.element.android.features.contentscanner.impl"
-}
-
-setupDependencyInjection()
-
-dependencies {
-    api(projects.features.contentscanner.api)
-    implementation(projects.libraries.core)
-    implementation(projects.libraries.architecture)
-    implementation(projects.libraries.matrix.api)
-    implementation(projects.libraries.matrixui)
-    implementation(projects.libraries.designsystem)
-
-    testImplementation(libs.test.junit)
-    testImplementation(libs.coroutines.test)
-    testImplementation(libs.molecule.runtime)
-    testImplementation(libs.test.truth)
-    testImplementation(libs.test.turbine)
-    testImplementation(projects.libraries.matrix.test)
-}
@@ -43,7 +43,6 @@ dependencies {
    implementation(libs.coil.compose)
    implementation(projects.libraries.featureflag.api)
    implementation(projects.features.invitepeople.api)
-    implementation(projects.features.enterprise.api)
    api(projects.features.createroom.api)

    testCommonDependencies(libs, true)
@@ -54,5 +53,4 @@ dependencies {
    testImplementation(projects.libraries.permissions.test)
    testImplementation(projects.features.startchat.test)
    testImplementation(projects.libraries.featureflag.test)
-    testImplementation(projects.features.enterprise.test)
 }
@@ -24,7 +24,6 @@ import dev.zacsweers.metro.Assisted
 import dev.zacsweers.metro.AssistedFactory
 import dev.zacsweers.metro.AssistedInject
 import im.vector.app.features.analytics.plan.CreatedRoom
-import io.element.android.features.enterprise.api.SessionEnterpriseService
 import io.element.android.libraries.architecture.AsyncAction
 import io.element.android.libraries.architecture.Presenter
 import io.element.android.libraries.architecture.runCatchingUpdatingState
@@ -74,7 +73,6 @@ class ConfigureRoomPresenter(
    private val featureFlagService: FeatureFlagService,
    private val roomAliasHelper: RoomAliasHelper,
    private val mediaOptimizationConfigProvider: MediaOptimizationConfigProvider,
-    private val sessionEnterpriseService: SessionEnterpriseService,
 ) : Presenter<ConfigureRoomState> {
    @AssistedFactory
    interface Factory {
@@ -258,7 +256,7 @@ class ConfigureRoomPresenter(
                    CreateRoomParameters(
                        name = config.roomName,
                        topic = config.topic,
-                        isEncrypted = !sessionEnterpriseService.isEncryptionDisabledByHomeserver(),
+                        isEncrypted = true,
                        isDirect = false,
                        visibility = RoomVisibility.Private,
                        historyVisibilityOverride = RoomHistoryVisibility.Invited,
@@ -11,8 +11,7 @@ import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.lazy.LazyColumn
 import androidx.compose.material3.ExperimentalMaterial3Api
-import androidx.compose.material3.SheetValue
-import androidx.compose.material3.rememberBottomSheetState
+import androidx.compose.material3.rememberModalBottomSheetState
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
@@ -86,9 +85,9 @@ internal fun SelectParentSpaceOptions(
        )

        if (displaySelectSpaceBottomSheet) {
-            val sheetState = rememberBottomSheetState(
-                initialValue = SheetValue.Hidden,
-                enabledValues = setOf(SheetValue.Hidden, SheetValue.Expanded),
+            val sheetState = rememberModalBottomSheetState(
+                skipPartiallyExpanded = true,
+                confirmValueChange = { true },
            )
            ModalBottomSheet(
                sheetState = sheetState,
@@ -3,34 +3,14 @@
  <string name="screen_create_room_action_create_room">"Ruangan baru"</string>
  <string name="screen_create_room_add_people_title">"Undang orang-orang"</string>
  <string name="screen_create_room_error_creating_room">"Terjadi kesalahan saat membuat ruangan"</string>
-  <string name="screen_create_room_error_creating_space">"Ruang tersebut tidak dapat dibuat karena kesalahan yang tidak diketahui. Coba lagi nanti."</string>
-  <string name="screen_create_room_name_placeholder">"Tambahkan nama…"</string>
-  <string name="screen_create_room_new_room_title">"Ruangan baru"</string>
-  <string name="screen_create_room_new_space_title">"Ruang baru"</string>
  <string name="screen_create_room_private_option_description">"Hanya orang-orang yang diundang dapat mengakses ruangan ini. Semua pesan terenkripsi secara ujung ke ujung."</string>
-  <string name="screen_create_room_private_option_title">"Pribadi"</string>
  <string name="screen_create_room_public_option_description">"Siapa pun dapat mencari ruangan ini.
