diff --git a/Cargo.lock b/Cargo.lock
index a3ac30037..7254df69f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -39,6 +39,16 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "aead"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1973cfbc1a2daf9cf550e74e1f088c28e7f7d8c1e1418fb6c9dc5184b7e84c99"
+dependencies = [
+ "crypto-common 0.2.2",
+ "inout 0.2.2",
+]
+
 [[package]]
 name = "aes"
 version = "0.8.4"
@@ -46,10 +56,48 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
 dependencies = [
  "cfg-if",
- "cipher",
+ "cipher 0.4.4",
  "cpufeatures 0.2.17",
 ]
 
+[[package]]
+name = "aes"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35f0f96ce78e38c3dc6d8948aa8163d06385be74000f3c7a95bf1eef35d3ea32"
+dependencies = [
+ "cipher 0.5.2",
+ "cpubits",
+ "cpufeatures 0.3.1",
+]
+
+[[package]]
+name = "aes-gcm"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"
+dependencies = [
+ "aead 0.5.2",
+ "aes 0.8.4",
+ "cipher 0.4.4",
+ "ctr",
+ "ghash",
+ "subtle",
+]
+
+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if",
+ "getrandom 0.3.4",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
 [[package]]
 name = "aho-corasick"
 version = "1.1.5"
@@ -74,6 +122,12 @@ dependencies = [
  "alloc-no-stdlib",
 ]
 
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
 [[package]]
 name = "ambient-authority"
 version = "0.0.2"
@@ -89,12 +143,82 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "anyhow"
 version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
+[[package]]
+name = "apple-native-keyring-store"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b350bfd03649e07aa05c0a81b3e15934374e585c98204a57e20b9d49f49bb9a"
+dependencies = [
+ "keyring-core",
+ "log",
+ "security-framework",
+]
+
+[[package]]
+name = "approx"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cab112f0a86d568ea0e627cc1d6be74a1e9cd55214684db5561995f6dad897c6"
+dependencies = [
+ "num-traits",
+]
+
 [[package]]
 name = "arbitrary"
 version = "1.4.2"
@@ -134,6 +258,18 @@ dependencies = [
  "rustversion",
 ]
 
+[[package]]
+name = "argon2"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "134c52ddac6d63c576bef8168db10c83c49c26444ecbc68060fef078925a901c"
+dependencies = [
+ "base64ct",
+ "blake2",
+ "cpufeatures 0.3.1",
+ "password-hash 0.6.1",
+]
+
 [[package]]
 name = "arrayvec"
 version = "0.7.8"
@@ -271,6 +407,49 @@ dependencies = [
  "syn 3.0.5",
 ]
 
+[[package]]
+name = "async-utility"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "188f83b9a198af8c336e505611edb00d6d2ac5c694241c5a4f9a12316938cfe9"
+dependencies = [
+ "futures-util",
+ "gloo-timers",
+ "tokio",
+ "wasm-bindgen-futures",
+]
+
+[[package]]
+name = "async-wsocket"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c713e1f14c7b82e32ea159af1c6e2f070cfadbdf23fb2512acce9af0a26f1a2"
+dependencies = [
+ "futures",
+ "futures-util",
+ "js-sys",
+ "tokio",
+ "tokio-happy-eyeballs",
+ "tokio-rustls",
+ "tokio-socks",
+ "tokio-tungstenite 0.28.0",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "async_io_stream"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6d7b9decdf35d8908a7e3ef02f64c5e9b1695e230154c0e8de3969142d9b94c"
+dependencies = [
+ "futures",
+ "pharos",
+ "rustc_version",
+]
+
 [[package]]
 name = "atk"
 version = "0.18.2"
@@ -294,12 +473,33 @@ dependencies = [
  "system-deps",
 ]
 
+[[package]]
+name = "atomic"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89cbf775b137e9b968e67227ef7f775587cde3fd31b0d8599dbd0f598a48340"
+dependencies = [
+ "bytemuck",
+]
+
 [[package]]
 name = "atomic-waker"
 version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
+[[package]]
+name = "attohttpc"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16e2cdb6d5ed835199484bb92bb8b3edd526effe995c61732580439c1a67e2e9"
+dependencies = [
+ "base64 0.22.1",
+ "http",
+ "log",
+ "url",
+]
+
 [[package]]
 name = "autocfg"
 version = "1.5.1"
@@ -350,6 +550,7 @@ dependencies = [
  "matchit",
  "memchr",
  "mime",
+ "multer",
  "percent-encoding",
  "pin-project-lite",
  "serde_core",
@@ -359,7 +560,7 @@ dependencies = [
  "sha1",
  "sync_wrapper",
  "tokio",
- "tokio-tungstenite",
+ "tokio-tungstenite 0.29.0",
  "tower",
  "tower-layer",
  "tower-service",
@@ -396,6 +597,23 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "backon"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cffb0e931875b666fc4fcb20fee52e9bbd1ef836fd9e9e04ec21555f9f85f7ef"
+dependencies = [
+ "fastrand",
+ "gloo-timers",
+ "tokio",
+]
+
+[[package]]
+name = "base16ct"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd307490d624467aa6f74b0eabb77633d1f758a7b25f12bceb0b22e08d9726f6"
+
 [[package]]
 name = "base64"
 version = "0.21.7"
@@ -443,15 +661,30 @@ dependencies = [
  "unicode-normalization",
 ]
 
+[[package]]
+name = "bit-set"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0700ddab506f33b20a03b13996eccd309a48e5ff77d0d95926aa0210fb4e95f1"
+dependencies = [
+ "bit-vec 0.6.3",
+]
+
 [[package]]
 name = "bit-set"
 version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
 dependencies = [
- "bit-vec",
+ "bit-vec 0.8.0",
 ]
 
+[[package]]
+name = "bit-vec"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "349f9b6a179ed607305526ca489b34ad0a41aed5f7980fa90eb03160b69598fb"
+
 [[package]]
 name = "bit-vec"
 version = "0.8.0"
@@ -522,6 +755,28 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "blake2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b5d4d889834ee8ecfc0f8426ad30faf7cdcb10f741a8e6d7224d95325479f6f"
+dependencies = [
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "blake3"
+version = "1.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d9e454fc11f76977dc803893aff6304ed33d6a26efae8696573bea74baa27ae"
+dependencies = [
+ "arrayvec",
+ "cc",
+ "cfg-if",
+ "constant_time_eq",
+ "cpufeatures 0.3.1",
+]
+
 [[package]]
 name = "block-buffer"
 version = "0.10.4"
@@ -549,6 +804,15 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "block-padding"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "710f1dd022ef4e93f8a438b4ba958de7f64308434fa6a87104481645cc30068b"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "block2"
 version = "0.6.2"
@@ -571,6 +835,29 @@ dependencies = [
  "piper",
 ]
 
+[[package]]
+name = "bon"
+version = "3.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "214f5df094ce551a10a30ffb9c70243d61f121a3d985a6495933e181dee6a7d2"
+dependencies = [
+ "bon-macros",
+]
+
+[[package]]
+name = "bon-macros"
+version = "3.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2706da6c749998cc555d04184909608956a69ad3f8ab1a076fbc867b4a3c3ce5"
+dependencies = [
+ "darling 0.24.1",
+ "ident_case",
+ "prettyplease 0.3.0",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
 [[package]]
 name = "brotli"
 version = "8.0.4"
@@ -601,6 +888,17 @@ dependencies = [
  "tinyvec",
 ]
 
+[[package]]
+name = "bstr"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6bb31b46c14244e20ee9984b11bf5c992b91fb6939fea616e3512c8baecdbe5f"
+dependencies = [
+ "memchr",
+ "regex-automata",
+ "serde_core",
+]
+
 [[package]]
 name = "bumpalo"
 version = "3.20.3"
@@ -622,7 +920,7 @@ dependencies = [
  "hex",
  "nix 0.31.3",
  "reqwest",
- "rmcp",
+ "rmcp 1.8.0",
  "serde",
  "serde_json",
  "serde_yaml",
@@ -644,7 +942,7 @@ dependencies = [
  "buzz-credential-store",
  "dotenvy",
  "getrandom 0.3.4",
- "hmac",
+ "hmac 0.12.1",
  "libc",
  "nix 0.31.3",
  "nostr 0.45.5",
@@ -656,7 +954,7 @@ dependencies = [
  "sha2 0.10.9",
  "strip-ansi-escapes",
  "tempfile",
- "tungstenite",
+ "tungstenite 0.29.0",
  "url",
  "windows-sys 0.61.2",
  "zeroize",
@@ -667,7 +965,7 @@ name = "buzz-credential-store"
 version = "0.1.0"
 dependencies = [
  "dirs",
- "keyring",
+ "keyring 3.6.3",
  "nix 0.31.3",
  "security-framework",
  "sha2 0.10.9",
@@ -686,6 +984,7 @@ dependencies = [
  "buzz-agent",
  "buzz-agent-controller",
  "buzz-credential-store",
+ "buzz-mesh-compute",
  "buzz-pairing",
  "buzzodz-plugins",
  "bytes",
@@ -697,7 +996,7 @@ dependencies = [
  "getrandom 0.3.4",
  "gtk",
  "hex",
- "hmac",
+ "hmac 0.12.1",
  "image",
  "libc",
  "nostr 0.44.8",
@@ -730,7 +1029,7 @@ dependencies = [
  "tauri-winrt-notification",
  "tempfile",
  "tokio",
- "tokio-tungstenite",
+ "tokio-tungstenite 0.29.0",
  "tokio-util",
  "url",
  "user-idle",
@@ -745,6 +1044,28 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "buzz-mesh-compute"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base64 0.22.1",
+ "ed25519-dalek 2.2.0",
+ "hex",
+ "iroh",
+ "mesh-llm-events",
+ "mesh-llm-host-runtime",
+ "mesh-llm-sdk",
+ "mesh-llm-system",
+ "nostr 0.45.5",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "tempfile",
+ "tokio",
+ "url",
+]
+
 [[package]]
 name = "buzz-pairing"
 version = "0.0.0"
@@ -779,6 +1100,12 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "by_address"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64fa3c856b712db6612c019f14756e64e4bcea13337a6b33b696333a9eaa2d06"
+
 [[package]]
 name = "bytemuck"
 version = "1.25.2"
@@ -903,13 +1230,31 @@ dependencies = [
  "toml 0.9.12+spec-1.1.0",
 ]
 
+[[package]]
+name = "castaway"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dec551ab6e7578819132c713a93c022a05d60159dc86e7a7050223577484c55a"
+dependencies = [
+ "rustversion",
+]
+
 [[package]]
 name = "cbc"
 version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26b52a9543ae338f279b96b0b9fed9c8093744685043739079ce85cd58f289a6"
 dependencies = [
- "cipher",
+ "cipher 0.4.4",
+]
+
+[[package]]
+name = "cbc"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce2dc9ee5f88d11e0beb842c88b33c8a5cf0d1329c4b19494af42b07dbfe8896"
+dependencies = [
+ "cipher 0.5.2",
 ]
 
 [[package]]
@@ -976,7 +1321,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
 dependencies = [
  "cfg-if",
- "cipher",
+ "cipher 0.4.4",
  "cpufeatures 0.2.17",
 ]
 
@@ -987,6 +1332,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
+ "cipher 0.5.2",
  "cpufeatures 0.3.1",
  "rand_core 0.10.1",
 ]
@@ -997,13 +1343,25 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
 dependencies = [
- "aead",
+ "aead 0.5.2",
  "chacha20 0.9.1",
- "cipher",
- "poly1305",
+ "cipher 0.4.4",
+ "poly1305 0.8.0",
  "zeroize",
 ]
 
+[[package]]
+name = "chacha20poly1305"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b89e1c441e926b9c82a8d023f6e1b7ae0adcfaa7d621814e4d60789bac751cb"
+dependencies = [
+ "aead 0.6.1",
+ "chacha20 0.10.2",
+ "cipher 0.5.2",
+ "poly1305 0.9.1",
+]
+
 [[package]]
 name = "chrono"
 version = "0.4.45"
@@ -1011,8 +1369,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
 dependencies = [
  "iana-time-zone",
+ "js-sys",
  "num-traits",
  "serde",
+ "wasm-bindgen",
  "windows-link 0.2.1",
 ]
 
@@ -1023,21 +1383,72 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
  "crypto-common 0.1.7",
- "inout",
+ "inout 0.1.4",
  "zeroize",
 ]
 
 [[package]]
-name = "clipboard-win"
-version = "5.4.1"
+name = "cipher"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bde03770d3df201d4fb868f2c9c59e66a3e4e2bd06692a0fe701e7103c7e84d4"
+checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
 dependencies = [
- "error-code",
+ "block-buffer 0.12.1",
+ "crypto-common 0.2.2",
+ "inout 0.2.2",
 ]
 
 [[package]]
-name = "cmake"
+name = "clap"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa8876b300ab35ba921adea3dfd70157a46249b33f95c9084ae5709785478946"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0797fb7aeb1406c84efac526901f7ec3ead2124f946b494e72879d4b54704d"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9c751b79415d4e559e3d1fcf128e09e720eb673a06d26cf6f392d37d75b66e0"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c133bc6a41be0d194c306b5506d15e6feeea7b1d6604bd3f8310dfb2ca96486"
+
+[[package]]
+name = "clipboard-win"
+version = "5.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bde03770d3df201d4fb868f2c9c59e66a3e4e2bd06692a0fe701e7103c7e84d4"
+dependencies = [
+ "error-code",
+]
+
+[[package]]
+name = "cmake"
 version = "0.1.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
@@ -1045,12 +1456,42 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "cmov"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
+
+[[package]]
+name = "cobs"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
+dependencies = [
+ "thiserror 2.0.20",
+]
+
 [[package]]
 name = "color_quant"
 version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
 
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
+[[package]]
+name = "colored"
+version = "3.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "combine"
 version = "4.6.8"
@@ -1061,6 +1502,20 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "compact_str"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9dfdd1c2274d9aa354115b09dc9a901d6c5576818cdf70d14cae2bdb47df00ab"
+dependencies = [
+ "castaway",
+ "cfg-if",
+ "itoa",
+ "rustversion",
+ "ryu",
+ "static_assertions",
+]
+
 [[package]]
 name = "concurrent-queue"
 version = "2.5.0"
@@ -1070,6 +1525,24 @@ dependencies = [
  "crossbeam-utils",
 ]
 
+[[package]]
+name = "const-hex"
+version = "1.19.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e59eef12462b0f9b0a3620219be5d639afd79fe39dff0a42c3997061f9298b4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "proptest",
+ "serde_core",
+]
+
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
 [[package]]
 name = "const-oid"
 version = "0.10.2"
@@ -1096,6 +1569,36 @@ dependencies = [
  "tiny-keccak",
 ]
 
+[[package]]
+name = "const-str"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18f12cc9948ed9604230cdddc7c86e270f9401ccbe3c2e98a4378c5e7632212f"
+
+[[package]]
+name = "const_panic"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9603f79528ece8163c496f8932121cb36cfe46259e9c907bb3d8205139d7caa3"
+dependencies = [
+ "typewit",
+]
+
+[[package]]
+name = "constant_time_eq"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b"
+
+[[package]]
+name = "convert_case"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "633458d4ef8c78b72454de2d54fd6ab2e60f9e02be22f3c6104cdc8a4e0fceb9"
+dependencies = [
+ "unicode-segmentation",
+]
+
 [[package]]
 name = "cookie"
 version = "0.18.2"
@@ -1106,6 +1609,16 @@ dependencies = [
  "version_check",
 ]
 
+[[package]]
+name = "cordyceps"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b9ab7e0ca1d179628fa0172b2b97203c7fa0cd81be2448bd446fb9559ca9261"
+dependencies = [
+ "loom",
+ "tracing",
+]
+
 [[package]]
 name = "core-foundation"
 version = "0.9.4"
@@ -1156,6 +1669,27 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "core_detect"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f8f80099a98041a3d1622845c271458a2d73e688351bf3cb999266764b81d48"
+
+[[package]]
+name = "countio"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9702aee5d1d744c01d82f6915644f950f898e014903385464c773b96fefdecb"
+dependencies = [
+ "futures-io",
+]
+
+[[package]]
+name = "cpubits"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
+
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -1183,6 +1717,12 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "critical-section"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
+
 [[package]]
 name = "crossbeam-channel"
 version = "0.5.17"
@@ -1192,12 +1732,48 @@ dependencies = [
  "crossbeam-utils",
 ]
 
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03e8bd762f7479489c70ed6c768ddca99d7296857de437a68dcb2a94365b3fae"
+dependencies = [
+ "crossbeam-utils",
+]
+
 [[package]]
 name = "crossbeam-utils"
 version = "0.8.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a31eee39dddec8330830986fcd7625edb5a24ec90ea038215273bbc3adb08ac6"
 
+[[package]]
+name = "crossterm"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8b9f2e4c67f833b660cdb0a3523065869fb35570177239812ed4c905aeff87b"
+dependencies = [
+ "bitflags 2.13.1",
+ "crossterm_winapi",
+ "derive_more",
+ "document-features",
+ "mio",
+ "parking_lot",
+ "rustix",
+ "signal-hook",
+ "signal-hook-mio",
+ "winapi",
+]
+
+[[package]]
+name = "crossterm_winapi"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "acdd7c62a3665c7f6830a51635d9ac9b23ed385797f70a83bb8bafe9c572ab2b"
+dependencies = [
+ "winapi",
+]
+
 [[package]]
 name = "crunchy"
 version = "0.2.4"
@@ -1221,7 +1797,48 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
+ "getrandom 0.4.3",
  "hybrid-array",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "crypto_box"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16182b4f39a82ec8a6851155cc4c0cda3065bb1db33651726a29e1951de0f009"
+dependencies = [
+ "aead 0.5.2",
+ "crypto_secretbox",
+ "curve25519-dalek 4.1.3",
+ "salsa20",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "crypto_secretbox"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9d6cf87adf719ddf43a805e92c6870a531aedda35ff640442cbaf8674e141e1"
+dependencies = [
+ "aead 0.5.2",
+ "cipher 0.4.4",
+ "generic-array",
+ "poly1305 0.8.0",
+ "salsa20",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "csscolorparser"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb2a7d3066da2de787b7f032c736763eb7ae5d355f81a68bab2675a96008b0bf"
+dependencies = [
+ "lab",
+ "phf 0.11.3",
 ]
 
 [[package]]
@@ -1233,7 +1850,7 @@ dependencies = [
  "cssparser-macros",
  "dtoa-short",
  "itoa",
- "phf",
+ "phf 0.13.1",
  "smallvec",
 ]
 
@@ -1267,20 +1884,103 @@ dependencies = [
  "dtor",
 ]
 
+[[package]]
+name = "ctor"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "914a755b7c2d4af2bdcff7ce1739e2db9a1b81a9b07123d8015786ae03c0980d"
+dependencies = [
+ "link-section",
+ "linktime-proc-macro",
+]
+
 [[package]]
 name = "ctor-proc-macro"
 version = "0.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "52560adf09603e58c9a7ee1fe1dcb95a16927b17c127f0ac02d6e768a0e25bc1"
 
+[[package]]
+name = "ctr"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
+dependencies = [
+ "cipher 0.4.4",
+]
+
+[[package]]
+name = "ctutils"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03bb0e1cc970d482d121d9a1744999169b69a07470b3d644a7894e53fcaf4574"
+dependencies = [
+ "cmov",
+]
+
+[[package]]
+name = "curve25519-dalek"
+version = "4.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "curve25519-dalek-derive",
+ "digest 0.10.7",
+ "fiat-crypto 0.2.9",
+ "rustc_version",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek"
+version = "5.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5eed333089e2e1c1ac8c6c0398e5e2497b4c9926ca6d0365ed1e099afa5bc23"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.1",
+ "curve25519-dalek-derive",
+ "digest 0.11.3",
+ "fiat-crypto 0.3.0",
+ "rand_core 0.10.1",
+ "rustc_version",
+ "serde",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "darling"
 version = "0.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
 dependencies = [
- "darling_core",
- "darling_macro",
+ "darling_core 0.23.0",
+ "darling_macro 0.23.0",
+]
+
+[[package]]
+name = "darling"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed17f5901b6630b993ca003def43f2f8ef4014fc13b047b57aad617ff32bc2ec"
+dependencies = [
+ "darling_core 0.24.1",
+ "darling_macro 0.24.1",
 ]
 
 [[package]]
@@ -1296,17 +1996,41 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "darling_core"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6837e2cf7485aaae18f86181d2f0e9a7ed297a025e220aeabf63fdebd3a2ddff"
+dependencies = [
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn 3.0.5",
+]
+
 [[package]]
 name = "darling_macro"
 version = "0.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
 dependencies = [
- "darling_core",
+ "darling_core 0.23.0",
  "quote",
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "darling_macro"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ac7135c3ef02b2f7833bbeb1be5ba7f966dcde8a87c6b87f65a778d71a02785"
+dependencies = [
+ "darling_core 0.24.1",
+ "quote",
+ "syn 3.0.5",
+]
+
 [[package]]
 name = "data-encoding"
 version = "2.11.1"
@@ -1314,10 +2038,30 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"
 
 [[package]]
-name = "dbus"
-version = "0.9.12"
+name = "data-encoding-macro"
+version = "0.1.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ab69f03cc8c4340c9c8e315114e1658e6775a9b16a04357973aa21cec22b32e"
+checksum = "c6a127ecbb3c4632e1525380e04c0c3fcf8dcb44d32a79ea290d8a36906edcd8"
+dependencies = [
+ "data-encoding",
+ "data-encoding-macro-internal",
+]
+
+[[package]]
+name = "data-encoding-macro-internal"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c54e03a951783e8b327515db3f2a2fd0e3bed362a96b066f341ce66ed49b4ead"
+dependencies = [
+ "data-encoding",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "dbus"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ab69f03cc8c4340c9c8e315114e1658e6775a9b16a04357973aa21cec22b32e"
 dependencies = [
  "libc",
  "libdbus-sys",
@@ -1330,12 +2074,12 @@ version = "4.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "708b509edf7889e53d7efb0ffadd994cc6c2345ccb62f55cfd6b0682165e4fa6"
 dependencies = [
- "aes",
- "block-padding",
- "cbc",
+ "aes 0.8.4",
+ "block-padding 0.3.3",
+ "cbc 0.1.2",
  "dbus",
  "fastrand",
- "hkdf",
+ "hkdf 0.12.4",
  "num",
  "once_cell",
  "openssl",
@@ -1383,6 +2127,33 @@ dependencies = [
  "thiserror 2.0.20",
 ]
 
+[[package]]
+name = "deltae"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5729f5117e208430e437df2f4843f5e5952997175992d1414f94c57d61e270b4"
+
+[[package]]
+name = "der"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+dependencies = [
+ "const-oid 0.9.6",
+ "zeroize",
+]
+
+[[package]]
+name = "der"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a878c850e9e421b20262e9b41f9c860e4785fa07541c266b62ff9d1ef998a80a"
+dependencies = [
+ "const-oid 0.10.2",
+ "pem-rfc7468",
+ "zeroize",
+]
+
 [[package]]
 name = "deranged"
 version = "0.5.8"
@@ -1418,12 +2189,20 @@ version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
 dependencies = [
+ "convert_case",
  "proc-macro2",
  "quote",
  "rustc_version",
  "syn 2.0.119",
+ "unicode-xid",
 ]
 
+[[package]]
+name = "diatomic-waker"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab03c107fafeb3ee9f5925686dbb7a73bc76e3932abb0d2b365cb64b169cf04c"
+
 [[package]]
 name = "digest"
 version = "0.10.7"
@@ -1442,8 +2221,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
  "block-buffer 0.12.1",
- "const-oid",
+ "const-oid 0.10.2",
  "crypto-common 0.2.2",
+ "ctutils",
 ]
 
 [[package]]
@@ -1522,13 +2302,22 @@ dependencies = [
  "const-random",
 ]
 
+[[package]]
+name = "document-features"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4b8a88685455ed29a21542a33abd9cb6510b6b129abadabdcef0f4c55bc8f61"
+dependencies = [
+ "litrs",
+]
+
 [[package]]
 name = "dom_query"
 version = "0.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "521e380c0c8afb8d9a1e83a1822ee03556fc3e3e7dbc1fd30be14e37f9cb3f89"
 dependencies = [
- "bit-set",
+ "bit-set 0.8.0",
  "cssparser",
  "foldhash 0.2.0",
  "html5ever",
@@ -1600,6 +2389,63 @@ version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
 
+[[package]]
+name = "ed25519"
+version = "2.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
+dependencies = [
+ "pkcs8 0.10.2",
+ "signature 2.2.0",
+]
+
+[[package]]
+name = "ed25519"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29fcf32e6c73d1079f83ab4d782de2d81620346a5f38c6237a86a22f8368980a"
+dependencies = [
+ "pkcs8 0.11.0",
+ "serdect",
+ "signature 3.0.0",
+]
+
+[[package]]
+name = "ed25519-dalek"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
+dependencies = [
+ "curve25519-dalek 4.1.3",
+ "ed25519 2.2.3",
+ "serde",
+ "sha2 0.10.9",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "ed25519-dalek"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ebaa1a2bf1290ab3bfe5a7b771d050ebffab2711c19a81691c683a5144a25de"
+dependencies = [
+ "curve25519-dalek 5.0.0",
+ "ed25519 3.0.0",
+ "rand_core 0.10.1",
+ "serde",
+ "sha2 0.11.0",
+ "signature 3.0.0",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "either"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e9c71c2167ca323c882b99918929403426e2373ea17242ff5653e0d5e1058be"
+
 [[package]]
 name = "embed-resource"
 version = "3.0.11"
@@ -1620,12 +2466,49 @@ version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ef6b89e5b37196644d8796de5268852ff179b44e96276cf4290264843743bb7"
 
+[[package]]
+name = "embedded-io"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef1a6892d9eef45c8fa6b9e0086428a2cca8491aca8f787c534a3d6d0bcb3ced"
+
+[[package]]
+name = "embedded-io"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edd0f118536f44f5ccd48bcb8b111bdc3de888b58c74639dfb034a357d0f206d"
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.42"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e985e0451871ad22fb8d2b6b076e2028a502a0d3950998c2c5c0a4f9b5d9679"
+dependencies = [
+ "cfg-if",
+ "core_detect",
+ "multiversion_no_op",
+ "rustversion",
+ "scopeguard",
+ "simdutf8",
+]
+
 [[package]]
 name = "endi"
 version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"
 
+[[package]]
+name = "enum-assoc"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0590c4a94da3372e83493b956755a6e2266830b6e4e3b101afe66e3f39477b91"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
 [[package]]
 name = "enumflags2"
 version = "0.7.12"
@@ -1680,6 +2563,15 @@ version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b5343afd4a8365a643ac588dab4cf234a190c7f6c88c9f6dd6ffe00837661b7"
 
+[[package]]
+name = "euclid"
+version = "0.22.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1a05365e3b1c6d1650318537c7460c6923f1abdd272ad6842baa2b509957a06"
+dependencies = [
+ "num-traits",
+]
+
 [[package]]
 name = "event-listener"
 version = "5.4.2"
@@ -1712,6 +2604,16 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
 
+[[package]]
+name = "fancy-regex"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b95f7c0680e4142284cf8b22c14a476e87d61b004a3a0861872b32ef7ead40a2"
+dependencies = [
+ "bit-set 0.5.3",
+ "regex",
+]
+
 [[package]]
 name = "faster-hex"
 version = "0.10.1"
@@ -1745,6 +2647,18 @@ dependencies = [
  "simd-adler32",
 ]
 
+[[package]]
+name = "fiat-crypto"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
+
+[[package]]
+name = "fiat-crypto"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64cd1e32ddd350061ae6edb1b082d7c54915b5c672c389143b9a63403a109f24"
+
 [[package]]
 name = "field-offset"
 version = "0.3.6"
@@ -1782,6 +2696,18 @@ version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3e0f1c7c3a72c66fd80abe965175f7523475c0489a87d3ff9d6e8c87d87a9d2d"
 
+[[package]]
+name = "finl_unicode"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "80bb028c8b4148c9ee0cca68fcd9add6044e81d3619f48577ddf13a263d047a2"
+
+[[package]]
+name = "fixedbitset"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"
+
 [[package]]
 name = "fixedbitset"
 version = "0.5.7"
@@ -1799,6 +2725,17 @@ dependencies = [
  "zlib-rs",
 ]
 
+[[package]]
+name = "flume"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e139bc46ca777eb5efaf62df0ab8cc5fd400866427e56c68b22e414e53bd3be"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+ "spin 0.9.9",
+]
+
 [[package]]
 name = "fnv"
 version = "1.0.7"
@@ -1910,6 +2847,19 @@ dependencies = [
  "futures-util",
 ]
 
+[[package]]
+name = "futures-buffered"
+version = "0.2.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4421cb78ee172b6b06080093479d3c50f058e7c81b7d577bbb8d118d551d4cd5"
+dependencies = [
+ "cordyceps",
+ "diatomic-waker",
+ "futures-core",
+ "pin-project-lite",
+ "spin 0.10.1",
+]
+
 [[package]]
 name = "futures-channel"
 version = "0.3.34"
@@ -2095,6 +3045,27 @@ dependencies = [
  "x11",
 ]
 
+[[package]]
+name = "gearhash"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "616e8f476a586f1b078d9eece21f7a071f27997e709e2b471f5697deea53bda9"
+
+[[package]]
+name = "generator"
+version = "0.8.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54ade96dc9003043bce7c035c85a9df5a858bfb2039c5a2e6fdf00f324f6c551"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "libc",
+ "log",
+ "rustversion",
+ "windows-link 0.2.1",
+ "windows-result 0.4.1",
+]
+
 [[package]]
 name = "generic-array"
 version = "0.14.7"
@@ -2103,6 +3074,7 @@ checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
 dependencies = [
  "typenum",
  "version_check",
+ "zeroize",
 ]
 
 [[package]]
@@ -2124,7 +3096,7 @@ dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
- "wasi",
+ "wasi 0.11.1+wasi-snapshot-preview1",
  "wasm-bindgen",
 ]
 
@@ -2154,6 +3126,16 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "ghash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1"
+dependencies = [
+ "opaque-debug",
+ "polyval",
+]
+
 [[package]]
 name = "gif"
 version = "0.14.2"
@@ -2196,6 +3178,26 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "git-version"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ad568aa3db0fcbc81f2f116137f263d7304f512a1209b35b85150d3ef88ad19"
+dependencies = [
+ "git-version-macro",
+]
+
+[[package]]
+name = "git-version-macro"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53010ccb100b96a67bc32c0175f0ed1426b31b655d562898e57325f81c023ac0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "glib"
 version = "0.18.5"
@@ -2249,6 +3251,31 @@ version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
 
+[[package]]
+name = "globset"
+version = "0.4.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07c34a9410465b45bd9787443bc7370f37735bad04b0f0cd57ff1a3186c98988"
+dependencies = [
+ "aho-corasick",
+ "bstr",
+ "log",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "gloo-timers"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbb143cf96099802033e0d4f4963b19fd2e0b728bcf076cd9cf7f6634f092994"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "js-sys",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "gobject-sys"
 version = "0.18.0"
@@ -2312,6 +3339,25 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "h2"
+version = "0.4.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d29020232d6aa3fb1daca64c1127cf662cf97f254ae16c18c05b8ab635fc118"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap 2.14.2",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
 [[package]]
 name = "half"
 version = "2.7.1"
@@ -2359,7 +3405,11 @@ version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
 dependencies = [
+ "allocator-api2",
+ "equivalent",
  "foldhash 0.2.0",
+ "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -2367,16 +3417,27 @@ name = "hashbrown"
 version = "0.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash 0.2.0",
+]
 
 [[package]]
 name = "hashlink"
-version = "0.11.1"
+version = "0.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "824e001ac4f3012dd16a264bec811403a67ca9deb6c102fc5049b32c4574b35f"
+checksum = "a596f1b20ed2cc5ecac41a164aaebc7258057060f06c0cf7a2ba3991ee7990fb"
 dependencies = [
- "hashbrown 0.16.1",
+ "hashbrown 0.17.1",
 ]
 
+[[package]]
+name = "heapify"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0049b265b7f201ca9ab25475b22b47fe444060126a51abe00f77d986fc5cc52e"
+
 [[package]]
 name = "heapless"
 version = "0.8.0"
@@ -2429,24 +3490,67 @@ dependencies = [
  "arrayvec",
 ]
 
+[[package]]
+name = "hf-xet"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f24754aef4f6c3d57bc4a0dc2648ca74487050eda01c361b3eefa11feeafd662"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "bytes",
+ "http",
+ "more-asserts",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.20",
+ "tokio",
+ "tokio-util",
+ "tokio_with_wasm",
+ "tracing",
+ "uuid",
+ "xet-client",
+ "xet-core-structures",
+ "xet-data",
+ "xet-runtime",
+]
+
 [[package]]
 name = "hkdf"
 version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
 dependencies = [
- "hmac",
+ "hmac 0.12.1",
 ]
 
 [[package]]
-name = "hmac"
-version = "0.12.1"
+name = "hkdf"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4aaa26c720c68b866f2c96ef5c1264b3e6f473fe5d4ce61cd44bbe913e553018"
+dependencies = [
+ "hmac 0.13.0",
+]
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
 dependencies = [
  "digest 0.10.7",
 ]
 
+[[package]]
+name = "hmac"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
+dependencies = [
+ "digest 0.11.3",
+]
+
 [[package]]
 name = "html5ever"
 version = "0.38.0"
@@ -2502,6 +3606,12 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
+[[package]]
+name = "humantime"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15cdd26707701c53297e2fa6afb323d55fbc1d0810c3aec078ae3ef0424c3c15"
+
 [[package]]
 name = "hybrid-array"
 version = "0.4.15"
@@ -2521,6 +3631,7 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-core",
+ "h2",
  "http",
  "http-body",
  "httparse",
@@ -2547,6 +3658,19 @@ dependencies = [
  "tower-service",
 ]
 
+[[package]]
+name = "hyper-timeout"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
+dependencies = [
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
 [[package]]
 name = "hyper-util"
 version = "0.1.20"
@@ -2565,11 +3689,11 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "socket2",
- "system-configuration",
+ "system-configuration 0.7.0",
  "tokio",
  "tower-service",
  "tracing",
- "windows-registry",
+ "windows-registry 0.6.1",
 ]
 
 [[package]]
@@ -2695,6 +3819,12 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
 
+[[package]]
+name = "identity-hash"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfdd7caa900436d8f13b2346fe10257e0c05c1f1f9e351f4f5d57c03bd5f45da"
+
 [[package]]
 name = "idna"
 version = "1.1.0"
@@ -2716,6 +3846,36 @@ dependencies = [
  "icu_properties",
 ]
 
+[[package]]
+name = "if-addrs"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0a05c691e1fae256cf7013d99dad472dc52d5543322761f83ec8d47eab40d2b"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "igd-next"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de7238d487a9aff61f81b5ab41c0a841532a115a398b5fa92a2fadd0885e2581"
+dependencies = [
+ "attohttpc",
+ "bytes",
+ "futures",
+ "http",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "log",
+ "rand 0.10.2",
+ "tokio",
+ "url",
+ "xmltree",
+]
+
 [[package]]
 name = "image"
 version = "0.25.10"
@@ -2768,6 +3928,15 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "indoc"
+version = "2.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79cf5c93f93228cf8efb3ba362535fb11199ac548a09ce117c9b1adc3030d706"
+dependencies = [
+ "rustversion",
+]
+
 [[package]]
 name = "infer"
 version = "0.19.0"
@@ -2783,10 +3952,33 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
 dependencies = [
- "block-padding",
+ "block-padding 0.3.3",
  "generic-array",
 ]
 
+[[package]]
+name = "inout"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7"
+dependencies = [
+ "block-padding 0.4.2",
+ "hybrid-array",
+]
+
+[[package]]
+name = "instability"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c3b5acc1e2fd9375041a388da33d1eb8aed5f7a8c0dd3543e3ea2805adfbe20"
+dependencies = [
+ "darling 0.24.1",
+ "indoc",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
 [[package]]
 name = "instant"
 version = "0.1.13"
@@ -2821,12 +4013,188 @@ version = "3.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2f0fb0570afe1fed943c5c3d4102d5358592d8625fda6a0007fdbe65a92fba96"
 
+[[package]]
+name = "ipconfig"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d40460c0ce33d6ce4b0630ad68ff63d6661961c48b6dba35e5a4d81cfb48222"
+dependencies = [
+ "socket2",
+ "widestring",
+ "windows-registry 0.6.1",
+ "windows-result 0.4.1",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "ipnet"
 version = "2.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0"
 
+[[package]]
+name = "iroh"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "885787b892b5e2507c701f132ecbd45d2bad4bbb75157a19427087c16dadb833"
+dependencies = [
+ "backon",
+ "blake3",
+ "bytes",
+ "cfg_aliases 0.2.2",
+ "ctutils",
+ "data-encoding",
+ "derive_more",
+ "ed25519-dalek 3.0.0",
+ "futures-util",
+ "getrandom 0.4.3",
+ "http",
+ "ipnet",
+ "iroh-base",
+ "iroh-dns",
+ "iroh-metrics",
+ "iroh-relay",
+ "n0-error",
+ "n0-future",
+ "n0-watcher",
+ "netwatch",
+ "noq",
+ "noq-proto",
+ "noq-udp",
+ "papaya",
+ "pin-project",
+ "portable-atomic",
+ "portmapper",
+ "rand 0.10.2",
+ "reqwest",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "serde",
+ "smallvec",
+ "strum",
+ "time",
+ "tokio",
+ "tokio-stream",
+ "tokio-util",
+ "tracing",
+ "url",
+ "wasm-bindgen-futures",
+]
+
+[[package]]
+name = "iroh-base"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ae9092be76c9f5429776ab3394f5a5a78dc19dc2524267e884a5b9781546c3f"
+dependencies = [
+ "curve25519-dalek 5.0.0",
+ "data-encoding",
+ "data-encoding-macro",
+ "derive_more",
+ "ed25519-dalek 3.0.0",
+ "getrandom 0.4.3",
+ "n0-error",
+ "rand 0.10.2",
+ "serde",
+ "url",
+ "zeroize",
+]
+
+[[package]]
+name = "iroh-dns"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "80276761b56e904e26ea71d0863beef0bb8d5ab6b639cbd1338e4b615209e3a1"
+dependencies = [
+ "arc-swap",
+ "cfg_aliases 0.2.2",
+ "derive_more",
+ "iroh-base",
+ "n0-dns-resolver",
+ "n0-error",
+ "n0-future",
+ "portable-atomic",
+ "rand 0.10.2",
+ "rustls",
+ "simple-dns",
+ "strum",
+ "tokio",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "iroh-metrics"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ede55536349842337f7cdc63012ec33dc637945f3259c98a0763aac364cdf09"
+dependencies = [
+ "iroh-metrics-derive",
+ "itoa",
+ "n0-error",
+ "portable-atomic",
+ "ryu",
+ "serde",
+ "tracing",
+]
+
+[[package]]
+name = "iroh-metrics-derive"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ae5f0c4405d1fbc9fb16ff422ca40620e93dc36c30ecaba0c2aee3992b7bd48"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "iroh-relay"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee116a8233f84980574bb8d11e4517503080cd2c3605bafca04ee9c35d708bd9"
+dependencies = [
+ "blake3",
+ "bytes",
+ "cfg_aliases 0.2.2",
+ "data-encoding",
+ "derive_more",
+ "getrandom 0.4.3",
+ "http",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "iroh-base",
+ "iroh-dns",
+ "iroh-metrics",
+ "lru",
+ "n0-error",
+ "n0-future",
+ "noq",
+ "noq-proto",
+ "num_enum",
+ "pin-project",
+ "postcard",
+ "rand 0.10.2",
+ "reqwest",
+ "rustls",
+ "rustls-pki-types",
+ "serde",
+ "serde_bytes",
+ "strum",
+ "tokio",
+ "tokio-rustls",
+ "tokio-util",
+ "tokio-websockets",
+ "tracing",
+ "url",
+ "webpki-roots 1.0.9",
+ "ws_stream_wasm",
+]
+
 [[package]]
 name = "is-docker"
 version = "0.2.0"
@@ -2846,6 +4214,21 @@ dependencies = [
  "once_cell",
 ]
 
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "itertools"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "itoa"
 version = "1.0.18"
@@ -3045,6 +4428,17 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "kasuari"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bde5057d6143cc94e861d90f591b9303d6716c6b9602309150bd068853c10899"
+dependencies = [
+ "hashbrown 0.16.1",
+ "portable-atomic",
+ "thiserror 2.0.20",
+]
+
 [[package]]
 name = "keyboard-types"
 version = "0.7.0"
@@ -3066,11 +4460,55 @@ dependencies = [
  "dbus-secret-service",
  "log",
  "openssl",
- "secret-service",
+ "secret-service 4.0.0",
  "windows-sys 0.60.2",
  "zeroize",
 ]
 
+[[package]]
+name = "keyring"
+version = "4.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2270074a3d26bcac93c1dc5d2845eb4c089e8d761ccf6e0ea266a16004640627"
+dependencies = [
+ "apple-native-keyring-store",
+ "keyring-core",
+ "windows-native-keyring-store",
+ "zbus-secret-service-keyring-store",
+]
+
+[[package]]
+name = "keyring-core"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb1e621458ca9c51aa110bd0339d4751a056b9576bf1253aee1aa560dda0fc9d"
+dependencies = [
+ "log",
+]
+
+[[package]]
+name = "konst"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f660d5f887e3562f9ab6f4a14988795b694099d66b4f5dedc02d197ba9becb1d"
+dependencies = [
+ "const_panic",
+ "konst_proc_macros",
+ "typewit",
+]
+
+[[package]]
+name = "konst_proc_macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e037a2e1d8d5fdbd49b16a4ea09d5d6401c1f29eca5ff29d03d3824dba16256a"
+
+[[package]]
+name = "lab"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf36173d4167ed999940f804952e6b08197cae5ad5d572eb4db150ce8ad5d58f"
+
 [[package]]
 name = "lazy_static"
 version = "1.5.0"
@@ -3097,7 +4535,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6e9ec52138abedcc58dc17a7c6c0c00a2bdb4f3427c7f63fa97fd0d859155caf"
 dependencies = [
  "gtk-sys",
- "libloading",
+ "libloading 0.7.4",
  "once_cell",
 ]
 
@@ -3127,6 +4565,22 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "libloading"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "754ca22de805bb5744484a5b151a9e1a8e837d5dc232c2d7d8c2e3492edc8b60"
+dependencies = [
+ "cfg-if",
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "libm"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
+
 [[package]]
 name = "libredox"
 version = "0.1.23"
@@ -3138,9 +4592,9 @@ dependencies = [
 
 [[package]]
 name = "libsqlite3-sys"
-version = "0.36.0"
+version = "0.38.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95b4103cffefa72eb8428cb6b47d6627161e51c2739fc5e3b734584157bc642a"
+checksum = "f1d20bef17f513b9b3004532233187769cd072d790971f4e4da0e346eb6401e8"
 dependencies = [
  "cc",
  "pkg-config",
@@ -3148,17 +4602,44 @@ dependencies = [
 ]
 
 [[package]]
-name = "linux-raw-sys"
-version = "0.12.1"
+name = "line-clipping"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
-
-[[package]]
+checksum = "e752191d037c44ad111a8caa762921926658402f01cc1253f7bef2020ece4f5e"
+dependencies = [
+ "bitflags 2.13.1",
+]
+
+[[package]]
+name = "link-section"
+version = "0.19.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39c29a617ce3df32c08497bdc1ab6e2376e0b17948ac166a2fbe5977c5954cd9"
+
+[[package]]
+name = "linktime-proc-macro"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e57c38c1e860fd37c604281cdfb1dd2216977fd76a50f85ba2f388ef3219616"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
 name = "litemap"
 version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
 
+[[package]]
+name = "litrs"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11d3d7f243d5c5a8b9bb5d6dd2b1602c0cb0b9db1621bafc7ed66e35ff9fe092"
+
 [[package]]
 name = "lock_api"
 version = "0.4.14"
@@ -3174,12 +4655,59 @@ version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
 
+[[package]]
+name = "loom"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "419e0dc8046cb947daa77eb95ae174acfbddb7673b4151f56d1eed8e93fbfaca"
+dependencies = [
+ "cfg-if",
+ "generator",
+ "scoped-tls",
+ "tracing",
+ "tracing-subscriber",
+]
+
+[[package]]
+name = "lru"
+version = "0.18.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef9ac18847474e638e3702b76c65d4eb93428471a74778ef0f1be711717f89b5"
+dependencies = [
+ "hashbrown 0.17.1",
+]
+
 [[package]]
 name = "lru-slab"
 version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
 
+[[package]]
+name = "lz4_flex"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ef0d4ed8669f8f8826eb00dc878084aa8f253506c4fd5e8f58f5bce72ddb97e"
+dependencies = [
+ "twox-hash",
+]
+
+[[package]]
+name = "mac-addr"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3d25b0e0b648a86960ac23b7ad4abb9717601dec6f66c165f5b037f3f03065f"
+
+[[package]]
+name = "mac_address"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b367b50a9be9a5d3b5718c1da74e5d6b9c17647f89752ee2562a470cc3c4eb1a"
+dependencies = [
+ "nix 0.30.1",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "mach"
 version = "0.1.2"
@@ -3230,6 +4758,21 @@ version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4facc753ae494aeb6e3c22f839b158aebd4f9270f55cd3c79906c45476c47ab4"
 
+[[package]]
+name = "mdns-sd"
+version = "0.21.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "127d3355da0615643c88c885e29a1ccb29ca4b1ca1f2e44b3caed2e728a796aa"
+dependencies = [
+ "fastrand",
+ "flume",
+ "if-addrs",
+ "log",
+ "mio",
+ "socket-pktinfo",
+ "socket2",
+]
+
 [[package]]
 name = "memchr"
 version = "2.8.3"
@@ -3237,210 +4780,1212 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
 [[package]]
-name = "memoffset"
-version = "0.9.1"
+name = "memmap2"
+version = "0.9.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0"
 dependencies = [
- "autocfg",
+ "libc",
 ]
 
 [[package]]
-name = "mime"
-version = "0.3.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
-
-[[package]]
-name = "minisign-verify"
-version = "0.2.5"
+name = "memmem"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22f9645cb765ea72b8111f36c522475d2daa0d22c957a9826437e97534bc4e9e"
+checksum = "a64a92489e2744ce060c349162be1c5f33c6969234104dbd99ddb5feb08b8c15"
 
 [[package]]
-name = "miniz_oxide"
-version = "0.8.9"
+name = "memoffset"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
 dependencies = [
- "adler2",
- "simd-adler32",
+ "autocfg",
 ]
 
 [[package]]
-name = "miniz_oxide"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c"
+name = "mesh-llm-analytics"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
 dependencies = [
- "adler2",
- "simd-adler32",
+ "anyhow",
+ "chrono",
+ "dirs",
+ "mesh-llm-build-info",
+ "mesh-llm-events",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "tokio",
+ "tracing",
+ "uuid",
 ]
 
 [[package]]
-name = "mio"
-version = "1.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b18443e9c262bfe8fa82f51666e2642c53393f7e5c27b3e1aeab922cff5b9d8"
+name = "mesh-llm-api-client"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
 dependencies = [
- "libc",
- "wasi",
- "windows-sys 0.61.2",
+ "hex",
+ "mesh-llm-client",
+ "thiserror 2.0.20",
 ]
 
 [[package]]
-name = "moxcms"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb85c154ba489f01b25c0d36ae69a87e4a1c73a72631fc6c0eb6dde34a73e44b"
+name = "mesh-llm-api-server"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
 dependencies = [
- "num-traits",
- "pxfm",
+ "anyhow",
+ "mesh-llm-api-client",
+ "mesh-llm-node",
+ "tokio",
 ]
 
 [[package]]
-name = "muda"
-version = "0.19.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1dd04e60bc0b07438a6771710ee1698f98f6ebbc7f89b61264af1563b8aeb878"
+name = "mesh-llm-build-info"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+
+[[package]]
+name = "mesh-llm-client"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
 dependencies = [
- "crossbeam-channel",
- "dpi",
- "gtk",
- "keyboard-types",
- "objc2",
- "objc2-app-kit",
- "objc2-core-foundation",
- "objc2-foundation",
- "once_cell",
- "png 0.18.1",
+ "anyhow",
+ "async-trait",
+ "base64 0.23.1",
+ "httparse",
+ "iroh",
+ "mesh-llm-identity",
+ "mesh-llm-protocol",
+ "mesh-llm-routing",
+ "mesh-llm-types",
+ "model-artifact",
+ "nostr-sdk",
+ "prost",
+ "rustls",
  "serde",
+ "serde_json",
  "thiserror 2.0.20",
- "windows-sys 0.61.2",
+ "tokio",
+ "tracing",
+ "uuid",
 ]
 
 [[package]]
-name = "ndk"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3f42e7bbe13d351b6bead8286a43aac9534b82bd3cc43e47037f012ebfd62d4"
+name = "mesh-llm-config"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
 dependencies = [
- "bitflags 2.13.1",
- "jni-sys 0.3.1",
- "log",
- "ndk-sys",
- "num_enum",
- "raw-window-handle",
- "thiserror 1.0.69",
+ "anyhow",
+ "dirs",
+ "mesh-llm-native-runtime",
+ "mesh-llm-types",
+ "semver",
+ "serde",
+ "skippy-protocol",
+ "toml 1.1.5+spec-1.1.0",
+ "toml_edit 0.25.13+spec-1.1.0",
+ "url",
 ]
 
 [[package]]
-name = "ndk-context"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b"
-
-[[package]]
-name = "ndk-sys"
-version = "0.6.0+11769913"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee6cda3051665f1fb8d9e08fc35c96d5a244fb1be711a03b71118828afc9a873"
+name = "mesh-llm-embedded-runtime"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
 dependencies = [
- "jni-sys 0.3.1",
+ "mesh-llm-host-runtime",
 ]
 
 [[package]]
-name = "new_debug_unreachable"
-version = "1.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
-
-[[package]]
-name = "nix"
-version = "0.28.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab2156c4fce2f8df6c499cc1c763e4394b7482525bf2a9701c9d79d215f519e4"
+name = "mesh-llm-events"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
 dependencies = [
- "bitflags 2.13.1",
- "cfg-if",
- "cfg_aliases 0.1.1",
+ "anyhow",
+ "chrono",
+ "clap",
+ "crossterm",
  "libc",
+ "ratatui",
+ "serde",
+ "serde_json",
+ "tracing",
+ "uuid",
 ]
 
 [[package]]
-name = "nix"
-version = "0.29.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
+name = "mesh-llm-gpu-bench"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
 dependencies = [
- "bitflags 2.13.1",
- "cfg-if",
- "cfg_aliases 0.2.2",
- "libc",
- "memoffset",
+ "serde",
+ "serde_json",
+ "tracing",
 ]
 
 [[package]]
-name = "nix"
-version = "0.31.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+name = "mesh-llm-guardrails"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
 dependencies = [
- "bitflags 2.13.1",
- "cfg-if",
- "cfg_aliases 0.2.2",
- "libc",
+ "serde_json",
 ]
 
 [[package]]
-name = "nom"
-version = "8.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df9761775871bdef83bee530e60050f7e54b1105350d6884eb0fb4f46c2f9405"
+name = "mesh-llm-hardware-profile"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
 dependencies = [
- "memchr",
+ "mesh-llm-native-runtime",
 ]
 
 [[package]]
-name = "nostr"
-version = "0.44.8"
+name = "mesh-llm-hf-hub"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40ff7b77ef428b40aa2834a6acbae38a0e104c98b306208ca4b87a420d579a4b"
+checksum = "43088a838cf0c6715c65f65a5ac99045fd6d6e90949a8a4183b8104ab791e96b"
 dependencies = [
  "base64 0.22.1",
- "bech32 0.11.1",
- "bip39",
- "bitcoin_hashes 0.14.101",
- "cbc",
- "chacha20 0.9.1",
- "chacha20poly1305",
+ "bon",
+ "bytes",
+ "futures",
  "getrandom 0.2.17",
- "hex",
- "instant",
- "scrypt",
- "secp256k1 0.29.1",
+ "globset",
+ "hf-xet",
+ "hyper",
+ "pathdiff",
+ "percent-encoding",
+ "reqwest",
  "serde",
  "serde_json",
- "unicode-normalization",
+ "sha2 0.11.0",
+ "thiserror 2.0.20",
+ "tokio",
+ "tokio-retry",
+ "tokio-util",
+ "tracing",
  "url",
+ "wasm-bindgen-futures",
 ]
 
 [[package]]
-name = "nostr"
-version = "0.45.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38ca5c25a6df8d4d78fdf39b42792438f6ce22b4809ccbfdb27582ed9ca45407"
+name = "mesh-llm-host-runtime"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
 dependencies = [
- "base64 0.22.1",
- "bech32 0.12.0",
- "bip39",
- "bitcoin_hashes 1.2.0",
- "cbc",
- "chacha20 0.9.1",
- "chacha20poly1305",
- "faster-hex",
- "opaquerr",
- "rand 0.10.2",
+ "anyhow",
+ "async-trait",
+ "axum",
+ "base64 0.23.1",
+ "bytes",
+ "chrono",
+ "crossbeam-queue",
+ "crossterm",
+ "dirs",
+ "ed25519-dalek 3.0.0",
+ "futures-util",
+ "hex",
+ "http",
+ "http-body-util",
+ "httparse",
+ "iroh",
+ "libc",
+ "mdns-sd",
+ "mesh-llm-analytics",
+ "mesh-llm-build-info",
+ "mesh-llm-client",
+ "mesh-llm-config",
+ "mesh-llm-events",
+ "mesh-llm-guardrails",
+ "mesh-llm-hf-hub",
+ "mesh-llm-identity",
+ "mesh-llm-log-store",
+ "mesh-llm-moa-plugin",
+ "mesh-llm-native-runtime",
+ "mesh-llm-node",
+ "mesh-llm-plugin",
+ "mesh-llm-plugin-manager",
+ "mesh-llm-protocol",
+ "mesh-llm-routing",
+ "mesh-llm-runtime-event-contracts",
+ "mesh-llm-runtime-install",
+ "mesh-llm-system",
+ "mesh-llm-types",
+ "mesh-llm-ui",
+ "mesh-native-serving-plugin-host",
+ "model-artifact",
+ "model-hf",
+ "model-ref",
+ "model-resolver",
+ "nostr-sdk",
+ "openai-frontend",
+ "opentelemetry",
+ "opentelemetry-otlp",
+ "opentelemetry_sdk",
+ "prost",
+ "rand 0.10.2",
+ "regex-lite",
+ "reqwest",
+ "rmcp 3.5.1",
+ "rpassword",
+ "rustls",
+ "ryu",
+ "same-file",
+ "schemars 1.2.2",
+ "semver",
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+ "skippy-cache",
+ "skippy-coordinator",
+ "skippy-ffi",
+ "skippy-model",
+ "skippy-package-format",
+ "skippy-protocol",
+ "skippy-runtime",
+ "skippy-server",
+ "skippy-topology",
+ "socket2",
+ "tempfile",
+ "thiserror 2.0.20",
+ "tokio",
+ "tokio-stream",
+ "toml 1.1.5+spec-1.1.0",
+ "tower",
+ "tracing",
+ "tracing-subscriber",
+ "url",
+ "urlencoding",
+ "uuid",
+ "windows-sys 0.61.2",
+ "zeroize",
+]
+
+[[package]]
+name = "mesh-llm-identity"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "apple-native-keyring-store",
+ "argon2",
+ "base64 0.23.1",
+ "chacha20poly1305 0.11.0",
+ "chrono",
+ "crypto_box",
+ "dirs",
+ "ed25519-dalek 3.0.0",
+ "hex",
+ "keyring 4.2.0",
+ "rand 0.10.2",
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+ "thiserror 2.0.20",
+ "zeroize",
+]
+
+[[package]]
+name = "mesh-llm-log-store"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "chrono",
+ "data-encoding",
+ "hex",
+ "mesh-llm-events",
+ "rusqlite",
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+ "uuid",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "mesh-llm-moa-plugin"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "mesh-llm-plugin",
+ "mesh-mixture-of-agents",
+ "serde_json",
+ "tokio",
+]
+
+[[package]]
+name = "mesh-llm-native-runtime"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "anyhow",
+ "hex",
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+]
+
+[[package]]
+name = "mesh-llm-node"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "anyhow",
+ "mesh-llm-types",
+ "model-artifact",
+ "model-hf",
+ "model-ref",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "mesh-llm-plugin"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "prost",
+ "prost-build",
+ "protoc-bin-vendored",
+ "rmcp 3.5.1",
+ "schemars 1.2.2",
+ "serde",
+ "serde_json",
+ "tokio",
+]
+
+[[package]]
+name = "mesh-llm-plugin-manager"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "anyhow",
+ "dirs",
+ "flate2",
+ "futures-util",
+ "hex",
+ "mesh-llm-skills",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+ "tar",
+ "tempfile",
+ "zip 8.6.0",
+]
+
+[[package]]
+name = "mesh-llm-protocol"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "anyhow",
+ "hex",
+ "iroh",
+ "prost",
+ "serde_json",
+ "sha2 0.11.0",
+]
+
+[[package]]
+name = "mesh-llm-release-footer"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "hex",
+ "sha2 0.11.0",
+]
+
+[[package]]
+name = "mesh-llm-routing"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "blake3",
+ "iroh",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "mesh-llm-runtime-event-contracts"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "uuid",
+]
+
+[[package]]
+name = "mesh-llm-runtime-install"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "anyhow",
+ "dirs",
+ "flate2",
+ "futures-util",
+ "hex",
+ "mesh-llm-build-info",
+ "mesh-llm-hardware-profile",
+ "mesh-llm-native-runtime",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+ "skippy-ffi",
+ "tar",
+ "tempfile",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "mesh-llm-sdk"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "anyhow",
+ "mesh-llm-api-client",
+ "mesh-llm-api-server",
+ "mesh-llm-embedded-runtime",
+ "mesh-llm-runtime-install",
+ "reqwest",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "mesh-llm-skills"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "anyhow",
+ "dirs",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "mesh-llm-system"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "anyhow",
+ "chrono",
+ "clap",
+ "dirs",
+ "hex",
+ "libc",
+ "libloading 0.9.0",
+ "mesh-llm-build-info",
+ "mesh-llm-events",
+ "mesh-llm-gpu-bench",
+ "mesh-llm-native-runtime",
+ "mesh-llm-release-footer",
+ "mesh-llm-runtime-install",
+ "reqwest",
+ "semver",
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+ "skippy-runtime",
+ "tracing",
+ "windows-sys 0.61.2",
+ "zip 8.6.0",
+]
+
+[[package]]
+name = "mesh-llm-types"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "hex",
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+]
+
+[[package]]
+name = "mesh-llm-ui"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+
+[[package]]
+name = "mesh-mixture-of-agents"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "async-trait",
+ "mesh-llm-guardrails",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "mesh-native-serving-plugin-api"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+
+[[package]]
+name = "mesh-native-serving-plugin-host"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "anyhow",
+ "libloading 0.9.0",
+ "mesh-native-serving-plugin-api",
+ "skippy-server",
+ "skippy-tokenizer",
+ "tracing",
+]
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "mime_guess"
+version = "2.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
+dependencies = [
+ "mime",
+ "unicase",
+]
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "minisign-verify"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22f9645cb765ea72b8111f36c522475d2daa0d22c957a9826437e97534bc4e9e"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "miniz_oxide"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "mio"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b18443e9c262bfe8fa82f51666e2642c53393f7e5c27b3e1aeab922cff5b9d8"
+dependencies = [
+ "libc",
+ "log",
+ "wasi 0.11.1+wasi-snapshot-preview1",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "model-artifact"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "model-ref",
+ "serde",
+]
+
+[[package]]
+name = "model-hf"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "chrono",
+ "dirs",
+ "hex",
+ "libc",
+ "mesh-llm-hf-hub",
+ "model-artifact",
+ "model-ref",
+ "rustls",
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "model-ref"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "model-resolver"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "anyhow",
+ "model-artifact",
+ "model-ref",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "more-asserts"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fafa6961cabd9c63bcd77a45d7e3b7f3b552b70417831fb0f56db717e72407e"
+
+[[package]]
+name = "moxcms"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb85c154ba489f01b25c0d36ae69a87e4a1c73a72631fc6c0eb6dde34a73e44b"
+dependencies = [
+ "num-traits",
+ "pxfm",
+]
+
+[[package]]
+name = "muda"
+version = "0.19.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1dd04e60bc0b07438a6771710ee1698f98f6ebbc7f89b61264af1563b8aeb878"
+dependencies = [
+ "crossbeam-channel",
+ "dpi",
+ "gtk",
+ "keyboard-types",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-core-foundation",
+ "objc2-foundation",
+ "once_cell",
+ "png 0.18.1",
+ "serde",
+ "thiserror 2.0.20",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "multer"
+version = "3.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83e87776546dc87511aa5ee218730c92b666d7264ab6ed41f9d215af9cd5224b"
+dependencies = [
+ "bytes",
+ "encoding_rs",
+ "futures-util",
+ "http",
+ "httparse",
+ "memchr",
+ "mime",
+ "spin 0.9.9",
+ "version_check",
+]
+
+[[package]]
+name = "multimap"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d87ecb2933e8aeadb3e3a02b828fed80a7528047e68b4f424523a0981a3a084"
+
+[[package]]
+name = "multiversion_no_op"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "743fb55ba31b18fb1ecef6bdc9aa2743314978ac084044301a7eee33fb99a20d"
+
+[[package]]
+name = "n0-dns-resolver"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "535c99c9a786bee714155d2ee4fc2477405c2c43536e1bc6a51de09a0d1448f7"
+dependencies = [
+ "derive_more",
+ "ipconfig",
+ "jni 0.22.4",
+ "lru",
+ "n0-error",
+ "n0-future",
+ "ndk-context",
+ "rand 0.10.2",
+ "reqwest",
+ "rustc-hash",
+ "rustls",
+ "simple-dns",
+ "system-configuration 0.8.0",
+ "tokio",
+ "tokio-rustls",
+ "tracing",
+ "webpki-roots 1.0.9",
+]
+
+[[package]]
+name = "n0-error"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26c59ea174675ce6bc196878851e5049e11b8b1f9af3ba87e4d6df8d828bb001"
+dependencies = [
+ "n0-error-macros",
+ "spez",
+]
+
+[[package]]
+name = "n0-error-macros"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4412346410d6616f3668c40e53c298e5320c7b856f7a960e5914e442601be79f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "n0-future"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2ab99dfb861450e68853d34ae665243a88b8c493d01ba957321a1e9b2312bbe"
+dependencies = [
+ "cfg_aliases 0.2.2",
+ "derive_more",
+ "futures-buffered",
+ "futures-lite",
+ "futures-util",
+ "js-sys",
+ "pin-project",
+ "send_wrapper",
+ "tokio",
+ "tokio-util",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-time",
+]
+
+[[package]]
+name = "n0-watcher"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbc618745ad0b7414b149d0517ad8b5573b2fb4d4e2717add3d2446ce1fdd826"
+dependencies = [
+ "derive_more",
+ "n0-error",
+ "n0-future",
+]
+
+[[package]]
+name = "ndk"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3f42e7bbe13d351b6bead8286a43aac9534b82bd3cc43e47037f012ebfd62d4"
+dependencies = [
+ "bitflags 2.13.1",
+ "jni-sys 0.3.1",
+ "log",
+ "ndk-sys",
+ "num_enum",
+ "raw-window-handle",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "ndk-context"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b"
+
+[[package]]
+name = "ndk-sys"
+version = "0.6.0+11769913"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee6cda3051665f1fb8d9e08fc35c96d5a244fb1be711a03b71118828afc9a873"
+dependencies = [
+ "jni-sys 0.3.1",
+]
+
+[[package]]
+name = "negentropy"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81c353b400a5503efdcf398f11a83fb7aa84f59f5d76fc4bf5bbc1e4f5366caa"
+
+[[package]]
+name = "netdev"
+version = "0.45.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "096c44b66a9b09b99b4dd36b1c295ff3a492039ccecaf55466bd6ddcdba59968"
+dependencies = [
+ "block2",
+ "dispatch2",
+ "dlopen2",
+ "ipnet",
+ "jni 0.21.1",
+ "libc",
+ "mac-addr",
+ "ndk-context",
+ "netlink-packet-core 0.8.2",
+ "netlink-packet-route 0.31.0",
+ "netlink-sys 0.8.8",
+ "objc2",
+ "objc2-core-foundation",
+ "objc2-core-wlan",
+ "objc2-foundation",
+ "objc2-system-configuration",
+ "once_cell",
+ "plist",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "netdev"
+version = "0.46.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3c52c2584961c68f5a6e3356797344061f818c93b8acc9cd6d7e284795e563e"
+dependencies = [
+ "block2",
+ "dispatch2",
+ "dlopen2",
+ "ipnet",
+ "jni 0.21.1",
+ "libc",
+ "mac-addr",
+ "ndk-context",
+ "netlink-packet-core 0.9.0",
+ "netlink-packet-route 0.33.0",
+ "netlink-sys 0.9.0",
+ "objc2-core-foundation",
+ "objc2-system-configuration",
+ "once_cell",
+ "plist",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "netlink-packet-core"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b897d7bd4f0af82e68d40d0344cf37e97f9c97ddf74a098de3e4da05e96ca395"
+dependencies = [
+ "paste",
+]
+
+[[package]]
+name = "netlink-packet-core"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d6e2daf9a8c2e21302714706860a0e6be02e03d17294ecc66b354ea7d4059dd"
+
+[[package]]
+name = "netlink-packet-route"
+version = "0.31.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2288fcb784eb3defd5fb16f4c4160d5f477de192eac730f43e1d11c24d9a007"
+dependencies = [
+ "bitflags 2.13.1",
+ "libc",
+ "log",
+ "netlink-packet-core 0.8.2",
+]
+
+[[package]]
+name = "netlink-packet-route"
+version = "0.33.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59d48ffc8b73a506e1ff0878528c72668f2bfbc3d875b6be890a96be5d0d5576"
+dependencies = [
+ "bitflags 2.13.1",
+ "libc",
+ "log",
+ "netlink-packet-core 0.9.0",
+ "zerocopy",
+]
+
+[[package]]
+name = "netlink-proto"
+version = "0.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93af8261786086024cd5e96e0a991dd65ced07bbf7c233a487bbc96b971d5539"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "log",
+ "netlink-packet-core 0.8.2",
+ "netlink-sys 0.8.8",
+ "thiserror 2.0.20",
+]
+
+[[package]]
+name = "netlink-sys"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd6c30ed10fa69cc491d491b85cc971f6bdeb8e7367b7cde2ee6cc878d583fae"
+dependencies = [
+ "bytes",
+ "futures-util",
+ "libc",
+ "log",
+ "tokio",
+]
+
+[[package]]
+name = "netlink-sys"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c99d38e00b420df49e940fe0826e667c3dad82ac68eb4c2bbf754c1c14a83a10"
+dependencies = [
+ "bytes",
+ "libc",
+ "log",
+]
+
+[[package]]
+name = "netwatch"
+version = "0.19.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39da9cad5f23aa43401f09497d3b280e51b5feba115d9ffbf38ca35d6ff95e96"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "cfg_aliases 0.2.2",
+ "derive_more",
+ "ipnet",
+ "js-sys",
+ "libc",
+ "n0-error",
+ "n0-future",
+ "n0-watcher",
+ "netdev 0.45.1",
+ "netdev 0.46.3",
+ "netlink-packet-core 0.8.2",
+ "netlink-packet-route 0.31.0",
+ "netlink-proto",
+ "netlink-sys 0.8.8",
+ "noq-udp",
+ "objc2-core-foundation",
+ "objc2-system-configuration",
+ "pin-project-lite",
+ "serde",
+ "socket2",
+ "time",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "web-sys",
+ "windows 0.62.2",
+ "windows-result 0.4.1",
+ "wmi",
+]
+
+[[package]]
+name = "new_debug_unreachable"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
+
+[[package]]
+name = "nix"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab2156c4fce2f8df6c499cc1c763e4394b7482525bf2a9701c9d79d215f519e4"
+dependencies = [
+ "bitflags 2.13.1",
+ "cfg-if",
+ "cfg_aliases 0.1.1",
+ "libc",
+]
+
+[[package]]
+name = "nix"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
+dependencies = [
+ "bitflags 2.13.1",
+ "cfg-if",
+ "cfg_aliases 0.2.2",
+ "libc",
+ "memoffset",
+]
+
+[[package]]
+name = "nix"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
+dependencies = [
+ "bitflags 2.13.1",
+ "cfg-if",
+ "cfg_aliases 0.2.2",
+ "libc",
+ "memoffset",
+]
+
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags 2.13.1",
+ "cfg-if",
+ "cfg_aliases 0.2.2",
+ "libc",
+]
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "nom"
+version = "8.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df9761775871bdef83bee530e60050f7e54b1105350d6884eb0fb4f46c2f9405"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "noq"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b78be567e796cfa74bb9bdc4117790af2d505eb887019cf8803244353eb09d89"
+dependencies = [
+ "bytes",
+ "cfg_aliases 0.2.2",
+ "derive_more",
+ "noq-proto",
+ "noq-udp",
+ "pin-project-lite",
+ "rustc-hash",
+ "rustls",
+ "socket2",
+ "thiserror 2.0.20",
+ "tokio",
+ "tokio-stream",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "noq-proto"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c1e5b6fe668491eca022f745a0a9402585626c73a7b839b3424ace15d6a9c8f"
+dependencies = [
+ "aes-gcm",
+ "aws-lc-rs",
+ "bytes",
+ "derive_more",
+ "enum-assoc",
+ "getrandom 0.4.3",
+ "identity-hash",
+ "lru-slab",
+ "rand 0.10.2",
+ "rand_pcg",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "sorted-index-buffer",
+ "thiserror 2.0.20",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "noq-udp"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4dc50afea61aff926e150a36c31f06094608848e114a3fe667d76ec233163b1c"
+dependencies = [
+ "cfg_aliases 0.2.2",
+ "libc",
+ "socket2",
+ "tracing",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "nostr"
+version = "0.44.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40ff7b77ef428b40aa2834a6acbae38a0e104c98b306208ca4b87a420d579a4b"
+dependencies = [
+ "base64 0.22.1",
+ "bech32 0.11.1",
+ "bip39",
+ "bitcoin_hashes 0.14.101",
+ "cbc 0.1.2",
+ "chacha20 0.9.1",
+ "chacha20poly1305 0.10.1",
+ "getrandom 0.2.17",
+ "hex",
+ "instant",
+ "scrypt",
+ "secp256k1 0.29.1",
+ "serde",
+ "serde_json",
+ "unicode-normalization",
+ "url",
+]
+
+[[package]]
+name = "nostr"
+version = "0.45.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38ca5c25a6df8d4d78fdf39b42792438f6ce22b4809ccbfdb27582ed9ca45407"
+dependencies = [
+ "base64 0.22.1",
+ "bech32 0.12.0",
+ "bip39",
+ "bitcoin_hashes 1.2.0",
+ "cbc 0.1.2",
+ "chacha20 0.9.1",
+ "chacha20poly1305 0.10.1",
+ "faster-hex",
+ "opaquerr",
+ "rand 0.10.2",
  "secp256k1 0.30.0",
  "serde",
  "serde_json",
@@ -3450,6 +5995,58 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "nostr-database"
+version = "0.45.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "309950383c9854ca413d195705400e78b1376aedc48f3256754a86c609c047e8"
+dependencies = [
+ "nostr 0.45.5",
+ "opaquerr",
+]
+
+[[package]]
+name = "nostr-gossip"
+version = "0.45.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea822fd48ff6b84b81ddf84169e6edf1dc0bc9b312c8e41685b2278debaac3d"
+dependencies = [
+ "nostr 0.45.5",
+ "opaquerr",
+]
+
+[[package]]
+name = "nostr-sdk"
+version = "0.45.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db717044f755b5ed9be53cacb59660c36efbe578bde870151a24d6bead3cb218"
+dependencies = [
+ "async-utility",
+ "async-wsocket",
+ "faster-hex",
+ "futures",
+ "lru",
+ "negentropy",
+ "nostr 0.45.5",
+ "nostr-database",
+ "nostr-gossip",
+ "opaquerr",
+ "rand 0.10.2",
+ "tokio",
+ "tokio-stream",
+ "tracing",
+ "universal-time",
+]
+
+[[package]]
+name = "ntapi"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3b335231dfd352ffb0f8017f3b6027a4917f7df785ea2143d8af2adc66980ae"
+dependencies = [
+ "winapi",
+]
+
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.3"
@@ -3498,6 +6095,17 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
 
+[[package]]
+name = "num-derive"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed3955f1a9c7c0c15e092f9c887db08b1fc683305fdf6eb6684f22555355e202"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "num-integer"
 version = "0.1.47"
@@ -3559,6 +6167,15 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "num_threads"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c7398b9c8b70908f6371f47ed36737907c87c52af34c268fed0bf0ceb92ead9"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "objc2"
 version = "0.6.4"
@@ -3611,7 +6228,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
 dependencies = [
  "bitflags 2.13.1",
+ "block2",
  "dispatch2",
+ "libc",
  "objc2",
 ]
 
@@ -3660,6 +6279,20 @@ dependencies = [
  "objc2-core-graphics",
 ]
 
+[[package]]
+name = "objc2-core-wlan"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c71e34919aba0d701380d911702455038a8a3587467fe0141d6a71501e7ffe48"
+dependencies = [
+ "bitflags 2.13.1",
+ "objc2",
+ "objc2-core-foundation",
+ "objc2-foundation",
+ "objc2-security",
+ "objc2-security-foundation",
+]
+
 [[package]]
 name = "objc2-encode"
 version = "4.1.0"
@@ -3679,20 +6312,76 @@ dependencies = [
 name = "objc2-foundation"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272"
+checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272"
+dependencies = [
+ "bitflags 2.13.1",
+ "block2",
+ "libc",
+ "objc2",
+ "objc2-core-foundation",
+]
+
+[[package]]
+name = "objc2-io-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33fafba39597d6dc1fb709123dfa8289d39406734be322956a69f0931c73bb15"
+dependencies = [
+ "libc",
+ "objc2-core-foundation",
+]
+
+[[package]]
+name = "objc2-io-surface"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "180788110936d59bab6bd83b6060ffdfffb3b922ba1396b312ae795e1de9d81d"
+dependencies = [
+ "bitflags 2.13.1",
+ "objc2",
+ "objc2-core-foundation",
+]
+
+[[package]]
+name = "objc2-open-directory"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb82bed227edf5201dfedf072bba4015a33d3d4a98519837295a90f0a23f676d"
+dependencies = [
+ "objc2",
+ "objc2-core-foundation",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-osa-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f112d1746737b0da274ef79a23aac283376f335f4095a083a267a082f21db0c0"
+dependencies = [
+ "bitflags 2.13.1",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-quartz-core"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96c1358452b371bf9f104e21ec536d37a650eb10f7ee379fff67d2e08d537f1f"
 dependencies = [
  "bitflags 2.13.1",
- "block2",
- "libc",
  "objc2",
  "objc2-core-foundation",
+ "objc2-foundation",
 ]
 
 [[package]]
-name = "objc2-io-surface"
+name = "objc2-security"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "180788110936d59bab6bd83b6060ffdfffb3b922ba1396b312ae795e1de9d81d"
+checksum = "709fe137109bd1e8b5a99390f77a7d8b2961dafc1a1c5db8f2e60329ad6d895a"
 dependencies = [
  "bitflags 2.13.1",
  "objc2",
@@ -3700,27 +6389,27 @@ dependencies = [
 ]
 
 [[package]]
-name = "objc2-osa-kit"
+name = "objc2-security-foundation"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f112d1746737b0da274ef79a23aac283376f335f4095a083a267a082f21db0c0"
+checksum = "ef76382e9cedd18123099f17638715cc3d81dba3637d4c0d39ab69df2ef345a5"
 dependencies = [
- "bitflags 2.13.1",
  "objc2",
- "objc2-app-kit",
  "objc2-foundation",
 ]
 
 [[package]]
-name = "objc2-quartz-core"
+name = "objc2-system-configuration"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96c1358452b371bf9f104e21ec536d37a650eb10f7ee379fff67d2e08d537f1f"
+checksum = "7216bd11cbda54ccabcab84d523dc93b858ec75ecfb3a7d89513fa22464da396"
 dependencies = [
  "bitflags 2.13.1",
+ "dispatch2",
+ "libc",
  "objc2",
  "objc2-core-foundation",
- "objc2-foundation",
+ "objc2-security",
 ]
 
 [[package]]
@@ -3776,6 +6465,18 @@ version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
+[[package]]
+name = "oneshot"
+version = "0.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "269bca4c2591a28585d6bf10d9ed0332b7d76900a1b02bec41bdc3a2cdcda107"
+
 [[package]]
 name = "opaque-debug"
 version = "0.3.1"
@@ -3799,6 +6500,25 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "openai-frontend"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "async-trait",
+ "axum",
+ "base64 0.22.1",
+ "futures-core",
+ "futures-util",
+ "mesh-llm-events",
+ "mesh-llm-guardrails",
+ "serde",
+ "serde_json",
+ "tokio",
+ "tracing",
+ "uuid",
+]
+
 [[package]]
 name = "openssl"
 version = "0.10.81"
@@ -3852,12 +6572,96 @@ dependencies = [
  "vcpkg",
 ]
 
+[[package]]
+name = "opentelemetry"
+version = "0.32.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0142c63252a9e054e68a4c61a5778f7b14f576274d593f8ce883d191a099682"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+ "js-sys",
+ "pin-project-lite",
+ "thiserror 2.0.20",
+ "tracing",
+]
+
+[[package]]
+name = "opentelemetry-http"
+version = "0.32.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5683015d09e2df236ef005b17f6f196f0d5f6313c4fa43a7b6a53b52776e4331"
+dependencies = [
+ "async-trait",
+ "bytes",
+ "http",
+ "opentelemetry",
+ "reqwest",
+]
+
+[[package]]
+name = "opentelemetry-otlp"
+version = "0.32.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9966929966d17620d7c316c643ba62631826e10021409357772d5eea84f62c35"
+dependencies = [
+ "http",
+ "opentelemetry",
+ "opentelemetry-http",
+ "opentelemetry-proto",
+ "opentelemetry_sdk",
+ "prost",
+ "reqwest",
+ "thiserror 2.0.20",
+]
+
+[[package]]
+name = "opentelemetry-proto"
+version = "0.32.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56d658ba1faf63f7b9c492cfbe6e0ec365440a16132d3270c1065f7b33f1b638"
+dependencies = [
+ "base64 0.22.1",
+ "const-hex",
+ "opentelemetry",
+ "opentelemetry_sdk",
+ "prost",
+ "serde",
+ "tonic",
+ "tonic-prost",
+]
+
+[[package]]
+name = "opentelemetry_sdk"
+version = "0.32.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b59f80e1ac4d5ff7a2db8fb6c80badb7f0f3f858211fba08dd9aaec750894f9"
+dependencies = [
+ "futures-channel",
+ "futures-executor",
+ "futures-util",
+ "opentelemetry",
+ "percent-encoding",
+ "portable-atomic",
+ "rand 0.9.5",
+ "thiserror 2.0.20",
+]
+
 [[package]]
 name = "option-ext"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
 
+[[package]]
+name = "ordered-float"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7bb71e1b3fa6ca1c61f383464aaf2bb0e2f8e772a1f01d486832464de363b951"
+dependencies = [
+ "num-traits",
+]
+
 [[package]]
 name = "ordered-multimap"
 version = "0.7.3"
@@ -3888,6 +6692,15 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "os_str_bytes"
+version = "6.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2355d85b9a3786f481747ced0e0ff2ba35213a1f9bd406ed906554d7af805a1"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "osakit"
 version = "0.3.1"
@@ -3902,6 +6715,39 @@ dependencies = [
  "thiserror 2.0.20",
 ]
 
+[[package]]
+name = "palette"
+version = "0.7.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddeed8580d347d2abf3dcf06a5f0b3dc020258338526b277847cd4248a70fc64"
+dependencies = [
+ "approx",
+ "libm",
+ "palette_derive",
+ "palette_math",
+]
+
+[[package]]
+name = "palette_derive"
+version = "0.7.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88537020289b719d81be994ccf1bbf4990f477e2f69ee52fe3e45f43a02e56be"
+dependencies = [
+ "by_address",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "palette_math"
+version = "0.7.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e6eb142958d64335fb0e345c5b9ead2ecd6fc438c307e9d7d3c4fd428dbaf12"
+dependencies = [
+ "libm",
+]
+
 [[package]]
 name = "pango"
 version = "0.18.3"
@@ -3927,6 +6773,16 @@ dependencies = [
  "system-deps",
 ]
 
+[[package]]
+name = "papaya"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da2442474a9404698c42509b8967f437249dbc7b50493e83020333d3943ec0ae"
+dependencies = [
+ "equivalent",
+ "seize",
+]
+
 [[package]]
 name = "parking"
 version = "2.2.1"
@@ -3967,6 +6823,34 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "password-hash"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aab41826031698d6ffcd9cff78ef56ef998e39dc7e5067cdfebe373842d4723b"
+dependencies = [
+ "getrandom 0.4.3",
+ "phc",
+]
+
+[[package]]
+name = "paste"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
+
+[[package]]
+name = "pastey"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ee67f1008b1ba2321834326597b8e186293b049a023cdef258527550b9935b4"
+
+[[package]]
+name = "pathdiff"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df94ce210e5bc13cb6651479fa48d14f601d9858cfe0467f43ae157023b938d3"
+
 [[package]]
 name = "pbkdf2"
 version = "0.12.2"
@@ -3974,7 +6858,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
 dependencies = [
  "digest 0.10.7",
- "hmac",
+ "hmac 0.12.1",
+]
+
+[[package]]
+name = "pem-rfc7468"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6305423e0e7738146434843d1694d621cce767262b2a86910beab705e4493d9"
+dependencies = [
+ "base64ct",
 ]
 
 [[package]]
@@ -3983,70 +6876,205 @@ version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
+[[package]]
+name = "pest"
+version = "2.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "45d3aca230fad2e6f6317ca0a72724338c4960cb97168a85cdee66df4a9a21a8"
+dependencies = [
+ "memchr",
+ "ucd-trie",
+]
+
+[[package]]
+name = "pest_derive"
+version = "2.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "284b60557f2c4a2e72ad3f2d34d42685a2fa4a6a61d0d2a10c0ae2a5e916c2cf"
+dependencies = [
+ "pest",
+ "pest_generator",
+]
+
+[[package]]
+name = "pest_generator"
+version = "2.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d9d1f08a115309ee99268cf85e5228e0e56aa9caf8841ec12866b6be07c3109"
+dependencies = [
+ "pest",
+ "pest_meta",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "pest_meta"
+version = "2.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed93ba1a9ffcca32130a5188701c81c0c49cf00d4b7c5007d5148951d743adcb"
+dependencies = [
+ "pest",
+]
+
 [[package]]
 name = "petgraph"
 version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8701b58ea97060d5e5b155d383a69952a60943f0e6dfe30b04c287beb0b27455"
 dependencies = [
- "fixedbitset",
+ "fixedbitset 0.5.7",
  "hashbrown 0.15.5",
  "indexmap 2.14.2",
 ]
 
 [[package]]
-name = "phf"
-version = "0.13.1"
+name = "pharos"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9567389417feee6ce15dd6527a8a1ecac205ef62c2932bcf3d9f6fc5b78b414"
+dependencies = [
+ "futures",
+ "rustc_version",
+]
+
+[[package]]
+name = "phc"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44dc769b75f93afdddd8c7fa12d685292ddeff1e66f7f0f3a234cf1818afe892"
+dependencies = [
+ "base64ct",
+ "ctutils",
+ "getrandom 0.4.3",
+]
+
+[[package]]
+name = "phf"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078"
+dependencies = [
+ "phf_macros 0.11.3",
+ "phf_shared 0.11.3",
+]
+
+[[package]]
+name = "phf"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
+dependencies = [
+ "phf_macros 0.13.1",
+ "phf_shared 0.13.1",
+ "serde",
+]
+
+[[package]]
+name = "phf_codegen"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aef8048c789fa5e851558d709946d6d79a8ff88c0440c587967f8e94bfb1216a"
+dependencies = [
+ "phf_generator 0.11.3",
+ "phf_shared 0.11.3",
+]
+
+[[package]]
+name = "phf_codegen"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49aa7f9d80421bca176ca8dbfebe668cc7a2684708594ec9f3c0db0805d5d6e1"
+dependencies = [
+ "phf_generator 0.13.1",
+ "phf_shared 0.13.1",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
+dependencies = [
+ "phf_shared 0.11.3",
+ "rand 0.8.8",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
+dependencies = [
+ "fastrand",
+ "phf_shared 0.13.1",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f84ac04429c13a7ff43785d75ad27569f2951ce0ffd30a3321230db2fc727216"
+dependencies = [
+ "phf_generator 0.11.3",
+ "phf_shared 0.11.3",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
+dependencies = [
+ "phf_generator 0.13.1",
+ "phf_shared 0.13.1",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
+checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5"
 dependencies = [
- "phf_macros",
- "phf_shared",
- "serde",
+ "siphasher",
 ]
 