 Anda dapat mengubah ini kapan pun dalam pengaturan ruangan."</string>
-  <string name="screen_create_room_public_option_short_description">"Siapa pun bisa bergabung."</string>
-  <string name="screen_create_room_public_option_title">"Umum"</string>
  <string name="screen_create_room_room_access_section_knocking_option_description">"Siapa pun dapat meminta untuk bergabung dengan ijin administrator atau moderator"</string>
  <string name="screen_create_room_room_access_section_knocking_option_title">"Minta untuk bergabung"</string>
-  <string name="screen_create_room_room_access_section_knocking_restricted_option_description">"Siapa pun di %1$s dapat bergabung, tetapi semua orang lain harus meminta akses."</string>
-  <string name="screen_create_room_room_access_section_knocking_restricted_option_title">"Ajukan permohonan untuk bergabung"</string>
-  <string name="screen_create_room_room_access_section_private_option_description">"Hanya orang-orang yang diundang dapat mengakses ruangan ini. Semua pesan terenkripsi secara ujung ke ujung."</string>
-  <string name="screen_create_room_room_access_section_private_option_title">"Pribadi"</string>
  <string name="screen_create_room_room_access_section_public_option_description">"Siapa pun dapat bergabung dengan ruangan ini"</string>
-  <string name="screen_create_room_room_access_section_public_option_title">"Umum"</string>
-  <string name="screen_create_room_room_access_section_restricted_option_description">"Siapa pun di %1$s dapat bergabung."</string>
-  <string name="screen_create_room_room_access_section_restricted_option_title">"Standar"</string>
-  <string name="screen_create_room_room_access_section_title">"Yang memiliki akses"</string>
  <string name="screen_create_room_room_address_section_footer">"Supaya ruangan ini terlihat di direktori ruangan publik, Anda memerlukan alamat ruangan."</string>
  <string name="screen_create_room_room_address_section_title">"Alamat ruangan"</string>
  <string name="screen_create_room_room_visibility_section_title">"Keterlihatan ruangan"</string>
-  <string name="screen_create_room_space_selection_no_space_description">"(ruang sudah penuh)"</string>
-  <string name="screen_create_room_space_selection_no_space_option">"Jangan menambahkan sesuatu ke ruang yang sudah ada."</string>
-  <string name="screen_create_room_space_selection_no_space_title">"Tidak ada ruang yang dipilih"</string>
-  <string name="screen_create_room_space_selection_sheet_title">"Tambahkan ke ruang"</string>
  <string name="screen_create_room_topic_label">"Topik (opsional)"</string>
-  <string name="screen_create_room_topic_placeholder">"Tambahkan deskripsi…"</string>
 </resources>
@@ -23,7 +23,7 @@
  <string name="screen_create_room_room_access_section_public_option_title">"公開"</string>
  <string name="screen_create_room_room_access_section_restricted_option_description">"%1$s にいる全員が参加することができます。"</string>
  <string name="screen_create_room_room_access_section_restricted_option_title">"スタンダード"</string>
-  <string name="screen_create_room_room_access_section_title">"参加可能なユーザー"</string>
+  <string name="screen_create_room_room_access_section_title">"参加できるユーザー"</string>
  <string name="screen_create_room_room_address_section_footer">"公開ディレクトリで自分を見つけられるようにするには、アドレスが必要です。"</string>
  <string name="screen_create_room_room_address_section_title">"アドレス"</string>
  <string name="screen_create_room_room_visibility_section_title">"ルームの公開度"</string>
@@ -20,13 +20,11 @@ import io.element.android.features.createroom.impl.configureroom.CreateRoomConfi
 import io.element.android.features.createroom.impl.configureroom.JoinRuleItem
 import io.element.android.features.createroom.impl.configureroom.RoomAddress