 [[package]]
-name = "phf_codegen"
+name = "phf_shared"
 version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49aa7f9d80421bca176ca8dbfebe668cc7a2684708594ec9f3c0db0805d5d6e1"
+checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
 dependencies = [
- "phf_generator",
- "phf_shared",
+ "siphasher",
 ]
 
 [[package]]
-name = "phf_generator"
-version = "0.13.1"
+name = "pin-project"
+version = "1.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
+checksum = "2466b2336ed02bcdca6b294417127b90ec92038d1d5c4fbeac971a922e0e0924"
 dependencies = [
- "fastrand",
- "phf_shared",
+ "pin-project-internal",
 ]
 
 [[package]]
-name = "phf_macros"
-version = "0.13.1"
+name = "pin-project-internal"
+version = "1.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
+checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
 dependencies = [
- "phf_generator",
- "phf_shared",
  "proc-macro2",
  "quote",
  "syn 2.0.119",
 ]
 
-[[package]]
-name = "phf_shared"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
-dependencies = [
- "siphasher",
-]
-
 [[package]]
 name = "pin-project-lite"
 version = "0.2.17"
@@ -4064,6 +7092,26 @@ dependencies = [
  "futures-io",
 ]
 
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der 0.7.10",
+ "spki 0.7.3",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7"
+dependencies = [
+ "der 0.8.2",
+ "spki 0.8.1",
+]
+
 [[package]]
 name = "pkg-config"
 version = "0.3.34"
@@ -4131,7 +7179,29 @@ checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
 dependencies = [
  "cpufeatures 0.2.17",
  "opaque-debug",
- "universal-hash",
+ "universal-hash 0.5.1",
+]
+
+[[package]]
+name = "poly1305"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e2d0073b297041425c7c3df6eb4792d598a15323fe63346852b092eca02904c"
+dependencies = [
+ "cpufeatures 0.3.1",
+ "universal-hash 0.6.1",
+]
+
+[[package]]
+name = "polyval"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "opaque-debug",
+ "universal-hash 0.5.1",
 ]
 
 [[package]]
@@ -4139,6 +7209,9 @@ name = "portable-atomic"
 version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85"
+dependencies = [
+ "serde",
+]
 
 [[package]]
 name = "portable-atomic-util"
@@ -4171,110 +7244,327 @@ dependencies = [
 ]
 
 [[package]]
-name = "potential_utf"
-version = "0.1.6"
+name = "portmapper"
+version = "0.19.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca97242f016e090a25330613bc2382aab65eb22f9149dbe84d8f8e711d49a530"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "derive_more",
+ "hyper-util",
+ "igd-next",
+ "iroh-metrics",
+ "libc",
+ "n0-error",
+ "n0-future",
+ "netwatch",
+ "num_enum",
+ "rand 0.10.2",
+ "serde",
+ "smallvec",
+ "socket2",
+ "time",
+ "tokio",
+ "tokio-util",
+ "tower-layer",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "postcard"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6764c3b5dd454e283a30e6dfe78e9b31096d9e32036b5d1eaac7a6119ccb9a24"
+dependencies = [
+ "cobs",
+ "embedded-io 0.4.0",
+ "embedded-io 0.6.1",
+ "postcard-derive",
+ "serde",
+]
+
+[[package]]
+name = "postcard-derive"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0232bd009a197ceec9cc881ba46f727fcd8060a2d8d6a9dde7a69030a6fe2bb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "potential_utf"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "precomputed-hash"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "prettyplease"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bfe0f4c752e450fc2faf62654f1c134747922825d5b04ca717b8874f41a40c0"
+dependencies = [
+ "proc-macro2",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f4c021e1093a56626774e81216a4ce732a735e5bad4868a03f3ed65ca0c3919"
+dependencies = [
+ "once_cell",
+ "toml_edit 0.19.15",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b00f26d3400549137f92511a46ac1cd8ce37cb5598a96d382381458b992a5d24"
+dependencies = [
+ "toml_datetime 0.6.3",
+ "toml_edit 0.20.2",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
+dependencies = [
+ "toml_edit 0.25.13+spec-1.1.0",
+]
+
+[[package]]
+name = "proc-macro-error"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+dependencies = [
+ "proc-macro-error-attr",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-error-attr"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "process-wrap"
+version = "9.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e842efad9119158434d193c6682e2ebee4b44d6ad801d7b349623b3f57cdf55"
+dependencies = [
+ "futures",
+ "indexmap 2.14.2",
+ "nix 0.31.3",
+ "tokio",
+ "tracing",
+ "windows 0.62.2",
+]
+
+[[package]]
+name = "process-wrap"
+version = "10.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f21b97672d2dc848e7b25701ab4535618b92f4861c13cc3f7f7bed52ad3c8da"
+dependencies = [
+ "futures",
+ "indexmap 2.14.2",
+ "nix 0.31.3",
+ "tokio",
+ "tracing",
+ "windows 0.62.2",
+]
+
+[[package]]
+name = "proptest"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744"
+dependencies = [
+ "bitflags 2.13.1",
+ "num-traits",
+ "rand 0.9.5",
+ "rand_chacha 0.9.0",
+ "rand_xorshift",
+ "regex-syntax",
+ "unarray",
+]
+
+[[package]]
+name = "prost"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "528ac67416ff8646872a3c02cad9cc4ee5dc9f9540c9b10771855c95cb2e5ae1"
+dependencies = [
+ "bytes",
+ "prost-derive",
+]
+
+[[package]]
+name = "prost-build"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03da047801ff44bb6a4d407d4860c05fd70bb81714e6b2f3812603d5b145b042"
+dependencies = [
+ "heck 0.5.0",
+ "itertools",
+ "log",
+ "multimap",
+ "petgraph",
+ "prettyplease 0.2.37",
+ "prost",
+ "prost-types",
+ "regex",
+ "syn 2.0.119",
+ "tempfile",
+]
+
+[[package]]
+name = "prost-derive"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
+checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
 dependencies = [
- "zerovec",
+ "anyhow",
+ "itertools",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
 ]
 
 [[package]]
-name = "powerfmt"
-version = "0.2.0"
+name = "prost-types"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+checksum = "f94967dc7688f3054c7fac87473ffae4cc4c3904800e2d9f5b857246d8963b0a"
+dependencies = [
+ "prost",
+]
 
 [[package]]
-name = "ppv-lite86"
-version = "0.2.21"
+name = "protoc-bin-vendored"
+version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+checksum = "8760a25b6ff9c620324822737e468478fa092234190d2e449760344354896ed9"
 dependencies = [
- "zerocopy",
+ "protoc-bin-vendored-linux-aarch_64",
+ "protoc-bin-vendored-linux-ppcle_64",
+ "protoc-bin-vendored-linux-s390_64",
+ "protoc-bin-vendored-linux-x86_32",
+ "protoc-bin-vendored-linux-x86_64",
+ "protoc-bin-vendored-macos-aarch_64",
+ "protoc-bin-vendored-macos-x86_64",
+ "protoc-bin-vendored-win32",
 ]
 
 [[package]]
-name = "precomputed-hash"
-version = "0.1.1"
+name = "protoc-bin-vendored-linux-aarch_64"
+version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+checksum = "73fa2624782ca04cd44f51554566717377acd240e4c0016d757dd74fccc9324f"
 
 [[package]]
-name = "proc-macro-crate"
-version = "1.3.1"
+name = "protoc-bin-vendored-linux-ppcle_64"
+version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f4c021e1093a56626774e81216a4ce732a735e5bad4868a03f3ed65ca0c3919"
-dependencies = [
- "once_cell",
- "toml_edit 0.19.15",
-]
+checksum = "e2417e9817fa237dab803ad4dda7357a111656e242959cc6b8f9a1a583367d42"
 
 [[package]]
-name = "proc-macro-crate"
-version = "2.0.2"
+name = "protoc-bin-vendored-linux-s390_64"
+version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b00f26d3400549137f92511a46ac1cd8ce37cb5598a96d382381458b992a5d24"
-dependencies = [
- "toml_datetime 0.6.3",
- "toml_edit 0.20.2",
-]
+checksum = "4d189c34636356a46a7ed3188233dc8a88c431278cc54d4a19b096a2d270e985"
 
 [[package]]
-name = "proc-macro-crate"
-version = "3.5.0"
+name = "protoc-bin-vendored-linux-x86_32"
+version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
-dependencies = [
- "toml_edit 0.25.13+spec-1.1.0",
-]
+checksum = "171e39f1e846e5f322ced1ac3b8d4cd3a3833ca24b6e5d58b3632574fe6204fa"
 
 [[package]]
-name = "proc-macro-error"
-version = "1.0.4"
+name = "protoc-bin-vendored-linux-x86_64"
+version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
-dependencies = [
- "proc-macro-error-attr",
- "proc-macro2",
- "quote",
- "syn 1.0.109",
- "version_check",
-]
+checksum = "873cdcc097593432086661aa432b8078f1cd87bfb02847c332e98ae2c119e966"
 
 [[package]]
-name = "proc-macro-error-attr"
-version = "1.0.4"
+name = "protoc-bin-vendored-macos-aarch_64"
+version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
-dependencies = [
- "proc-macro2",
- "quote",
- "version_check",
-]
+checksum = "eeb72df001783b8297847fe8f5f874ee400fd742c843d60583e8c23d96977c7f"
 
 [[package]]
-name = "proc-macro2"
-version = "1.0.107"
+name = "protoc-bin-vendored-macos-x86_64"
+version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
-dependencies = [
- "unicode-ident",
-]
+checksum = "b04652167eca899dda05f32f5481adeaf25c623a98ce2fc146a001cc59a2add7"
 
 [[package]]
-name = "process-wrap"
-version = "9.1.0"
+name = "protoc-bin-vendored-win32"
+version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e842efad9119158434d193c6682e2ebee4b44d6ad801d7b349623b3f57cdf55"
-dependencies = [
- "futures",
- "indexmap 2.14.2",
- "nix 0.31.3",
- "tokio",
- "tracing",
- "windows 0.62.2",
-]
+checksum = "263a3f48f01e7309e857138bd47f785585b4a005e8e56c6d2824ce91195999c3"
 
 [[package]]
 name = "pxfm"
@@ -4475,12 +7765,131 @@ dependencies = [
  "rand_core 0.10.1",
 ]
 
+[[package]]
+name = "rand_xorshift"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "513962919efc330f829edb2535844d1b912b0fbe2ca165d613e4e8788bb05a5a"
+dependencies = [
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "ratatui"
+version = "0.30.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3274ba0a2c5e1bcad2a2005d20f4dc59dad26b2eb0940fb094500dba4099d57d"
+dependencies = [
+ "instability",
+ "ratatui-core",
+ "ratatui-crossterm",
+ "ratatui-macros",
+ "ratatui-termina",
+ "ratatui-termwiz",
+ "ratatui-widgets",
+ "serde",
+]
+
+[[package]]
+name = "ratatui-core"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cbb175c433c8e28a809d1f5773a2ae96e68c0ce40db865cbab1020bf33ae479c"
+dependencies = [
+ "bitflags 2.13.1",
+ "compact_str",
+ "critical-section",
+ "hashbrown 0.17.1",
+ "itertools",
+ "kasuari",
+ "lru",
+ "palette",
+ "serde",
+ "strum",
+ "thiserror 2.0.20",
+ "unicode-segmentation",
+ "unicode-truncate",
+ "unicode-width",
+]
+
+[[package]]
+name = "ratatui-crossterm"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "567584a3b0e6a8203c23de40b4861497266725eb5363dbfd18a1edd603cca9f0"
+dependencies = [
+ "cfg-if",
+ "crossterm",
+ "instability",
+ "ratatui-core",
+]
+
+[[package]]
+name = "ratatui-macros"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed7dc68daa7498a43e4d68e0eb078427e10c38fbcfbb1e42d955f1fa2140d814"
+dependencies = [
+ "ratatui-core",
+ "ratatui-widgets",
+]
+
+[[package]]
+name = "ratatui-termina"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0bf912d9e66f057a759d92e386a280ea886b352ab757d6ac4d653c7ed2c43c2"
+dependencies = [
+ "instability",
+ "ratatui-core",
+ "termina",
+]
+
+[[package]]
+name = "ratatui-termwiz"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faf03e0380b7744054d6cb74224fe3adf062a029754933f575ca1e3b4c2ce977"
+dependencies = [
+ "ratatui-core",
+ "termwiz",
+]
+
+[[package]]
+name = "ratatui-widgets"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66e3d19bcc9130ca376277d93b60767ff121ace3be06f5f95f81dd68956407d1"
+dependencies = [
+ "bitflags 2.13.1",
+ "hashbrown 0.17.1",
+ "indoc",
+ "instability",
+ "itertools",
+ "line-clipping",
+ "ratatui-core",
+ "serde",
+ "strum",
+ "time",
+ "unicode-segmentation",
+ "unicode-width",
+]
+
 [[package]]
 name = "raw-window-handle"
 version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "20675572f6f24e9e76ef639bc5552774ed45f1c30e2951e1e99c59888861c539"
 
+[[package]]
+name = "redb"
+version = "3.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ba239c1c1693315d3cc0e601db3b3965543afbf48c41730fdca2f069f510f4a"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "redox_syscall"
 version = "0.5.18"
@@ -4544,6 +7953,12 @@ dependencies = [
  "regex-syntax",
 ]
 
+[[package]]
+name = "regex-lite"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cab834c73d247e67f4fae452806d17d3c7501756d98c8808d7c9c7aa7d18f973"
+
 [[package]]
 name = "regex-syntax"
 version = "0.8.11"
@@ -4558,8 +7973,11 @@ checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
 dependencies = [
  "base64 0.22.1",
  "bytes",
+ "encoding_rs",
+ "futures-channel",
  "futures-core",
  "futures-util",
+ "h2",
  "http",
  "http-body",
  "http-body-util",
@@ -4568,6 +7986,8 @@ dependencies = [
  "hyper-util",
  "js-sys",
  "log",
+ "mime",
+ "mime_guess",
  "percent-encoding",
  "pin-project-lite",
  "quinn",
@@ -4591,6 +8011,20 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "reqwest-middleware"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bc3f1384cffa4f274dad2d4ddd73aed32fed8f786d96c6be8aa4e5fd3c3b58"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "http",
+ "reqwest",
+ "thiserror 2.0.20",
+ "tower-service",
+]
+
 [[package]]
 name = "rfd"
 version = "0.16.0"
@@ -4639,7 +8073,7 @@ dependencies = [
  "chrono",
  "futures",
  "pin-project-lite",
- "process-wrap",
+ "process-wrap 9.1.0",
  "serde",
  "serde_json",
  "thiserror 2.0.20",
@@ -4649,6 +8083,64 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "rmcp"
+version = "3.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab5023804cbe0304cbe06197ac16e645a0a0d0ffa2953bf735c15c2fa0213350"
+dependencies = [
+ "async-trait",
+ "base64 0.23.1",
+ "bytes",
+ "chrono",
+ "futures",
+ "http",
+ "http-body",
+ "http-body-util",
+ "indexmap 2.14.2",
+ "pastey",
+ "pin-project-lite",
+ "process-wrap 10.0.1",
+ "rand 0.10.2",
+ "reqwest",
+ "rmcp-macros",
+ "schemars 1.2.2",
+ "serde",
+ "serde_json",
+ "sse-stream",
+ "thiserror 2.0.20",
+ "tokio",
+ "tokio-stream",
+ "tokio-util",
+ "tower-service",
+ "tracing",
+ "uuid",
+]
+
+[[package]]
+name = "rmcp-macros"
+version = "3.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1da498700030856ba63114bceefa30ba21f5e278cb975e5b9de3529fe842b40"
+dependencies = [
+ "darling 0.24.1",
+ "proc-macro2",
+ "quote",
+ "serde_json",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "rpassword"
+version = "7.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2da316a15f47e3d053de9cb2c439650bd8fa4aaeb9365f2e5f27f492ff73c196"
+dependencies = [
+ "libc",
+ "rtoolbox",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "rsqlite-vfs"
 version = "0.1.1"
@@ -4659,11 +8151,21 @@ dependencies = [
  "thiserror 2.0.20",
 ]
 
+[[package]]
+name = "rtoolbox"
+version = "0.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a1efe12a1469752d0e6ff5ebec0b6ef4924cc5c4c71046b0ec730040535819d"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "rusqlite"
-version = "0.38.0"
+version = "0.40.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1c93dd1c9683b438c392c492109cb702b8090b2bfc8fed6f6e4eb4523f17af3"
+checksum = "23f2a97da3e3873c73cb2a2e71b35c40ff95e0b1eefa8d72d8499a6928c3b5b3"
 dependencies = [
  "bitflags 2.13.1",
  "fallible-iterator",
@@ -4729,6 +8231,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6725596c3f2c3a0aef021139e145d4eafe314a6623e4680ca83852b2c67ab2ba"
 dependencies = [
  "aws-lc-rs",
+ "log",
  "once_cell",
  "ring",
  "rustls-pki-types",
@@ -4810,13 +8313,32 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
+[[package]]
+name = "safe-transmute"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3944826ff8fa8093089aba3acb4ef44b9446a99a16f3bf4e74af3f77d340ab7d"
+
+[[package]]
+name = "safetensors"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79b079b829cb27a1c3c374341345ed2e8b2c0c839034522cee576c140bd7f846"
+dependencies = [
+ "hashbrown 0.16.1",
+ "libc",
+ "serde",
+ "serde_json",
+ "tempfile",
+]
+
 [[package]]
 name = "salsa20"
 version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "97a22f5af31f73a954c10289c93e8a50cc23d971e80ee446f1f6f7137a088213"
 dependencies = [
- "cipher",
+ "cipher 0.4.4",
 ]
 
 [[package]]
@@ -4845,7 +8367,7 @@ checksum = "3fbf2ae1b8bc8e02df939598064d22402220cd5bbcca1c76f7d6a310974d5615"
 dependencies = [
  "dyn-clone",
  "indexmap 1.9.3",
- "schemars_derive",
+ "schemars_derive 0.8.22",
  "serde",
  "serde_json",
  "url",
@@ -4870,8 +8392,10 @@ version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "687274d293b6cdc6e73e0fee520bf2049650090d7164f87672d212a3c530cf4a"
 dependencies = [
+ "chrono",
  "dyn-clone",
  "ref-cast",
+ "schemars_derive 1.2.2",
  "serde",
  "serde_json",
 ]
@@ -4884,10 +8408,28 @@ checksum = "32e265784ad618884abaea0600a9adf15393368d840e0222d101a072f3f7534d"
 dependencies = [
  "proc-macro2",
  "quote",
- "serde_derive_internals",
+ "serde_derive_internals 0.29.1",
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "schemars_derive"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d98c67716b46af2f0b8cf752abc930f6f9aecfbf671ecfb531db8a31dbe4e2ba"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde_derive_internals 0.30.0",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "scoped-tls"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
+
 [[package]]
 name = "scopeguard"
 version = "1.2.0"
@@ -4900,7 +8442,7 @@ version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0516a385866c09368f0b5bcd1caff3366aace790fcd46e2bb032697bb172fd1f"
 dependencies = [
- "password-hash",
+ "password-hash 0.5.0",
  "pbkdf2",
  "salsa20",
  "sha2 0.10.9",
@@ -4963,11 +8505,11 @@ version = "4.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e4d35ad99a181be0a60ffcbe85d680d98f87bdc4d7644ade319b87076b9dbfd4"
 dependencies = [
- "aes",
- "cbc",
+ "aes 0.8.4",
+ "cbc 0.1.2",
  "futures-util",
  "generic-array",
- "hkdf",
+ "hkdf 0.12.4",
  "num",
  "once_cell",
  "rand 0.8.8",
@@ -4976,6 +8518,25 @@ dependencies = [
  "zbus 4.4.0",
 ]
 
+[[package]]
+name = "secret-service"
+version = "5.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5107b24b91445dd2aa449a258a1807b63240942157292354dc5bfdbeb8bc6db8"
+dependencies = [
+ "aes 0.9.3",
+ "cbc 0.2.1",
+ "futures-util",
+ "getrandom 0.4.3",
+ "hkdf 0.13.0",
+ "hybrid-array",
+ "num",
+ "once_cell",
+ "serde",
+ "sha2 0.11.0",
+ "zbus 5.19.0",
+]
+
 [[package]]
 name = "security-framework"
 version = "3.7.0"
@@ -4999,6 +8560,12 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "seize"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b55fb86dfd3a2f5f76ea78310a88f96c4ea21a3031f8d212443d56123fd0521"
+
 [[package]]
 name = "selectors"
 version = "0.36.1"
@@ -5010,8 +8577,8 @@ dependencies = [
  "derive_more",
  "log",
  "new_debug_unreachable",
- "phf",
- "phf_codegen",
+ "phf 0.13.1",
+ "phf_codegen 0.13.1",
  "precomputed-hash",
  "rustc-hash",
  "servo_arc",
@@ -5028,6 +8595,12 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "send_wrapper"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd0b0ec5f1c1ca621c432a25813d8d60c88abe6d3e08a3eb9cf37d97a0fe3d73"
+
 [[package]]
 name = "serde"
 version = "1.0.229"
@@ -5050,6 +8623,16 @@ dependencies = [
  "typeid",
 ]
 
+[[package]]
+name = "serde_bytes"
+version = "0.11.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5d440709e79d88e51ac01c4b72fc6cb7314017bb7da9eeff678aa94c10e3ea8"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
 [[package]]
 name = "serde_core"
 version = "1.0.229"
@@ -5081,6 +8664,17 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "serde_derive_internals"
+version = "0.30.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f852137cce035d6a4df67ccce505ff6b3e9fd3a10e3e52b24dc71e650bb1a9bd"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
 [[package]]
 name = "serde_json"
 version = "1.0.151"
@@ -5173,7 +8767,7 @@ version = "3.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8705578779c2b6bd90d84d66eb2e206b708b1a4d7b9f17641b293545bf1c7e46"
 dependencies = [
- "darling",
+ "darling 0.23.0",
  "proc-macro2",
  "quote",
  "syn 2.0.119",
@@ -5192,6 +8786,16 @@ dependencies = [
  "unsafe-libyaml",
 ]
 
+[[package]]
+name = "serdect"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66cf8fedced2fcf12406bcb34223dffb92eaf34908ede12fed414c82b7f00b3e"
+dependencies = [
+ "base16ct",
+ "serde",
+]
+
 [[package]]
 name = "serial2"
 version = "0.2.38"
@@ -5245,6 +8849,12 @@ dependencies = [
  "digest 0.10.7",
 ]
 
+[[package]]
+name = "sha1_smol"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbfa15b3dddfee50a0fff136974b3e1bde555604ba463834a7eb7deb6417705d"
+
 [[package]]
 name = "sha2"
 version = "0.10.9"
@@ -5292,12 +8902,44 @@ version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc6fe69c597f9c37bfeeeeeb33da3530379845f10be461a66d16d03eca2ded77"
 
+[[package]]
+name = "shellexpand"
+version = "3.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32824fab5e16e6c4d86dc1ba84489390419a39f97699852b66480bb87d297ed8"
+dependencies = [
+ "bstr",
+ "dirs",
+ "os_str_bytes",
+]
+
 [[package]]
 name = "shlex"
 version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
+[[package]]
+name = "signal-hook"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d881a16cf4426aa584979d30bd82cb33429027e42122b169753d6ef1085ed6e2"
+dependencies = [
+ "libc",
+ "signal-hook-registry",
+]
+
+[[package]]
+name = "signal-hook-mio"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b75a19a7a740b25bc7944bdee6172368f988763b744e3d4dfe753f6b4ece40cc"
+dependencies = [
+ "libc",
+ "mio",
+ "signal-hook",
+]
+
 [[package]]
 name = "signal-hook-registry"
 version = "1.4.8"
@@ -5308,6 +8950,24 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "signature"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28d567dcbaf0049cb8ac2608a76cd95ff9e4412e1899d389ee400918ca7537f5"
+dependencies = [
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "simd-adler32"
 version = "0.3.10"
@@ -5330,12 +8990,175 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
 
+[[package]]
+name = "simple-dns"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b6f884fa9a8d48101774bfbd3aeb81e968dd22cffd19a372da69f183db22c1a"
+dependencies = [
+ "bitflags 2.13.1",
+]
+
 [[package]]
 name = "siphasher"
 version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
 
+[[package]]
+name = "skippy-cache"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "anyhow",
+ "blake3",
+ "fs2",
+ "libc",
+ "serde",
+ "serde_json",
+ "skippy-protocol",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "skippy-coordinator"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "thiserror 2.0.20",
+]
+
+[[package]]
+name = "skippy-ffi"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "libloading 0.9.0",
+]
+
+[[package]]
+name = "skippy-metrics"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+
+[[package]]
+name = "skippy-model"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "anyhow",
+ "clap",
+ "memmap2",
+ "safetensors",
+ "serde",
+ "serde_json",
+ "skippy-package-format",
+]
+
+[[package]]
+name = "skippy-package-format"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+]
+
+[[package]]
+name = "skippy-protocol"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "prost",
+ "prost-build",
+ "protoc-bin-vendored",
+ "serde",
+ "skippy-tokenizer",
+]
+
+[[package]]
+name = "skippy-runtime"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "anyhow",
+ "crossbeam-queue",
+ "hex",
+ "libc",
+ "model-ref",
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+ "skippy-cache",
+ "skippy-ffi",
+ "skippy-model",
+ "skippy-package-format",
+ "tokio",
+]
+
+[[package]]
+name = "skippy-scheduler"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "skippy-runtime",
+ "thiserror 2.0.20",
+]
+
+[[package]]
+name = "skippy-server"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "ahash",
+ "anyhow",
+ "async-trait",
+ "axum",
+ "base64 0.23.1",
+ "blake3",
+ "clap",
+ "futures-util",
+ "libc",
+ "mesh-llm-events",
+ "mesh-native-serving-plugin-api",
+ "model-artifact",
+ "openai-frontend",
+ "opentelemetry-proto",
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+ "skippy-cache",
+ "skippy-metrics",
+ "skippy-package-format",
+ "skippy-protocol",
+ "skippy-runtime",
+ "skippy-scheduler",
+ "skippy-tokenizer",
+ "socket2",
+ "tokio",
+ "tonic",
+ "tracing",
+ "uuid",
+]
+
+[[package]]
+name = "skippy-tokenizer"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "skippy-topology"
+version = "0.78.1"
+source = "git+https://github.com/Mesh-LLM/mesh-llm.git?tag=v0.78.1#bc215ce5b880e21c6c3840b8574ab64f83278821"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "slab"
 version = "0.4.12"
@@ -5348,6 +9171,17 @@ version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9be42f50aa861c555654aa3a37f52f4b1074bacf4e48fe0ef7fa584e80f1f0f"
 
+[[package]]
+name = "socket-pktinfo"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "612942246d0cc239cfd83af1dfd39be47f649208a3524e5e9da651910128e0ac"
+dependencies = [
+ "libc",
+ "socket2",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "socket2"
 version = "0.6.5"
@@ -5380,6 +9214,12 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "sorted-index-buffer"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea06cc588e43c632923a55450401b8f25e628131571d4e1baea1bdfdb2b5ed06"
+
 [[package]]
 name = "soup3"
 version = "0.5.0"
@@ -5406,6 +9246,52 @@ dependencies = [
  "system-deps",
 ]
 
+[[package]]
+name = "spez"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c87e960f4dca2788eeb86bbdde8dd246be8948790b7618d656e68f9b720a86e8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "spin"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
+dependencies = [
+ "lock_api",
+]
+
+[[package]]
+name = "spin"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "023a211cb3138dbc438680b32560ad89f699977624c9f8dbb95a47d5b4c07dd3"
+
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der 0.7.10",
+]
+
+[[package]]
+name = "spki"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ef958a98b9d5da290cfc78946e9f3e61e1e62a18db0d92cac0b83cc161491a9"
+dependencies = [
+ "base64ct",
+ "der 0.8.2",
+]
+
 [[package]]
 name = "sqlite-wasm-rs"
 version = "0.5.5"
@@ -5418,6 +9304,19 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "sse-stream"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c25ac7aff0abd1dbc474536e40416e1102c7dd9bfba0b9861c6d357f835dcfb4"
+dependencies = [
+ "bytes",
+ "futures-util",
+ "http-body",
+ "http-body-util",
+ "pin-project-lite",
+]
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.1"
@@ -5430,6 +9329,16 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
 
+[[package]]
+name = "statrs"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a3fe7c28c6512e766b0874335db33c94ad7b8f9054228ae1c2abd47ce7d335e"
+dependencies = [
+ "approx",
+ "num-traits",
+]
+
 [[package]]
 name = "string_cache"
 version = "0.9.0"
@@ -5438,7 +9347,7 @@ checksum = "a18596f8c785a729f2819c0f6a7eae6ebeebdfffbfe4214ae6b087f690e31901"
 dependencies = [
  "new_debug_unreachable",
  "parking_lot",
- "phf_shared",
+ "phf_shared 0.13.1",
  "precomputed-hash",
 ]
 
@@ -5448,8 +9357,8 @@ version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "585635e46db231059f76c5849798146164652513eb9e8ab2685939dd90f29b69"
 dependencies = [
- "phf_generator",
- "phf_shared",
+ "phf_generator 0.13.1",
+ "phf_shared 0.13.1",
  "proc-macro2",
  "quote",
 ]
@@ -5469,6 +9378,27 @@ version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
+[[package]]
+name = "strum"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9628de9b8791db39ceda2b119bbe13134770b56c138ec1d3af810d045c04f9bd"
+dependencies = [
+ "strum_macros",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab85eea0270ee17587ed4156089e10b9e6880ee688791d45a905f5b1ca36f664"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "subtle"
 version = "2.6.1"
@@ -5486,6 +9416,12 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "symlink"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7973cce6668464ea31f176d85b13c7ab3bba2cb3b77a2ed26abd7801688010a"
+
 [[package]]
 name = "syn"
 version = "1.0.109"
@@ -5493,6 +9429,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
 dependencies = [
  "proc-macro2",
+ "quote",
  "unicode-ident",
 ]
 
@@ -5538,6 +9475,21 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "sysinfo"
+version = "0.39.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2071df9448915b71c4fe6d25deaf1c22f12bd234f01540b77312bb8e41361e6"
+dependencies = [
+ "libc",
+ "memchr",
+ "ntapi",
+ "objc2-core-foundation",
+ "objc2-io-kit",
+ "objc2-open-directory",
+ "windows 0.62.2",
+]
+
 [[package]]
 name = "system-configuration"
 version = "0.7.0"
@@ -5549,6 +9501,17 @@ dependencies = [
  "system-configuration-sys",
 ]
 
+[[package]]
+name = "system-configuration"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "501336eb7ba9e417300a6a0fa985721065467aa83a6dcf0422a8e43e4c0328fa"
+dependencies = [
+ "bitflags 2.13.1",
+ "core-foundation 0.10.1",
+ "system-configuration-sys",
+]
+
 [[package]]
 name = "system-configuration-sys"
 version = "0.6.0"
@@ -5786,7 +9749,7 @@ dependencies = [
  "thiserror 2.0.20",
  "tracing",
  "url",
- "windows-registry",
+ "windows-registry 0.5.3",
  "windows-result 0.3.4",
 ]
 
@@ -5901,7 +9864,7 @@ dependencies = [
  "tokio",
  "url",
  "windows-sys 0.60.2",
- "zip",
+ "zip 4.6.1",
 ]
 
 [[package]]
@@ -5979,7 +9942,7 @@ dependencies = [
  "anyhow",
  "brotli",
  "cargo_metadata",
- "ctor",
+ "ctor 0.8.0",
  "dom_query",
  "dunce",
  "glob",
@@ -5988,7 +9951,7 @@ dependencies = [
  "json-patch",
  "log",
  "memchr",
- "phf",
+ "phf 0.13.1",
  "plist",
  "proc-macro2",
  "quote",
@@ -6052,6 +10015,82 @@ dependencies = [
  "new_debug_unreachable",
 ]
 
+[[package]]
+name = "termina"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9048a889effe34a5cddee0af7f53285198b16dca3be510858d38dfdb3e62a04e"
+dependencies = [
+ "bitflags 2.13.1",
+ "parking_lot",
+ "rustix",
+ "signal-hook",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "terminfo"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4ea810f0692f9f51b382fff5893887bb4580f5fa246fde546e0b13e7fcee662"
+dependencies = [
+ "fnv",
+ "nom 7.1.3",
+ "phf 0.11.3",
+ "phf_codegen 0.11.3",
+]
+
+[[package]]
+name = "termios"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "411c5bf740737c7918b8b1fe232dca4dc9f8e754b8ad5e20966814001ed0ac6b"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "termwiz"
+version = "0.23.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4676b37242ccbd1aabf56edb093a4827dc49086c0ffd764a5705899e0f35f8f7"
+dependencies = [
+ "anyhow",
+ "base64 0.22.1",
+ "bitflags 2.13.1",
+ "fancy-regex",
+ "filedescriptor",
+ "finl_unicode",
+ "fixedbitset 0.4.2",
+ "hex",
+ "lazy_static",
+ "libc",
+ "log",
+ "memmem",
+ "nix 0.29.0",
+ "num-derive",
+ "num-traits",
+ "ordered-float",
+ "pest",
+ "pest_derive",
+ "phf 0.11.3",
+ "sha2 0.10.9",
+ "signal-hook",
+ "siphasher",
+ "terminfo",
+ "termios",
+ "thiserror 1.0.69",
+ "ucd-trie",
+ "unicode-segmentation",
+ "vtparse",
+ "wezterm-bidi",
+ "wezterm-blob-leases",
+ "wezterm-color-types",
+ "wezterm-dynamic",
+ "wezterm-input-types",
+ "winapi",
+]
+
 [[package]]
 name = "thiserror"
 version = "1.0.69"
@@ -6122,7 +10161,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
 dependencies = [
  "deranged",
+ "js-sys",
+ "libc",
  "num-conv",
+ "num_threads",
  "powerfmt",
  "serde_core",
  "time-core",
@@ -6188,6 +10230,7 @@ dependencies = [
  "bytes",
  "libc",
  "mio",
+ "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
  "socket2",
@@ -6195,6 +10238,15 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "tokio-happy-eyeballs"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8564c32dfb6f4257f8bc6edfc178a34af97520e0b7b9815500c55eb3d092f29f"
+dependencies = [
+ "tokio",
+]
+
 [[package]]
 name = "tokio-macros"
 version = "2.7.2"
@@ -6206,6 +10258,17 @@ dependencies = [
  "syn 3.0.5",
 ]
 
+[[package]]
+name = "tokio-retry"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a129d95275ebf4c493ec53bf0f8cd95f5ac161bc4f381700809a54f595d4470"
+dependencies = [
+ "pin-project-lite",
+ "rand 0.10.2",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-rustls"
 version = "0.26.5"
@@ -6216,6 +10279,18 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "tokio-socks"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7e2948f60dbe26b35f2c7fb74ac2854c1fddded0fe9d7548fcc674a246f7615"
+dependencies = [
+ "either",
+ "futures-util",
+ "thiserror 1.0.69",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-stream"
 version = "0.1.19"
@@ -6225,6 +10300,23 @@ dependencies = [
  "futures-core",
  "pin-project-lite",
  "tokio",
+ "tokio-util",
+]
+
+[[package]]
+name = "tokio-tungstenite"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d25a406cddcc431a75d3d9afc6a7c0f7428d4891dd973e4d54c56b46127bf857"
+dependencies = [
+ "futures-util",
+ "log",
+ "rustls",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tungstenite 0.28.0",
+ "webpki-roots 0.26.11",
 ]
 
 [[package]]
@@ -6239,7 +10331,7 @@ dependencies = [
  "rustls-pki-types",
  "tokio",
  "tokio-rustls",
- "tungstenite",
+ "tungstenite 0.29.0",
  "webpki-roots 0.26.11",
 ]
 
@@ -6252,11 +10344,60 @@ dependencies = [
  "bytes",
  "futures-core",
  "futures-sink",
+ "futures-util",
  "libc",
  "pin-project-lite",
  "tokio",
 ]
 
+[[package]]
+name = "tokio-websockets"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d52efb639344a7c6adb8e62c6f3d2c19c001ff1b79a5041ba1c6ed42e19c6aa5"
+dependencies = [
+ "aws-lc-rs",
+ "base64 0.22.1",
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "getrandom 0.4.3",
+ "http",
+ "httparse",
+ "rand 0.10.2",
+ "ring",
+ "rustls-pki-types",
+ "sha1_smol",
+ "simdutf8",
+ "tokio",
+ "tokio-rustls",
+ "tokio-util",
+]
+
+[[package]]
+name = "tokio_with_wasm"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34e40fbbbd95441133fe9483f522db15dbfd26dc636164ebd8f2dd28759a6aa6"
+dependencies = [
+ "js-sys",
+ "tokio",
+ "tokio_with_wasm_proc",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "tokio_with_wasm_proc"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d01145a2c788d6aae4cd653afec1e8332534d7d783d01897cefcafe4428de992"
+dependencies = [
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "toml"
 version = "0.8.2"
@@ -6359,6 +10500,7 @@ dependencies = [
  "indexmap 2.14.2",
  "toml_datetime 1.1.1+spec-1.1.0",
  "toml_parser",
+ "toml_writer",
  "winnow 1.0.4",
 ]
 
@@ -6377,6 +10519,46 @@ version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2"
 
+[[package]]
+name = "tonic"
+version = "0.14.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac2a5518c70fa84342385732db33fb3f44bc4cc748936eb5833d2df34d6445ef"
+dependencies = [
+ "async-trait",
+ "axum",
+ "base64 0.22.1",
+ "bytes",
+ "h2",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-timeout",
+ "hyper-util",
+ "percent-encoding",
+ "pin-project",
+ "socket2",
+ "sync_wrapper",
+ "tokio",
+ "tokio-stream",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tonic-prost"
+version = "0.14.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50849f68853be452acf590cde0b146665b8d507b3b8af17261df47e02c209ea0"
+dependencies = [
+ "bytes",
+ "prost",
+ "tonic",
+]
+
 [[package]]
 name = "tower"
 version = "0.5.3"
@@ -6385,9 +10567,12 @@ checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
 dependencies = [
  "futures-core",
  "futures-util",
+ "indexmap 2.14.2",
  "pin-project-lite",
+ "slab",
  "sync_wrapper",
  "tokio",
+ "tokio-util",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -6435,6 +10620,19 @@ dependencies = [
  "tracing-core",
 ]
 
+[[package]]
+name = "tracing-appender"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "050686193eb999b4bb3bc2acfa891a13da00f79734704c4b8b4ef1a10b368a3c"
+dependencies = [
+ "crossbeam-channel",
+ "symlink",
+ "thiserror 2.0.20",
+ "time",
+ "tracing-subscriber",
+]
+
 [[package]]
 name = "tracing-attributes"
 version = "0.1.31"
@@ -6527,7 +10725,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8765b90061cba6c22b5831f675da109ae5561588290f9fa2317adab2714d5a6"
 dependencies = [
  "memchr",
- "nom",
+ "nom 8.0.0",
  "petgraph",
 ]
 
@@ -6537,6 +10735,25 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
+[[package]]
+name = "tungstenite"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8628dcc84e5a09eb3d8423d6cb682965dea9133204e8fb3efee74c2a0c259442"
+dependencies = [
+ "bytes",
+ "data-encoding",
+ "http",
+ "httparse",
+ "log",
+ "rand 0.9.5",
+ "rustls",
+ "rustls-pki-types",
+ "sha1",
+ "thiserror 2.0.20",
+ "utf-8",
+]
+
 [[package]]
 name = "tungstenite"
 version = "0.29.0"
@@ -6555,6 +10772,18 @@ dependencies = [
  "thiserror 2.0.20",
 ]
 
+[[package]]
+name = "twox-hash"
+version = "2.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86a801b3cea342a06d468c8710662aa29e5e05e4f5c0d62f00bbb7f2ad7941c2"
+
+[[package]]
+name = "typed-path"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
+
 [[package]]
 name = "typeid"
 version = "1.0.3"
@@ -6567,6 +10796,18 @@ version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
+[[package]]
+name = "typewit"
+version = "1.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "214ca0b2191785cbc06209b9ca1861e048e39b5ba33574b3cedd58363d5bb5f6"
+
+[[package]]
+name = "ucd-trie"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2896d95c02a80c6d6a5d6e953d479f5ddf2dfdb6a244441010e373ac0fb88971"
+
 [[package]]
 name = "uds_windows"
 version = "1.2.1"
@@ -6578,6 +10819,12 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "unarray"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
+
 [[package]]
 name = "unic-char-property"
 version = "0.9.0"
@@ -6619,6 +10866,12 @@ dependencies = [
  "unic-common",
 ]
 
+[[package]]
+name = "unicase"
+version = "2.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "357cc3acc6a036009fd6c973ed009037c732d60d0b4f6c673e9041497482a28f"
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.24"
@@ -6640,6 +10893,29 @@ version = "1.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
 
+[[package]]
+name = "unicode-truncate"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16b380a1238663e5f8a691f9039c73e1cdae598a30e9855f541d29b08b53e9a5"
+dependencies = [
+ "itertools",
+ "unicode-segmentation",
+ "unicode-width",
+]
+
+[[package]]
+name = "unicode-width"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
 [[package]]
 name = "universal-hash"
 version = "0.5.1"
@@ -6650,6 +10926,16 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "universal-hash"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4987bdc12753382e0bec4a65c50738ffaabc998b9cdd1f952fb5f39b0048a96"
+dependencies = [
+ "crypto-common 0.2.2",
+ "ctutils",
+]
+
 [[package]]
 name = "universal-time"
 version = "0.3.1"
@@ -6712,18 +10998,31 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
+[[package]]
+name = "utf-8"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
 [[package]]
 name = "uuid"
 version = "1.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5772d71c9be8a8a6ac2117d949c5b224c1b72241bb611d9a3012edcf8af7812"
 dependencies = [
+ "atomic",
  "getrandom 0.4.3",
  "js-sys",
  "serde_core",
@@ -6783,6 +11082,15 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "vtparse"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d9b2acfb050df409c972a37d3b8e08cdea3bddb0c09db9d53137e504cfabed0"
+dependencies = [
+ "utf8parse",
+]
+
 [[package]]
 name = "walkdir"
 version = "2.5.0"
@@ -6808,6 +11116,15 @@ version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
+[[package]]
+name = "wasi"
+version = "0.14.7+wasi-0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "883478de20367e224c0090af9cf5f9fa85bed63a95c1abf3afc5c083ebc06e8c"
+dependencies = [
+ "wasip2",
+]
+
 [[package]]
 name = "wasip2"
 version = "1.0.4+wasi-0.2.12"
@@ -6817,6 +11134,15 @@ dependencies = [
  "wit-bindgen",
 ]
 
+[[package]]
+name = "wasite"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66fe902b4a6b8028a753d5424909b764ccf79b7a209eac9bf97e59cda9f71a42"
+dependencies = [
+ "wasi 0.14.7+wasi-0.2.4",
+]
+
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.128"
@@ -6981,8 +11307,8 @@ version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ba8b815c1b593dc0baf78dd0f4fc8fdb2de53198fb1163738093e9a311c33fb3"
 dependencies = [
- "phf",
- "phf_codegen",
+ "phf 0.13.1",
+ "phf_codegen 0.13.1",
  "string_cache",
  "string_cache_codegen",
 ]
@@ -7116,6 +11442,97 @@ version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a28ac98ddc8b9274cb41bb4d9d4d5c425b6020c50c46f25559911905610b4a88"
 
+[[package]]
+name = "wezterm-bidi"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0a6e355560527dd2d1cf7890652f4f09bb3433b6aadade4c9b5ed76de5f3ec"
+dependencies = [
+ "log",
+ "wezterm-dynamic",
+]
+
+[[package]]
+name = "wezterm-blob-leases"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "692daff6d93d94e29e4114544ef6d5c942a7ed998b37abdc19b17136ea428eb7"
+dependencies = [
+ "getrandom 0.3.4",
+ "mac_address",
+ "sha2 0.10.9",
+ "thiserror 1.0.69",
+ "uuid",
+]
+
+[[package]]
+name = "wezterm-color-types"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7de81ef35c9010270d63772bebef2f2d6d1f2d20a983d27505ac850b8c4b4296"
+dependencies = [
+ "csscolorparser",
+ "deltae",
+ "lazy_static",
+ "wezterm-dynamic",
+]
+
+[[package]]
+name = "wezterm-dynamic"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f2ab60e120fd6eaa68d9567f3226e876684639d22a4219b313ff69ec0ccd5ac"
+dependencies = [
+ "log",
+ "ordered-float",
+ "strsim",
+ "thiserror 1.0.69",
+ "wezterm-dynamic-derive",
+]
+
+[[package]]
+name = "wezterm-dynamic-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46c0cf2d539c645b448eaffec9ec494b8b19bd5077d9e58cb1ae7efece8d575b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "wezterm-input-types"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7012add459f951456ec9d6c7e6fc340b1ce15d6fc9629f8c42853412c029e57e"
+dependencies = [
+ "bitflags 1.3.2",
+ "euclid",
+ "lazy_static",
+ "serde",
+ "wezterm-dynamic",
+]
+
+[[package]]
+name = "whoami"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "626c4bac6755d76ffc12cb01b2eac751db1996b9e0041de9aa02c8c211ddc82c"
+dependencies = [
+ "libc",
+ "libredox",
+ "objc2-system-configuration",
+ "wasite",
+ "web-sys",
+]
+
+[[package]]
+name = "widestring"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72069c3113ab32ab29e5584db3c6ec55d416895e60715417b5b883a357c3e471"
+
 [[package]]
 name = "winapi"
 version = "0.3.9"
@@ -7287,6 +11704,19 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
+[[package]]
+name = "windows-native-keyring-store"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "063426e76fdec7438d56bb777f67e318a84a25c707b07e575cb8b78e10c028f8"
+dependencies = [
+ "byteorder",
+ "keyring-core",
+ "regex",
+ "windows-sys 0.61.2",
+ "zeroize",
+]
+
 [[package]]
 name = "windows-numerics"
 version = "0.2.0"
@@ -7318,6 +11748,17 @@ dependencies = [
  "windows-strings 0.4.2",
 ]
 
+[[package]]
+name = "windows-registry"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
+dependencies = [
+ "windows-link 0.2.1",
+ "windows-result 0.4.1",
+ "windows-strings 0.5.1",
+]
+
 [[package]]
 name = "windows-result"
 version = "0.3.4"
@@ -7755,6 +12196,21 @@ dependencies = [
  "wayland-protocols-wlr",
 ]
 
+[[package]]
+name = "wmi"
+version = "0.18.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c81b85c57a57500e56669586496bf2abd5cf082b9d32995251185d105208b64"
+dependencies = [
+ "chrono",
+ "futures",
+ "log",
+ "serde",
+ "thiserror 2.0.20",
+ "windows 0.62.2",
+ "windows-core 0.62.2",
+]
+
 [[package]]
 name = "writeable"
 version = "0.6.4"
@@ -7805,6 +12261,25 @@ dependencies = [
  "x11-dl",
 ]
 
+[[package]]
+name = "ws_stream_wasm"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c173014acad22e83f16403ee360115b38846fe754e735c5d9d3803fe70c6abc"
+dependencies = [
+ "async_io_stream",
+ "futures",
+ "js-sys",
+ "log",
+ "pharos",
+ "rustc_version",
+ "send_wrapper",
+ "thiserror 2.0.20",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
 [[package]]
 name = "x11"
 version = "2.21.0"
@@ -7863,6 +12338,164 @@ dependencies = [
  "windows-sys 0.59.0",
 ]
 
+[[package]]
+name = "xet-client"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15500e5fc9e17be15224f9e34cb07d41fb2805d9dbbf7bd3507c982fd1eb3efd"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "base64 0.22.1",
+ "bytes",
+ "chrono",
+ "crc32fast",
+ "futures",
+ "http",
+ "hyper",
+ "more-asserts",
+ "rand 0.10.2",
+ "redb",
+ "reqwest",
+ "reqwest-middleware",
+ "serde",
+ "serde_json",
+ "serde_repr",
+ "statrs",
+ "tempfile",
+ "thiserror 2.0.20",
+ "tokio",
+ "tokio-retry",
+ "tokio_with_wasm",
+ "tracing",
+ "url",
+ "urlencoding",
+ "uuid",
+ "web-time",
+ "xet-core-structures",
+ "xet-runtime",
+]
+
+[[package]]
+name = "xet-core-structures"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5080d5803c8bf15fa56ef934050a46b225801bad3ea4cb8bb3c46c5c37976516"
+dependencies = [
+ "async-trait",
+ "base64 0.22.1",
+ "blake3",
+ "bytemuck",
+ "bytes",
+ "countio",
+ "futures",
+ "futures-util",
+ "getrandom 0.4.3",
+ "heapify",
+ "itertools",
+ "lz4_flex",
+ "more-asserts",
+ "rand 0.10.2",
+ "regex",
+ "safe-transmute",
+ "serde",
+ "static_assertions",
+ "thiserror 2.0.20",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "uuid",
+ "web-time",
+ "xet-runtime",
+]
+
+[[package]]
+name = "xet-data"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1287a1657fb67de846030f6605a9960dcdad401c467b490657e6e909d2e0d1c0"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "bytes",
+ "chrono",
+ "gearhash",
+ "http",
+ "itertools",
+ "more-asserts",
+ "rand 0.10.2",
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+ "tempfile",
+ "thiserror 2.0.20",
+ "tokio",
+ "tokio-util",
+ "tokio_with_wasm",
+ "tracing",
+ "url",
+ "uuid",
+ "web-time",
+ "xet-client",
+ "xet-core-structures",
+ "xet-runtime",
+]
+
+[[package]]
+name = "xet-runtime"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "921953c885ce83e02b21e8d26444b75c78c9e83076699ced08d5c6fc1cdb48ac"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "bytes",
+ "chrono",
+ "colored",
+ "const-str",
+ "ctor 1.0.13",
+ "dirs",
+ "futures",
+ "git-version",
+ "humantime",
+ "konst",
+ "libc",
+ "more-asserts",
+ "oneshot",
+ "pin-project",
+ "rand 0.10.2",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "shellexpand",
+ "sysinfo",
+ "thiserror 2.0.20",
+ "tokio",
+ "tokio-util",
+ "tokio_with_wasm",
+ "tracing",
+ "tracing-appender",
+ "tracing-subscriber",
+ "web-time",
+ "whoami",
+ "winapi",
+]
+
+[[package]]
+name = "xml-rs"
+version = "0.8.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"
+
+[[package]]
+name = "xmltree"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7d8a75eaf6557bb84a65ace8609883db44a29951042ada9b393151532e41fcb"
+dependencies = [
+ "xml-rs",
+]
+
 [[package]]
 name = "yoke"
 version = "0.8.3"
@@ -7953,6 +12586,17 @@ dependencies = [
  "zvariant 5.15.0",
 ]
 
+[[package]]
+name = "zbus-secret-service-keyring-store"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74801d001b9e7729adb4f1825b67b398185fed424749aa3d8bacf70417137d9a"
+dependencies = [
+ "keyring-core",
+ "secret-service 5.2.0",
+ "zbus 5.19.0",
+]
+
 [[package]]
 name = "zbus_macros"
 version = "4.4.0"
@@ -8118,6 +12762,20 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "zip"
+version = "8.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
+dependencies = [
+ "crc32fast",
+ "flate2",
+ "indexmap 2.14.2",
+ "memchr",
+ "typed-path",
+ "zopfli",
+]
+
 [[package]]
 name = "zlib-rs"
 version = "0.6.7"
@@ -8130,6 +12788,18 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
 
+[[package]]
+name = "zopfli"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f05cd8797d63865425ff89b5c4a48804f35ba0ce8d125800027ad6017d2b5249"
+dependencies = [
+ "bumpalo",
+ "crc32fast",
+ "log",
+ "simd-adler32",
+]
+
 [[package]]
 name = "zune-core"
 version = "0.5.3"
diff --git a/Cargo.toml b/Cargo.toml
index fc50185b9..613fda0c6 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,4 +1,4 @@
 [workspace]
-members = ["crates/pairing", "crates/plugin-manager", "crates/agent-controller", "crates/credential-store", "src-tauri"]
+members = ["crates/pairing", "crates/plugin-manager", "crates/agent-controller", "crates/credential-store", "crates/mesh-compute", "src-tauri"]
 default-members = ["crates/plugin-manager"]
 resolver = "2"
diff --git a/crates/agent-controller/src/lib.rs b/crates/agent-controller/src/lib.rs
index cd74797ed..8511d5e94 100644
--- a/crates/agent-controller/src/lib.rs
+++ b/crates/agent-controller/src/lib.rs
@@ -62,3 +62,6 @@ pub use secret::{validate_snapshot_memory_envelope, Credentials, Secret};
 pub use skills::ensure_buzz_cli_skill;
 pub use store::{ParkedIdentity, Store};
 type Result<T> = std::result::Result<T, String>;
+
+mod mesh;
+pub use mesh::{MeshLaunch, MeshRequest};
diff --git a/crates/agent-controller/src/mesh.rs b/crates/agent-controller/src/mesh.rs
new file mode 100644
index 000000000..184709459
--- /dev/null
+++ b/crates/agent-controller/src/mesh.rs
@@ -0,0 +1,117 @@
+//! Native-only endpoint configuration for one saved Mesh agent start. Never persisted.
+use crate::{config::Agent, Result};
+
+/// Effective saved selectors for the native readiness check; contains no secrets.
+pub struct MeshRequest {
+    pub agent_id: String,
+    pub revision: u64,
+    pub relay: String,
+    pub model: String,
+}
+
+impl crate::Controller {
+    /// Resolve the same defaults and environment used at launch.
+    pub fn mesh_request(&self, id: &str) -> Result<Option<MeshRequest>> {
+        let agent = self.mesh_agent(id)?;
+        if agent.harness.provider != "relay-mesh" {
+            return Ok(None);
+        }
+        if agent.harness.command != "buzz-agent"
+            || !agent.imported["record"]["relay_mesh"].is_null()
+        {
+            return Err("Shared compute supports the local Buzz Agent harness".into());
+        }
+        Ok(Some(MeshRequest {
+            agent_id: agent.id,
+            revision: agent.revision,
+            relay: agent.relay_url,
+            model: agent.harness.model,
+        }))
+    }
+}
+
+/// Prepared after node readiness; the app, not an agent process, owns the node.
+pub struct MeshLaunch {
+    agent_id: String,
+    revision: u64,
+    relay: String,
+    model: String,
+    port: u16,
+}
+
+impl MeshLaunch {
+    /// Create only after native discovery and node readiness succeed.
+    /// A port, rather than an arbitrary URL, limits child routing to loopback.
+    pub fn new(
+        agent_id: String,
+        revision: u64,
+        relay: String,
+        model: String,
+        port: u16,
+    ) -> Result<Self> {
+        let grant = Self {
+            agent_id: agent_id.clone(),
+            revision,
+            relay,
+            model,
+            port,
+        };
+        if grant.port == 0 || grant.model.trim().is_empty() {
+            return Err("Shared compute requires a ready endpoint and model".into());
+        }
+        Ok(grant)
+    }
+
+    pub(crate) fn apply(&self, agent: &Agent) -> Result<Agent> {
+        let mut agent = agent.clone();
+        agent.harness = crate::build_defaults().resolve(&agent.harness, &agent.environment);
+        if agent.id != self.agent_id
+            || agent.revision != self.revision
+            || agent.relay_url != self.relay
+            || agent.harness.provider != "relay-mesh"
+            || agent.harness.command != "buzz-agent"
+            || !agent.imported["record"]["relay_mesh"].is_null()
+        {
+            return Err("Shared compute grant no longer matches the saved agent".into());
+        }
+        let mut runtime = agent.clone();
+        runtime.harness.provider = "openai".into();
+        runtime.harness.model.clone_from(&self.model);
+        // Legacy relay_mesh default, not policy: an explicit agent value wins and
+        // no context window is derived from the catalog (buzz-agent's default applies).
+        runtime
+            .environment
+            .entry("BUZZ_AGENT_MAX_OUTPUT_TOKENS".into())
+            .or_insert_with(|| "4096".into());
+        // Explicit last-writer runtime settings; user environment cannot reroute this grant.
+        // Legacy default just above MeshLLM's 600 s backend budget; a user value wins.
+        runtime
+            .environment
+            .entry("BUZZ_AGENT_LLM_TIMEOUT_SECS".into())
+            .or_insert_with(|| "660".into());
+        for (name, value) in [
+            ("BUZZ_AGENT_PROVIDER", "openai".to_owned()),
+            ("BUZZ_AGENT_MODEL", self.model.clone()),
+            ("OPENAI_COMPAT_MODEL", self.model.clone()),
+            (
+                "OPENAI_COMPAT_BASE_URL",
+                format!("http://127.0.0.1:{}/v1", self.port),
+            ),
+            ("OPENAI_COMPAT_API_KEY", "mesh-local".to_owned()),
+            ("OPENAI_COMPAT_API", "chat".to_owned()),
+        ] {
+            runtime.environment.insert(name.into(), value);
+        }
+        // Match classic Buzz without overriding an explicit opt-out.
+        runtime
+            .environment
+            .entry("BUZZ_AGENT_REQUIRE_REPLY".into())
+            .or_insert_with(|| "1".into());
+        // Mesh agents default to no reasoning; explicit user effort wins.
+        runtime
+            .environment
+            .entry("BUZZ_AGENT_THINKING_EFFORT".into())
+            .or_insert_with(|| "none".into());
+        Ok(runtime)
+    }
+}
diff --git a/crates/agent-controller/src/runtime.rs b/crates/agent-controller/src/runtime.rs
index e0b0198d2..266ec5103 100644
--- a/crates/agent-controller/src/runtime.rs
+++ b/crates/agent-controller/src/runtime.rs
@@ -531,6 +531,7 @@ struct Running {
     /// Native-only: holds environment values and is never serialized.
     spawned: serde_json::Value,
     databricks_host: Option<String>,
+    mesh_consumer: bool,
     #[cfg(all(test, unix))]
     temporary: Option<PathBuf>,
 }
@@ -541,6 +542,8 @@ impl Drop for Running {
 }
 /// Deliberately not serializable: only the native connection owner consumes it.
 pub struct ModelContext {
+    pub mesh: bool,
+    pub relay: Option<String>,
     pub host: Option<String>,
     pub filter: Option<String>,
     pub model_overridden: bool,
@@ -663,7 +666,9 @@ impl Controller {
     }
     pub fn model_context(&self, id: &str, revision: u64, edit: AgentEdit) -> Result<ModelContext> {
         let agent = self.edited_agent(id, revision, edit)?;
-        model_context(&agent.harness, &agent.environment)
+        let mut context = model_context(&agent.harness, &agent.environment)?;
+        context.relay = Some(agent.relay_url);
+        Ok(context)
     }
     pub fn goose_model_context(
         &self,
@@ -1048,6 +1053,17 @@ impl Controller {
         }
         self.snapshot()
     }
+    pub(crate) fn mesh_agent(&self, id: &str) -> Result<Agent> {
+        let agent = self
+            .store
+            .agents()?
+            .into_iter()
+            .find(|a| a.id == id)
+            .ok_or("Agent no longer exists")?;
+        let mut agent = crate::agent_defaults::effective(&agent, &self.store.defaults()?);
+        agent.harness = crate::build_defaults().resolve(&agent.harness, &agent.environment);
+        Ok(agent)
+    }
     pub fn credential_request(&self, id: &str) -> Result<(String, String, u64, Option<String>)> {
         let agent = self
             .store
@@ -1072,7 +1088,7 @@ impl Controller {
         key: &crate::Secret,
         replay_floor: Option<u64>,
     ) -> Result<()> {
-        self.action_checked(id, action, revision, key, replay_floor, None)
+        self.action_checked(id, action, revision, key, replay_floor, (None, None))
     }
     pub fn action_with_preflight(
         &mut self,
@@ -1083,7 +1099,33 @@ impl Controller {
         replay_floor: Option<u64>,
         preflight: &crate::pi::LaunchPreflight,
     ) -> Result<()> {
-        self.action_checked(id, action, revision, key, replay_floor, Some(preflight))
+        self.action_checked(
+            id,
+            action,
+            revision,
+            key,
+            replay_floor,
+            (Some(preflight), None),
+        )
+    }
+    /// Start with an identity-bound Mesh grant and the host's verified preflight.
+    pub fn action_with_mesh(
+        &mut self,
+        id: &str,
+        action: Action,
+        revision: u64,
+        key: &crate::Secret,
+        replay_floor: Option<u64>,
+        launch: (&crate::pi::LaunchPreflight, crate::MeshLaunch),
+    ) -> Result<()> {
+        self.action_checked(
+            id,
+            action,
+            revision,
+            key,
+            replay_floor,
+            (Some(launch.0), Some(launch.1)),
+        )
     }
     fn action_checked(
         &mut self,
@@ -1092,8 +1134,12 @@ impl Controller {
         revision: u64,
         key: &crate::Secret,
         replay_floor: Option<u64>,
-        preflight: Option<&crate::pi::LaunchPreflight>,
+        launch: (
+            Option<&crate::pi::LaunchPreflight>,
+            Option<crate::MeshLaunch>,
+        ),
     ) -> Result<()> {
+        let (preflight, mesh) = launch;
         if self.credential_request(id)?.2 != revision {
             return Err("Saved settings changed while opening credentials; retry Start".into());
         }
@@ -1107,7 +1153,7 @@ impl Controller {
                 return Ok(());
             }
         }
-        match self.start_with_key(id, Some(key), replay_floor, preflight) {
+        match self.start_with_key(id, Some(key), replay_floor, preflight, mesh) {
             Ok(()) => {
                 self.errors.remove(id);
             }
@@ -1130,7 +1176,7 @@ impl Controller {
             .collect())
     }
     fn start(&mut self, id: &str) -> Result<()> {
-        self.start_with_key(id, None, None, None)
+        self.start_with_key(id, None, None, None, None)
     }
     fn start_with_key(
         &mut self,
@@ -1138,6 +1184,7 @@ impl Controller {
         supplied: Option<&crate::Secret>,
         replay_floor: Option<u64>,
         preflight: Option<&crate::pi::LaunchPreflight>,
+        mesh: Option<crate::MeshLaunch>,
     ) -> Result<()> {
         if let Some(run) = self.running.get_mut(id) {
             if run.process.alive()? {
@@ -1182,10 +1229,12 @@ impl Controller {
             .map_err(|_| "Could not create private runtime directory")?;
         let scratch = temporary.path().join("tmp");
         crate::connection::private_directory(&scratch)?;
+        let runtime_agent = mesh.as_ref().map(|grant| grant.apply(&agent)).transpose()?;
+        let launch_agent = runtime_agent.as_ref().unwrap_or(&agent);
         let mut command = if let Some(preflight) = preflight {
-            bundle.command_checked(&agent, key, &crate::build_defaults(), Some(preflight))?
+            bundle.command_checked(launch_agent, key, &crate::build_defaults(), Some(preflight))?
         } else {
-            bundle.command(&agent, key)?
+            bundle.command(launch_agent, key)?
         };
         // Per-send startup input, never saved configuration or inherited environment.
         if let Some(floor) = replay_floor {
@@ -1225,6 +1274,7 @@ impl Controller {
                 revision: agent.revision,
                 spawned: crate::restart::spawn_config(&agent),
                 databricks_host: settings.map(|s| s.host),
+                mesh_consumer: mesh.is_some(),
                 #[cfg(all(test, unix))]
                 temporary: Some(temporary),
             },
@@ -1265,6 +1315,24 @@ impl Controller {
         let cache = crate::connection::oauth_root(self.store.root())?;
         crate::connection::disconnect(&cache, &workspace)
     }
+    /// Whether any running agent was launched as a Mesh consumer.
+    pub fn has_mesh_consumers(&self) -> bool {
+        self.running.values().any(|run| run.mesh_consumer)
+    }
+    /// Stop exact running Mesh consumers using captured launch evidence, not edited settings.
+    /// A failed process teardown retains ownership and prevents endpoint replacement.
+    pub fn stop_mesh_consumers(&mut self) -> Result<()> {
+        let ids: Vec<_> = self
+            .running
+            .iter()
+            .filter(|(_, run)| run.mesh_consumer)
+            .map(|(id, _)| id.clone())
+            .collect();
+        for id in ids {
+            self.stop(&id)?;
+        }
+        Ok(())
+    }
     pub fn shutdown(&mut self) -> Result<()> {
         let ids: Vec<_> = self.running.keys().cloned().collect();
         let mut result = Ok(());
@@ -1313,6 +1381,15 @@ fn model_context_with_defaults(
     let provider = environment
         .get("BUZZ_AGENT_PROVIDER")
         .unwrap_or(&harness.provider);
+    if provider == "relay-mesh" {
+        return Ok(ModelContext {
+            mesh: true,
+            relay: None,
+            host: None,
+            filter: None,
+            model_overridden: environment.contains_key("BUZZ_AGENT_MODEL"),
+        });
+    }
     if !matches!(provider.as_str(), "databricks_v2" | "databricks-v2") {
         return Err(
             "Effective provider is not Databricks v2; check the provider and environment overrides"
@@ -1323,6 +1400,8 @@ fn model_context_with_defaults(
         return Err("A saved or draft token override conflicts with this app-isolated OAuth connection. Remove it explicitly or keep manual model entry".into());
     }
     Ok(ModelContext {
+        mesh: false,
+        relay: None,
         host: environment
             .get("DATABRICKS_HOST")
             .cloned()
diff --git a/crates/agent-controller/src/runtime/tests.rs b/crates/agent-controller/src/runtime/tests.rs
index 092d4043f..0d2b27cc9 100644
--- a/crates/agent-controller/src/runtime/tests.rs
+++ b/crates/agent-controller/src/runtime/tests.rs
@@ -3668,6 +3668,166 @@ fn use_here_exhausted_revision_preserves_the_saved_import() {
     assert!(!store.snapshot().unwrap().agents[0].configured);
 }
 
+#[test]
+fn mesh_launch_is_bound_and_runtime_only() {
+    let dir = tempfile::tempdir().unwrap();
+    let mut saved = agent(dir.path());
+    saved.harness.provider = "relay-mesh".into();
+    saved.environment.insert(
+        "OPENAI_COMPAT_BASE_URL".into(),
+        "https://wrong.example".into(),
+    );
+    saved
+        .environment
+        .insert("BUZZ_AGENT_MAX_OUTPUT_TOKENS".into(), "8192".into());
+    let grant = crate::MeshLaunch::new(
+        saved.id.clone(),
+        saved.revision,
+        saved.relay_url.clone(),
+        "shared-model".into(),
+        19337,
+    )
+    .unwrap();
+    let runtime = grant.apply(&saved).unwrap();
+    assert_eq!(
+        runtime.environment["OPENAI_COMPAT_BASE_URL"],
+        "http://127.0.0.1:19337/v1"
+    );
+    assert_eq!(runtime.environment["BUZZ_AGENT_MODEL"], "shared-model");
+    assert_eq!(saved.harness.provider, "relay-mesh");
+    let mut changed = saved.clone();
+    changed.revision += 1;
+    assert!(grant.apply(&changed).is_err());
+    changed = saved.clone();
+    changed.relay_url = "wss://other.example".into();
+    assert!(grant.apply(&changed).is_err());
+    changed = saved.clone();
+    changed.harness.command = "goose".into();
+    assert!(grant.apply(&changed).is_err());
+}
+
+#[test]
+fn mesh_output_default_matches_legacy_and_user_generation_controls_win() {
+    let dir = tempfile::tempdir().unwrap();
+    let mut saved = agent(dir.path());
+    saved.harness.provider = "relay-mesh".into();
+    let grant = crate::MeshLaunch::new(
+        saved.id.clone(),
+        saved.revision,
+        saved.relay_url.clone(),
+        "mesh".into(),
+        19337,
+    )
+    .unwrap();
+    let runtime = grant.apply(&saved).unwrap();
+    // Legacy relay_mesh: 4096 output default, no catalog-derived context window.
+    assert_eq!(runtime.environment["BUZZ_AGENT_MAX_OUTPUT_TOKENS"], "4096");
+    assert!(!runtime
+        .environment
+        .contains_key("BUZZ_AGENT_MAX_CONTEXT_TOKENS"));
+    assert_eq!(runtime.environment["BUZZ_AGENT_LLM_TIMEOUT_SECS"], "660");
+    assert!(!saved
+        .environment
+        .contains_key("BUZZ_AGENT_MAX_OUTPUT_TOKENS"));
+    for (name, value) in [
+        ("BUZZ_AGENT_MAX_OUTPUT_TOKENS", "20000"),
+        ("BUZZ_AGENT_MAX_CONTEXT_TOKENS", "65536"),
+        ("BUZZ_AGENT_LLM_TIMEOUT_SECS", "90"),
+    ] {
+        saved.environment.insert(name.into(), value.into());
+    }
+    let runtime = grant.apply(&saved).unwrap();
+    assert_eq!(runtime.environment["BUZZ_AGENT_MAX_OUTPUT_TOKENS"], "20000");
+    assert_eq!(
+        runtime.environment["BUZZ_AGENT_MAX_CONTEXT_TOKENS"],
+        "65536"
+    );
+    // Legacy relay_mesh preserves an explicit request timeout.
+    assert_eq!(runtime.environment["BUZZ_AGENT_LLM_TIMEOUT_SECS"], "90");
+}
+
+#[test]
+fn mesh_preflight_and_launch_resolve_the_same_environment_without_persistence() {
+    let dir = tempfile::tempdir().unwrap();
+    let mut saved = agent(dir.path());
+    saved
+        .environment
+        .insert("BUZZ_AGENT_PROVIDER".into(), "relay-mesh".into());
+    saved
+        .environment
+        .insert("BUZZ_AGENT_MODEL".into(), "auto".into());
+    let root = dir.path().join("config");
+    let mut store = Store::open(root.clone()).unwrap();
+    store.insert(vec![saved.clone()]).unwrap();
+    let before = fs::read(root.join("agents.json")).unwrap();
+    let controller = Controller::new(
+        store,
+        Arc::new(Memory),
+        Err("fixture".into()),
+        dir.path().join("ownership"),
+    );
+    let request = controller.mesh_request(&saved.id).unwrap().unwrap();
+    assert_eq!(request.model, "auto");
+    assert_eq!(request.relay, saved.relay_url);
+    let config = crate::MeshLaunch::new(
+        request.agent_id,
+        request.revision,
+        request.relay,
+        "mesh".into(),
+        19337,
+    )
+    .unwrap();
+    let runtime = config.apply(&saved).unwrap();
+    assert_eq!(runtime.harness.model, "mesh");
+    assert_eq!(runtime.environment["BUZZ_AGENT_PROVIDER"], "openai");
+    assert_eq!(
+        runtime.environment["OPENAI_COMPAT_BASE_URL"],
+        "http://127.0.0.1:19337/v1"
+    );
+    assert_eq!(fs::read(root.join("agents.json")).unwrap(), before);
+    saved
+        .environment
+        .insert("BUZZ_AGENT_PROVIDER".into(), "openai".into());
+    assert!(config.apply(&saved).is_err());
+}
+
+#[test]
+fn shared_compute_model_context_resolves_defaults_and_environment_without_cloud_settings() {
+    let dir = tempfile::tempdir().unwrap();
+    let mut agent = agent(dir.path());
+    agent.harness.provider = "relay-mesh".into();
+    agent
+        .environment
+        .insert("DATABRICKS_TOKEN".into(), "unused".into());
+    let context = model_context(&agent.harness, &agent.environment).unwrap();
+    assert!(context.mesh);
+    assert!(context.host.is_none());
+    assert!(context.filter.is_none());
+    let mut defaults = deployment_defaults();
+    defaults.provider = "relay-mesh".into();
+    agent.harness.provider.clear();
+    assert!(
+        model_context_with_defaults(&agent.harness, &agent.environment, &defaults)
+            .unwrap()
+            .mesh
+    );
+    agent
+        .environment
+        .insert("BUZZ_AGENT_PROVIDER".into(), "openai".into());
+    assert!(model_context_with_defaults(&agent.harness, &agent.environment, &defaults).is_err());
+    agent
+        .environment
+        .insert("BUZZ_AGENT_PROVIDER".into(), "relay-mesh".into());
+    agent
+        .environment
+        .insert("BUZZ_AGENT_MODEL".into(), "saved".into());
+    assert!(
+        model_context(&agent.harness, &agent.environment)
+            .unwrap()
+            .model_overridden
+    );
+}
+
 #[test]
 fn protection_revision_limit_preserves_saved_agent() {
     use crate::security::Request;
@@ -4023,6 +4183,157 @@ while :; do /bin/sleep 0.1; done
 #[cfg(target_os = "macos")]
 mod protection_integration;
 