 import io.element.android.features.createroom.impl.configureroom.RoomVisibilityState
-import io.element.android.features.enterprise.test.FakeSessionEnterpriseService
 import io.element.android.libraries.architecture.AsyncAction
 import io.element.android.libraries.featureflag.api.FeatureFlags
 import io.element.android.libraries.featureflag.test.FakeFeatureFlagService
 import io.element.android.libraries.matrix.api.MatrixClient
 import io.element.android.libraries.matrix.api.core.RoomId
-import io.element.android.libraries.matrix.api.createroom.CreateRoomParameters
 import io.element.android.libraries.matrix.api.room.RoomInfo
 import io.element.android.libraries.matrix.api.room.alias.ResolvedRoomAlias
 import io.element.android.libraries.matrix.api.room.alias.RoomAliasHelper
@@ -58,7 +56,6 @@ import io.element.android.services.analytics.api.AnalyticsService
 import io.element.android.services.analytics.test.FakeAnalyticsService
 import io.element.android.tests.testutils.WarmUpRule
 import io.element.android.tests.testutils.lambda.lambdaRecorder
-import io.element.android.tests.testutils.lambda.matching
 import io.element.android.tests.testutils.robolectric.RobolectricTest
 import io.element.android.tests.testutils.test
 import io.mockk.mockk
@@ -520,30 +517,6 @@ class ConfigureRoomPresenterTest : RobolectricTest() {
        }
    }

-    @Test
-    fun `present - creating a private room when encryption is disabled by the HS creates it unencrypted`() = runTest {
-        val sessionEnterpriseService = FakeSessionEnterpriseService(isEncryptionDisabledResult = { true })
-        val createRoomLambda = lambdaRecorder<CreateRoomParameters, Result<RoomId>> { Result.success(A_ROOM_ID) }
-        val matrixClient = createMatrixClient().apply {
-            createRoomResult = createRoomLambda
-        }
-        val presenter = createConfigureRoomPresenter(
-            matrixClient = matrixClient,
-            sessionEnterpriseService = sessionEnterpriseService,
-        )
-        presenter.test {
-            val initialState = initialState()
-
-            initialState.eventSink(ConfigureRoomEvents.JoinRuleChanged(JoinRuleItem.PrivateVisibility.Private))
-            initialState.eventSink(ConfigureRoomEvents.CreateRoom)
-
-            assertThat(awaitItem().createRoomAction.isLoading()).isTrue()
-            assertThat(awaitItem().createRoomAction.isSuccess()).isTrue()
-
-            createRoomLambda.assertions().isCalledOnce().with(matching<CreateRoomParameters> { !it.isEncrypted })
-        }
-    }
-
    private suspend fun TurbineTestContext<ConfigureRoomState>.initialState(): ConfigureRoomState {
        skipItems(1)
        return awaitItem()
@@ -579,7 +552,6 @@ class ConfigureRoomPresenterTest : RobolectricTest() {
        permissionsPresenter: PermissionsPresenter = FakePermissionsPresenter(),
        isKnockFeatureEnabled: Boolean = true,
        mediaOptimizationConfigProvider: FakeMediaOptimizationConfigProvider = FakeMediaOptimizationConfigProvider(),
-        sessionEnterpriseService: FakeSessionEnterpriseService = FakeSessionEnterpriseService(isEncryptionDisabledResult = { false }),
    ) = ConfigureRoomPresenter(
        isSpace = isSpace,
        initialParentSpaceId = initialParenSpaceId,
@@ -594,6 +566,5 @@ class ConfigureRoomPresenterTest : RobolectricTest() {
            mapOf(FeatureFlags.Knock.key to isKnockFeatureEnabled)
        ),
        mediaOptimizationConfigProvider = mediaOptimizationConfigProvider,
-        sessionEnterpriseService = sessionEnterpriseService,
    )
 }
@@ -48,11 +48,11 @@ import io.element.android.compound.tokens.generated.CompoundIcons
 import io.element.android.features.deactivation.impl.R
 import io.element.android.features.logout.impl.ui.AccountDeactivationActionDialog
 import io.element.android.libraries.architecture.AsyncAction
+import io.element.android.libraries.designsystem.atomic.organisms.InfoListItem
+import io.element.android.libraries.designsystem.atomic.organisms.InfoListOrganism
 import io.element.android.libraries.designsystem.components.button.BackButton
 import io.element.android.libraries.designsystem.components.form.textFieldState
 import io.element.android.libraries.designsystem.components.list.SwitchListItem
-import io.element.android.libraries.designsystem.components.visuallist.VisualList
-import io.element.android.libraries.designsystem.components.visuallist.VisualListItemData
 import io.element.android.libraries.designsystem.modifiers.onTabOrEnterKeyFocusNext
 import io.element.android.libraries.designsystem.preview.ElementPreview
 import io.element.android.libraries.designsystem.preview.PreviewsDayNight
@@ -175,9 +175,9 @@ private fun Content(
            style = ElementTheme.typography.fontBodyMdRegular,
            color = ElementTheme.colors.textSecondary,
        )
-        VisualList(
+        InfoListOrganism(
            items = persistentListOf(
-                VisualListItemData(
+                InfoListItem(
                    message = buildAnnotatedStringWithStyledPart(
                        R.string.screen_deactivate_account_list_item_1,
                        R.string.screen_deactivate_account_list_item_1_bold_part,
@@ -194,7 +194,7 @@ private fun Content(
                        )
                    },
                ),
-                VisualListItemData(
+                InfoListItem(
                    message = stringResource(R.string.screen_deactivate_account_list_item_2),
                    iconComposable = {
                        Icon(
@@ -205,7 +205,7 @@ private fun Content(
                        )
                    },
                ),
-                VisualListItemData(
+                InfoListItem(
                    message = stringResource(R.string.screen_deactivate_account_list_item_3),
                    iconComposable = {
                        Icon(
@@ -216,7 +216,7 @@ private fun Content(
                        )
                    },
                ),
-                VisualListItemData(
+                InfoListItem(
                    message = stringResource(R.string.screen_deactivate_account_list_item_4),
                    iconComposable = {
                        Icon(
@@ -1,14 +1,14 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources xmlns:xliff="urn:oasis:names:tc:xliff:document:1.2">
-  <string name="screen_deactivate_account_confirmation_dialog_content">"Bekreft at du vil slette kontoen din. Denne handlingen kan ikke angres."</string>
+  <string name="screen_deactivate_account_confirmation_dialog_content">"Bekreft at du vil deaktivere kontoen din. Denne handlingen kan ikke angres."</string>
  <string name="screen_deactivate_account_delete_all_messages">"Slett alle meldingene mine"</string>
  <string name="screen_deactivate_account_delete_all_messages_notice">"Advarsel: Fremtidige brukere vil kunne se ufullstendige samtaler."</string>
-  <string name="screen_deactivate_account_description">"Hvis %1$s sletter kontoen din, vil følgende skje:"</string>
+  <string name="screen_deactivate_account_description">"Deaktivering av kontoen din er %1$s , det vil:"</string>
  <string name="screen_deactivate_account_description_bold_part">"irreversibel"</string>
  <string name="screen_deactivate_account_list_item_1">"%1$s kontoen din (du kan ikke logge på igjen, og ID-en din kan ikke brukes på nytt)."</string>