+#[test]
+fn mesh_defaults_preserve_explicit_agent_choices_and_do_not_mutate_saved_config() {
+    let dir = tempfile::tempdir().unwrap();
+    let mut saved = agent(dir.path());
+    saved.harness.provider = "relay-mesh".into();
+    for expected in ["4096"] {
+        let grant = crate::MeshLaunch::new(
+            saved.id.clone(),
+            saved.revision,
+            saved.relay_url.clone(),
+            "shared-model".into(),
+            19337,
+        )
+        .unwrap();
+        let runtime = grant.apply(&saved).unwrap();
+        assert_eq!(
+            runtime.environment["BUZZ_AGENT_MAX_OUTPUT_TOKENS"],
+            expected
+        );
+        assert_eq!(runtime.environment["BUZZ_AGENT_REQUIRE_REPLY"], "1");
+        assert_eq!(runtime.environment["BUZZ_AGENT_THINKING_EFFORT"], "none");
+        for key in [
+            "BUZZ_AGENT_MAX_OUTPUT_TOKENS",
+            "BUZZ_AGENT_REQUIRE_REPLY",
+            "BUZZ_AGENT_THINKING_EFFORT",
+        ] {
+            assert!(!saved.environment.contains_key(key));
+        }
+    }
+    let grant = crate::MeshLaunch::new(
+        saved.id.clone(),
+        saved.revision,
+        saved.relay_url.clone(),
+        "shared-model".into(),
+        19337,
+    )
+    .unwrap();
+    for (reply, effort) in [("0", "none"), ("1", "high")] {
+        saved
+            .environment
+            .insert("BUZZ_AGENT_REQUIRE_REPLY".into(), reply.into());
+        saved
+            .environment
+            .insert("BUZZ_AGENT_THINKING_EFFORT".into(), effort.into());
+        saved
+            .environment
+            .insert("BUZZ_AGENT_MAX_OUTPUT_TOKENS".into(), "8192".into());
+        let runtime = grant.apply(&saved).unwrap();
+        assert_eq!(runtime.environment["BUZZ_AGENT_REQUIRE_REPLY"], reply);
+        assert_eq!(runtime.environment["BUZZ_AGENT_THINKING_EFFORT"], effort);
+        assert_eq!(runtime.environment["BUZZ_AGENT_MAX_OUTPUT_TOKENS"], "8192");
+    }
+}
+
+#[cfg(unix)]
+#[test]
+fn mesh_replacement_stops_captured_consumer_without_changing_saved_restore() {
+    let dir = tempfile::tempdir().unwrap();
+    let tools = tempfile::tempdir().unwrap();
+    let mut store = Store::open(dir.path().join("config")).unwrap();
+    let mut saved = agent(dir.path());
+    saved.harness.provider = "relay-mesh".into();
+    saved.start_on_app_launch = Some(true);
+    store.insert(vec![saved.clone()]).unwrap();
+    let mut controller = Controller::new(
+        store,
+        Arc::new(Memory),
+        Ok(bundle(tools.path())),
+        dir.path().join("ownership"),
+    );
+    let grant = crate::MeshLaunch::new(
+        saved.id.clone(),
+        saved.revision,
+        saved.relay_url.clone(),
+        "mesh".into(),
+        19337,
+    )
+    .unwrap();
+    controller
+        .action_with_mesh(
+            &saved.id,
+            Action::Start,
+            saved.revision,
+            &Secret::parse(KEY, PUB).unwrap(),
+            None,
+            (&crate::pi::LaunchPreflight::new(None), grant),
+        )
+        .unwrap();
+    assert!(controller.running.contains_key(&saved.id));
+    // Persisted edits must not hide an already-running consumer of the old endpoint.
+    controller.store.agents().unwrap();
+    controller.stop_mesh_consumers().unwrap();
+    assert!(!controller.running.contains_key(&saved.id));
+    assert!(controller.launch_ids().unwrap().contains(&saved.id));
+    let snapshot = controller.snapshot().unwrap();
+    assert!(snapshot.agents[0].enabled);
+    assert!(snapshot.agents[0].start_on_app_launch);
+}
+
+#[test]
+fn saved_shared_compute_discovery_validates_edit_without_mutating_saved_agent() {
+    let root = tempfile::tempdir().unwrap();
+    let mut saved = agent(root.path());
+    saved.harness.provider = "relay-mesh".into();
+    let mut store = Store::open(root.path().join("config")).unwrap();
+    store.insert(vec![saved.clone()]).unwrap();
+    let before = fs::read(root.path().join("config/agents.json")).unwrap();
+    let controller = Controller::new(
+        store,
+        Arc::new(Memory),
+        Err("Runtime bundle is missing".into()),
+        root.path().join("ownership"),
+    );
+    let edit = AgentEdit {
+        name: "Model discovery".into(),
+        effort: None,
+        picture: None,
+        system_prompt: String::new(),
+        session_policy: Some(None),
+        workspace: saved.workspace.clone(),
+        harness: HarnessEdit {
+            model: String::new(),
+            ..saved.harness.clone()
+        },
+        environment: BTreeMap::new(),
+    };
+    // The old picker payload fails at the real saved-agent validation boundary.
+    let mut invalid = edit.clone();
+    invalid.name.clear();
+    assert!(controller
+        .model_context(&saved.id, saved.revision, invalid)
+        .err()
+        .unwrap()
+        .contains("Agent name is required"));
+    // Repeated Browse/Retry succeeds without changing name, prompt or revision.
+    for _ in 0..2 {
+        let context = controller
+            .model_context(&saved.id, saved.revision, edit.clone())
+            .unwrap();
+        assert!(context.mesh);
+        assert_eq!(context.relay.as_deref(), Some("wss://relay.example"));
+    }
+    assert!(controller
+        .model_context(&saved.id, saved.revision + 1, edit)
+        .is_err());
+    assert_eq!(
+        fs::read(root.path().join("config/agents.json")).unwrap(),
+        before
+    );
+}
+
 #[test]
 #[cfg(unix)]
 fn launch_discovers_login_shell_tools_without_inheriting_credentials() {
diff --git a/crates/mesh-compute/Cargo.toml b/crates/mesh-compute/Cargo.toml
new file mode 100644
index 000000000..86f368ba1
--- /dev/null
+++ b/crates/mesh-compute/Cargo.toml
@@ -0,0 +1,33 @@
+[package]
+name = "buzz-mesh-compute"
+version = "0.1.0"
+edition = "2021"
+rust-version = "1.89"
+
+[features]
+default = []
+mesh = ["dep:nostr", "dep:sha2", "dep:hex", "dep:ed25519-dalek", "dep:tokio", "dep:mesh-llm-sdk", "dep:mesh-llm-host-runtime", "dep:mesh-llm-events", "dep:mesh-llm-system", "dep:iroh", "dep:anyhow", "dep:base64", "dep:url", "dep:serde_json"]
+
+[dependencies]
+tempfile = "3"
+serde = { version = "1", features = ["derive"] }
+mesh-llm-sdk = { git = "https://github.com/Mesh-LLM/mesh-llm.git", tag = "v0.78.1", default-features = false, features = ["client", "serving"], optional = true }
+
+mesh-llm-host-runtime = { git = "https://github.com/Mesh-LLM/mesh-llm.git", tag = "v0.78.1", default-features = false, features = ["dynamic-native-runtime"], optional = true }
+mesh-llm-events = { git = "https://github.com/Mesh-LLM/mesh-llm.git", tag = "v0.78.1", optional = true }
+mesh-llm-system = { git = "https://github.com/Mesh-LLM/mesh-llm.git", tag = "v0.78.1", optional = true }
+iroh = { version = "1.3.0", optional = true }
+anyhow = { version = "1", optional = true }
+base64 = { version = "0.22", optional = true }
+url = { version = "2", optional = true }
+serde_json = { version = "1", optional = true }
+
+tokio = { version = "1", features = ["rt", "sync", "macros", "time"], optional = true }
+
+nostr = { version = "=0.45.5", default-features = false, features = ["std"], optional = true }
+sha2 = { version = "0.10", optional = true }
+hex = { version = "0.4", optional = true }
+ed25519-dalek = { version = "2", optional = true }
+
+[dev-dependencies]
+tokio = { version = "1", features = ["test-util"] }
diff --git a/crates/mesh-compute/fixtures/README.md b/crates/mesh-compute/fixtures/README.md
new file mode 100644
index 000000000..419258e3a
--- /dev/null
+++ b/crates/mesh-compute/fixtures/README.md
@@ -0,0 +1,5 @@
+# SDK status fixture
+
+`sdk-status-ready.json` is an unchanged field subset of a captured console `/api/status` response, read through the SDK status surface. Source: workspace `RESEARCH/evidence-split-lab-fb58/m5-status.json`; source SHA-256: `728f60f4ab33c63a55043829a5a7e512fdf0d3106bfa3ced1ccf2cbcfabcab27`.
+
+Retained: version, models, hosted_models, serving_models, runtime.models. All other runtime fields were removed too. Removed all other fields (including node identity, endpoint tokens, peer inventory and machine metadata). No new live run was performed. This is historical runtime-schema evidence, not verification against the current SDK pin.
diff --git a/crates/mesh-compute/fixtures/sdk-status-ready.json b/crates/mesh-compute/fixtures/sdk-status-ready.json
new file mode 100644
index 000000000..e68cac405
--- /dev/null
+++ b/crates/mesh-compute/fixtures/sdk-status-ready.json
@@ -0,0 +1,24 @@
+{
+  "version": "0.76.0-rc4",
+  "models": [
+    "meshllm/Qwen3.5-35B-A3B-UD-Q4_K_XL-layers@69cbd9fc1f928305e8e86e1148a1db6a6f1de8e9"
+  ],
+  "hosted_models": [
+    "meshllm/Qwen3.5-35B-A3B-UD-Q4_K_XL-layers@69cbd9fc1f928305e8e86e1148a1db6a6f1de8e9"
+  ],
+  "serving_models": [
+    "meshllm/Qwen3.5-35B-A3B-UD-Q4_K_XL-layers@69cbd9fc1f928305e8e86e1148a1db6a6f1de8e9"
+  ],
+  "runtime": {
+    "models": [
+      {
+        "name": "meshllm/Qwen3.5-35B-A3B-UD-Q4_K_XL-layers@69cbd9fc1f928305e8e86e1148a1db6a6f1de8e9",
+        "instance_id": "runtime-1",
+        "backend": "skippy",
+        "status": "ready",
+        "port": 52759,
+        "context_length": 8192
+      }
+    ]
+  }
+}
diff --git a/crates/mesh-compute/src/catalog.rs b/crates/mesh-compute/src/catalog.rs
new file mode 100644
index 000000000..b544caa93
--- /dev/null
+++ b/crates/mesh-compute/src/catalog.rs
@@ -0,0 +1,327 @@
+//! Share-compute picker, adapting Buzz's curated ladder to the pinned SDK catalog.
+use mesh_llm_host_runtime::models::{self, remote_catalog::RemoteCatalogModel};
+use mesh_llm_system::{hardware, vram};
+use serde::Serialize;
+
+const CURATED_SMALL: &str = "unsloth/gemma-4-E4B-it-GGUF:Q4_K_M";
+const CURATED_MEDIUM: &str = "unsloth/Qwen3.5-9B-GGUF:Q4_K_M";
+const CURATED_LARGE: &str = "unsloth/Qwen3.8-27B-GGUF:UD-Q4_K_M";
+const LEGACY_LARGE_XL: &str = "unsloth/Qwen3.8-27B-GGUF:UD-Q4_K_XL";
+
+/// Rated-capacity boundary for the balanced Qwen3.5 9B tier.
+const CURATED_MEDIUM_MIN_RATED_GB: u64 = 32;
+/// Qwen3.8 27B is recommended for 64 GB-and-larger rated capacity classes,
+/// leaving headroom for KV cache and runtime use (Buzz donor 639593bba).
+const CURATED_LARGE_MIN_RATED_GB: u64 = 64;
+
+/// Preserve the historical Buzz aliases at the native sharing boundary.
+pub fn canonical_curated_model_id(model: &str) -> &str {
+    match model.trim() {
+        "Gemma-4-E4B-it-Q4_K_M" => CURATED_SMALL,
+        "Qwen3.5-9B-Vision-Q4_K_M" => CURATED_MEDIUM,
+        "Qwen3.8-27B-Q4_K_M" => "unsloth/Qwen3.8-27B-GGUF:Q4_K_M",
+        "gemma-4-26B-A4B-it-UD-Q4_K_M" => "unsloth/gemma-4-26B-A4B-it-GGUF:UD-Q4_K_M",
+        other => other,
+    }
+}
+
+/// Older pickers persisted these recommendations without an explicit Auto mode.
+pub fn is_legacy_recommendation(model: &str) -> bool {
+    matches!(
+        model,
+        CURATED_SMALL | CURATED_MEDIUM | CURATED_LARGE | LEGACY_LARGE_XL
+    )
+}
+
+/// Hardware-ranked models with cache evidence, not a claim of runtime readiness.
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Catalog {
+    pub gpu_name: Option<String>,
+    pub vram_display: String,
+    pub recommended: Option<String>,
+    pub entries: Vec<Entry>,
+}
+
+/// One exact, downloadable model choice from the SDK's catalog.
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Entry {
+    pub model: String,
+    pub name: String,
+    pub size: Option<String>,
+    pub description: Option<String>,
+    pub installed: bool,
+    pub curated: bool,
+    pub fit: &'static str,
+}
+
+/// Runs blocking hardware/cache/catalog I/O; callers must use a blocking task.
+pub fn catalog() -> anyhow::Result<Catalog> {
+    // The remote layer catalog enriches choices; it does not own Buzz's GGUF ladder.
+    if let Err(error) = models::remote_catalog::ensure_catalog() {
+        eprintln!("Mesh catalog metadata unavailable: {error}");
+    }
+    let survey = hardware::survey();
+    let installed = models::scan_installed_models();
+    Ok(build(
+        survey.gpu_name,
+        survey.vram_bytes,
+        models::remote_catalog::loaded_models().unwrap_or_default(),
+        |model| {
+            installed
+                .iter()
+                .any(|cached| canonical_curated_model_id(cached) == model)
+                || models::find_model_path(model).is_file()
+        },
+    ))
+}
+
+fn exact_quant(file: &str, quant: &str) -> bool {
+    let file = file.to_ascii_uppercase();
+    let quant = quant.to_ascii_uppercase();
+    file.match_indices(&quant).any(|(offset, _)| {
+        let prefix = &file[..offset];
+        let suffix = &file[offset + quant.len()..];
+        (prefix.is_empty() || prefix.ends_with(['-', '.', '_']))
+            && !prefix.ends_with("UD-")
+            && (suffix.is_empty() || suffix.starts_with(['-', '.']))
+    })
+}
+
+fn fit(size: Option<&str>, memory: f64) -> &'static str {
+    let gb = size.map(models::catalog::parse_size_gb).unwrap_or(0.0);
+    if gb <= 0.0 || memory <= 0.0 {
+        "unknown"
+    } else if gb <= memory * 0.6 {
+        "comfortable"
+    } else if gb <= memory * 0.9 {
+        "tight"
+    } else if gb <= memory * 1.1 {
+        "tradeoff"
+    } else {
+        "too_large"
+    }
+}
+fn fit_rank(fit: &str) -> u8 {
+    match fit {
+        "comfortable" => 0,
+        "tight" => 1,
+        "tradeoff" => 2,
+        "too_large" => 3,
+        _ => 4,
+    }
+}
+/// Device recommendation uses Buzz's hardware ladder, not remote catalog availability.
+/// This performs only a local hardware survey; serving owns artifact acquisition.
+pub fn recommended_model() -> String {
+    recommendation_for_memory(hardware::survey().vram_bytes).to_owned()
+}
+
+fn recommendation_for_memory(bytes: u64) -> &'static str {
+    match vram::rated_capacity_gb(bytes) {
+        Some(gb) if gb >= CURATED_LARGE_MIN_RATED_GB => CURATED_LARGE,
+        Some(gb) if gb >= CURATED_MEDIUM_MIN_RATED_GB => CURATED_MEDIUM,
+        _ => CURATED_SMALL,
+    }
+}
+
+fn build(
+    gpu_name: Option<String>,
+    bytes: u64,
+    models: Vec<RemoteCatalogModel>,
+    installed: impl Fn(&str) -> bool,
+) -> Catalog {
+    let recommendation = recommendation_for_memory(bytes);
+    let mut entries: Vec<Entry> = models
+        .iter()
+        .filter(|model| {
+            !models
+                .iter()
+                .any(|other| other.draft.as_deref() == Some(model.name.as_str()))
+                || model.draft.is_some()
+        })
+        .map(|model| {
+            // Curated choices preserve the donor's ingress refs; other choices use exact SDK refs.
+            let curated = [CURATED_SMALL, CURATED_MEDIUM, CURATED_LARGE]
+                .into_iter()
+                .find(|reference| {
+                    reference.split_once(':').is_some_and(|(repo, quant)| {
+                        model.repo == repo && exact_quant(&model.source_file, quant)
+                    })
+                });
+            let reference = curated
+                .map(str::to_owned)
+                .unwrap_or_else(|| model.exact_ref());
+            Entry {
+                installed: installed(&reference),
+                model: reference,
+                name: model.name.clone(),
+                size: model.size.clone(),
+                description: model.description.clone(),
+                curated: curated.is_some(),
+                fit: fit(model.size.as_deref(), bytes as f64 / 1e9),
+            }
+        })
+        .collect();
+    // Curated GGUF refs are resolved by Mesh at serving time, independently of
+    // whether its remote layer-package catalog happens to list that quant.
+    for reference in [CURATED_LARGE, CURATED_MEDIUM, CURATED_SMALL] {
+        if !entries.iter().any(|entry| entry.model == reference) {
+            entries.push(Entry {
+                model: reference.into(),
+                name: reference.into(),
+                size: None,
+                description: None,
+                installed: installed(reference),
+                curated: true,
+                fit: "unknown",
+            });
+        }
+    }
+    let recommended = Some(recommendation.to_owned());
+    entries.sort_by(|a, b| {
+        (Some(&b.model) == recommended.as_ref())
+            .cmp(&(Some(&a.model) == recommended.as_ref()))
+            .then(b.curated.cmp(&a.curated))
+            .then(fit_rank(a.fit).cmp(&fit_rank(b.fit)))
+            .then(a.name.cmp(&b.name))
+    });
+    Catalog {
+        gpu_name,
+        vram_display: vram::format_rated_capacity(bytes),
+        recommended,
+        entries,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn quantization_matches_do_not_confuse_dynamic_and_standard_files() {
+        assert!(exact_quant("model-Q4_K_M.gguf", "Q4_K_M"));
+        assert!(!exact_quant("model-UD-Q4_K_M.gguf", "Q4_K_M"));
+        assert!(exact_quant("model-UD-Q4_K_XL.gguf", "UD-Q4_K_XL"));
+        assert!(!exact_quant("model-Q4_K_M_EXTRA.gguf", "Q4_K_M"));
+    }
+    #[test]
+    fn aliases_keep_the_donor_ingress_contract() {
+        assert_eq!(
+            canonical_curated_model_id("Gemma-4-E4B-it-Q4_K_M"),
+            CURATED_SMALL
+        );
+        assert_eq!(
+            canonical_curated_model_id("Qwen3.5-9B-Vision-Q4_K_M"),
+            CURATED_MEDIUM
+        );
+        assert_eq!(
+            canonical_curated_model_id("Qwen3.8-27B-Q4_K_M"),
+            "unsloth/Qwen3.8-27B-GGUF:Q4_K_M"
+        );
+        assert_eq!(
+            canonical_curated_model_id("gemma-4-26B-A4B-it-UD-Q4_K_M"),
+            "unsloth/gemma-4-26B-A4B-it-GGUF:UD-Q4_K_M"
+        );
+        assert_eq!(canonical_curated_model_id(" custom-model "), "custom-model");
+    }
+    #[test]
+    fn fit_preserves_donor_thresholds_and_unknown_is_not_a_fit() {
+        assert_eq!(fit(Some("10GB"), 20.0), "comfortable");
+        assert_eq!(fit(Some("10GB"), 12.0), "tight");
+        assert_eq!(fit(Some("10GB"), 10.0), "tradeoff");
+        assert_eq!(fit(Some("10GB"), 8.0), "too_large");
+        assert_eq!(fit(None, 96.0), "unknown");
+        assert_eq!(fit(Some("10GB"), 0.0), "unknown");
+    }
+    fn model(repo: &str, name: &str, size: &str) -> RemoteCatalogModel {
+        RemoteCatalogModel {
+            repo: repo.into(),
+            name: name.into(),
+            file: "weights-Q4_K_M.gguf".into(),
+            source_file: "weights-Q4_K_M.gguf".into(),
+            revision: None,
+            size: Some(size.into()),
+            description: None,
+            draft: None,
+            extra_files: vec![],
+            mmproj: None,
+        }
+    }
+    #[test]
+    fn ladder_is_catalog_backed_and_keeps_exact_ids_installation_and_draft_policy() {
+        let mut large = model("unsloth/Qwen3.8-27B-GGUF", "large", "17GB");
+        large.source_file = "weights-UD-Q4_K_M.gguf".into();
+        large.file = large.source_file.clone();
+        large.draft = Some("draft".into());
+        let models = vec![
+            large,
+            model("unsloth/Qwen3.5-9B-GGUF", "medium", "6GB"),
+            model("unsloth/gemma-4-E4B-it-GGUF", "small", "3GB"),
+            model("fixture/draft", "draft", "1GB"),
+        ];
+        for (bytes, recommended) in [
+            (24_000_000_000, CURATED_SMALL),
+            (32_000_000_000, CURATED_MEDIUM),
+            (64_000_000_000, CURATED_LARGE),
+            (96_000_000_000, CURATED_LARGE),
+        ] {
+            let catalog = build(None, bytes, models.clone(), |m| m == CURATED_SMALL);
+            assert_eq!(catalog.recommended.as_deref(), Some(recommended));
+            assert_eq!(catalog.entries[0].model, recommended);
+            assert_eq!(catalog.entries.len(), 3);
+            assert!(
+                catalog
+                    .entries
+                    .iter()
+                    .find(|e| e.model == CURATED_SMALL)
+                    .unwrap()
+                    .installed
+            );
+        }
+        assert_eq!(
+            build(None, 0, vec![], |_| false).recommended.as_deref(),
+            Some(CURATED_SMALL)
+        );
+    }
+    #[test]
+    fn missing_layer_catalog_entry_does_not_change_the_gguf_ladder() {
+        let catalog = build(
+            None,
+            128_000_000_000,
+            vec![{
+                let mut xl = model("unsloth/Qwen3.8-27B-GGUF", "large XL", "17GB");
+                xl.source_file = "Qwen3.8-27B-UD-Q4_K_XL.gguf".into();
+                xl.file = xl.source_file.clone();
+                xl
+            }],
+            |reference| reference == CURATED_LARGE,
+        );
+        assert_eq!(catalog.recommended.as_deref(), Some(CURATED_LARGE));
+        let recommended = &catalog.entries[0];
+        assert_eq!(recommended.model, "unsloth/Qwen3.8-27B-GGUF:UD-Q4_K_M");
+        assert!(recommended.installed);
+        assert!(recommended.size.is_none());
+        assert_eq!(recommended.fit, "unknown");
+    }
+}
+
+#[cfg(test)]
+mod auto_tests {
+    use super::*;
+    #[test]
+    fn auto_follows_the_hardware_ladder_without_catalog_or_cache_fallback() {
+        assert_eq!(
+            recommendation_for_memory(16 * 1024 * 1024 * 1024),
+            CURATED_SMALL
+        );
+        assert_eq!(
+            recommendation_for_memory(32 * 1024 * 1024 * 1024),
+            CURATED_MEDIUM
+        );
+        assert_eq!(
+            recommendation_for_memory(128 * 1024 * 1024 * 1024),
+            CURATED_LARGE
+        );
+    }
+}
diff --git a/crates/mesh-compute/src/config.rs b/crates/mesh-compute/src/config.rs
new file mode 100644
index 000000000..0a7d8e148
--- /dev/null
+++ b/crates/mesh-compute/src/config.rs
@@ -0,0 +1,277 @@
+//! Host-only startup configuration. Never deserialize admission policy from plugin input.
+
+use crate::transport_policy::{
+    iroh_relay_mode, sdk_iroh_relay_config, validate_advertised_endpoint,
+};
+use mesh_llm_sdk::{client, MeshDiscoveryMode, TrustPolicy};
+use std::path::PathBuf;
+use std::time::Duration;
+
+/// A consumer starts closed and learns dial targets through verified host discovery.
+/// Serving reuses these host-owned transport and admission settings.
+pub struct ClientConfig {
+    pub api_port: u16,
+    pub console_port: u16,
+    pub owner_key: PathBuf,
+    pub trusted_owners: Vec<String>,
+    pub owner_id: String,
+    pub join_token: Option<String>,
+    pub mesh_name: Option<String>,
+}
+
+impl ClientConfig {
+    pub fn build(self) -> anyhow::Result<client::EmbeddedClientConfig> {
+        if self.api_port == 0 || self.console_port == 0 || self.api_port == self.console_port {
+            anyhow::bail!("Mesh needs two distinct non-zero ports");
+        }
+        if !self.owner_key.is_absolute() {
+            anyhow::bail!("Mesh owner keystore path must be absolute");
+        }
+        // Empty/unknown membership must not silently become TrustPolicy::Off.
+        if self.trusted_owners.is_empty()
+            || self
+                .trusted_owners
+                .iter()
+                .any(|owner| owner.trim().is_empty())
+        {
+            anyhow::bail!("Verified Mesh owner admission is required");
+        }
+        if self.owner_id.trim().is_empty() {
+            anyhow::bail!("Mesh owner identity is required");
+        }
+        let owners = normalized_roster(&Some(self.trusted_owners), &self.owner_id)
+            .expect("roster supplied above");
+        let (disabled, relays) = sdk_iroh_relay_config(iroh_relay_mode()?);
+        let mut builder = client::EmbeddedClientConfig::builder()
+            .api_port(self.api_port)
+            .console_port(self.console_port)
+            .owner_key(self.owner_key)
+            .owner_required(true)
+            .trust_policy(TrustPolicy::Allowlist)
+            .trust_owners(owners)
+            .disable_iroh_relays(disabled)
+            .iroh_relays(relays)
+            .publish(false)
+            .auto_join(false)
+            .discovery_mode(MeshDiscoveryMode::Nostr)
+            .nostr_relays(Vec::<String>::new())
+            .isolated_config(true)
+            .console_ui(false)
+            .startup_timeout(MESH_CLIENT_MANAGEMENT_TIMEOUT);
+        if let Some(name) = self.mesh_name {
+            builder = builder.mesh_name(name);
+        }
+        if let Some(token) = self.join_token {
+            builder = builder.join_token(validate_advertised_endpoint(&token)?.join_token);
+        }
+        Ok(builder.build())
+    }
+}
+
+/// Classic serving role on the same private community node, including solo serving.
+pub struct ServeConfig {
+    pub node: ClientConfig,
+    pub model: String,
+    pub max_vram_gb: Option<u64>,
+}
+impl ServeConfig {
+    pub fn build(self) -> anyhow::Result<mesh_llm_sdk::serve::EmbeddedServeConfig> {
+        let model = self.model.trim();
+        if model.is_empty() {
+            anyhow::bail!("Choose a model before sharing compute");
+        }
+        if self.max_vram_gb == Some(0) {
+            anyhow::bail!("Shared compute memory limit must be positive");
+        }
+        let node = self.node.build()?;
+        let mut config = mesh_llm_sdk::serve::EmbeddedServeConfig::builder()
+            .model(model)
+            .build();
+        config.http = node.http;
+        config.network = node.network;
+        config.admission = node.admission;
+        config.storage = node.storage;
+        config.log_format = node.log_format;
+        // Bounds SDK management readiness; Mesh owns subsequent model acquisition.
+        config.startup_timeout = Duration::from_secs(180);
+        config.serving.max_vram_gb = self.max_vram_gb.map(|gb| gb as f64);
+        Ok(config)
+    }
+}
+
+// Legacy management wait is deliberately longer than the ingress readiness deadline.
+const MESH_CLIENT_MANAGEMENT_TIMEOUT: Duration = Duration::from_secs(365 * 24 * 60 * 60);
+
+// Ported from legacy normalized_roster; only the identity argument is narrowed to its ID.
+fn normalized_roster(
+    trusted_owner_ids: &Option<Vec<String>>,
+    owner_id: &str,
+) -> Option<Vec<String>> {
+    let ids = trusted_owner_ids.as_ref()?;
+    let mut owners: Vec<String> = ids
+        .iter()
+        .map(|id| id.trim().to_string())
+        .filter(|id| !id.is_empty())
+        .collect();
+    owners.push(owner_id.to_owned());
+    owners.sort();
+    owners.dedup();
+    Some(owners)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn config() -> ClientConfig {
+        ClientConfig {
+            api_port: 19337,
+            console_port: 13131,
+            owner_key: std::env::temp_dir().join("buzz-mesh-test-owner.json"),
+            trusted_owners: vec!["fixture-owner".into()],
+            owner_id: "self-owner".into(),
+            join_token: None,
+            mesh_name: Some("fixture-community".into()),
+        }
+    }
+
+    #[test]
+    fn solo_serving_has_no_remote_target_and_keeps_private_self_admission() {
+        let mut node = config();
+        node.trusted_owners = vec![node.owner_id.clone()];
+        let result = ServeConfig {
+            node,
+            model: " fixture-model ".into(),
+            max_vram_gb: Some(16),
+        }
+        .build()
+        .unwrap();
+        assert_eq!(result.serving.models, vec!["fixture-model"]);
+        assert_eq!(result.serving.max_vram_gb, Some(16.0));
+        assert_eq!(result.startup_timeout, Duration::from_secs(180));
+        assert!(result.network.join_tokens.is_empty());
+        assert!(!result.network.publish);
+        assert!(!result.network.auto_join);
+        assert!(result.network.nostr_relays.is_empty());
+        assert_eq!(result.admission.trust_policy, Some(TrustPolicy::Allowlist));
+        assert!(result.admission.owner_required);
+        assert_eq!(result.admission.trusted_owners, vec!["self-owner"]);
+        assert!(result.storage.isolated_config);
+    }
+
+    #[test]
+    fn serving_rejects_missing_model_invalid_limit_and_missing_roster() {
+        assert!(ServeConfig {
+            node: config(),
+            model: "  ".into(),
+            max_vram_gb: None
+        }
+        .build()
+        .is_err());
+        assert!(ServeConfig {
+            node: config(),
+            model: "model".into(),
+            max_vram_gb: Some(0)
+        }
+        .build()
+        .is_err());
+        let mut node = config();
+        node.trusted_owners.clear();
+        assert!(ServeConfig {
+            node,
+            model: "model".into(),
+            max_vram_gb: None
+        }
+        .build()
+        .is_err());
+    }
+
+    #[test]
+    fn client_is_private_and_uses_explicit_owner_path() {
+        let expected_path = config().owner_key;
+        let result = config().build().unwrap();
+        assert!(!result.network.publish);
+        assert!(!result.network.auto_join);
+        assert!(result.network.nostr_relays.is_empty());
+        assert!(result.network.join_tokens.is_empty());
+        assert!(result.storage.isolated_config);
+        assert_eq!(result.admission.owner_key, Some(expected_path));
+        assert!(result.admission.owner_required);
+        assert_eq!(
+            result.network.mesh_name.as_deref(),
+            Some("fixture-community")
+        );
+        assert_eq!(result.startup_timeout, MESH_CLIENT_MANAGEMENT_TIMEOUT);
+        assert_eq!(
+            result.admission.trusted_owners,
+            vec!["fixture-owner", "self-owner"]
+        );
+        assert_eq!(result.admission.trust_policy, Some(TrustPolicy::Allowlist));
+    }
+
+    #[test]
+    fn normalizes_roster_without_losing_self() {
+        assert_eq!(normalized_roster(&None, "self"), None);
+        assert_eq!(
+            normalized_roster(
+                &Some(vec![" peer ".into(), "peer".into(), "".into()]),
+                "self"
+            ),
+            Some(vec!["peer".into(), "self".into()])
+        );
+    }
+
+    #[test]
+    fn accepts_validated_initial_dial_target() {
+        let mut request = config();
+        let token = crate::transport_policy::endpoint_token_for_test([iroh::TransportAddr::Ip(
+            "192.168.1.20:47916".parse().unwrap(),
+        )]);
+        request.join_token = Some(token.clone());
+        assert_eq!(request.build().unwrap().network.join_tokens, vec![token]);
+        let mut request = config();
+        request.join_token = Some("invalid".into());
+        assert!(request.build().is_err());
+    }
+
+    #[test]
+    fn rejects_missing_admission_and_invalid_ports_or_paths() {
+        let mut request = config();
+        request.trusted_owners.clear();
+        assert!(request.build().is_err());
+        let mut request = config();
+        request.console_port = request.api_port;
+        assert!(request.build().is_err());
+        let mut request = config();
+        request.api_port = 0;
+        assert!(request.build().is_err());
+        let mut request = config();
+        request.owner_key = "relative.json".into();
+        assert!(request.build().is_err());
+    }
+}
+
+/// Legacy community name derivation: hash the relay URL origin, preserving its scheme.
+pub fn mesh_name_for_relay(relay_url: &str) -> String {
+    use sha2::{Digest, Sha256};
+    let normalized = url::Url::parse(relay_url.trim())
+        .map(|url| url.origin().ascii_serialization())
+        .unwrap_or_else(|_| relay_url.trim().trim_end_matches('/').to_ascii_lowercase());
+    let digest = hex::encode(Sha256::digest(normalized.as_bytes()));
+    format!("buzz-community-{}", &digest[..32])
+}
+
+#[cfg(test)]
+mod mesh_name_tests {
+    #[test]
+    fn matches_legacy_fixture_origin_hash() {
+        assert_eq!(
+            super::mesh_name_for_relay("wss://meshllm.communities.buzz.xyz/"),
+            "buzz-community-d91dbf16b4343b6383e4ff067f7d9ecc"
+        );
+        assert_eq!(
+            super::mesh_name_for_relay("wss://meshllm.communities.buzz.xyz/path"),
+            super::mesh_name_for_relay("wss://meshllm.communities.buzz.xyz")
+        );
+    }
+}
diff --git a/crates/mesh-compute/src/discovery.rs b/crates/mesh-compute/src/discovery.rs
new file mode 100644
index 000000000..d11025d79
--- /dev/null
+++ b/crates/mesh-compute/src/discovery.rs
@@ -0,0 +1,448 @@
+//! Legacy discovery readers ported from block/buzz 5fdb2e536.
+//! Callers must validate signed events and relay membership authority first.
+use std::collections::{BTreeMap, BTreeSet};
+
+use ed25519_dalek::{Signature, Verifier, VerifyingKey};
+use sha2::{Digest, Sha256};
+
+use super::discovery_types::{
+    dedupe_models, MeshAvailability, MeshModelOption, MeshServeTarget, MESH_STATUS_KIND,
+};
+
+/// Running-node status notes are refreshed every 45 seconds. Routing ignores
+/// notes older than two minutes so crashed/offline devices stop contributing
+/// compute without a relay-side cleanup job. Admission intentionally does not:
+/// Buzz membership, rather than device liveness, is the trust boundary.
+pub(super) const STATUS_FRESHNESS_SECS: u64 = 120;
+pub const MESH_STATUS_PAGE_SIZE: usize = 100;
+
+fn status_is_fresh(event: &nostr::event::Event, now: u64) -> bool {
+    event
+        .created_at
+        .as_secs()
+        .saturating_add(STATUS_FRESHNESS_SECS)
+        >= now
+}
+
+fn dedupe_targets(targets: Vec<MeshServeTarget>) -> Vec<MeshServeTarget> {
+    let mut by_endpoint_and_model = BTreeMap::<(String, String), MeshServeTarget>::new();
+    for target in targets {
+        by_endpoint_and_model
+            .entry((target.endpoint_addr.clone(), target.model_id.clone()))
+            .or_insert(target);
+    }
+    by_endpoint_and_model.into_values().collect()
+}
+
+/// Resolve the mesh admission roster from relay status and membership events.
+///
+/// Only status notes signed by a currently listed NIP-43 direct member
+/// contribute an owner id. This removes stale notes from former members and
+/// ignores notes from nonmembers. If the relay has no membership snapshot, the
+/// roster is empty and MeshLLM admission therefore remains self-only.
+///
+/// Admission deliberately ignores status freshness: membership is the trust
+/// boundary, and a member whose device is offline (stale status) is still a
+/// member. Gating admission on freshness caused the allowlist — and therefore
+/// the serving node — to churn whenever any member's app went online or
+/// offline. Freshness still gates *routing* (see `availability_from_events`):
+/// stale nodes are never selected as serve targets. Revocation is unaffected:
+/// a member removed from the NIP-43 roster leaves the intersection at the next
+/// roster poll regardless of how fresh their last status is.
+pub fn owner_ids_from_events(events: &[nostr::event::Event]) -> Vec<String> {
+    let Some(members) = latest_membership_list(events) else {
+        return Vec::new();
+    };
+    let mut ids: Vec<String> = events
+        .iter()
+        .filter(|event| event.kind.as_u16() as u64 == MESH_STATUS_KIND)
+        .filter(|event| {
+            reporter_pubkey_from_status_event(event)
+                .is_some_and(|reporter| members.contains(&reporter.to_ascii_lowercase()))
+        })
+        .filter_map(owner_id_from_status_event)
+        .collect();
+    ids.sort();
+    ids.dedup();
+    ids
+}
+
+fn latest_membership_list(events: &[nostr::event::Event]) -> Option<BTreeSet<String>> {
+    events
+        .iter()
+        .filter(|event| event.kind.as_u16() == 13_534)
+        .max_by_key(|event| event.created_at)
+        .map(|event| {
+            event
+                .tags
+                .iter()
+                .filter_map(|tag| {
+                    let slice = tag.as_slice();
+                    let name = slice.first()?;
+                    if name != "member" && name != "p" {
+                        return None;
+                    }
+                    slice
+                        .get(1)
+                        .map(|pubkey| pubkey.trim().to_ascii_lowercase())
+                })
+                .filter(|pubkey| !pubkey.is_empty())
+                .collect()
+        })
+}
+
+/// Join tokens for other machines only. This machine's own advert (same Mesh
+/// owner) can outlive its runtime by a heartbeat, and joining it makes the SDK
+/// reject the token as its own node id and retry forever.
+pub fn peer_join_tokens(targets: Vec<MeshServeTarget>, own_owner: &str) -> Vec<String> {
+    targets
+        .into_iter()
+        .filter(|target| target.owner_id.as_deref() != Some(own_owner))
+        .map(|target| target.endpoint_addr)
+        .collect()
+}
+
+pub fn current_member_pubkeys(events: &[nostr::event::Event]) -> Vec<String> {
+    latest_membership_list(events)
+        .map(BTreeSet::into_iter)
+        .map(Iterator::collect)
+        .unwrap_or_default()
+}
+
+/// Whether the relay actually returned a NIP-43 membership snapshot (kind
+/// 13534) in `events`.
+///
+/// The relay publishes an explicit membership event even for a zero-member
+/// community, so its presence is what makes an empty roster *authoritative*.
+/// Callers use this to distinguish "the community genuinely has no members"
+/// (snapshot present, zero `member` tags) from "no snapshot came back at all"
+/// (a transient relay gap / replication lag). Only the former may shrink the
+/// admission roster; the latter must be surfaced as an error so the reconcile
+/// loop keeps the current allowlist instead of restarting to self-only.
+pub fn has_membership_snapshot(events: &[nostr::event::Event]) -> bool {
+    events.iter().any(|event| event.kind.as_u16() == 13_534)
+}
+
+fn owner_id_from_status_event(event: &nostr::event::Event) -> Option<String> {
+    let content = serde_json::from_str::<serde_json::Value>(&event.content).ok()?;
+    let owner_id = content
+        .get("ownerId")
+        .or_else(|| content.get("owner_id"))?
+        .as_str()?
+        .trim();
+    let verifying_key_bytes: [u8; 32] =
+        hex::decode(content.get("ownerVerifyingKey")?.as_str()?.trim())
+            .ok()?
+            .try_into()
+            .ok()?;
+    let derived_owner = hex::encode(Sha256::digest(verifying_key_bytes));
+    if owner_id != derived_owner {
+        return None;
+    }
+    let signature_bytes = hex::decode(content.get("ownerBindingSig")?.as_str()?.trim()).ok()?;
+    let signature = Signature::from_slice(&signature_bytes).ok()?;
+    let verifying_key = VerifyingKey::from_bytes(&verifying_key_bytes).ok()?;
+    verifying_key
+        .verify(
+            &super::identity::member_binding_bytes(&event.pubkey.to_hex()),
+            &signature,
+        )
+        .ok()?;
+    Some(owner_id.to_string())
+}
+
+fn endpoint_binding_is_valid(event: &nostr::event::Event, content: &serde_json::Value) -> bool {
+    let Some(endpoint_tokens) = super::identity::advertised_endpoint_tokens(content) else {
+        return false;
+    };
+    let Some(verifying_key_bytes) = content
+        .get("ownerVerifyingKey")
+        .and_then(serde_json::Value::as_str)
+        .map(str::trim)
+        .and_then(|value| hex::decode(value).ok())
+        .and_then(|value| <[u8; 32]>::try_from(value).ok())
+    else {
+        return false;
+    };
+    let Some(signature) = content
+        .get("ownerEndpointBindingSig")
+        .and_then(serde_json::Value::as_str)
+        .map(str::trim)
+        .and_then(|value| hex::decode(value).ok())
+        .and_then(|value| Signature::from_slice(&value).ok())
+    else {
+        return false;
+    };
+    let Ok(verifying_key) = VerifyingKey::from_bytes(&verifying_key_bytes) else {
+        return false;
+    };
+    verifying_key
+        .verify(
+            &super::identity::member_endpoint_binding_bytes(
+                &event.pubkey.to_hex(),
+                &endpoint_tokens,
+            ),
+            &signature,
+        )
+        .is_ok()
+}
+
+pub fn availability_from_events(events: Vec<nostr::event::Event>) -> MeshAvailability {
+    if events.is_empty() {
+        return MeshAvailability::unavailable("Buzz shared compute status is not published yet");
+    }
+    let Some(members) = latest_membership_list(&events) else {
+        return MeshAvailability::unavailable(
+            "Buzz shared compute is waiting for the current member roster",
+        );
+    };
+
+    // Status is replaceable per member pubkey, so a query returns multiple
+    // events. Aggregate only current members: a removed member's last status
+    // must not remain selectable after their admission is revoked.
+    let mut all_targets = Vec::<MeshServeTarget>::new();
+    let mut all_models = Vec::<MeshModelOption>::new();
+    let mut saw_valid_status = false;
+
+    let now = nostr::types::time::Timestamp::now().as_secs();
+    for event in events {
+        if event.kind.as_u16() as u64 != MESH_STATUS_KIND
+            || !status_is_fresh(&event, now)
+            || !members.contains(&event.pubkey.to_hex().to_ascii_lowercase())
+        {
+            continue;
+        }
+        let Ok(content) = serde_json::from_str::<serde_json::Value>(&event.content) else {
+            continue;
+        };
+        let Some(owner_id) = owner_id_from_status_event(&event) else {
+            continue;
+        };
+        if !endpoint_binding_is_valid(&event, &content) {
+            continue;
+        }
+        saw_valid_status = true;
+        let reporter_pubkey = event.pubkey.to_hex().to_ascii_lowercase();
+        let mut serve_targets = content
+            .get("serveTargets")
+            .or_else(|| content.get("serve_targets"))
+            .cloned()
+            .and_then(|value| serde_json::from_value::<Vec<MeshServeTarget>>(value).ok())
+            .unwrap_or_default()
+            .into_iter()
+            .filter_map(|mut target| {
+                let validated =
+                    super::transport_policy::validate_advertised_endpoint(&target.endpoint_addr)
+                        .ok()?;
+                target.endpoint_addr = validated.join_token;
+                target.reporter_pubkey = Some(reporter_pubkey.clone());
+                target.owner_id = Some(owner_id.clone());
+                if target.endpoint_id.is_none() {
+                    target.endpoint_id = Some(validated.endpoint_id);
+                }
+                if target.device_id.is_none() {
+                    target.device_id = target.endpoint_id.clone();
+                }
+                if target.device_name.is_none() {
+                    target.device_name = target
+                        .node_name
+                        .clone()
+                        .or_else(|| target.endpoint_id.as_deref().map(short_endpoint_label));
+                }
+                Some(target)
+            })
+            .collect::<Vec<_>>();
+
+        let mut models = content
+            .get("models")
+            .cloned()
+            .and_then(|value| serde_json::from_value::<Vec<MeshModelOption>>(value).ok())
+            .unwrap_or_else(|| {
+                dedupe_models(
+                    serve_targets
+                        .iter()
+                        .map(|target| MeshModelOption {
+                            id: target.model_id.clone(),
+                            name: target.model_name.clone(),
+                        })
+                        .collect(),
+                )
+            });
+        all_targets.append(&mut serve_targets);
+        all_models.append(&mut models);
+    }
+
+    if !saw_valid_status {
+        return MeshAvailability::unavailable("Buzz shared compute status is malformed");
+    }
+
+    let serve_targets = dedupe_targets(all_targets);
+    let models = dedupe_models(all_models);
+    let available = !serve_targets.is_empty();
+    MeshAvailability {
+        state: if available {
+            crate::discovery_types::AvailabilityState::Available
+        } else {
+            crate::discovery_types::AvailabilityState::Empty
+        },
+        reason: if available {
+            None
+        } else {
+            Some("no Buzz shared compute serving members are available".to_string())
+        },
+        models,
+        serve_targets,
+    }
+}
+
+/// Status filter for admission and availability queries.
+///
+/// Deliberately has no `since` bound: status events are parameterized
+/// replaceable (one per member), and admission must see a member's latest
+/// owner binding even when that member has been offline for longer than
+/// [`STATUS_FRESHNESS_SECS`]. Freshness is applied *after* the query, and only
+/// where it belongs — routing (`availability_from_events`), never admission
+/// (`owner_ids_from_events`).
+pub fn mesh_status_filter() -> serde_json::Value {
+    serde_json::json!({
+        "kinds": [MESH_STATUS_KIND],
+        "#k": ["buzz-mesh-status"],
+        "limit": MESH_STATUS_PAGE_SIZE
+    })
+}
+
+pub fn relay_membership_filter() -> serde_json::Value {
+    serde_json::json!({
+        "kinds": [13534],
+        "limit": 1
+    })
+}
+
+fn reporter_pubkey_from_status_event(event: &nostr::event::Event) -> Option<String> {
+    // Discovery notes are signed by the member that owns the MeshLLM identity.
+    // The generic relay only stores/queries them; it is not an identity oracle.
+    Some(event.pubkey.to_hex())
+}
+
+fn short_endpoint_label(endpoint_id: &str) -> String {
+    endpoint_id.chars().take(12).collect()
+}
+
+/// Keep independently verified records; a bad member note cannot veto the community.
+/// The authority is obtained by the host from this community's NIP-11 `self`.
+pub fn verify_evidence(
+    events: Vec<nostr::event::Event>,
+    authority: &nostr::key::PublicKey,
+) -> anyhow::Result<Vec<nostr::event::Event>> {
+    let events: Vec<_> = events
+        .into_iter()
+        .filter(|event| {
+            let expected = match event.kind.as_u16() {
+                13534 => &event.pubkey == authority,
+                30003 => {
+                    event.tags.iter().any(|tag| {
+                        let values = tag.as_slice();
+                        values.first().map(String::as_str) == Some("k")
+                            && values.get(1).map(String::as_str) == Some("buzz-mesh-status")
+                    }) && serde_json::from_str::<serde_json::Value>(&event.content)
+                        .is_ok_and(|value| value.is_object())
+                }
+                _ => false,
+            };
+            let accepted = expected && event.verify().is_ok();
+            if !accepted {
+                // Never echo member-controlled content, credentials or dial tokens.
+                eprintln!(
+                    "Mesh discovery discarded event {}: invalid signature, shape or authority",
+                    event.id
+                );
+            }
+            accepted
+        })
+        .collect();
+    if !has_membership_snapshot(&events) {
+        anyhow::bail!("Relay returned no verified membership snapshot from its authority");
+    }
+    Ok(events)
+}
+
+/// Only the captured relay authority may supply membership, never member notes.
+pub fn authoritative_membership_filter(authority: &nostr::key::PublicKey) -> serde_json::Value {
+    let mut filter = relay_membership_filter();
+    filter["authors"] = serde_json::json!([authority.to_hex()]);
+    filter
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use nostr::{
+        event::{EventBuilder, FinalizeEvent},
+        key::Keys,
+    };
+
+    #[test]
+    fn rejects_missing_wrong_author_and_corrupt_membership() {
+        let keys = Keys::generate();
+        let other = Keys::generate();
+        let event = EventBuilder::new(nostr::event::Kind::Custom(13534), "")
+            .finalize(&keys)
+            .unwrap();
+        assert!(verify_evidence(vec![], &keys.public_key()).is_err());
+        assert!(verify_evidence(vec![event.clone()], &other.public_key()).is_err());
+        assert!(verify_evidence(vec![event.clone()], &keys.public_key()).is_ok());
+        let mut corrupt = event;
+        corrupt.content = "tampered".into();
+        assert!(verify_evidence(vec![corrupt], &keys.public_key()).is_err());
+    }
+    #[test]
+    fn bad_member_notes_do_not_hide_a_valid_target() {
+        use mesh_llm_host_runtime::crypto::OwnerKeypair;
+        use nostr::event::{Kind, Tag};
+        let relay = Keys::generate();
+        let member = Keys::generate();
+        let attacker = Keys::generate();
+        let owner = OwnerKeypair::generate();
+        let token = crate::transport_policy::endpoint_token_for_test([iroh::TransportAddr::Ip(
+            "192.168.1.20:47916".parse().unwrap(),
+        )]);
+        let content = serde_json::json!({
+            "ownerId": owner.owner_id(),
+            "ownerVerifyingKey": hex::encode(owner.verifying_key().as_bytes()),
+            "ownerBindingSig": hex::encode(owner.sign_bytes(&crate::identity::member_binding_bytes(&member.public_key().to_hex()))),
+            "ownerEndpointBindingSig": hex::encode(owner.sign_bytes(&crate::identity::member_endpoint_binding_bytes(&member.public_key().to_hex(), std::slice::from_ref(&token)))),
+            "serveTargets": [{"modelId":"fixture", "endpointAddr":token}]
+        });
+        let roster = EventBuilder::new(Kind::Custom(13534), "")
+            .tags([Tag::parse(["member", &member.public_key().to_hex()]).unwrap()])
+            .finalize(&relay)
+            .unwrap();
+        let status = EventBuilder::new(Kind::Custom(30003), content.to_string())
+            .tags([Tag::parse(["k", "buzz-mesh-status"]).unwrap()])
+            .finalize(&member)
+            .unwrap();
+        let mut tampered = status.clone();
+        tampered.content = "tampered".into();
+        let foreign_roster = EventBuilder::new(Kind::Custom(13534), "")
+            .finalize(&attacker)
+            .unwrap();
+        let verified = verify_evidence(
+            vec![roster, status, tampered, foreign_roster],
+            &relay.public_key(),
+        )
+        .unwrap();
+        assert_eq!(verified.len(), 2);
+        assert_eq!(owner_ids_from_events(&verified), vec![owner.owner_id()]);
+        let available = availability_from_events(verified);
+        assert_eq!(available.serve_targets.len(), 1);
+        assert_eq!(available.serve_targets[0].model_id, "fixture");
+        assert_eq!(
+            authoritative_membership_filter(&relay.public_key())["authors"],
+            serde_json::json!([relay.public_key().to_hex()])
+        );
+    }
+}
+
+#[cfg(test)]
+#[path = "discovery_regression_tests.rs"]
+mod regression_tests;
diff --git a/crates/mesh-compute/src/discovery_query.rs b/crates/mesh-compute/src/discovery_query.rs
new file mode 100644
index 000000000..61e66a166
--- /dev/null
+++ b/crates/mesh-compute/src/discovery_query.rs
@@ -0,0 +1,139 @@
+//! Bounded legacy discovery pagination; network and signing remain host-owned.
+use crate::discovery::{
+    authoritative_membership_filter, current_member_pubkeys, mesh_status_filter, verify_evidence,
+    MESH_STATUS_PAGE_SIZE,
+};
+use nostr::{event::Event, key::PublicKey};
+use serde_json::Value;
+use std::future::Future;
+
+const MAX_STATUS_PAGES: usize = 100;
+
+pub async fn discover<F, Fut>(authority: &PublicKey, mut query: F) -> anyhow::Result<Vec<Event>>
+where
+    F: FnMut(Value) -> Fut,
+    Fut: Future<Output = anyhow::Result<Vec<Value>>>,
+{
+    let roster = query(authoritative_membership_filter(authority)).await?;
+    let mut events = verify_evidence(parse_events(roster), authority)?;
+    let members = current_member_pubkeys(&events);
+    if members.is_empty() {
+        return Ok(events);
+    }
+    let mut filter = mesh_status_filter();
+    filter["authors"] = serde_json::json!(members);
+    let mut previous_cursor = None;
+    for _ in 0..MAX_STATUS_PAGES {
+        let page = query(filter.clone()).await?;
+        if page.len() > MESH_STATUS_PAGE_SIZE {
+            anyhow::bail!("Oversized Mesh status page");
+        }
+        let done = page.len() < MESH_STATUS_PAGE_SIZE;
+        if !done {
+            let last = page
+                .last()
+                .ok_or_else(|| anyhow::anyhow!("Empty Mesh status page"))?;
+            let timestamp = last
+                .get("created_at")
+                .and_then(Value::as_u64)
+                .ok_or_else(|| anyhow::anyhow!("Malformed Mesh pagination cursor"))?;
+            let id = last
+                .get("id")
+                .and_then(Value::as_str)
+                .filter(|id| id.len() == 64 && id.bytes().all(|b| b.is_ascii_hexdigit()))
+                .ok_or_else(|| anyhow::anyhow!("Malformed Mesh pagination cursor"))?;
+            let cursor = (timestamp, id.to_owned());
+            filter["until"] = serde_json::json!(cursor.0);
+            filter["before_id"] = serde_json::json!(cursor.1);
+            if previous_cursor.as_ref() == Some(&cursor) {
+                anyhow::bail!("Mesh status pagination did not advance");
+            }
+            previous_cursor = Some(cursor);
+        }
+        // A status page must never introduce a second membership snapshot.
+        events.extend(
+            parse_events(page)
+                .into_iter()
+                .filter(|event| event.kind.as_u16() != 13534),
+        );
+        if done {
+            return verify_evidence(events, authority);
+        }
+    }
+    anyhow::bail!("Mesh status pagination exceeded its page limit")
+}
+
+fn parse_events(page: Vec<Value>) -> Vec<Event> {
+    page.into_iter()
+        .filter_map(|value| match serde_json::from_value(value) {
+            Ok(event) => Some(event),
+            Err(_) => {
+                eprintln!("Mesh discovery dropped malformed event envelope");
+                None
+            }
+        })
+        .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use nostr::{
+        event::{EventBuilder, FinalizeEvent, Kind, Tag},
+        key::Keys,
+    };
+    #[tokio::test]
+    async fn reads_more_than_one_hundred_statuses_with_legacy_cursor() {
+        let relay = Keys::generate();
+        let member = Keys::generate();
+        let roster = EventBuilder::new(Kind::Custom(13534), "")
+            .tags([Tag::parse(["member", &member.public_key().to_hex()]).unwrap()])
+            .finalize(&relay)
+            .unwrap();
+        let mut statuses: Vec<_> = (0..101)
+            .map(|i| {
+                EventBuilder::new(Kind::Custom(30003), format!("{{\"fixture\":{i}}}"))
+                    .tags([Tag::parse(["k", "buzz-mesh-status"]).unwrap()])
+                    .finalize(&member)
+                    .unwrap()
+            })
+            .collect();
+        statuses[2].content = "tampered".into();
+        let cursor = statuses[99].clone();
+        let mut calls = 0;
+        let events = discover(&relay.public_key(), |filter| {
+            calls += 1;
+            let page = match calls {
+                1 => {
+                    assert_eq!(
+                        filter["authors"],
+                        serde_json::json!([relay.public_key().to_hex()])
+                    );
+                    vec![roster.clone()]
+                }
+                2 => statuses[..100].to_vec(),
+                3 => {
+                    assert_eq!(
+                        filter["until"],
+                        serde_json::json!(cursor.created_at.as_secs())
+                    );
+                    assert_eq!(filter["before_id"], serde_json::json!(cursor.id.to_hex()));
+                    statuses[100..].to_vec()
+                }
+                _ => panic!("extra page"),
+            };
+            let mut raw: Vec<_> = page
+                .into_iter()
+                .map(|event| serde_json::to_value(event).unwrap())
+                .collect();
+            if calls == 2 {
+                raw[3] = serde_json::json!({"broken":true});
+            }
+            std::future::ready(Ok(raw))
+        })
+        .await
+        .unwrap();
+        assert_eq!(calls, 3);
+        assert_eq!(events.len(), 100);
+    }
+}
diff --git a/crates/mesh-compute/src/discovery_regression_tests.rs b/crates/mesh-compute/src/discovery_regression_tests.rs
new file mode 100644
index 000000000..bdbb69057
--- /dev/null
+++ b/crates/mesh-compute/src/discovery_regression_tests.rs
@@ -0,0 +1,195 @@
+//! Signed-event regressions adapted from classic Buzz's discovery tests.
+use super::*;
+use mesh_llm_host_runtime::crypto::OwnerKeypair;
+use nostr::{
+    event::{EventBuilder, FinalizeEvent, Kind, Tag},
+    key::Keys,
+    types::time::Timestamp,
+};
+use serde_json::{json, Value};
+
+fn roster(relay: &Keys, members: &[&Keys]) -> nostr::event::Event {
+    EventBuilder::new(Kind::Custom(13534), "")
+        .tags(
+            members
+                .iter()
+                .map(|member| Tag::parse(["member", &member.public_key().to_hex()]).unwrap()),
+        )
+        .finalize(relay)
+        .unwrap()
+}
+
+fn status(member: &Keys, owner: &OwnerKeypair, port: u16) -> nostr::event::Event {
+    let token = crate::transport_policy::endpoint_token_for_test([iroh::TransportAddr::Ip(
+        ([192, 168, 1, 20], port).into(),
+    )]);
+    crate::publication::status_event(
+        owner,
+        &member.public_key().to_hex(),
+        true,
+        Some(&json!({"hosted_models": ["fixture-model"]})),
+        Some(&token),
+        None,
+    )
+    .unwrap()
+    .finalize(member)
+    .unwrap()
+}
+
+fn resign(member: &Keys, event: &nostr::event::Event, payload: Value) -> nostr::event::Event {
+    EventBuilder::new(event.kind, payload.to_string())
+        .tags(event.tags.clone())
+        .finalize(member)
+        .unwrap()
+}
+
+#[test]
+fn spoofed_owner_and_cross_member_binding_cannot_admit_or_route() {
+    let relay = Keys::generate();
+    let member = Keys::generate();
+    let other = Keys::generate();
+    let owner = OwnerKeypair::generate();
+    let good = status(&member, &owner, 47916);
+    let membership = roster(&relay, &[&member]);
+    let valid =
+        verify_evidence(vec![membership.clone(), good.clone()], &relay.public_key()).unwrap();
+    assert_eq!(owner_ids_from_events(&valid), vec![owner.owner_id()]);
+    assert_eq!(availability_from_events(valid).serve_targets.len(), 1);
+
+    let mut spoofed: Value = serde_json::from_str(&good.content).unwrap();
+    spoofed["ownerId"] = json!("0".repeat(64));
+    let cross_member = status(&other, &owner, 47916);
+    for payload in [
+        spoofed,
+        serde_json::from_str(&cross_member.content).unwrap(),
+    ] {
+        // Both envelopes really are signed by the current member. It is the
+        // claimed Mesh owner/binding, not the outer event signature, that fails.
+        let bad = resign(&member, &good, payload);
+        let verified = verify_evidence(vec![membership.clone(), bad], &relay.public_key()).unwrap();
+        assert_eq!(verified.len(), 2);
+        assert!(owner_ids_from_events(&verified).is_empty());
+        assert!(availability_from_events(verified).serve_targets.is_empty());
+    }
+}
+
+#[test]
+fn removal_excludes_fresh_status_from_both_admission_and_routing() {
+    let relay = Keys::generate();
+    let member = Keys::generate();
+    let removed = Keys::generate();
+    let owner = OwnerKeypair::generate();
+    let removed_owner = OwnerKeypair::generate();
+    let good = status(&member, &owner, 47916);
+    let removed_status = status(&removed, &removed_owner, 47917);
+    let before = verify_evidence(
+        vec![
+            roster(&relay, &[&member, &removed]),
+            good.clone(),
+            removed_status.clone(),
+        ],
+        &relay.public_key(),
+    )
+    .unwrap();
+    let mut expected = vec![owner.owner_id(), removed_owner.owner_id()];
+    expected.sort();
+    assert_eq!(owner_ids_from_events(&before), expected);
+    assert_eq!(availability_from_events(before).serve_targets.len(), 2);
+
+    let after = verify_evidence(
+        vec![roster(&relay, &[&member]), good, removed_status],
+        &relay.public_key(),
+    )
+    .unwrap();
+    assert_eq!(owner_ids_from_events(&after), vec![owner.owner_id()]);
+    let targets = availability_from_events(after).serve_targets;
+    assert_eq!(targets.len(), 1);
+    assert_eq!(
+        targets[0].owner_id.as_deref(),
+        Some(owner.owner_id().as_str())
+    );
+}
+
+#[test]
+fn stale_status_preserves_membership_admission_but_not_routing() {
+    let relay = Keys::generate();
+    let member = Keys::generate();
+    let owner = OwnerKeypair::generate();
+    let fresh = status(&member, &owner, 47916);
+    let membership = roster(&relay, &[&member]);
+    let control =
+        verify_evidence(vec![membership.clone(), fresh.clone()], &relay.public_key()).unwrap();
+    assert_eq!(availability_from_events(control).serve_targets.len(), 1);
+    // Deliberately ancient timestamp, not a wall-clock boundary race.
+    let stale = EventBuilder::new(fresh.kind, fresh.content)
+        .tags(fresh.tags)
+        .custom_created_at(Timestamp::from(1))
+        .finalize(&member)
+        .unwrap();
+    let events = verify_evidence(vec![membership, stale], &relay.public_key()).unwrap();
+    assert_eq!(owner_ids_from_events(&events), vec![owner.owner_id()]);
+    assert!(availability_from_events(events).serve_targets.is_empty());
+}
+
+#[test]
+fn one_member_can_advertise_two_distinct_owner_devices() {
+    let relay = Keys::generate();
+    let member = Keys::generate();
+    let first = OwnerKeypair::generate();
+    let second = OwnerKeypair::generate();
+    let a = status(&member, &first, 47916);
+    let b = status(&member, &second, 47917);
+    assert_ne!(
+        a.tags, b.tags,
+        "devices need separate replaceable-event keys"
+    );
+    let events =
+        verify_evidence(vec![roster(&relay, &[&member]), a, b], &relay.public_key()).unwrap();
+    let mut expected = vec![first.owner_id(), second.owner_id()];
+    expected.sort();
+    assert_eq!(owner_ids_from_events(&events), expected);
+    let targets = availability_from_events(events).serve_targets;
+    assert_eq!(targets.len(), 2);
+    let mut actual: Vec<_> = targets
+        .iter()
+        .map(|target| target.owner_id.clone().unwrap())
+        .collect();
+    actual.sort();
+    assert_eq!(actual, expected);
+    assert_ne!(targets[0].endpoint_addr, targets[1].endpoint_addr);
+}
+
+#[test]
+fn a_restarting_consumer_never_joins_its_own_lingering_advert() {
+    // Share Off stops the serve runtime, then a consumer restarts for running
+    // agents. This machine's serving note is still fresh at that moment; joining
+    // it made the SDK reject its own node id and retry forever.
+    let relay = Keys::generate();
+    let member = Keys::generate();
+    let this_machine = OwnerKeypair::generate();
+    let other_machine = OwnerKeypair::generate();
+    let own = status(&member, &this_machine, 47916);
+    let peer = status(&member, &other_machine, 47917);
+    let events = verify_evidence(
+        vec![roster(&relay, &[&member]), own, peer],
+        &relay.public_key(),
+    )
+    .unwrap();
+    let targets = availability_from_events(events).serve_targets;
+    assert_eq!(targets.len(), 2);
+    let peer_token = targets
+        .iter()
+        .find(|target| target.owner_id.as_deref() == Some(other_machine.owner_id().as_str()))
+        .map(|target| target.endpoint_addr.clone())
+        .unwrap();
+    assert_eq!(
+        peer_join_tokens(targets.clone(), &this_machine.owner_id()),
+        vec![peer_token]
+    );
+    // Alone in the community, there is nothing to join: not a retry loop.
+    let alone = targets
+        .into_iter()
+        .filter(|target| target.owner_id.as_deref() == Some(this_machine.owner_id().as_str()))
+        .collect();
+    assert!(peer_join_tokens(alone, &this_machine.owner_id()).is_empty());
+}
diff --git a/crates/mesh-compute/src/discovery_types.rs b/crates/mesh-compute/src/discovery_types.rs
new file mode 100644
index 000000000..594a0576f
--- /dev/null
+++ b/crates/mesh-compute/src/discovery_types.rs
@@ -0,0 +1,96 @@
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct MeshModelOption {
+    pub id: String,
+    pub name: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct MeshServeTarget {
+    pub model_id: String,
+    pub model_name: Option<String>,
+    pub endpoint_addr: String,
+    /// Buzz member that signed the discovery note containing this target.
+    /// Populated after signature/membership validation; never trusted from the
+    /// note payload itself.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub reporter_pubkey: Option<String>,
+    /// Per-runtime MeshLLM owner identity verified by the signed Buzz status.
+    /// Distinguishes two devices logged into the same Buzz member account.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub owner_id: Option<String>,
+    pub node_name: Option<String>,
+    pub capacity: Option<MeshTargetCapacity>,
+    #[serde(default)]
+    pub endpoint_id: Option<String>,
+    #[serde(default)]
+    pub device_id: Option<String>,
+    #[serde(default)]
+    pub device_name: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct MeshTargetCapacity {
+    pub vram_gb: Option<f64>,
+}
+
+#[derive(Debug, Clone, Copy, Default, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub enum AvailabilityState {
+    #[default]
+    Unavailable,
+    Empty,
+    Available,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct MeshAvailability {
+    #[serde(default)]
+    pub state: AvailabilityState,
+    pub reason: Option<String>,
+    pub models: Vec<MeshModelOption>,
+    pub serve_targets: Vec<MeshServeTarget>,
+}
+
+impl MeshAvailability {
+    pub fn unavailable(reason: impl Into<String>) -> Self {
+        Self {
+            state: AvailabilityState::Unavailable,
+            reason: Some(reason.into()),
+            models: Vec::new(),
+            serve_targets: Vec::new(),
+        }
+    }
+}
+
+pub(crate) fn dedupe_models(models: Vec<MeshModelOption>) -> Vec<MeshModelOption> {
+    // Key by canonical id so `@main` / non-`@main` forms of the same model
+    // dedup together. Display the canonical (stripped) id so the UI shows one
+    // stable label; selection still matches because the picker canonicalizes
+    // both sides too.
+    let mut by_id = BTreeMap::<String, Option<String>>::new();
+    for model in models {
+        by_id
+            .entry(canonical_model_id(&model.id))
+            .and_modify(|name| {
+                if name.is_none() {
+                    *name = model.name.clone();
+                }
+            })
+            .or_insert(model.name);
+    }
+    by_id
+        .into_iter()
+        .map(|(id, name)| MeshModelOption { id, name })
+        .collect()
+}
+pub const MESH_STATUS_KIND: u64 = 30003;
+
+fn canonical_model_id(value: &str) -> String {
+    value.trim().replace("@main", "")
+}
diff --git a/crates/mesh-compute/src/identity.rs b/crates/mesh-compute/src/identity.rs
new file mode 100644
index 000000000..bf488e4d1
--- /dev/null
+++ b/crates/mesh-compute/src/identity.rs
@@ -0,0 +1,212 @@
+//! Legacy Mesh owner identity, separate from the host-owned Nostr key.
+use mesh_llm_host_runtime::crypto::{
+    keystore_exists, keystore_metadata, load_keystore, load_owner_keypair_from_keychain,
+    save_keystore, OwnerKeychainLoadError, OwnerKeypair,
+};
+use std::path::Path;
+
+/// Preserve the host-selected owner identity, unlocking encrypted files through the SDK.
+/// Only encrypted files consult the native credential store; this never writes credentials.
+pub fn ensure_owner_at(path: &Path) -> anyhow::Result<String> {
+    Ok(load_owner_at(path)?.owner_id())
+}
+
+/// Load the same owner for signing discovery; encrypted files use the existing loader.
+pub fn load_owner_at(path: &Path) -> anyhow::Result<OwnerKeypair> {
+    load_owner_with(path, load_owner_keypair_from_keychain)
+}
+
+#[cfg(test)]
+fn ensure_owner_with(
+    path: &Path,
+    unlock: impl FnOnce(&Path) -> Result<OwnerKeypair, OwnerKeychainLoadError>,
+) -> anyhow::Result<String> {
+    Ok(load_owner_with(path, unlock)?.owner_id())
+}
+
+fn load_owner_with(
+    path: &Path,
+    unlock: impl FnOnce(&Path) -> Result<OwnerKeypair, OwnerKeychainLoadError>,
+) -> anyhow::Result<OwnerKeypair> {
+    let key = if keystore_exists(path) {
+        if keystore_metadata(path)?.encrypted {
+            unlock(path).map_err(|error| match error {
+                OwnerKeychainLoadError::NoEntry => anyhow::anyhow!(
+                    "Mesh identity is encrypted, but its unlock secret is not in the OS credential store. Unlock or configure this identity with mesh-llm before starting Mesh in Buzz. The existing keystore was not changed."
+                ),
+                OwnerKeychainLoadError::Crypto(error) => anyhow::anyhow!(
+                    "Could not unlock the existing Mesh identity through the OS credential store: {error}. Check credential access and the identity with mesh-llm, then retry. The existing keystore was not changed."
+                ),
+            })?
+        } else {
+            load_keystore(path, None)?
+        }
+    } else {
+        let key = OwnerKeypair::generate();
+        save_keystore(path, &key, None, false)?;
+        key
+    };
+    Ok(key)
+}
+
+use sha2::{Digest, Sha256};
+pub fn member_binding_bytes(member_pubkey: &str) -> Vec<u8> {
+    format!(
+        "buzz-mesh-owner-binding-v1:{}",
+        member_pubkey.trim().to_ascii_lowercase()
+    )
+    .into_bytes()
+}
+
+/// Canonical bytes binding a member-associated node identity to the exact set
+/// of endpoint tokens in its status event.
+pub fn member_endpoint_binding_bytes(member_pubkey: &str, endpoint_tokens: &[String]) -> Vec<u8> {
+    let mut endpoints = endpoint_tokens
+        .iter()
+        .map(|token| token.trim())
+        .filter(|token| !token.is_empty())
+        .collect::<Vec<_>>();
+    endpoints.sort_unstable();
+    endpoints.dedup();
+
+    let mut digest = Sha256::new();
+    for endpoint in endpoints {
+        digest.update((endpoint.len() as u64).to_be_bytes());
+        digest.update(endpoint.as_bytes());
+    }
+    format!(
+        "buzz-mesh-owner-endpoint-binding-v1:{}:{}",
+        member_pubkey.trim().to_ascii_lowercase(),
+        hex::encode(digest.finalize())
+    )
+    .into_bytes()
+}
+
+/// Extract endpoint tokens from a status payload using the same canonical
+/// field rules for publication and verification.
+pub fn advertised_endpoint_tokens(payload: &serde_json::Value) -> Option<Vec<String>> {
+    let Some(targets) = payload
+        .get("serveTargets")
+        .or_else(|| payload.get("serve_targets"))
+    else {
+        return Some(Vec::new());
+    };
+    let targets = targets.as_array()?;
+    targets
+        .iter()
+        .map(|target| {
+            target
+                .get("endpointAddr")
+                .or_else(|| target.get("endpoint_addr"))?
+                .as_str()
+                .map(str::trim)
+                .filter(|token| !token.is_empty())
+                .map(ToString::to_string)
+        })
+        .collect()
+}
+
+/// Resolve the same SDK-owned path as legacy Desktop.
+pub fn default_owner_path() -> anyhow::Result<std::path::PathBuf> {
+    Ok(mesh_llm_host_runtime::crypto::default_keystore_path()?)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use mesh_llm_host_runtime::crypto::CryptoError;
+
+    struct Fixture(std::path::PathBuf);
+    impl Fixture {
+        fn new() -> Self {
+            Self(std::env::temp_dir().join(format!(
+                "buzz-mesh-owner-{}-{}",
+                std::process::id(),
+                OwnerKeypair::generate().owner_id()
+            )))
+        }
+        fn path(&self) -> std::path::PathBuf {
+            self.0.join("owner.json")
+        }
+    }
+    impl Drop for Fixture {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    #[test]
+    fn encrypted_owner_uses_credential_loader_and_preserves_file() {
+        let fixture = Fixture::new();
+        let path = fixture.path();
+        let key = OwnerKeypair::generate();
+        save_keystore(&path, &key, Some("fixture-secret"), false).unwrap();
+        let before = std::fs::read(&path).unwrap();
+        assert!(load_keystore(&path, None).is_err());
+        let owner = ensure_owner_with(&path, |requested| {
+            assert_eq!(requested, path);
+            // Inject only the credential boundary: real encrypted-file decryption.
+            load_keystore(requested, Some("fixture-secret")).map_err(OwnerKeychainLoadError::Crypto)
+        })
+        .unwrap();
+        assert_eq!(owner, key.owner_id());
+        assert_eq!(std::fs::read(&path).unwrap(), before);
+    }
+
+    #[test]
+    fn failed_unlock_never_replaces_or_decrypts_the_file() {
+        let fixture = Fixture::new();
+        let path = fixture.path();
+        save_keystore(
+            &path,
+            &OwnerKeypair::generate(),
+            Some("fixture-secret"),
+            false,
+        )
+        .unwrap();
+        let before = std::fs::read(&path).unwrap();
+        for failure in [
+            OwnerKeychainLoadError::NoEntry,
+            OwnerKeychainLoadError::Crypto(CryptoError::KeychainAccessDenied {
+                reason: "fixture denial".into(),
+            }),
+            OwnerKeychainLoadError::Crypto(CryptoError::KeychainUnavailable {
+                reason: "fixture unavailable".into(),
+            }),
+            OwnerKeychainLoadError::Crypto(
+                load_keystore(&path, Some("wrong-secret")).err().unwrap(),
+            ),
+        ] {
+            let error = ensure_owner_with(&path, |_| Err(failure))
+                .unwrap_err()
+                .to_string();
+            assert!(error.contains("credential"), "{error}");
+            assert!(error.contains("not changed"), "{error}");
+            assert!(!error.contains("fixture-secret"));
+            assert_eq!(std::fs::read(&path).unwrap(), before);
+        }
+    }
+
+    #[test]
+    fn new_and_plaintext_owners_do_not_consult_credentials() {
+        let fixture = Fixture::new();
+        let path = fixture.path();
+        let owner = ensure_owner_with(&path, |_| panic!("unexpected credential access")).unwrap();
+        let before = std::fs::read(&path).unwrap();
+        assert_eq!(
+            ensure_owner_with(&path, |_| panic!("unexpected credential access")).unwrap(),
+            owner
+        );
+        assert_eq!(std::fs::read(&path).unwrap(), before);
+    }
+
+    #[test]
+    fn malformed_existing_file_is_not_replaced() {
+        let fixture = Fixture::new();
+        std::fs::create_dir_all(&fixture.0).unwrap();
+        let path = fixture.path();
+        std::fs::write(&path, "invalid fixture").unwrap();
+        assert!(ensure_owner_with(&path, |_| panic!("unexpected credential access")).is_err());
+        assert_eq!(std::fs::read_to_string(path).unwrap(), "invalid fixture");
+    }
+}
diff --git a/crates/mesh-compute/src/inventory.rs b/crates/mesh-compute/src/inventory.rs
new file mode 100644
index 000000000..1b9ce5db7
--- /dev/null
+++ b/crates/mesh-compute/src/inventory.rs
@@ -0,0 +1,112 @@
+//! Allowlisted relay-advertised inventory. Never exports routing tokens or owner bindings.
+use crate::discovery_types::{AvailabilityState, MeshAvailability};
+use serde::Serialize;
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Inventory {
+    pub unavailable: Option<String>,
+    pub entries: Vec<Entry>,
+}
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Entry {
+    pub device_id: Option<String>,
+    pub member_pubkey: String,
+    pub model_id: String,
+    pub model_name: Option<String>,
+    pub device_name: Option<String>,
+    pub vram_gb: Option<f64>,
+}
+
+/// Project only already-verified discovery results; preserve unavailable evidence.
+pub fn project(availability: MeshAvailability) -> Inventory {
+    let unavailable = if availability.state == AvailabilityState::Unavailable {
+        Some(
+            availability
+                .reason
+                .unwrap_or_else(|| "Community mesh is unavailable".into()),
+        )
+    } else {
+        None
+    };
+    let entries = availability
+        .serve_targets
+        .into_iter()
+        .filter_map(|target| {
+            Some(Entry {
+                device_id: target.device_id,
+                member_pubkey: target.reporter_pubkey?,
+                model_id: target.model_id,
+                model_name: target.model_name,
+                device_name: target.device_name,
+                vram_gb: target
+                    .capacity
+                    .and_then(|capacity| capacity.vram_gb)
+                    .filter(|value| value.is_finite() && *value >= 0.0),
+            })
+        })
+        .collect();
+    Inventory {
+        unavailable,
+        entries,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::discovery_types::{MeshServeTarget, MeshTargetCapacity};
+
+    #[test]
+    fn projection_excludes_routing_secrets_and_keeps_member_fields() {
+        let target = MeshServeTarget {
+            model_id: "model".into(),
+            model_name: Some("Model".into()),
+            endpoint_addr: "secret-join-token".into(),
+            reporter_pubkey: Some("member".into()),
+            owner_id: Some("private-binding".into()),
+            node_name: None,
+            capacity: Some(MeshTargetCapacity {
+                vram_gb: Some(32.0),
+            }),
+            endpoint_id: Some("endpoint".into()),
+            device_id: Some("device-id".into()),
+            device_name: Some("Workstation".into()),
+        };
+        let value = serde_json::to_value(project(MeshAvailability {
+            state: AvailabilityState::Available,
+            reason: None,
+            models: vec![],
+            serve_targets: vec![target],
+        }))
+        .unwrap();
+        assert_eq!(
+            value["entries"][0],
+            serde_json::json!({
+                "deviceId": "device-id", "memberPubkey": "member", "modelId": "model", "modelName": "Model",
+                "deviceName": "Workstation", "vramGb": 32.0
+            })
+        );
+        assert!(!value.to_string().contains("secret-join-token"));
+        assert!(!value.to_string().contains("private-binding"));
+    }
+
+    #[test]
+    fn unavailable_is_not_empty_success() {
+        assert!(project(MeshAvailability::unavailable(
+            "Buzz shared compute status is malformed"
+        ))
+        .unavailable
+        .is_some());
+        let empty = project(MeshAvailability {
+            state: AvailabilityState::Empty,
+            reason: Some("Any future display wording".into()),
+            models: vec![],
+            serve_targets: vec![],
+        });
+        assert!(empty.unavailable.is_none());
+        assert!(empty.entries.is_empty());
+    }
+}
diff --git a/crates/mesh-compute/src/lib.rs b/crates/mesh-compute/src/lib.rs
new file mode 100644
index 000000000..9bf764eac
--- /dev/null
+++ b/crates/mesh-compute/src/lib.rs
@@ -0,0 +1,59 @@
+//! Native Mesh lifecycle owner. The application retains credentials and relay authority.
+//!
+//! Initial integration checkpoint: no runtime is launched until the SDK adapter lands.
+
+#[cfg(feature = "mesh")]
+pub mod config;
+#[cfg(feature = "mesh")]
+pub mod identity;
+#[cfg(feature = "mesh")]
+pub mod lifecycle;
+#[cfg(feature = "mesh")]
+mod transport_policy;
+
+use serde::Serialize;
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Status {
+    pub available: bool,
+    pub reason: &'static str,
+}
+
+/// Explicitly unavailable during bring-up; compilation is not runtime readiness.
+pub fn status() -> Status {
+    Status {
+        available: false,
+        reason: "Mesh runtime integration is not complete",
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn scaffold_never_claims_runtime_readiness() {
+        assert!(!super::status().available);
+    }
+}
+
+#[cfg(feature = "mesh")]
+pub mod discovery;
+#[cfg(feature = "mesh")]
+pub mod discovery_query;
+#[cfg(feature = "mesh")]
+pub mod discovery_types;
+
+#[cfg(feature = "mesh")]
+pub mod inventory;
+pub mod startup_log;
+
+#[cfg(feature = "mesh")]
+pub mod roster;
+
+#[cfg(feature = "mesh")]
+pub mod publication;
+
+#[cfg(feature = "mesh")]
+pub mod catalog;
+#[cfg(feature = "mesh")]
+mod progress;
diff --git a/crates/mesh-compute/src/lifecycle.rs b/crates/mesh-compute/src/lifecycle.rs
new file mode 100644
index 000000000..2561d51d1
--- /dev/null
+++ b/crates/mesh-compute/src/lifecycle.rs
@@ -0,0 +1,863 @@
+//! Process-owned SDK worker. Startup is never aborted: it may already own an OS thread.
+
+use std::collections::HashSet;
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+const JOIN_BUDGET: Duration = Duration::from_secs(120);
+pub const MESH_STOP_TIMEOUT: Duration = Duration::from_secs(12);
+use tokio::sync::{mpsc, oneshot, watch};
+
+use crate::config::{ClientConfig, ServeConfig};
+use crate::transport_policy::validate_advertised_endpoint;
+
+// Same explicit policy for native initialization and embedded startup; never read
+// the user's standalone Mesh config. File stays alive through initialization.
+fn isolated_config() -> anyhow::Result<tempfile::NamedTempFile> {
+    use std::io::Write;
+    let mut file = tempfile::NamedTempFile::new()?;
+    file.write_all(b"[[plugin]]\nname = \"telemetry\"\nenabled = false\n\n[[plugin]]\nname = \"blobstore\"\nenabled = false\n" )?;
+    Ok(file)
+}
+
+/// SDK status returned by the owned worker; payload remains untyped JSON.
+pub use mesh_llm_sdk::EmbeddedNodeStatus as NodeStatus;
+
+#[derive(Debug)]
+struct BeforeNode(anyhow::Error);
+impl std::fmt::Display for BeforeNode {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        self.0.fmt(f)
+    }
+}
+impl std::error::Error for BeforeNode {}
+
+type Observer = Arc<dyn Fn(Phase) + Send + Sync>;
+
+type Operation<'a, T> = Pin<Box<dyn Future<Output = anyhow::Result<T>> + Send + 'a>>;
+
+trait Node: Send + Sync + 'static {
+    fn join(&self, token: String) -> Operation<'_, ()>;
+    fn status(&self) -> Operation<'_, mesh_llm_sdk::EmbeddedNodeStatus>;