  <string name="screen_deactivate_account_list_item_1_bold_part">"Deaktiver permanent"</string>
  <string name="screen_deactivate_account_list_item_2">"Fjern deg fra alle chatterom."</string>
  <string name="screen_deactivate_account_list_item_3">"Slett kontoinformasjonen din fra vår identitetsserver."</string>
  <string name="screen_deactivate_account_list_item_4">"Meldingene dine vil fortsatt være synlige for registrerte brukere, men vil ikke være tilgjengelige for nye eller uregistrerte brukere hvis du velger å slette dem."</string>
-  <string name="screen_deactivate_account_title">"Slett kontoen"</string>
+  <string name="screen_deactivate_account_title">"Deaktiver kontoen"</string>
 </resources>
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources xmlns:xliff="urn:oasis:names:tc:xliff:document:1.2">
-  <string name="screen_deactivate_account_confirmation_dialog_content">"Iltimos, hisobingizni oʻchirishni xohlayotganingizni tasdiqlang. Bu amalni qaytarib boʻlmaydi."</string>
+  <string name="screen_deactivate_account_confirmation_dialog_content">"Iltimos, hisobingizni o‘chirishni xohlayotganingizni tasdiqlang. Bu amalni qaytarib bo‘lmaydi."</string>
  <string name="screen_deactivate_account_delete_all_messages">"Barcha xabarlarimni o‘chirib tashlang"</string>
  <string name="screen_deactivate_account_delete_all_messages_notice">"Ogohlantirish: Kelgusi foydalanuvchilar chala suhbatlarni ko‘rishi mumkin."</string>
  <string name="screen_deactivate_account_description">"Hisobingiz %1$s faolsizlantirilmoqda, u quyidagilarni bajaradi:"</string>
@@ -12,7 +12,5 @@ interface SessionEnterpriseService {
    suspend fun isElementCallAvailable(): Boolean
    suspend fun tweakMasUrl(url: String): String

-    suspend fun isEncryptionDisabledByHomeserver(): Boolean
-
    suspend fun init()
 }
@@ -24,7 +24,7 @@ class DefaultEnterpriseService : EnterpriseService {

    override suspend fun isEnterpriseUser(sessionId: SessionId) = false
    override suspend fun tweakMasUrl(url: String, homeserver: String) = url
-    override fun defaultHomeserverList(): List<String> = emptyList()
+    override fun defaultHomeserverList(): List<String> = listOf("matrix.healthchat.ch")
    override suspend fun isAllowedToConnectToHomeserver(homeserverUrl: String) = true

    override suspend fun overrideBrandColor(sessionId: SessionId?, brandColor: String?) = Unit
@@ -17,5 +17,4 @@ class DefaultSessionEnterpriseService : SessionEnterpriseService {
    override suspend fun init() = Unit
    override suspend fun tweakMasUrl(url: String): String = url
    override suspend fun isElementCallAvailable(): Boolean = true
-    override suspend fun isEncryptionDisabledByHomeserver(): Boolean = false
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
joel.poyet	a907501c08	chore(release): prepare 26.08.0 release notes Fold the member directory, profile editor, invite and status banner features into the unreleased 26.08.0 changelog section.	2026-08-06 13:41:23 +02:00
joel.poyet	7f43998fa5	Add profile editor, member invite and status banners (#4 ) * feat(healthchat): add profile editor, member invite and status banners Native 13-field profile editor with diff-only saves and avatar upload through the HealthChat API (replaces the upstream display-name editor), email invitation for approved accounts, and non-dismissible account status banners in settings and the member directory. * fix(healthchat): satisfy detekt and konsist rules Konsist presenter helper shape, no '=' in state parameter docs, present-tense invite callback, and complete renderer KDoc.	2026-08-06 13:28:24 +02:00
joel.poyet	edb3520c56	Add member directory tab to home navigation (#3 ) * feat(healthchat): add member directory tab to home navigation Third bottom-nav tab backed by the HealthChat API: searchable member cards with native start-chat, approval-pending banner, retry on failure and navigation into the native profile screens. * fix(healthchat): stop tab back handler swallowing back presses While a screen is pushed on top of Home, the still-composed tab BackHandler intercepted back presses during the transition and invisibly switched to the Chats tab. Gate it on the node's target visibility in both the parent and Home's own backstack. * fix(healthchat): satisfy detekt, ktlint and konsist rules Import alias order, composable parameter order in HomeView, and konsist presenter helper shape. * ci: pass the real repository name to the screenshot recorder recordScreenshots.yml set GITHUB_REPOSITORY from `secrets.GITHUB_REPOSITORY`. No such secret exists on this fork, so the expression expands to an empty string and overrides the built-in environment variable of the same name. recordScreenshots.sh checks it up front and exits 1 with "No repo specified", so the workflow could never record anything here. Use the `github.repository` context instead, which is always populated. Claude-Session: https://claude.ai/code/session_01MQbp1EPM4TSXq8P8Pyq44F * Update screenshots * Revert "Update screenshots" This reverts commit `b99e0d643f`. * Reapply "Update screenshots" This reverts commit `85bceb6d67`. * test(screenshots): stop a LayoutLib teardown crash failing the shard tests Paparazzi 2.0.0-alpha05 / LayoutLib 16.2.1 races on HandlerThread startup: HandlerThread_Delegate.run calls Process.setThreadPriority, which throws NoSuchMethodError for Thread.setPosixNicenessInternal and kills the "android.bg" thread. If the test thread reaches getLooper() after that, it gets null, BackgroundThread.ensureThreadReady() NPEs, and the static initialiser of LatencyTracker fails. The JVM then marks that class erroneous for the lifetime of the fork, so every later preview showing the soft keyboard dies with NoClassDefFoundError. LayoutLibErrorFilterStatement already swallowed the bare NoSuchMethodError, but PaparazziLogger re-throws collected background errors from teardown() wrapped in a MultipleFailuresException when there is more than one, and that wrapper slipped through. A recent run reported 17 failures with zero image comparisons failing and zero delta images written. Unwrap the wrapper by reflection and swallow it only when every collected cause matches the known-bug list; anything unrecognised, and anything that cannot be decomposed, is rethrown. Also close a hole this filter had from the start. Paparazzi runs the test as `try { body } finally { teardown() }`, so a teardown error discards whatever the body threw — including a genuine snapshot mismatch. renderFailureCapture is registered inside the Paparazzi rule to record the body's exception so it wins over any teardown error, and the filter refuses to swallow anything if that rule is not registered. Two HorizontalFloatingToolbar previews have been mismatching silently behind this, and may now surface as real failures. Claude-Session: https://claude.ai/code/session_01MQbp1EPM4TSXq8P8Pyq44F --------- Co-authored-by: ElementBot <android@element.io>	2026-08-06 13:10:01 +02:00
joel.poyet	0c78553641	Merge pull request #16 from Novaloop-AG/ci/screenshot-fork-per-test-class Give each screenshot test class its own JVM	2026-08-06 10:49:24 +02:00