+    fn stop(self) -> Operation<'static, ()>;
+}
+impl Node for mesh_llm_sdk::EmbeddedNodeHandle {
+    fn join(&self, token: String) -> Operation<'_, ()> {
+        Box::pin(self.join_token(token))
+    }
+    fn status(&self) -> Operation<'_, mesh_llm_sdk::EmbeddedNodeStatus> {
+        Box::pin(self.status())
+    }
+    fn stop(self) -> Operation<'static, ()> {
+        Box::pin(self.stop())
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, serde::Serialize)]
+#[serde(tag = "state", content = "reason", rename_all = "camelCase")]
+pub enum Phase {
+    Stopped,
+    Starting,
+    Ready,
+    Stopping,
+    /// Shutdown was not proved; replacement is deliberately refused.
+    Failed(String),
+}
+
+struct Slot {
+    phase: Phase,
+    serving: bool,
+    joining: bool,
+    pending_tokens: HashSet<String>,
+    retryable: bool,
+    dial: Option<mpsc::Sender<String>>,
+    stop: Option<watch::Sender<bool>>,
+    status: Option<mpsc::Sender<oneshot::Sender<anyhow::Result<mesh_llm_sdk::EmbeddedNodeStatus>>>>,
+}
+
+/// The app owns this across plugin/page lifetimes. Dropping it requests shutdown.
+pub struct Lifecycle {
+    slot: Arc<Mutex<Slot>>,
+    progress: crate::progress::Progress,
+}
+impl Default for Lifecycle {
+    fn default() -> Self {
+        Self {
+            progress: crate::progress::Progress::default(),
+            slot: Arc::new(Mutex::new(Slot {
+                phase: Phase::Stopped,
+                serving: false,
+                joining: false,
+                pending_tokens: HashSet::new(),
+                retryable: false,
+                dial: None,
+                stop: None,
+                status: None,
+            })),
+        }
+    }
+}
+impl Lifecycle {
+    pub fn phase(&self) -> Phase {
+        self.slot.lock().expect("mesh slot poisoned").phase.clone()
+    }
+
+    /// Ask the owned SDK handle for status; never discover a node by a guessed port.
+    pub async fn status(&self) -> anyhow::Result<mesh_llm_sdk::EmbeddedNodeStatus> {
+        let (reply, result) = oneshot::channel();
+        {
+            let slot = self
+                .slot
+                .lock()
+                .map_err(|_| anyhow::anyhow!("Mesh slot unavailable"))?;
+            if slot.phase != Phase::Ready {
+                anyhow::bail!("Mesh status is not ready");
+            }
+            slot.status
+                .as_ref()
+                .ok_or_else(|| anyhow::anyhow!("Mesh worker unavailable"))?
+                .try_send(reply)
+                .map_err(|_| anyhow::anyhow!("Mesh status request is already pending"))?;
+        }
+        result
+            .await
+            .map_err(|_| anyhow::anyhow!("Mesh stopped during status read"))?
+    }
+
+    /// The pinned SDK finishes an already queued peer join before Shutdown.
+    pub fn finishing_join(&self) -> bool {
+        self.slot
+            .lock()
+            .map(|slot| slot.joining && slot.phase == Phase::Stopping)
+            .unwrap_or(false)
+    }
+
+    pub fn start(&self, request: ClientConfig) -> anyhow::Result<()> {
+        let config = request.build()?;
+        self.launch(async move { mesh_llm_sdk::client::start(config).await })
+    }
+
+    /// Share a local model through the same exclusive SDK slot as consumers.
+    pub fn serve(&self, request: ServeConfig) -> anyhow::Result<()> {
+        self.serve_observed(request, |_| {})
+    }
+
+    /// Notify the host of worker transitions for fenced persistence checkpoints.
+    /// Observers run outside the slot lock and must not block on async work.
+    pub fn serve_observed(
+        &self,
+        request: ServeConfig,
+        observe: impl Fn(Phase) + Send + Sync + 'static,
+    ) -> anyhow::Result<()> {
+        let mut config = request.build()?;
+        let isolated = isolated_config()?;
+        config.storage.config_path = Some(isolated.path().to_owned());
+        let progress = self.progress.clone();
+        self.launch_observed(
+            async move {
+                progress.install();
+                mesh_llm_host_runtime::initialize_host_runtime_with_config(Some(isolated.path()))
+                    .await
+                    .map_err(BeforeNode)?;
+                // Serving resolves and acquires its own artifacts (including layer packages).
+                // A separate GGUF download here duplicates acquisition.
+                mesh_llm_sdk::serve::start(config).await
+            },
+            true,
+            Arc::new(observe),
+        )
+    }
+
+    /// Byte progress from the current worker, retained across UI remounts.
+    pub fn download_progress(&self) -> Option<crate::progress::DownloadProgress> {
+        self.progress.latest()
+    }
+
+    fn launch<N: Node>(
+        &self,
+        startup: impl Future<Output = anyhow::Result<N>> + Send + 'static,
+    ) -> anyhow::Result<()> {
+        self.launch_role(startup, false)
+    }
+
+    /// True only for the installed, ready serving worker, never for startup intent.
+    pub fn is_serving(&self) -> bool {
+        self.slot
+            .lock()
+            .map(|slot| slot.phase == Phase::Ready && slot.serving)
+            .unwrap_or(false)
+    }
+
+    fn launch_role<N: Node>(
+        &self,
+        startup: impl Future<Output = anyhow::Result<N>> + Send + 'static,
+        serving: bool,
+    ) -> anyhow::Result<()> {
+        self.launch_observed(startup, serving, Arc::new(|_| {}))
+    }
+
+    fn launch_observed<N: Node>(
+        &self,
+        startup: impl Future<Output = anyhow::Result<N>> + Send + 'static,
+        serving: bool,
+        observe: Observer,
+    ) -> anyhow::Result<()> {
+        let mut slot = self.slot.lock().expect("mesh slot poisoned");
+        if slot.phase != Phase::Stopped {
+            anyhow::bail!("Previous Mesh runtime shutdown is not confirmed");
+        }
+        let runtime = tokio::runtime::Handle::try_current()?;
+        self.progress.clear();
+        let (dial, mut pending) = mpsc::channel::<String>(64);
+        let (status, mut reads) =
+            mpsc::channel::<oneshot::Sender<anyhow::Result<mesh_llm_sdk::EmbeddedNodeStatus>>>(1);
+        let (stop, mut stopping) = watch::channel(false);
+        slot.retryable = false;
+        slot.pending_tokens.clear();
+        slot.phase = Phase::Starting;
+        slot.serving = serving;
+        slot.dial = Some(dial);
+        slot.stop = Some(stop);
+        slot.status = Some(status);
+        let shared = self.slot.clone();
+        drop(slot);
+        // Detached from the caller's request lifetime, intentionally not abortable by IPC.
+        let launched = std::time::Instant::now();
+        runtime.spawn(async move {
+            let started = startup.await;
+            crate::startup_log::stage(
+                "sdk_start_returned",
+                &format!("ok={} launch_ms={}", started.is_ok(), launched.elapsed().as_millis()),
+            );
+            let node = match started {
+                Ok(node) => node,
+                Err(error) => {
+                    let phase = Phase::Failed(format!("{error:#}"));
+                    {
+                        let mut slot = shared.lock().expect("mesh slot poisoned");
+                        slot.retryable = error.downcast_ref::<BeforeNode>().is_some();
+                        slot.phase = phase.clone();
+                        if slot.retryable { slot.stop = None; slot.status = None; slot.dial = None; }
+                    }
+                    observe(phase);
+                    return;
+                }
+            };
+            {
+                let mut slot = shared.lock().expect("mesh slot poisoned");
+                if slot.phase == Phase::Starting { slot.phase = Phase::Ready; }
+            }
+            let phase = shared.lock().expect("mesh slot poisoned").phase.clone();
+            observe(phase);
+            loop {
+                if *stopping.borrow() { break; }
+                tokio::select! {
+                    biased;
+                    _ = stopping.changed() => break,
+                    request = reads.recv() => {
+                        let Some(reply) = request else { break; };
+                        // Status is cancellable; unlike startup it creates no runtime.
+                        tokio::select! {
+                            biased;
+                            _ = stopping.changed() => break,
+                            result = tokio::time::timeout(Duration::from_secs(10), node.status()) => {
+                                let result = result.unwrap_or_else(|_| Err(anyhow::anyhow!("Mesh status read timed out")));
+                                let _ = reply.send(result);
+                            }
+                        }
+                    }
+                    token = pending.recv() => {
+                        let Some(token) = token else { break; };
+                        shared.lock().expect("mesh slot poisoned").joining = true;
+                        // SDK Join queues work inside its serial control loop. Keep just one
+                        // in flight; dropping its response does NOT cancel the SDK operation.
+                        let joining = node.join(token.clone());
+                        tokio::pin!(joining);
+                        loop {
+                            tokio::select! {
+                                biased;
+                                _ = stopping.changed() => break,
+                                result = &mut joining => {
+                                    if let Err(error) = result {
+                                        eprintln!("Mesh peer join failed; keeping node running: {error:#}");
+                                    }
+                                    {
+                                        let mut slot = shared.lock().expect("mesh slot poisoned");
+                                        slot.joining = false;
+                                        slot.pending_tokens.remove(&token);
+                                    }
+                                    break;
+                                }
+                                request = reads.recv() => {
+                                    let Some(reply) = request else { break; };
+                                    tokio::select! {
+                                        biased;
+                                        _ = stopping.changed() => break,
+                                        result = tokio::time::timeout(Duration::from_secs(10), node.status()) => {
+                                            let _ = reply.send(result.unwrap_or_else(|_| Err(anyhow::anyhow!("Mesh status read timed out"))));
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            drop(pending); // Never enqueue another SDK join after Stop.
+            let stop_budget = if shared.lock().expect("mesh slot poisoned").joining {
+                JOIN_BUDGET + MESH_STOP_TIMEOUT
+            } else { MESH_STOP_TIMEOUT };
+            // A timeout is not proof of shutdown: retain Failed and reject replacement.
+            let result = match tokio::time::timeout(stop_budget, node.stop()).await {
+                Ok(result) => result,
+                Err(_) => Err(anyhow::anyhow!("Mesh shutdown timed out; restart Buzz before starting another runtime")),
+            };
+            let mut slot = shared.lock().expect("mesh slot poisoned");
+            slot.phase = match result {
+                Ok(()) => Phase::Stopped,
+                Err(error) => Phase::Failed(format!("{error:#}")),
+            };
+            slot.joining = false;
+            slot.pending_tokens.clear();
+            slot.dial = None;
+            slot.stop = None;
+            slot.status = None;
+            let phase = slot.phase.clone();
+            drop(slot);
+            observe(phase);
+        });
+        Ok(())
+    }
+
+    /// Tokens come from host discovery; transport validation also applies to queued joins.
+    pub fn dial(&self, token: &str) -> anyhow::Result<()> {
+        let token = validate_advertised_endpoint(token)?.join_token;
+        self.enqueue(token)
+    }
+    fn enqueue(&self, token: String) -> anyhow::Result<()> {
+        let mut slot = self.slot.lock().expect("mesh slot poisoned");
+        if !matches!(slot.phase, Phase::Starting | Phase::Ready) {
+            anyhow::bail!("Mesh runtime is not accepting dial targets");
+        }
+        if slot.pending_tokens.contains(&token) {
+            return Ok(());
+        }
+        slot.dial
+            .as_ref()
+            .ok_or_else(|| anyhow::anyhow!("Mesh worker is unavailable"))?
+            .try_send(token.clone())
+            .map_err(|_| anyhow::anyhow!("Mesh dial queue is full or unavailable"))?;
+        slot.pending_tokens.insert(token);
+        Ok(())
+    }
+
+    /// Caller timeout never cancels startup or changes the slot to Stopped.
+    pub async fn stop_and_wait(&self) -> anyhow::Result<()> {
+        {
+            let mut slot = self
+                .slot
+                .lock()
+                .map_err(|_| anyhow::anyhow!("Mesh slot unavailable"))?;
+            if slot.retryable {
+                slot.phase = Phase::Stopped;
+                slot.retryable = false;
+            }
+        }
+        self.stop();
+        let budget = if self.slot.lock().expect("mesh slot poisoned").joining {
+            JOIN_BUDGET + MESH_STOP_TIMEOUT
+        } else {
+            MESH_STOP_TIMEOUT
+        };
+        tokio::time::timeout(budget, async {
+            loop {
+                match self.phase() {
+                    Phase::Stopped => return Ok(()),
+                    Phase::Failed(reason) => anyhow::bail!(reason),
+                    _ => tokio::time::sleep(Duration::from_millis(25)).await,
+                }
+            }
+        })
+        .await
+        .map_err(|_| anyhow::anyhow!("Finishing stop; restart Buzz if this persists"))?
+    }
+
+    pub fn stop(&self) {
+        let mut slot = self.slot.lock().expect("mesh slot poisoned");
+        if let Some(stop) = &slot.stop {
+            let _ = stop.send(true);
+            if !matches!(slot.phase, Phase::Failed(_)) {
+                slot.phase = Phase::Stopping;
+            }
+        }
+    }
+}
+impl Drop for Lifecycle {
+    fn drop(&mut self) {
+        self.stop();
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tokio::sync::oneshot;
+
+    struct FakeNode {
+        stopped: oneshot::Sender<()>,
+        release: oneshot::Receiver<()>,
+        joined: mpsc::UnboundedSender<String>,
+    }
+    impl Node for FakeNode {
+        fn join(&self, token: String) -> Operation<'_, ()> {
+            Box::pin(async move {
+                self.joined.send(token)?;
+                Ok(())
+            })
+        }
+        fn status(&self) -> Operation<'_, mesh_llm_sdk::EmbeddedNodeStatus> {
+            Box::pin(async {
+                Ok(mesh_llm_sdk::EmbeddedNodeStatus {
+                    api_base_url: "fixture".into(),
+                    console_url: "fixture".into(),
+                    invite_token: None,
+                    payload: serde_json::json!({"hosted_models":["fixture-model"]}),
+                })
+            })
+        }
+        fn stop(self) -> Operation<'static, ()> {
+            Box::pin(async move {
+                let _ = self.stopped.send(());
+                self.release.await?;
+                Ok(())
+            })
+        }
+    }
+    fn fixture() -> (
+        FakeNode,
+        oneshot::Receiver<()>,
+        oneshot::Sender<()>,
+        mpsc::UnboundedReceiver<String>,
+    ) {
+        let (stopped, observed) = oneshot::channel();
+        let (release, gate) = oneshot::channel();
+        let (joined, received) = mpsc::unbounded_channel();
+        (
+            FakeNode {
+                stopped,
+                release: gate,
+                joined,
+            },
+            observed,
+            release,
+            received,
+        )
+    }
+    #[tokio::test]
+    async fn known_pre_node_failure_can_retry_but_unknown_startup_failure_cannot() {
+        let owner = Lifecycle::default();
+        owner
+            .launch(async {
+                Err::<FakeNode, _>(BeforeNode(anyhow::anyhow!("download failed")).into())
+            })
+            .unwrap();
+        while owner.phase() == Phase::Starting {
+            tokio::task::yield_now().await;
+        }
+        assert!(matches!(owner.phase(), Phase::Failed(_)));
+        owner.stop_and_wait().await.unwrap();
+        let (node, stopped, release, _) = fixture();
+        owner.launch(async { Ok(node) }).unwrap();
+        owner.stop();
+        stopped.await.unwrap();
+        release.send(()).unwrap();
+        wait_stopped(&owner).await;
+        owner
+            .launch(async { Err::<FakeNode, _>(anyhow::anyhow!("uncertain runtime")) })
+            .unwrap();
+        while owner.phase() == Phase::Starting {
+            tokio::task::yield_now().await;
+        }
+        assert!(owner.stop_and_wait().await.is_err());
+        assert!(matches!(owner.phase(), Phase::Failed(_)));
+    }
+
+    struct JoiningNode {
+        inner: FakeNode,
+        began: mpsc::UnboundedSender<()>,
+        release_join: watch::Receiver<bool>,
+        fail: bool,
+    }
+    impl Node for JoiningNode {
+        fn join(&self, _: String) -> Operation<'_, ()> {
+            Box::pin(async move {
+                self.began.send(())?;
+                let mut gate = self.release_join.clone();
+                if !*gate.borrow() {
+                    gate.changed().await?;
+                }
+                if self.fail {
+                    anyhow::bail!("unreachable peer");
+                }
+                Ok(())
+            })
+        }
+        fn status(&self) -> Operation<'_, NodeStatus> {
+            self.inner.status()
+        }
+        fn stop(self) -> Operation<'static, ()> {
+            self.inner.stop()
+        }
+    }
+    #[tokio::test]
+    async fn failed_peer_join_keeps_ready_and_next_status_works() {
+        let owner = Lifecycle::default();
+        let (inner, stopped, release, _) = fixture();
+        let (began, mut observed) = mpsc::unbounded_channel();
+        let (_open, gate) = watch::channel(true);
+        owner
+            .launch(async {
+                Ok(JoiningNode {
+                    inner,
+                    began,
+                    release_join: gate,
+                    fail: true,
+                })
+            })
+            .unwrap();
+        owner.enqueue("failed-peer".into()).unwrap();
+        observed.recv().await.unwrap();
+        owner.status().await.unwrap();
+        assert_eq!(owner.phase(), Phase::Ready);
+        owner.stop();
+        stopped.await.unwrap();
+        release.send(()).unwrap();
+        wait_stopped(&owner).await;
+    }
+    #[tokio::test]
+    async fn held_join_allows_status_and_stop_discards_queued_peers() {
+        let owner = Lifecycle::default();
+        let (inner, stopped, release, _) = fixture();
+        let (began, mut observed) = mpsc::unbounded_channel();
+        let (_open, gate) = watch::channel(false);
+        owner
+            .launch(async {
+                Ok(JoiningNode {
+                    inner,
+                    began,
+                    release_join: gate,
+                    fail: false,
+                })
+            })
+            .unwrap();
+        owner.enqueue("held-peer".into()).unwrap();
+        observed.recv().await.unwrap();
+        owner.enqueue("must-not-dial".into()).unwrap();
+        assert!(owner.status().await.is_ok());
+        assert_eq!(owner.phase(), Phase::Ready);
+        owner.stop();
+        stopped.await.unwrap();
+        assert!(owner.finishing_join());
+        release.send(()).unwrap();
+        wait_stopped(&owner).await;
+        assert!(observed.recv().await.is_none());
+    }
+
+    #[tokio::test]
+    async fn repeated_pending_and_inflight_targets_are_coalesced_and_can_retry() {
+        let owner = Lifecycle::default();
+        let (inner, stopped, release, _) = fixture();
+        let (began, mut observed) = mpsc::unbounded_channel();
+        let (open, gate) = watch::channel(false);
+        let (start, startup) = oneshot::channel();
+        owner
+            .launch(async move {
+                startup.await?;
+                Ok(JoiningNode {
+                    inner,
+                    began,
+                    release_join: gate,
+                    fail: true,
+                })
+            })
+            .unwrap();
+        for _ in 0..100 {
+            owner.enqueue("same-peer".into()).unwrap();
+        }
+        assert_eq!(owner.slot.lock().unwrap().pending_tokens.len(), 1);
+        start.send(()).unwrap();
+        observed.recv().await.unwrap();
+        for _ in 0..100 {
+            owner.enqueue("same-peer".into()).unwrap();
+        }
+        assert_eq!(owner.slot.lock().unwrap().pending_tokens.len(), 1);
+        open.send(true).unwrap();
+        while owner
+            .slot
+            .lock()
+            .unwrap()
+            .pending_tokens
+            .contains("same-peer")
+        {
+            tokio::task::yield_now().await;
+        }
+        // Completion is the barrier: no duplicate queued work remains.
+        assert!(observed.try_recv().is_err());
+        owner.enqueue("same-peer".into()).unwrap();
+        observed.recv().await.unwrap();
+        owner.stop();
+        stopped.await.unwrap();
+        release.send(()).unwrap();
+        wait_stopped(&owner).await;
+        assert!(owner.slot.lock().unwrap().pending_tokens.is_empty());
+    }
+
+    #[tokio::test]
+    async fn serving_requires_ready_worker_and_clears_on_stop_or_failure() {
+        let owner = Lifecycle::default();
+        let (node, stopped, release, _) = fixture();
+        let (enter, gate) = oneshot::channel();
+        owner
+            .launch_role(
+                async move {
+                    gate.await?;
+                    Ok(node)
+                },
+                true,
+            )
+            .unwrap();
+        assert!(!owner.is_serving());
+        enter.send(()).unwrap();
+        while owner.phase() == Phase::Starting {
+            tokio::task::yield_now().await;
+        }
+        assert!(owner.is_serving());
+        owner.stop();
+        stopped.await.unwrap();
+        assert!(!owner.is_serving());
+        release.send(()).unwrap();
+        wait_stopped(&owner).await;
+        owner
+            .launch_role(
+                async { Err::<FakeNode, _>(anyhow::anyhow!("load failed")) },
+                true,
+            )
+            .unwrap();
+        while owner.phase() == Phase::Starting {
+            tokio::task::yield_now().await;
+        }
+        assert!(matches!(owner.phase(), Phase::Failed(_)));
+        assert!(!owner.is_serving());
+    }
+    #[tokio::test]
+    async fn observer_sees_ready_then_stop_outside_slot_lock_and_failure_before_replacement() {
+        let owner = Lifecycle::default();
+        let (node, stopped, release, _) = fixture();
+        let (events, mut observed) = mpsc::unbounded_channel();
+        let slot = owner.slot.clone();
+        owner
+            .launch_observed(
+                async { Ok(node) },
+                true,
+                Arc::new(move |phase| {
+                    assert!(
+                        slot.try_lock().is_ok(),
+                        "observer cannot run under the slot lock"
+                    );
+                    events.send(phase).unwrap();
+                }),
+            )
+            .unwrap();
+        assert_eq!(observed.recv().await, Some(Phase::Ready));
+        owner.stop();
+        stopped.await.unwrap();
+        release.send(()).unwrap();
+        assert_eq!(observed.recv().await, Some(Phase::Stopped));
+        let (events, mut observed) = mpsc::unbounded_channel();
+        owner
+            .launch_observed(
+                async { Err::<FakeNode, _>(anyhow::anyhow!("load failed")) },
+                true,
+                Arc::new(move |phase| {
+                    events.send(phase).unwrap();
+                }),
+            )
+            .unwrap();
+        assert_eq!(
+            observed.recv().await,
+            Some(Phase::Failed("load failed".into()))
+        );
+        assert!(owner
+            .start(ClientConfig {
+                api_port: 1,
+                console_port: 2,
+                owner_key: std::env::temp_dir().join("fixture"),
+                owner_id: "fixture".into(),
+                trusted_owners: vec!["fixture".into()],
+                join_token: None,
+                mesh_name: None,
+            })
+            .is_err());
+    }
+
+    async fn wait_stopped(owner: &Lifecycle) {
+        tokio::time::timeout(std::time::Duration::from_secs(2), async {
+            while owner.phase() != Phase::Stopped {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .unwrap();
+    }
+    #[tokio::test]
+    async fn status_reads_the_owned_node_only_after_start_and_rejects_after_stop() {
+        let owner = Lifecycle::default();
+        assert!(owner.status().await.is_err());
+        let (node, stopped, release, mut joined) = fixture();
+        owner.launch(async { Ok(node) }).unwrap();
+        owner.enqueue("ready-barrier".into()).unwrap();
+        joined.recv().await.unwrap();
+        assert_eq!(
+            owner.status().await.unwrap().payload["hosted_models"][0],
+            "fixture-model"
+        );
+        owner.stop();
+        stopped.await.unwrap();
+        assert!(owner.status().await.is_err());
+        release.send(()).unwrap();
+        wait_stopped(&owner).await;
+    }
+
+    #[tokio::test]
+    async fn stop_during_start_retains_worker_and_blocks_replacement_until_shutdown() {
+        let owner = Lifecycle::default();
+        let (node, stopped, release, _) = fixture();
+        let (start, gate) = oneshot::channel();
+        owner
+            .launch(async {
+                gate.await?;
+                Ok(node)
+            })
+            .unwrap();
+        owner.stop();
+        assert_eq!(owner.phase(), Phase::Stopping);
+        let (rejected, _, _, _) = fixture();
+        assert!(owner.launch(async { Ok(rejected) }).is_err());
+        start.send(()).unwrap();
+        stopped.await.unwrap();
+        assert_eq!(owner.phase(), Phase::Stopping);
+        let (next, _, _, _) = fixture();
+        assert!(owner.launch(async { Ok(next) }).is_err());
+        release.send(()).unwrap();
+        wait_stopped(&owner).await;
+        let (next, stopped, release, _) = fixture();
+        owner.launch(async { Ok(next) }).unwrap();
+        owner.stop();
+        stopped.await.unwrap();
+        release.send(()).unwrap();
+        wait_stopped(&owner).await;
+    }
+    #[tokio::test]
+    async fn queued_dial_is_delivered_after_start_and_failed_shutdown_blocks_restart() {
+        let owner = Lifecycle::default();
+        let (node, stopped, release, mut joined) = fixture();
+        let (start, gate) = oneshot::channel();
+        owner
+            .launch(async {
+                gate.await?;
+                Ok(node)
+            })
+            .unwrap();
+        owner.enqueue("host-validated-token".into()).unwrap();
+        start.send(()).unwrap();
+        assert_eq!(joined.recv().await.as_deref(), Some("host-validated-token"));
+        owner.stop();
+        stopped.await.unwrap();
+        drop(release);
+        tokio::time::timeout(std::time::Duration::from_secs(2), async {
+            while !matches!(owner.phase(), Phase::Failed(_)) {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .unwrap();
+        let (next, _, _, _) = fixture();
+        assert!(owner.launch(async { Ok(next) }).is_err());
+    }
+    #[tokio::test(start_paused = true)]
+    async fn ready_stop_timeout_never_permits_replacement() {
+        let owner = Lifecycle::default();
+        let (node, stopped, _release, mut joined) = fixture();
+        owner.launch(async { Ok(node) }).unwrap();
+        owner.enqueue("barrier".into()).unwrap();
+        joined.recv().await.unwrap();
+        assert_eq!(owner.phase(), Phase::Ready);
+        owner.stop();
+        stopped.await.unwrap();
+        tokio::time::advance(MESH_STOP_TIMEOUT).await;
+        while !matches!(owner.phase(), Phase::Failed(_)) {
+            tokio::task::yield_now().await;
+        }
+        let (next, _, _, _) = fixture();
+        assert!(owner.launch(async { Ok(next) }).is_err());
+    }
+}
+
+#[cfg(test)]
+mod embedded_join_test {
+    use super::*;
+    #[tokio::test]
+    #[ignore = "isolated real SDK test; requires BUZZ_MESH_JOIN_TEST=1 and sanitized environment"]
+    async fn real_embedded_unreachable_join_keeps_status_and_stops() {
+        assert_eq!(std::env::var("BUZZ_MESH_JOIN_TEST").as_deref(), Ok("1"));
+        assert_eq!(std::env::var("BUZZ_MESH_IROH_RELAYS").as_deref(), Ok("0"));
+        let temp = tempfile::tempdir().unwrap();
+        let path = temp.path().join("owner.json");
+        let owner = crate::identity::ensure_owner_at(&path).unwrap();
+        let first = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+        let second = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+        let api_port = first.local_addr().unwrap().port();
+        let console_port = second.local_addr().unwrap().port();
+        let request = ClientConfig {
+            api_port,
+            console_port,
+            owner_key: path,
+            owner_id: owner.clone(),
+            trusted_owners: vec![owner],
+            join_token: None,
+            mesh_name: Some("isolated-buzz-join-regression".into()),
+        };
+        drop((first, second));
+        let runtime = Lifecycle::default();
+        runtime.start(request).unwrap();
+        let ready = tokio::time::timeout(Duration::from_secs(30), async {
+            while runtime.phase() == Phase::Starting {
+                tokio::task::yield_now().await;
+            }
+            assert_eq!(runtime.phase(), Phase::Ready);
+        })
+        .await;
+        if ready.is_err() {
+            let _ = runtime.stop_and_wait().await;
+        }
+        ready.unwrap();
+        let dead = crate::transport_policy::endpoint_token_for_test([iroh::TransportAddr::Ip(
+            ([127, 0, 0, 1], 9).into(),
+        )]);
+        // Exercise the worker/SDK directly; public discovery intentionally rejects loopback.
+        runtime.enqueue(dead).unwrap();
+        while !runtime.slot.lock().unwrap().joining {
+            tokio::task::yield_now().await;
+        }
+        let status = tokio::time::timeout(Duration::from_secs(12), runtime.status()).await;
+        let stopped = runtime.stop_and_wait().await;
+        assert!(status.unwrap().is_ok());
+        stopped.unwrap();
+        assert_eq!(runtime.phase(), Phase::Stopped);
+        for port in [api_port, console_port] {
+            std::net::TcpListener::bind((std::net::Ipv4Addr::LOCALHOST, port)).unwrap();
+        }
+    }
+}
diff --git a/crates/mesh-compute/src/progress.rs b/crates/mesh-compute/src/progress.rs
new file mode 100644
index 000000000..5a40d16e3
--- /dev/null
+++ b/crates/mesh-compute/src/progress.rs
@@ -0,0 +1,102 @@
+//! Retained download progress for the app-owned worker, using the SDK's output sink.
+use mesh_llm_events::{ConsoleSessionMode, ModelProgressStatus, OutputEvent, OutputSink};
+use std::sync::{Arc, Mutex};
+
+/// Latest byte-level progress; a completed download is not inference readiness.
+#[derive(Clone, Debug, serde::Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct DownloadProgress {
+    pub label: String,
+    pub file: Option<String>,
+    pub downloaded_bytes: Option<u64>,
+    pub total_bytes: Option<u64>,
+    pub done: bool,
+}
+
+#[derive(Clone, Default)]
+pub(crate) struct Progress(Arc<Mutex<Option<DownloadProgress>>>);
+impl Progress {
+    pub fn latest(&self) -> Option<DownloadProgress> {
+        self.0.lock().ok().and_then(|progress| progress.clone())
+    }
+    pub fn clear(&self) {
+        if let Ok(mut progress) = self.0.lock() {
+            *progress = None;
+        }
+    }
+    pub fn install(&self) {
+        mesh_llm_events::set_output_sink(Arc::new(self.clone()));
+    }
+}
+impl OutputSink for Progress {
+    fn emit_event(&self, event: OutputEvent) -> std::io::Result<()> {
+        if let OutputEvent::Warning { message, context }
+        | OutputEvent::Error { message, context }
+        | OutputEvent::Fatal { message, context } = &event
+        {
+            eprintln!(
+                "Mesh runtime {}: {message}{}",
+                event.event_name(),
+                context
+                    .as_ref()
+                    .map(|value| format!(": {value}"))
+                    .unwrap_or_default()
+            );
+        }
+        if let OutputEvent::ModelDownloadProgress {
+            label,
+            file,
+            downloaded_bytes,
+            total_bytes,
+            status,
+        } = event
+        {
+            let mut progress = self
+                .0
+                .lock()
+                .map_err(|_| std::io::Error::other("Mesh progress unavailable"))?;
+            *progress = Some(DownloadProgress {
+                label,
+                file,
+                downloaded_bytes,
+                total_bytes,
+                done: matches!(status, ModelProgressStatus::Ready),
+            });
+        }
+        Ok(())
+    }
+    fn console_session_mode(&self) -> Option<ConsoleSessionMode> {
+        Some(ConsoleSessionMode::InteractiveDashboard)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn retains_bytes_and_resets_between_workers_without_claiming_node_readiness() {
+        let progress = Progress::default();
+        for status in [ModelProgressStatus::Downloading, ModelProgressStatus::Ready] {
+            let done = matches!(status, ModelProgressStatus::Ready);
+            progress
+                .emit_event(OutputEvent::ModelDownloadProgress {
+                    label: "fixture".into(),
+                    file: Some("weights.gguf".into()),
+                    downloaded_bytes: Some(64),
+                    total_bytes: Some(128),
+                    status,
+                })
+                .unwrap();
+            let latest = progress.latest().unwrap();
+            assert_eq!(latest.downloaded_bytes, Some(64));
+            assert_eq!(latest.total_bytes, Some(128));
+            assert_eq!(latest.done, done);
+        }
+        progress.clear();
+        assert!(progress.latest().is_none());
+        assert_eq!(
+            progress.console_session_mode(),
+            Some(ConsoleSessionMode::InteractiveDashboard)
+        );
+    }
+}
diff --git a/crates/mesh-compute/src/publication.rs b/crates/mesh-compute/src/publication.rs
new file mode 100644
index 000000000..d0778dd30
--- /dev/null
+++ b/crates/mesh-compute/src/publication.rs
@@ -0,0 +1,420 @@
+//! Community-only status notes, compatible with classic Buzz's discovery reader.
+use mesh_llm_host_runtime::crypto::OwnerKeypair;
+use nostr::event::{EventBuilder, Kind, Tag};
+use serde_json::{json, Value};
+
+use crate::discovery_types::{
+    dedupe_models, MeshModelOption, MeshServeTarget, MeshTargetCapacity, MESH_STATUS_KIND,
+};
+use crate::identity::{member_binding_bytes, member_endpoint_binding_bytes};
+use crate::transport_policy::validate_advertised_endpoint;
+
+/// Facts about this machine that members see beside its shared models.
+/// Allowlisted: the chip name and rated memory. Hostnames are deliberately not
+/// published: managed machines report asset tags, which name nothing useful
+/// and leak inventory identifiers to the community.
+#[derive(Debug, Clone, Default, PartialEq)]
+pub struct LocalDevice {
+    pub name: Option<String>,
+    pub vram_gb: Option<f64>,
+}
+
+/// Survey this machine once per process; heartbeats reuse the answer. Memory
+/// is the same rated capacity the model catalog shows as "AI memory".
+pub fn local_device() -> &'static LocalDevice {
+    static DEVICE: std::sync::OnceLock<LocalDevice> = std::sync::OnceLock::new();
+    DEVICE.get_or_init(|| {
+        let survey = mesh_llm_system::hardware::survey();
+        LocalDevice {
+            name: survey.gpu_name.as_deref().and_then(device_label),
+            vram_gb: mesh_llm_system::vram::rated_capacity_gb(survey.vram_bytes)
+                .map(|gb| gb as f64),
+        }
+    })
+}
+
+/// Trimmed and bounded; a blank OS report is no name rather than an empty one.
+fn device_label(reported: &str) -> Option<String> {
+    let name = reported.trim();
+    (!name.is_empty()).then(|| name.chars().take(64).collect())
+}
+
+/// Project the pinned SDK wrapper; its payload is untyped JSON, not a typed model schema.
+pub fn sdk_status_event(
+    owner: &OwnerKeypair,
+    member: &str,
+    serving: bool,
+    status: &mesh_llm_sdk::EmbeddedNodeStatus,
+    device: &LocalDevice,
+) -> anyhow::Result<EventBuilder> {
+    status_event(
+        owner,
+        member,
+        serving,
+        Some(&status.payload),
+        status.invite_token.as_deref(),
+        Some(device),
+    )
+}
+
+/// Construct only the discovery fields; never publish the SDK's raw status or invite.
+/// A consumer/stopped heartbeat carries owner bindings but no serving targets.
+pub fn status_event(
+    owner: &OwnerKeypair,
+    member: &str,
+    serving: bool,
+    status: Option<&Value>,
+    endpoint: Option<&str>,
+    device: Option<&LocalDevice>,
+) -> anyhow::Result<EventBuilder> {
+    nostr::key::PublicKey::from_hex(member)?;
+    let models = if serving {
+        ready_models(status)
+    } else {
+        Vec::new()
+    };
+    let endpoint = if serving && !models.is_empty() {
+        endpoint.map(validate_advertised_endpoint).transpose()?
+    } else {
+        None
+    };
+    let tokens = endpoint
+        .as_ref()
+        .map(|value| vec![value.join_token.clone()])
+        .unwrap_or_default();
+    let targets = endpoint
+        .map(|endpoint| {
+            models
+                .iter()
+                .map(|model| MeshServeTarget {
+                    model_id: model.id.clone(),
+                    model_name: model.name.clone(),
+                    endpoint_addr: endpoint.join_token.clone(),
+                    reporter_pubkey: None,
+                    owner_id: None,
+                    node_name: status
+                        .and_then(|v| v["node_id"].as_str())
+                        .map(str::to_owned),
+                    capacity: device.and_then(|device| device.vram_gb).map(|vram_gb| {
+                        MeshTargetCapacity {
+                            vram_gb: Some(vram_gb),
+                        }
+                    }),
+                    endpoint_id: Some(endpoint.endpoint_id.clone()),
+                    device_id: None,
+                    device_name: device.and_then(|device| device.name.clone()),
+                })
+                .collect::<Vec<_>>()
+        })
+        .unwrap_or_default();
+    // Capacity is advertised only while serving; a consumer contributes none.
+    let device = device.filter(|_| !targets.is_empty());
+    let mut payload = json!({
+        "ownerId": owner.owner_id(),
+        "ownerVerifyingKey": hex::encode(owner.verifying_key().as_bytes()),
+        "ownerBindingSig": hex::encode(owner.sign_bytes(&member_binding_bytes(member))),
+        "ownerEndpointBindingSig": hex::encode(owner.sign_bytes(&member_endpoint_binding_bytes(member, &tokens))),
+        "models": models,
+        "serveTargets": targets,
+    });
+    // Top-level keys classic Buzz's snapshot reader already understands.
+    if let Some(name) = device.and_then(|device| device.name.as_deref()) {
+        payload["deviceName"] = json!(name);
+    }
+    if let Some(vram_gb) = device.and_then(|device| device.vram_gb) {
+        payload["my_vram_gb"] = json!(vram_gb);
+    }
+    Ok(
+        EventBuilder::new(Kind::Custom(MESH_STATUS_KIND as u16), payload.to_string()).tags([
+            Tag::parse([
+                "d",
+                &format!("buzz-mesh-member-status:{}", owner.owner_id()),
+            ])?,
+            Tag::parse(["k", "buzz-mesh-status"])?,
+        ]),
+    )
+}
+
+// Ported from classic mesh_llm/mod.rs:847-912. Requested serving_models are not ready.
+fn ready_models(status: Option<&Value>) -> Vec<MeshModelOption> {
+    fn collect(value: &Value, out: &mut Vec<MeshModelOption>) {
+        match value {
+            Value::Array(values) => {
+                for value in values {
+                    collect(value, out);
+                }
+            }
+            Value::Object(map) => {
+                let id = ["model_id", "modelId", "model_ref", "modelRef", "id", "name"]
+                    .iter()
+                    .find_map(|key| map.get(*key))
+                    .and_then(Value::as_str);
+                if let Some(id) = id {
+                    push(
+                        out,
+                        id,
+                        map.get("display_name")
+                            .or_else(|| map.get("displayName"))
+                            .and_then(Value::as_str),
+                    );
+                } else {
+                    for value in map.values().filter(|v| v.is_array() || v.is_object()) {
+                        collect(value, out);
+                    }
+                }
+            }
+            Value::String(id) => push(out, id, None),
+            _ => {}
+        }
+    }
+    fn push(out: &mut Vec<MeshModelOption>, id: &str, name: Option<&str>) {
+        let id = id.trim();
+        if !id.is_empty() && !id.starts_with("http://") && !id.starts_with("https://") {
+            out.push(MeshModelOption {
+                id: id.into(),
+                name: name.map(str::to_owned),
+            });
+        }
+    }
+    let mut models = Vec::new();
+    if let Some(status) = status {
+        for key in ["models", "hosted_models"] {
+            if let Some(value) = status.get(key) {
+                collect(value, &mut models);
+            }
+        }
+        if let Some(runtime) = status["runtime"]["models"].as_array() {
+            for model in runtime.iter().filter(|model| model["status"] == "ready") {
+                collect(model, &mut models);
+            }
+        }
+        // Mesh keys a cached GGUF as `local-gguf/sha256-…`; its own model
+        // catalog (`/api/models` `display_name`) carries the readable ref.
+        if let Some(names) = status[DISPLAY_NAMES_KEY].as_object() {
+            for model in &mut models {
+                let unnamed = model.name.as_deref().is_none_or(|name| name == model.id);
+                if let (true, Some(name)) = (unnamed, names.get(&model.id).and_then(Value::as_str))
+                {
+                    model.name = Some(name.to_owned());
+                }
+            }
+        }
+    }
+    dedupe_models(models)
+}
+
+/// Host-injected `{mesh model name: display name}` from Mesh's `/api/models`.
+pub const DISPLAY_NAMES_KEY: &str = "buzz_display_names";
+
+/// Project Mesh's `/api/models` response into the display-name map.
+pub fn display_names_from_models(models: &Value) -> Value {
+    let mut names = serde_json::Map::new();
+    for model in models["mesh_models"].as_array().into_iter().flatten() {
+        if let (Some(name), Some(display)) =
+            (model["name"].as_str(), model["display_name"].as_str())
+        {
+            if name != display && !display.trim().is_empty() {
+                names.insert(name.to_owned(), Value::String(display.to_owned()));
+            }
+        }
+    }
+    Value::Object(names)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn local_gguf_models_advertise_meshs_own_display_name() {
+        // Shapes captured from a live Mesh 0.78.1 node serving a cached HF GGUF.
+        let hash =
+            "local-gguf/sha256-7756e8943d5ec98b1cd76895d33d20b8c8bf7609a71540fc9b6fa512bdedd0de";
+        let catalog = json!({"mesh_models": [
+            {"name": hash, "display_name": "unsloth/Qwen3.8-27B-GGUF:UD-Q4_K_M"},
+            {"name": "unsloth/Qwen3.5-9B-GGUF:Q4_K_M", "display_name": "unsloth/Qwen3.5-9B-GGUF:Q4_K_M"},
+        ]});
+        let mut raw = json!({
+            "models": [hash],
+            "runtime": {"models": [{"name": hash, "status": "ready"}]},
+        });
+        raw[DISPLAY_NAMES_KEY] = display_names_from_models(&catalog);
+        let models = ready_models(Some(&raw));
+        assert_eq!(models.len(), 1);
+        // The routing id stays exactly what Mesh serves; only the label changes.
+        assert_eq!(models[0].id, hash);
+        assert_eq!(
+            models[0].name.as_deref(),
+            Some("unsloth/Qwen3.8-27B-GGUF:UD-Q4_K_M")
+        );
+        // Without Mesh's catalog the id is still published unchanged.
+        raw.as_object_mut().unwrap().remove(DISPLAY_NAMES_KEY);
+        assert_eq!(ready_models(Some(&raw))[0].name, None);
+    }
+    use crate::discovery::{availability_from_events, owner_ids_from_events};
+    use nostr::event::FinalizeEvent;
+    use nostr::key::Keys;
+
+    #[test]
+    fn rc4_schema_projects_ready_models_through_pinned_sdk_status_wrapper() {
+        let raw: Value =
+            serde_json::from_str(include_str!("../fixtures/sdk-status-ready.json")).unwrap();
+        let owner = OwnerKeypair::generate();
+        let member = Keys::generate();
+        let token = crate::transport_policy::endpoint_token_for_test([iroh::TransportAddr::Ip(
+            "192.168.1.20:9999".parse().unwrap(),
+        )]);
+        let sdk = mesh_llm_sdk::EmbeddedNodeStatus {
+            api_base_url: "http://127.0.0.1:19337/v1".into(),
+            console_url: "http://127.0.0.1:13131".into(),
+            invite_token: Some(token.clone()),
+            payload: raw.clone(),
+        };
+        let event = sdk_status_event(
+            &owner,
+            &member.public_key().to_hex(),
+            true,
+            &sdk,
+            &LocalDevice::default(),
+        )
+        .unwrap()
+        .finalize(&member)
+        .unwrap();
+        let payload: Value = serde_json::from_str(&event.content).unwrap();
+        assert_eq!(payload["serveTargets"].as_array().unwrap().len(), 1);
+        assert_eq!(
+            payload["serveTargets"][0]["modelId"],
+            raw["hosted_models"][0]
+        );
+        assert_eq!(payload["models"].as_array().unwrap().len(), 1);
+        assert!(payload.get("runtime").is_none());
+        // Independently exercise the runtime-only path used before hosted_models catches up.
+        assert_eq!(
+            ready_models(Some(&json!({"runtime": raw["runtime"]})))[0].id,
+            raw["hosted_models"][0].as_str().unwrap()
+        );
+    }
+
+    #[test]
+    fn signed_note_round_trips_discovery_and_does_not_publish_standby_or_raw_status() {
+        let member = Keys::generate();
+        let owner = OwnerKeypair::generate();
+        let token = crate::transport_policy::endpoint_token_for_test([iroh::TransportAddr::Ip(
+            "192.168.1.20:9999".parse().unwrap(),
+        )]);
+        let raw = json!({"hosted_models":["ready-model"], "runtime":{"models":[{"id":"warming-model","status":"loading"}]}, "serving_models":["requested-only"], "secret":"do-not-publish"});
+        let event = status_event(
+            &owner,
+            &member.public_key().to_hex(),
+            true,
+            Some(&raw),
+            Some(&token),
+            None,
+        )
+        .unwrap()
+        .finalize(&member)
+        .unwrap();
+        event.verify().unwrap();
+        assert!(!event.content.contains("do-not-publish"));
+        assert!(!event.content.contains("warming-model"));
+        assert!(!event.content.contains("requested-only"));
+        let membership = EventBuilder::new(Kind::Custom(13534), "")
+            .tags([Tag::parse(["member", &member.public_key().to_hex()]).unwrap()])
+            .finalize(&Keys::generate())
+            .unwrap();
+        // Even the legitimate Nostr member cannot substitute a dial pointer
+        // without the Mesh owner's endpoint signature.
+        let mut altered: Value = serde_json::from_str(&event.content).unwrap();
+        altered["serveTargets"][0]["endpointAddr"] =
+            json!(crate::transport_policy::endpoint_token_for_test([
+                iroh::TransportAddr::Ip("192.168.1.21:9999".parse().unwrap())
+            ]));
+        let altered = EventBuilder::new(Kind::Custom(MESH_STATUS_KIND as u16), altered.to_string())
+            .tags(event.tags.clone())
+            .finalize(&member)
+            .unwrap();
+        assert!(availability_from_events(vec![membership.clone(), altered])
+            .serve_targets
+            .is_empty());
+        let events = vec![membership.clone(), event];
+        assert_eq!(owner_ids_from_events(&events), vec![owner.owner_id()]);
+        let available = availability_from_events(events);
+        assert_eq!(available.serve_targets.len(), 1);
+        assert_eq!(available.serve_targets[0].model_id, "ready-model");
+        let stopped = status_event(
+            &owner,
+            &member.public_key().to_hex(),
+            false,
+            Some(&raw),
+            Some(&token),
+            None,
+        )
+        .unwrap()
+        .finalize(&member)
+        .unwrap();
+        assert!(!stopped.content.contains(&token));
+        let events = vec![membership, stopped];
+        assert_eq!(owner_ids_from_events(&events), vec![owner.owner_id()]);
+        assert!(availability_from_events(events).serve_targets.is_empty());
+    }
+
+    #[test]
+    fn invalid_endpoint_is_not_signed_and_only_ready_runtime_models_count() {
+        let raw = json!({"runtime":{"models":[{"model_ref":"ready","status":"ready"},{"id":"pending","status":"standby"}]}});
+        assert_eq!(ready_models(Some(&raw))[0].id, "ready");
+        assert_eq!(ready_models(Some(&raw)).len(), 1);
+        assert!(status_event(
+            &OwnerKeypair::generate(),
+            &Keys::generate().public_key().to_hex(),
+            true,
+            Some(&raw),
+            Some("invalid-token"),
+            None,
+        )
+        .is_err());
+    }
+
+    #[test]
+    fn serving_note_names_the_device_and_its_memory_only_while_serving() {
+        let member = Keys::generate();
+        let owner = OwnerKeypair::generate();
+        let token = crate::transport_policy::endpoint_token_for_test([iroh::TransportAddr::Ip(
+            "192.168.1.20:9999".parse().unwrap(),
+        )]);
+        let raw = json!({"hosted_models": ["ready-model"]});
+        let device = LocalDevice {
+            name: device_label("  Apple M4 Max "),
+            vram_gb: Some(64.0),
+        };
+        let membership = EventBuilder::new(Kind::Custom(13534), "")
+            .tags([Tag::parse(["member", &member.public_key().to_hex()]).unwrap()])
+            .finalize(&Keys::generate())
+            .unwrap();
+        let note = |serving| {
+            status_event(
+                &owner,
+                &member.public_key().to_hex(),
+                serving,
+                Some(&raw),
+                Some(&token),
+                Some(&device),
+            )
+            .unwrap()
+            .finalize(&member)
+            .unwrap()
+        };
+        let serving = note(true);
+        let payload: Value = serde_json::from_str(&serving.content).unwrap();
+        // Classic Buzz reads these top-level keys; this app reads the targets.
+        assert_eq!(payload["deviceName"], "Apple M4 Max");
+        assert_eq!(payload["my_vram_gb"], 64.0);
+        let target = &availability_from_events(vec![membership.clone(), serving]).serve_targets[0];
+        assert_eq!(target.device_name.as_deref(), Some("Apple M4 Max"));
+        assert_eq!(target.capacity.as_ref().and_then(|c| c.vram_gb), Some(64.0));
+        // A stopped heartbeat contributes no capacity and names no device.
+        let stopped = note(false);
+        assert!(!stopped.content.contains("Apple M4 Max"));
+        assert!(!stopped.content.contains("my_vram_gb"));
+        assert_eq!(device_label("   "), None);
+    }
+}
diff --git a/crates/mesh-compute/src/roster.rs b/crates/mesh-compute/src/roster.rs
new file mode 100644
index 000000000..c9d267a1f
--- /dev/null
+++ b/crates/mesh-compute/src/roster.rs
@@ -0,0 +1,162 @@
+//! Membership-change confirmation, independent of node restart and request admission.
+//! Classic policy: growth is immediate; shrink needs two matching successful polls.
+//! Read failures reset confirmation; startup defers only the restart action.
+
+#[derive(Debug, PartialEq, Eq)]
+pub enum Decision {
+    Keep,
+    AwaitConfirmation,
+    Grow(Vec<String>),
+    Shrink(Vec<String>),
+    ViewerRemoved,
+}
+
+/// Verified query outcome. Transport failure must never masquerade as removal.
+pub enum Observation {
+    Members(Vec<String>),
+    ReadFailed,
+    ViewerRemoved,
+}
+
+/// One instance belongs to one runtime generation; discard it on replacement.
+#[derive(Default)]
+pub struct Reconcile {
+    pending: Option<Vec<String>>,
+}
+
+impl Reconcile {
+    /// Compare verified owner sets. Startup defers changes, except verified viewer removal.
+    pub fn observe(
+        &mut self,
+        current: &[String],
+        observation: Observation,
+        starting: bool,
+    ) -> Decision {
+        let mut fresh = match observation {
+            Observation::ViewerRemoved => {
+                self.pending = None;
+                return Decision::ViewerRemoved;
+            }
+            Observation::ReadFailed => {
+                self.pending = None;
+                return Decision::Keep;
+            }
+            Observation::Members(owners) => owners,
+        };
+        fresh.sort();
+        fresh.dedup();
+        let mut current = current.to_vec();
+        current.sort();
+        current.dedup();
+        if fresh == current {
+            self.pending = None;
+            return Decision::Keep;
+        }
+        let shrinking = current.iter().any(|owner| !fresh.contains(owner));
+        if shrinking && self.pending.as_ref() != Some(&fresh) {
+            self.pending = Some(fresh);
+            return Decision::AwaitConfirmation;
+        }
+        self.pending = None;
+        if starting {
+            return Decision::Keep;
+        }
+        if shrinking {
+            Decision::Shrink(fresh)
+        } else {
+            Decision::Grow(fresh)
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    fn members(values: &[&str]) -> Observation {
+        Observation::Members(values.iter().map(|s| (*s).into()).collect())
+    }
+    #[test]
+    fn growth_is_immediate_but_shrink_needs_two_consecutive_successes() {
+        let current = vec!["a".into()];
+        let mut state = Reconcile::default();
+        assert_eq!(
+            state.observe(&current, members(&["b", "a", "a"]), false),
+            Decision::Grow(vec!["a".into(), "b".into()])
+        );
+        assert_eq!(
+            state.observe(&current, members(&[]), false),
+            Decision::AwaitConfirmation
+        );
+        assert_eq!(
+            state.observe(&current, Observation::ReadFailed, false),
+            Decision::Keep
+        );
+        assert_eq!(
+            state.observe(&current, members(&[]), false),
+            Decision::AwaitConfirmation
+        );
+        assert_eq!(
+            state.observe(&current, members(&[]), false),
+            Decision::Shrink(vec![])
+        );
+    }
+    #[test]
+    fn recovery_and_different_shrink_reset_confirmation() {
+        let current = vec!["a".into(), "b".into()];
+        let mut state = Reconcile::default();
+        assert_eq!(
+            state.observe(&current, members(&["a"]), false),
+            Decision::AwaitConfirmation
+        );
+        assert_eq!(
+            state.observe(&current, members(&["b"]), false),
+            Decision::AwaitConfirmation
+        );
+        assert_eq!(
+            state.observe(&current, members(&["b", "a"]), false),
+            Decision::Keep
+        );
+        assert_eq!(
+            state.observe(&current, members(&["b"]), false),
+            Decision::AwaitConfirmation
+        );
+        assert_eq!(
+            state.observe(&current, members(&["b"]), false),
+            Decision::Shrink(vec!["b".into()])
+        );
+    }
+    #[test]
+    fn startup_defers_action_not_observation_and_viewer_removal_is_immediate() {
+        let current = vec!["a".into()];
+        let mut state = Reconcile::default();
+        assert_eq!(
+            state.observe(&current, members(&[]), true),
+            Decision::AwaitConfirmation
+        );
+        assert_eq!(
+            state.observe(&current, members(&[]), false),
+            Decision::Shrink(vec![])
+        );
+        assert_eq!(
+            state.observe(&current, members(&[]), true),
+            Decision::AwaitConfirmation
+        );
+        assert_eq!(state.observe(&current, members(&[]), true), Decision::Keep);
+        assert_eq!(
+            state.observe(&current, members(&[]), false),
+            Decision::AwaitConfirmation
+        );
+        assert_eq!(
+            state.observe(&current, members(&["a", "b"]), true),
+            Decision::Keep
+        );
+        assert_eq!(
+            state.observe(&current, members(&["a", "b"]), false),
+            Decision::Grow(vec!["a".into(), "b".into()])
+        );
+        assert_eq!(
+            state.observe(&current, Observation::ViewerRemoved, true),
+            Decision::ViewerRemoved
+        );
+    }
+}
diff --git a/crates/mesh-compute/src/startup_log.rs b/crates/mesh-compute/src/startup_log.rs
new file mode 100644
index 000000000..2cb3d87ea
--- /dev/null
+++ b/crates/mesh-compute/src/startup_log.rs
@@ -0,0 +1,13 @@
+//! Diagnostic stage markers for Mesh startup latency: wall-clock timestamp, stage
+//! name and the stage's own duration only. No attempt correlation is claimed, and
+//! nothing sensitive (prompts, keys, config, addresses) is ever logged.
+use std::time::{SystemTime, UNIX_EPOCH};
+
+/// Log a timestamped stage marker.
+pub fn stage(name: &str, detail: &str) {
+    let ts = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_millis())
+        .unwrap_or(0);
+    eprintln!("mesh-startup ts_ms={ts} stage={name} {detail}");
+}
diff --git a/crates/mesh-compute/src/transport_policy.rs b/crates/mesh-compute/src/transport_policy.rs
new file mode 100644
index 000000000..8f363c49a
--- /dev/null
+++ b/crates/mesh-compute/src/transport_policy.rs
@@ -0,0 +1,528 @@
+// Ported from block/buzz 5fdb2e536, desktop/src-tauri/src/mesh_llm/transport_policy.rs.
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use iroh::{EndpointAddr, RelayUrl, TransportAddr};
+use mesh_llm_host_runtime::SignedBootstrapToken;
+
+const MESH_IROH_RELAYS_ENV: &str = "BUZZ_MESH_IROH_RELAYS";
+
+const MAX_INVITE_TOKEN_LEN: usize = 64 * 1024;
+const MAX_BOOTSTRAP_ADDRS: usize = 8;
+const MAX_ENDPOINT_TRANSPORT_ADDRS: usize = 16;
+
+/// Locally configured iroh relay policy. Remote discovery may only advertise
+/// relay URLs that this node was already configured to contact.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(super) enum IrohRelayMode {
+    /// Direct QUIC only; advertised endpoint tokens must not contain relays.
+    Disabled,
+    /// Iroh's production relay set, enabled by default for NAT traversal.
+    Default,
+    /// An explicit, locally configured relay allowlist.
+    Custom(Vec<RelayUrl>),
+}
+
+pub(super) fn iroh_relay_mode() -> anyhow::Result<IrohRelayMode> {
+    iroh_relay_mode_from(std::env::var(MESH_IROH_RELAYS_ENV).ok().as_deref())
+}
+
+pub(super) fn iroh_relay_mode_from(raw: Option<&str>) -> anyhow::Result<IrohRelayMode> {
+    match raw.map(str::trim) {
+        Some("0") => Ok(IrohRelayMode::Disabled),
+        None | Some("") | Some("1") | Some("default") => Ok(IrohRelayMode::Default),
+        Some(list) => {
+            let urls = list
+                .split(',')
+                .map(str::trim)
+                .filter(|url| !url.is_empty())
+                .map(parse_configured_relay_url)
+                .collect::<anyhow::Result<Vec<_>>>()?;
+            if urls.is_empty() {
+                anyhow::bail!("{MESH_IROH_RELAYS_ENV} must contain at least one relay URL");
+            }
+            Ok(IrohRelayMode::Custom(urls))
+        }
+    }
+}
+
+pub(super) fn sdk_iroh_relay_config(mode: IrohRelayMode) -> (bool, Vec<String>) {
+    match mode {
+        IrohRelayMode::Disabled => (true, Vec::new()),
+        IrohRelayMode::Default => (
+            false,
+            MESH_LLM_DEFAULT_RELAYS
+                .iter()
+                .map(|url| (*url).to_string())
+                .collect(),
+        ),
+        IrohRelayMode::Custom(urls) => {
+            (false, urls.into_iter().map(|url| url.to_string()).collect())
+        }
+    }
+}
+
+fn parse_configured_relay_url(raw: &str) -> anyhow::Result<RelayUrl> {
+    let parsed = url::Url::parse(raw)
+        .map_err(|error| anyhow::anyhow!("invalid relay URL {raw:?}: {error}"))?;
+    let secure = parsed.scheme() == "https";
+    let local_http = parsed.scheme() == "http"
+        && parsed.host().is_some_and(|host| match host {
+            url::Host::Domain(domain) => domain.eq_ignore_ascii_case("localhost"),
+            url::Host::Ipv4(ip) => ip.is_loopback(),
+            url::Host::Ipv6(ip) => ip.is_loopback(),
+        });
+    if !secure && !local_http {
+        anyhow::bail!(
+            "relay URL {raw:?} must use https (http is allowed only for loopback development)"
+        );
+    }
+    if !parsed.username().is_empty()
+        || parsed.password().is_some()
+        || parsed.query().is_some()
+        || parsed.fragment().is_some()
+        || !matches!(parsed.path(), "" | "/")
+    {
+        anyhow::bail!(
+            "relay URL {raw:?} must be an origin without credentials, path, query, or fragment"
+        );
+    }
+    raw.parse::<RelayUrl>()
+        .map_err(|error| anyhow::anyhow!("invalid iroh relay URL {raw:?}: {error}"))
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(super) struct ValidatedEndpoint {
+    pub endpoint_id: String,
+    pub join_token: String,
+}
+
+pub(super) fn validate_advertised_endpoint(
+    invite_token: &str,
+) -> anyhow::Result<ValidatedEndpoint> {
+    let mode = iroh_relay_mode()?;
+    validate_advertised_endpoint_with_mode(invite_token, &mode)
+}
+
+pub(super) fn validate_advertised_endpoint_with_mode(
+    invite_token: &str,
+    mode: &IrohRelayMode,
+) -> anyhow::Result<ValidatedEndpoint> {
+    let token = invite_token.trim();
+    if token.is_empty() {
+        anyhow::bail!("mesh invite token is empty");
+    }
+    if token.len() > MAX_INVITE_TOKEN_LEN {
+        anyhow::bail!("mesh invite token exceeds {MAX_INVITE_TOKEN_LEN} bytes");
+    }
+    let payload = URL_SAFE_NO_PAD
+        .decode(token)
+        .map_err(|error| anyhow::anyhow!("invalid mesh invite encoding: {error}"))?;
+
+    if let Ok(mut addr) = serde_json::from_slice::<EndpointAddr>(&payload) {
+        retain_usable_transports(&mut addr, mode)?;
+        let endpoint_id = addr.id.to_string();
+        let join_token = URL_SAFE_NO_PAD.encode(serde_json::to_vec(&addr)?);
+        return Ok(ValidatedEndpoint {
+            endpoint_id,
+            join_token,
+        });
+    }
+
+    let signed = serde_json::from_slice::<SignedBootstrapToken>(&payload)
+        .map_err(|error| anyhow::anyhow!("invalid mesh invite payload: {error}"))?;
+    signed
+        .verify()
+        .map_err(|reason| anyhow::anyhow!("invalid signed mesh invite: {}", reason.code()))?;
+    if signed.serialized_addrs.is_empty() || signed.serialized_addrs.len() > MAX_BOOTSTRAP_ADDRS {
+        anyhow::bail!(
+            "signed mesh invite must contain 1..={MAX_BOOTSTRAP_ADDRS} endpoint addresses"
+        );
+    }
+    let addrs = signed
+        .serialized_addrs
+        .iter()
+        .map(|bytes| {
+            serde_json::from_slice::<EndpointAddr>(bytes)
+                .map_err(|error| anyhow::anyhow!("invalid signed endpoint address: {error}"))
+        })
+        .collect::<anyhow::Result<Vec<_>>>()?;
+
+    // Rewriting a signed token would invalidate its signature. Keep the signed
+    // envelope intact only when every advertised transport is policy-approved;
+    // mixed signed tokens fail closed rather than leaking rejected dial targets.
+    for addr in &addrs {
+        validate_signed_transports(addr, mode)?;
+    }
+    Ok(ValidatedEndpoint {
+        endpoint_id: addrs[0].id.to_string(),
+        join_token: token.to_string(),
+    })
+}
+
+fn retain_usable_transports(addr: &mut EndpointAddr, mode: &IrohRelayMode) -> anyhow::Result<()> {
+    validate_transport_count(addr)?;
+    let mut rejections = Vec::new();
+    addr.addrs
+        .retain(|transport| match validate_transport(transport, mode) {
+            Ok(()) => true,
+            Err(error) => {
+                rejections.push(error.to_string());
+                false
+            }
+        });
+    if addr.addrs.is_empty() {
+        anyhow::bail!(
+            "mesh endpoint has no usable transport address (all rejected: {})",
+            rejections.join("; ")
+        );
+    }
+    Ok(())
+}
+
+fn validate_signed_transports(addr: &EndpointAddr, mode: &IrohRelayMode) -> anyhow::Result<()> {
+    validate_transport_count(addr)?;
+    let mut usable = 0usize;
+    for transport in &addr.addrs {
+        match validate_transport(transport, mode) {
+            Ok(()) => usable += 1,
+            // mesh-llm currently signs its own port-0 placeholder alongside a
+            // valid relay. It is non-dialable, so preserving it is safe and
+            // necessary for stock signed tokens to remain usable.
+            Err(_) if matches!(transport, TransportAddr::Ip(socket) if socket.port() == 0) => {}
+            Err(error) => return Err(error),
+        }
+    }
+    if usable == 0 {
+        anyhow::bail!("signed mesh endpoint has no usable transport address");
+    }
+    Ok(())
+}
+
+fn validate_transport_count(addr: &EndpointAddr) -> anyhow::Result<()> {
+    if addr.addrs.is_empty() || addr.addrs.len() > MAX_ENDPOINT_TRANSPORT_ADDRS {
+        anyhow::bail!(
+            "mesh endpoint must contain 1..={MAX_ENDPOINT_TRANSPORT_ADDRS} transport addresses"
+        );
+    }
+    Ok(())
+}
+
+fn validate_transport(transport: &TransportAddr, mode: &IrohRelayMode) -> anyhow::Result<()> {
+    match transport {
+        TransportAddr::Relay(relay) if relay_allowed(relay, mode) => Ok(()),
+        TransportAddr::Relay(relay) => anyhow::bail!("unapproved relay URL {relay}"),
+        TransportAddr::Ip(socket) => validate_direct_socket(*socket),
+        _ => anyhow::bail!("unsupported transport address"),
+    }
+}
+
+/// mesh-llm's default public relay set (`RelayPolicy::DefaultPublic` in
+/// `mesh-llm-host-runtime`). A stock mesh-llm server with no custom relay
+/// config advertises endpoints on exactly these relays, so buzz's `Default`
+/// mode MUST accept them — otherwise shared compute rejects every out-of-the-box
+/// mesh-llm serving node (they are not in iroh's own prod relay map).
+///
+/// Kept in sync with `effective_relay_urls(RelayPolicy::DefaultPublic, &[])`.
+pub(super) const MESH_LLM_DEFAULT_RELAYS: &[&str] = &[
+    "https://usw1-2.relay.michaelneale.mesh-llm.iroh.link./",
+    "https://aps1-1.relay.michaelneale.mesh-llm.iroh.link./",
+    "https://euc1-1.relay.michaelneale.mesh-llm.iroh.link./",
+    "https://use1-1.relay.michaelneale.mesh-llm.iroh.link./",
+];
+
+/// Whether `relay` is one of mesh-llm's baked-in default public relays.
+/// Parses each known URL to a `RelayUrl` so comparison is normalization-safe
+/// (matches regardless of trailing-dot / trailing-slash formatting).
+fn is_mesh_llm_default_relay(relay: &RelayUrl) -> bool {
+    MESH_LLM_DEFAULT_RELAYS.iter().any(|candidate| {
+        candidate
+            .parse::<RelayUrl>()
+            .map(|known| &known == relay)
+            .unwrap_or(false)
+    })
+}
+
+fn relay_allowed(relay: &RelayUrl, mode: &IrohRelayMode) -> bool {
+    match mode {
+        IrohRelayMode::Disabled => false,
+        // `Default` covers both iroh's own production relays AND mesh-llm's
+        // default public relays. Without the latter, a stock mesh-llm serving
+        // node is unreachable by default and shared compute silently fails with
+        // "no live member is serving this model" even though discovery found it.
+        IrohRelayMode::Default => {
+            iroh::defaults::prod::default_relay_map().contains(relay)
+                || is_mesh_llm_default_relay(relay)
+        }
+        IrohRelayMode::Custom(urls) => urls.contains(relay),
+    }
+}
+
+fn validate_direct_socket(socket: std::net::SocketAddr) -> anyhow::Result<()> {
+    let ip = socket.ip();
+    let unsafe_target = socket.port() == 0
+        || ip.is_unspecified()
+        || ip.is_loopback()
+        || ip.is_multicast()
+        || match ip {
+            std::net::IpAddr::V4(ip) => ip.is_link_local() || ip.is_broadcast(),
+            std::net::IpAddr::V6(ip) => ip.is_unicast_link_local(),
+        };
+    if unsafe_target {
+        anyhow::bail!("mesh endpoint advertises unsafe direct address {socket}");
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+pub(super) fn endpoint_token_for_test(
+    transports: impl IntoIterator<Item = TransportAddr>,
+) -> String {
+    let mut addr = EndpointAddr::new(iroh::SecretKey::generate().public());
+    addr.addrs.extend(transports);
+    URL_SAFE_NO_PAD.encode(serde_json::to_vec(&addr).expect("serialize test endpoint"))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn configured_relays_require_safe_origins() {
+        assert!(iroh_relay_mode_from(Some("https://relay.example")).is_ok());
+        assert!(iroh_relay_mode_from(Some("http://127.0.0.1:3340")).is_ok());
+        for invalid in [
+            "http://relay.example",
+            "https://user@relay.example",
+            "https://relay.example/path",
+            "https://relay.example?token=secret",
+        ] {
+            assert!(
+                iroh_relay_mode_from(Some(invalid)).is_err(),
+                "accepted unsafe relay {invalid}"
+            );
+        }
+    }
+
+    #[test]
+    fn remote_relay_must_match_local_policy() {
+        let allowed: RelayUrl = "https://relay.example".parse().unwrap();
+        let other: RelayUrl = "https://other.example".parse().unwrap();
+        let token = endpoint_token_for_test([TransportAddr::Relay(allowed.clone())]);
+        assert!(validate_advertised_endpoint_with_mode(
+            &token,
+            &IrohRelayMode::Custom(vec![allowed])
+        )
+        .is_ok());
+        assert!(validate_advertised_endpoint_with_mode(
+            &token,
+            &IrohRelayMode::Custom(vec![other])
+        )
+        .is_err());
+        assert!(validate_advertised_endpoint_with_mode(&token, &IrohRelayMode::Disabled).is_err());
+    }
+
+    #[test]
+    fn default_mode_accepts_meshllm_default_relays() {
+        // Regression: a stock mesh-llm serving node advertises endpoints on
+        // mesh-llm's OWN default public relays (not iroh's prod relay map).
+        // Under `Default` mode these MUST be accepted, or shared compute rejects
+        // every out-of-the-box mesh-llm server with "no live member is serving
+        // this model" even though discovery found it. See mesh-llm
+        // effective_relay_urls(RelayPolicy::DefaultPublic, &[]).
+        for relay_url in MESH_LLM_DEFAULT_RELAYS {
+            let relay: RelayUrl = relay_url
+                .parse()
+                .unwrap_or_else(|e| panic!("mesh-llm default relay {relay_url:?} must parse: {e}"));
+            assert!(
+                relay_allowed(&relay, &IrohRelayMode::Default),
+                "Default mode must accept mesh-llm default relay {relay_url}"
+            );
+
+            // And end-to-end through the advertised-endpoint validator.
+            let token = endpoint_token_for_test([TransportAddr::Relay(relay)]);
+            assert!(
+                validate_advertised_endpoint_with_mode(&token, &IrohRelayMode::Default).is_ok(),
+                "Default mode must validate an endpoint on mesh-llm default relay {relay_url}"
+            );
+        }
+    }
+
+    #[test]
+    fn sdk_default_relays_are_exactly_the_trusted_default_relays() {
+        let (disabled, configured) = sdk_iroh_relay_config(IrohRelayMode::Default);
+        assert!(!disabled);
+        let configured = configured
+            .into_iter()
+            .map(|url| url.parse::<RelayUrl>().expect("SDK relay URL must parse"))
+            .collect::<Vec<_>>();
+        let trusted = MESH_LLM_DEFAULT_RELAYS
+            .iter()
+            .map(|url| {
+                url.parse::<RelayUrl>()
+                    .expect("trusted relay URL must parse")
+            })
+            .collect::<Vec<_>>();
+        assert_eq!(configured, trusted);
+        assert!(configured
+            .iter()
+            .all(|relay| relay_allowed(relay, &IrohRelayMode::Default)));
+    }
+
+    #[test]
+    fn endpoint_with_one_good_and_one_junk_candidate_is_sanitized() {
+        // A mesh-llm endpoint can advertise a usable relay alongside an
+        // unusable direct IP. Keep the endpoint reachable, but never pass the
+        // rejected candidate through to iroh's parallel dialer.
+        let good_relay: RelayUrl = MESH_LLM_DEFAULT_RELAYS[0].parse().unwrap();
+        let unsafe_socket = "169.254.169.254:80".parse().unwrap();
+        let token = endpoint_token_for_test([
+            TransportAddr::Relay(good_relay.clone()),
+            TransportAddr::Ip(unsafe_socket),
+        ]);
+        let validated =
+            validate_advertised_endpoint_with_mode(&token, &IrohRelayMode::Default).unwrap();
+        let payload = URL_SAFE_NO_PAD.decode(validated.join_token).unwrap();
+        let sanitized: EndpointAddr = serde_json::from_slice(&payload).unwrap();
+        assert_eq!(
+            sanitized.addrs,
+            [TransportAddr::Relay(good_relay)].into_iter().collect()
+        );
+    }
+
+    #[test]
+    fn endpoint_with_all_junk_candidates_is_rejected() {
+        // Guard: if EVERY candidate is unusable, the endpoint must still fail.
+        let token = endpoint_token_for_test([
+            TransportAddr::Ip("180.181.228.108:0".parse().unwrap()), // port 0
+            TransportAddr::Ip("127.0.0.1:9337".parse().unwrap()),    // loopback
+        ]);
+        assert!(
+            validate_advertised_endpoint_with_mode(&token, &IrohRelayMode::Default).is_err(),
+            "endpoint with no usable candidate must be rejected"
+        );
+    }
+
+    #[test]
+    fn default_mode_still_rejects_unknown_relay() {
+        // Guard the fix doesn't over-open: a relay that is neither iroh-prod nor
+        // a mesh-llm default must still be rejected under Default mode.
+        let unknown: RelayUrl = "https://not-a-real-relay.example".parse().unwrap();
+        assert!(!relay_allowed(&unknown, &IrohRelayMode::Default));
+        let token = endpoint_token_for_test([TransportAddr::Relay(unknown)]);
+        assert!(validate_advertised_endpoint_with_mode(&token, &IrohRelayMode::Default).is_err());
+    }
+
+    #[test]
+    fn remote_endpoint_rejects_unsafe_direct_targets_and_oversized_tokens() {
+        for socket in ["127.0.0.1:9337", "169.254.169.254:80", "0.0.0.0:1"] {
+            let token = endpoint_token_for_test([TransportAddr::Ip(socket.parse().unwrap())]);
+            assert!(
+                validate_advertised_endpoint_with_mode(&token, &IrohRelayMode::Default).is_err(),
+                "accepted unsafe target {socket}"
+            );
+        }
+        let valid =
+            endpoint_token_for_test([TransportAddr::Ip("192.168.1.20:47916".parse().unwrap())]);
+        assert!(validate_advertised_endpoint_with_mode(&valid, &IrohRelayMode::Default).is_ok());
+        assert!(validate_advertised_endpoint_with_mode(
+            &"a".repeat(MAX_INVITE_TOKEN_LEN + 1),
+            &IrohRelayMode::Default
+        )
+        .is_err());
+    }
+
+    #[test]
+    fn accepts_verified_meshllm_signed_bootstrap_token_and_rejects_tampering() {
+        use mesh_llm_host_runtime::crypto::OwnerKeypair;
+        use mesh_llm_host_runtime::{
+            MeshGenesisPolicy, MeshRequirements, SignedBootstrapToken, SignedMeshGenesisPolicy,
+        };
+
+        let owner = OwnerKeypair::generate();
+        let policy = MeshGenesisPolicy::new(
+            owner.owner_id(),
+            1_717_171_717_000,
+            MeshRequirements::default(),
+        )
+        .expect("create test mesh policy");
+        let signed_policy =
+            SignedMeshGenesisPolicy::sign(policy, &owner).expect("sign test mesh policy");
+        let endpoint = EndpointAddr {
+            id: iroh::SecretKey::generate().public(),
+            addrs: [TransportAddr::Ip("192.168.1.20:47916".parse().unwrap())]
+                .into_iter()
+                .collect(),
+        };
+        let signed = SignedBootstrapToken::sign(
+            vec![serde_json::to_vec(&endpoint).unwrap()],
+            &signed_policy,
+            None,
+            &owner,
+        )
+        .expect("sign test bootstrap token");
+        let token = URL_SAFE_NO_PAD.encode(serde_json::to_vec(&signed).unwrap());
+        assert_eq!(
+            validate_advertised_endpoint_with_mode(&token, &IrohRelayMode::Default)
+                .unwrap()
+                .endpoint_id,
+            endpoint.id.to_string()
+        );
+
+        let good_relay: RelayUrl = MESH_LLM_DEFAULT_RELAYS[0].parse().unwrap();
+        let placeholder_endpoint = EndpointAddr {
+            id: endpoint.id,
+            addrs: [
+                TransportAddr::Relay(good_relay.clone()),
+                TransportAddr::Ip("180.181.228.108:0".parse().unwrap()),
+            ]
+            .into_iter()
+            .collect(),
+        };
+        let placeholder_signed = SignedBootstrapToken::sign(
+            vec![serde_json::to_vec(&placeholder_endpoint).unwrap()],
+            &signed_policy,
+            None,
+            &owner,
+        )
+        .expect("sign placeholder test bootstrap token");
+        let placeholder_token =
+            URL_SAFE_NO_PAD.encode(serde_json::to_vec(&placeholder_signed).unwrap());
+        assert!(
+            validate_advertised_endpoint_with_mode(&placeholder_token, &IrohRelayMode::Default)
+                .is_ok(),
+            "signed stock token with a port-0 placeholder must remain usable"
+        );
+
+        let mixed_endpoint = EndpointAddr {
+            id: endpoint.id,
+            addrs: [
+                TransportAddr::Relay(good_relay),
+                TransportAddr::Ip("169.254.169.254:80".parse().unwrap()),
+            ]
+            .into_iter()
+            .collect(),
+        };
+        let mixed_signed = SignedBootstrapToken::sign(
+            vec![serde_json::to_vec(&mixed_endpoint).unwrap()],
+            &signed_policy,
+            None,
+            &owner,
+        )
+        .expect("sign mixed test bootstrap token");
+        let mixed_token = URL_SAFE_NO_PAD.encode(serde_json::to_vec(&mixed_signed).unwrap());
+        assert!(
+            validate_advertised_endpoint_with_mode(&mixed_token, &IrohRelayMode::Default).is_err(),
+            "signed mixed-candidate tokens must fail closed because they cannot be rewritten"
+        );
+
+        let mut tampered = signed;
+        tampered.serialized_addrs[0] = serde_json::to_vec(&EndpointAddr {
+            id: endpoint.id,
+            addrs: [TransportAddr::Ip("192.168.1.21:47916".parse().unwrap())]
+                .into_iter()
+                .collect(),
+        })
+        .unwrap();
+        let token = URL_SAFE_NO_PAD.encode(serde_json::to_vec(&tampered).unwrap());
+        assert!(validate_advertised_endpoint_with_mode(&token, &IrohRelayMode::Default).is_err());
+    }
+}
diff --git a/crates/plugin-manager/src/lib.rs b/crates/plugin-manager/src/lib.rs
index 7d24553a0..a39b9605d 100644
--- a/crates/plugin-manager/src/lib.rs
+++ b/crates/plugin-manager/src/lib.rs
@@ -165,6 +165,10 @@ pub fn bundled_manifests() -> Vec<Manifest> {
         ..HostGrants::default()
     });
     vec![
+        serde_json::from_str(include_str!(
+            "../../../src/bundled/mesh-compute/manifest.json"
+        ))
+        .expect("mesh manifest"),
         builderlab,
         serde_json::from_str(include_str!("../../../src/bundled/pairing/manifest.json"))
             .expect("valid pairing manifest"),
diff --git a/crates/plugin-manager/tests/management.rs b/crates/plugin-manager/tests/management.rs
index 7ee667e92..68f2bc998 100644
--- a/crates/plugin-manager/tests/management.rs
+++ b/crates/plugin-manager/tests/management.rs
@@ -671,7 +671,10 @@ fn bundled_defaults_preserve_saved_choices_and_only_channels_is_required() {
         .any(|plugin| plugin.manifest.id == "buzz.me"));
     for plugin in &catalog.plugins {
         let id = plugin.manifest.id.as_str();
-        let default = !matches!(id, "buzz.bestie" | "buzz.todos" | "buzz.channel-templates");
+        let default = !matches!(
+            id,
+            "buzz.bestie" | "buzz.todos" | "buzz.channel-templates" | "buzz.mesh-compute"
+        );
         assert_eq!(plugin.enabled, default, "{id}");
         if id == "buzz.channels" {
             assert!(manager.change("disable", id).is_err());
diff --git a/docs/agent-control.md b/docs/agent-control.md
index bab2118c6..999564cbd 100644
--- a/docs/agent-control.md
+++ b/docs/agent-control.md
@@ -1166,3 +1166,72 @@ controls must remain reachable. Linked profiles remain visible on identity cards
 
 Before starting an imported identity, stop the old agent and disable its automatic
 startup in the old application. Do not run duplicate copies of the same identity.
+
+## Shared compute preview
+
+The opt-in **Shared compute** plugin contributes Settings → selected community →
+Shared compute. It selects a catalog-backed model for this device; Advanced owns
+manual model selection. **Create community agent** opens the normal creation
+form prefilled with Buzz Agent, Buzz shared compute and Auto. Creation, startup,
+profile publication and recovery remain owned by the existing agent controller.
+No identity is created just by opening the page or shortcut.
+
+Mesh agents saved to start on launch wait for their community's plugin lease;
+selecting that community resumes queued agents without opening Settings. Explicit
+Stop cancels that pending restore. This preview still supports one selected
+community node, not concurrent nodes for every saved community.
+
+Old unbound `mesh-sharing.json` files are preserved. They do not grant permission
+to resume sharing for the current viewer. A later explicit Share writes the
+viewer/community-bound `mesh-sharing-viewer.json` checkpoint instead. A corrupt
+bound sidecar remains a visible storage failure; it is not silently overwritten.
+
+The Mesh SDK is pinned to v0.78.1. Local catalog probing verifies hardware-based
+selection, and synthetic native/browser checks cover legacy settings, restore
+admission and the creation shortcut. These do not establish packaged live
+community → sharing → agent reply → quit/relaunch acceptance.
+
+### Mesh community lifetime and failure recovery
+
+Foreground navigation does not move a selected Mesh binding. The Shared compute
+page discloses the bound origin while viewing another community and hides its
+share/reset controls there. **Use compute in this community instead** requires a
+second confirmation: pending Mesh launches are cancelled and captured running
+Mesh consumers must exit before the node's loopback endpoint can be reused.
+Agent enabled/start-on-launch settings are not rewritten. An agent whose community
+differs from the bound community cannot prepare a launch, including restore.
+Plugin disable/disposal stops processes; ordinary page navigation does not.
+
+Authoritative membership is read independently of optional advertisements. Older
+rosters cannot revoke newer admitted membership. Confirmed removal rebuilds from
+retained, signed owner bindings without requiring a successful status read; no
+new owner is admitted on that partial evidence. Fresh routes are filtered to that
+retained admission; if discovery fails, a consumer restarts without expired routes
+and the existing coordinator can discover routes on its next tick. Viewer removal
+requests compute shutdown independently of agent-cleanup errors. A revoked binding
+still requires consumer retirement before another selection; a pristine first
+selection preserves queued launch restores. Peer join failure keeps the healthy
+node running. Repeated queued/in-flight join tokens coalesce until completion. Mesh v0.78.1 still
+serializes Shutdown behind an in-flight Join: status remains available, queued
+joins are discarded on stop, and the UI reports finishing the peer connection.
+The shutdown budget is 120 seconds for that outstanding join plus the usual
+12 seconds; uncertain shutdown still refuses replacement.
+
+Native initialization and embedded startup use the same explicit isolated
+configuration. Only a failure proven to precede node creation is retryable without
+process restart; unknown SDK startup/teardown failures remain fenced.
+
+Enrollment matches legacy Buzz: the member/device-owner binding is published
+only while Mesh actually runs on this device (Share, or a Mesh agent starting a
+node), never merely because the plugin is enabled. When a run ends, one
+non-serving note is published and publication then stops until Mesh runs again.
+Starting Share or a Mesh agent is the consent; there is no separate withdrawal.
+
+Native artifact trust is unchanged from legacy Buzz: both use the Mesh SDK's
+runtime installer, which downloads the native runtime and verifies its sha256
+against the release manifest (checksum-only; the SDK does not yet implement
+signature verification). The Rust tag pin does not independently pin downloaded
+native artifact bytes. Stronger artifact policy (pinned hashes, bundling or
+upstream signatures) is a separate follow-up, not part of this port. Optional failed
+old-community retirement is best-effort; routing advertisements expire after
+120 seconds. No live packaged acceptance is claimed by fixture tests.
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index a9ed8c7a8..e13cfc4ec 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -9,11 +9,16 @@ rust-version = "1.77.2"
 name = "buzz_foundation_lib"
 crate-type = ["staticlib", "cdylib", "rlib"]
 