joel.poyet	081904345a	ci: give each screenshot test class its own JVM There are five screenshot test classes (PreviewShard1..4Test plus PreviewA11yTest) and each shard renders roughly 770 previews in a single process. Gradle reuses a forked JVM for the next test class once maxParallelForks is exhausted, so on the current six-core runners (forks = 3) two classes run second, inside a process that has already rendered a full shard. That matches the observed failure exactly: PreviewShard2Test and PreviewShard4Test fail 100% while shards 1 and 3 pass 100%, and the split holds even for byte-identical preview states. The previous eight-core runners computed forks = 4, reused only one JVM, and were green on this same tree. forkEvery = 1 restarts the JVM after every test class. It costs five JVM startups and no extra peak memory, unlike raising maxParallelForks to 5, which would need 10 GB of test heap on a 19 GiB runner with no swap. Claude-Session: https://claude.ai/code/session_01MQbp1EPM4TSXq8P8Pyq44F	2026-08-06 10:41:22 +02:00
joel.poyet	ce180ef25b	Merge pull request #2 from Novaloop-AG/feature/healthchat-profile-fields Show HealthChat profile fields on profile screens	2026-08-05 15:24:31 +02:00
joel.poyet	c7800abb0f	test(healthchat): satisfy konsist presenter helper rule Konsist requires createPresenter helpers to omit the return type.	2026-08-05 14:13:04 +02:00
joel.poyet	1aeb4655bc	feat(healthchat): show profile fields on profile screens Renderer slot in UserProfileView (all three profile screens) shows specialty, practice, address, contact links and further info from the HealthChat API, with inline retry on failure.	2026-08-05 14:13:04 +02:00
joel.poyet	2db4c9847f	Add HealthChat API service layer (#1 ) * feat(healthchat): add HealthChat API service layer New features/healthchat modules: typed Retrofit client with per-request Matrix token auth, member directory, profile and invite services, plus test fakes and fixtures. * test(healthchat): use runCatchingExceptions Detekt's RunCatchingNotAllowed rule forbids plain runCatching.	2026-08-05 14:13:00 +02:00
joel.poyet	621df1dedf	Merge pull request #14 from Novaloop-AG/chore/rerecord-goldens-on-vm-runners Re-record screenshot goldens on the new VM runners	2026-08-05 14:12:35 +02:00
ElementBot	ac264ea08c	Update screenshots	2026-08-04 22:30:06 +02:00
joel.poyet	c0c0b48470	Merge pull request #9 from Novaloop-AG/feature/healthchat-remove-analytics-onboarding Remove the analytics opt-in screen from onboarding	2026-08-04 18:42:11 +02:00
joel.poyet	fa08091528	fix(lint): drop dead onboarding title overrides	2026-08-04 18:13:03 +02:00
joel.poyet	399adf2276	feat(analytics): disable analytics unless credentials are configured Removes the onboarding opt-in screen, the Analytics settings entry and the unused Posthog and Sentry SDKs.	2026-08-04 18:13:03 +02:00
joel.poyet	67fb6744fe	Merge pull request #12 from Novaloop-AG/chore/rerecord-paparazzi-goldens Re-record the stale Paparazzi screenshot goldens	2026-08-04 18:12:28 +02:00
joel.poyet	3e1010ba07	test(screenshots): re-record the 39 stale Paparazzi goldens Several captured blank or half-laid-out screens; ShareLocation also lost its map pin now that no MapTiler key is configured.	2026-08-04 17:40:13 +02:00
joel.poyet	1eb530e727	Merge pull request #13 from Novaloop-AG/ci/skip-codecov-upload Skip the Codecov upload when no token is configured	2026-08-04 17:39:36 +02:00
joel.poyet	0cd363b1c3	ci: skip the codecov upload when no token is configured	2026-08-04 17:10:38 +02:00
joel.poyet	31611e5499	Merge pull request #11 from Novaloop-AG/fix/healthchat-launcher-icon-lint Fix launcher icon lint errors in the HealthChat app icon	2026-08-04 16:08:20 +02:00
joel.poyet	fdf142db60	fix(icon): ship the monochrome launcher icons as webp Matches upstream's format, which is what tools/lint/lint.xml already exempts from IconExpectedSize.	2026-08-04 14:57:23 +02:00
joel.poyet	96db91de86	Merge pull request #10 from Novaloop-AG/fix/ci-runners-and-permissions Move releases to the persistent self-hosted runners and fix CI checkout	2026-08-04 14:45:50 +02:00
joel.poyet	e74db93344	ci: cap Gradle workers so test JVMs fit the container	2026-08-04 13:36:52 +02:00
joel.poyet	8c4ef9264b	ci: record why the Gradle heap is reduced	2026-08-04 12:55:48 +02:00
joel.poyet	409a1e5b90	ci: report runner capacity on the self-hosted jobs	2026-08-04 12:43:27 +02:00
joel.poyet	2013b86dfe	ci: size the Gradle heap for the self-hosted containers Upstream's -Xmx8g/4g is sized for hosted VMs; here the daemon is SIGKILLed and Gradle reports "the daemon has disappeared".	2026-08-04 12:28:42 +02:00
joel.poyet	cedd070bfe	ci: rely on the runner image for the Android SDK Drops the setup-android step from the release job and gates the swapfile resize, which needs a hosted runner image and passwordless sudo.	2026-08-04 11:04:07 +02:00
joel.poyet	0fcd7bcfce	ci: run the heavy Gradle jobs on the self-hosted runners Requires the Android SDK in the runner image. Also gates the disk-cleanup step to hosted runners, where it would otherwise strip the host.	2026-08-04 08:42:36 +02:00
joel.poyet	0799ad5b73	ci: disable the Label Community PRs job on this fork	2026-08-04 08:07:51 +02:00
joel.poyet	9475ec3a48	ci: grant contents:read so checkout works on this private fork	2026-08-04 07:11:37 +02:00
joel.poyet	2221bf2972	ci(release): move releases to the persistent self-hosted runners novaloop-incus-large is the GARM ephemeral pool, whose runners were reaped mid-job; [self-hosted, Linux, X64] matches four persistent org runners.	2026-08-04 07:11:37 +02:00
joel.poyet	05df27fc3a	Merge pull request #8 from Novaloop-AG/fix/play-upload-review-flag Fix Play Store upload rejected for changesNotSentForReview	2026-08-03 14:45:36 +02:00
joel.poyet	b4629fff90	fix(release): drop changesNotSentForReview from Play upload Play now sends this app's changes for review automatically and the Edits API rejects the parameter, so the AAB uploaded but the edit never committed.	2026-08-03 13:44:34 +02:00
joel.poyet	7bbbde76d1	Merge pull request #7 from Novaloop-AG/chore/release-26.08.0 Set version 26.08.0	2026-08-03 13:26:25 +02:00
joel.poyet	ec0303606a	chore(release): set version 26.08.0	2026-08-03 11:27:07 +02:00
joel.poyet	b7bfc6f751	Merge pull request #6 from Novaloop-AG/feature/healthchat-deeplinks Point deeplinks and shared permalinks at HealthChat hosts	2026-08-03 11:10:28 +02:00
joel.poyet	ada6fc457b	feat(share): share user permalinks via to.healthchat.ch Mention pills keep the matrix.to wire format other clients expect.	2026-08-03 10:53:51 +02:00
joel.poyet	57a2e585ba	feat(deeplink): point deeplinks at HealthChat hosts Claims app.healthchat.ch and to.healthchat.ch as App Links, registers the healthchat:// scheme, and drops the unreachable mobile.element.io handling.	2026-08-03 10:53:35 +02:00
joel.poyet	d6ea73140e	docs(release): document self-hosted runner and heap sizing	2026-07-27 18:38:37 +02:00
joel.poyet	a7e1217e82	fix(gplay): strip permissions Play Console rejects	2026-07-27 18:35:37 +02:00
joel.poyet	09b6d6341b	ci(release): add HealthChat Play Store release pipeline	2026-07-27 18:35:36 +02:00
Sedat Qaja	a1866b4b28	feat(branding): add HealthChat launcher icon and logo Official cross-in-circle icon (same art as the iOS X app); onboarding title localized for en/de/fr/it.	2026-07-16 14:13:00 +02:00
Sedat Qaja	2994430b88	feat(branding): rebrand app identity to HealthChat App id ch.healthchat.element, locked matrix.healthchat.ch homeserver.	2026-07-16 11:03:52 +02:00
				`@@ -0,0 +1 @@`
				`Sichere Kommunikation für Gesundheitsfachpersonen`