+[features]
+default = []
+mesh = ["dep:buzz-mesh-compute", "buzz-mesh-compute/mesh"]
+
 [build-dependencies]
 url = "2"
 tauri-build = { version = "2", features = [] }
 
 [dependencies]
+buzz-mesh-compute = { path = "../crates/mesh-compute", optional = true }
 buzz-pairing = { path = "../crates/pairing" }
 nostr-pairing = { package = "nostr", version = "0.44", features = ["nip44"] }
 tokio-util = "0.7"
@@ -58,7 +63,8 @@ tempfile = "3"
 fs2 = "0.4"
 arboard = { version = "3", features = ["wayland-data-control"] }
 image = { version = "0.25", default-features = false, features = ["jpeg", "png", "webp", "gif"] }
-rusqlite = { version = "0.38", features = ["bundled"] }
+rusqlite = { version = "0.40", features = ["bundled"] }
+
 
 [dev-dependencies]
 hex = "0.4"
diff --git a/src-tauri/build.rs b/src-tauri/build.rs
index ec00cd6b2..5f7ffa3de 100644
--- a/src-tauri/build.rs
+++ b/src-tauri/build.rs
@@ -165,6 +165,15 @@ fn main() {
             "browser_navigate",
             "browser_action",
             "browser_status",
+            "mesh_compute_catalog",
+            "mesh_compute_share",
+            "mesh_compute_inventory",
+            "mesh_compute_status",
+            "mesh_compute_stop",
+            "mesh_compute_start",
+            "mesh_compute_select",
+            "mesh_compute_release",
+            "mesh_compute_disarm",
         ])),
     )
     .expect("Could not build Tauri resources")
diff --git a/src-tauri/capabilities/default.json b/src-tauri/capabilities/default.json
index fac28ed35..8541e9ea2 100644
--- a/src-tauri/capabilities/default.json
+++ b/src-tauri/capabilities/default.json
@@ -129,6 +129,15 @@
     "allow-terminal-resize",
     "allow-terminal-close",
     "allow-terminal-close-owner",
+    "allow-mesh-compute-catalog",
+    "allow-mesh-compute-share",
+    "allow-mesh-compute-inventory",
+    "allow-mesh-compute-status",
+    "allow-mesh-compute-stop",
+    "allow-mesh-compute-start",
+    "allow-mesh-compute-select",
+    "allow-mesh-compute-release",
+    "allow-mesh-compute-disarm",
     "allow-browser-attach",
     "allow-browser-set-bounds",
     "allow-browser-detach",
diff --git a/src-tauri/src/agent_models.rs b/src-tauri/src/agent_models.rs
index f646a14cc..db62008c1 100644
--- a/src-tauri/src/agent_models.rs
+++ b/src-tauri/src/agent_models.rs
@@ -431,6 +431,41 @@ pub(crate) async fn agent_models_run<R: tauri::Runtime>(
             })
             .await;
     }
+    let context = if request.action != Operation::Disconnect {
+        match request.edit.clone() {
+            Some(edit) => {
+                controller
+                    .model_context(request.id.as_deref(), request.expected_revision, edit)
+                    .await
+            }
+            None => Err("Agent draft is required for model lookup".to_owned()),
+        }
+    } else {
+        Err("Disconnect has no model context".to_owned())
+    };
+    if context.as_ref().is_ok_and(|context| context.mesh) {
+        return host
+            .run(ticket, async move {
+                let context = context?;
+                if request.action == Operation::Test {
+                    return Err("Start the agent to test Buzz shared compute".into());
+                }
+                let entries =
+                    crate::mesh_compute::agent_models(&app, context.relay.as_deref()).await?;
+                Ok(Catalog {
+                    host: String::new(),
+                    models: entries
+                        .into_iter()
+                        .map(|(id, name)| Model { id, name })
+                        .collect(),
+                    model_overridden: context.model_overridden,
+                    disconnected: false,
+                    tested_model: None,
+                    codex: None,
+                })
+            })
+            .await;
+    }
     if request.action == Operation::Test {
         return host
             .run(ticket, async {
@@ -463,14 +498,6 @@ pub(crate) async fn agent_models_run<R: tauri::Runtime>(
             })
     } else {
         // Short settings read only; never hold the controller across network waits.
-        let context = match request.edit.clone() {
-            Some(edit) => {
-                controller
-                    .model_context(request.id.as_deref(), request.expected_revision, edit)
-                    .await
-            }
-            None => Err("Agent draft is required for model lookup".to_owned()),
-        };
         context
             .and_then(|context| {
                 resolve(&request, &context)
diff --git a/src-tauri/src/agents.rs b/src-tauri/src/agents.rs
index aee86fc12..0a49c4a52 100644
--- a/src-tauri/src/agents.rs
+++ b/src-tauri/src/agents.rs
@@ -362,6 +362,11 @@ fn harness_options(app_data: &std::path::Path) -> Vec<HarnessOption> {
                         value: "openai",
                         label: "OpenAI",
                     },
+                    #[cfg(feature = "mesh")]
+                    ProviderOption {
+                        value: "relay-mesh",
+                        label: "Buzz shared compute",
+                    },
                 ][usize::from(cfg!(windows))..],
             },
             HarnessOption {
@@ -718,15 +723,17 @@ pub(crate) struct AgentHost(
     Arc<tokio::sync::Mutex<()>>,
     /// Starts compare each agent's attested owner with the signed-in human.
     owner::Owner,
+    Option<tauri::AppHandle>,
 );
 impl AgentHost {
     pub(crate) fn initialize(
         paths: Result<(PathBuf, PathBuf, PathBuf), String>,
         resources: Result<PathBuf, String>,
         identity: owner::Owner,
+        app: tauri::AppHandle,
     ) -> Self {
         buzz_agent_controller::warm_tools_path();
-        Self::initialize_with(identity, move || {
+        Self::initialize_with_app(identity, Some(app), move || {
             let bundle = resources.and_then(RuntimeBundle::new);
             paths.and_then(|(root, legacy, workspace)| {
                 Host::open(
@@ -739,9 +746,17 @@ impl AgentHost {
             })
         })
     }
+    #[cfg(test)]
     fn initialize_with(
         identity: owner::Owner,
         open: impl FnOnce() -> Result<Host, String> + Send + 'static,
+    ) -> Self {
+        Self::initialize_with_app(identity, None, open)
+    }
+    fn initialize_with_app(
+        identity: owner::Owner,
+        app: Option<tauri::AppHandle>,
+        open: impl FnOnce() -> Result<Host, String> + Send + 'static,
     ) -> Self {
         let state = Arc::new(Mutex::new(Err(
             "Agent runtime is initializing; retry shortly".into(),
@@ -759,6 +774,7 @@ impl AgentHost {
             closed.clone(),
             admission.clone(),
             identity.clone(),
+            app.clone(),
         );
         tauri::async_runtime::spawn(async move {
             let opened = tauri::async_runtime::spawn_blocking(open)
@@ -771,7 +787,9 @@ impl AgentHost {
                 *state = opened;
             }
             drop(initializing); // restore itself enters through native admission.
-            Self(state, closed, admission, identity).restore().await;
+            Self(state, closed, admission, identity, app)
+                .restore()
+                .await;
         });
         owner
     }
@@ -831,6 +849,10 @@ impl AgentHost {
         .await
         .unwrap_or_default();
         for id in ids {
+            #[cfg(feature = "mesh")]
+            if self.mesh_restore_waiting(&id).await {
+                continue;
+            }
             let begin = std::time::Instant::now();
             startup_trace(serde_json::json!({"phase": "start", "agent": id}));
             let result = start(self.clone(), id.clone(), Action::Start, true, None, None).await;
@@ -845,6 +867,88 @@ impl AgentHost {
             }));
         }
     }
+    #[cfg(feature = "mesh")]
+    async fn mesh_restore_waiting(&self, id: &str) -> bool {
+        let id = id.to_owned();
+        let relay = run(self.clone(), move |host| {
+            Ok(host
+                .controller
+                .mesh_request(&id)?
+                .map(|request| request.relay))
+        })
+        .await
+        .ok()
+        .flatten();
+        let Some(relay) = relay else {
+            return false;
+        };
+        self.4.as_ref().map_or(true, |app| {
+            crate::mesh_compute::selected_for_agent(app, &relay).is_err()
+        })
+    }
+    #[cfg(feature = "mesh")]
+    pub(crate) async fn restore_mesh(&self, community: String) {
+        let ids = run(self.clone(), move |host| {
+            Ok(host
+                .queued
+                .keys()
+                .filter(|id| !host.acted.contains(*id))
+                .filter(|id| {
+                    host.controller
+                        .mesh_request(id)
+                        .ok()
+                        .flatten()
+                        .is_some_and(|request| {
+                            crate::mesh_compute::agent_community(&request.relay)
+                                .ok()
+                                .as_ref()
+                                == Some(&community)
+                        })
+                })
+                .cloned()
+                .collect::<Vec<_>>())
+        })
+        .await
+        .unwrap_or_default();
+        for id in ids {
+            let _ = start(self.clone(), id, Action::Start, true, None, None).await;
+        }
+    }
+    #[cfg(feature = "mesh")]
+    pub(crate) async fn has_mesh_consumers(&self) -> bool {
+        run(self.clone(), |host| {
+            Ok(host.controller.has_mesh_consumers())
+        })
+        .await
+        .unwrap_or(false)
+    }
+    #[cfg(feature = "mesh")]
+    pub(crate) async fn stop_mesh_consumers(&self) -> Result<(), String> {
+        run(self.clone(), |host| {
+            // Cancel preparation tickets/restore queue as well as captured running consumers.
+            let ids: Vec<_> = host
+                .controller
+                .snapshot()?
+                .agents
+                .into_iter()
+                .filter(|agent| {
+                    host.controller
+                        .mesh_request(&agent.id)
+                        .ok()
+                        .flatten()
+                        .is_some()
+                })
+                .map(|agent| agent.id)
+                .collect();
+            for id in ids {
+                host.starts.remove(&id);
+                host.queued.remove(&id);
+                host.acted.insert(id);
+            }
+            host.controller.stop_mesh_consumers()
+        })
+        .await
+    }
     pub(crate) async fn ensure_open(&self) -> Result<(), String> {
         run(self.clone(), |_| Ok(())).await
     }
@@ -1268,10 +1372,13 @@ async fn start_guarded(
     let target = id.clone();
     let prepared = run(owner.clone(), move |host| {
         let id = target;
-        let queued_replay = host.queued.remove(&id).flatten();
         if restore && (host.acted.contains(&id) || !host.controller.launch_ids()?.contains(&id)) {
             return Err("Agent disabled before restore".into());
         }
+        if restore && !host.queued.contains_key(&id) {
+            return Err("Agent restore already claimed or cancelled".into());
+        }
+        let queued_replay = host.queued.remove(&id).flatten();
         // Re-check while holding the controller, not just when the caller
         // chose this agent: Stop or Edit may have changed it since.
         check_guard(host, &id, guard)?;
@@ -1303,6 +1410,7 @@ async fn start_guarded(
             host.controller.record_error(&id, error.clone());
             return Err(error);
         }
+        let mesh_request = host.controller.mesh_request(&id)?;
         host.next_start = host
             .next_start
             .checked_add(1)
@@ -1319,10 +1427,17 @@ async fn start_guarded(
             },
         );
         let attested = host.controller.attested_owner(&id)?;
-        Ok((request, ticket, host.credentials.clone(), attested))
+        Ok((
+            request,
+            ticket,
+            host.credentials.clone(),
+            attested,
+            mesh_request,
+        ))
     })
     .await?;
-    let ((credential, pubkey, revision, _workspace), ticket, credentials, attested) = prepared;
+    let ((credential, pubkey, revision, _workspace), ticket, credentials, attested, mesh_request) =
+        prepared;
     prepare_tools_path().await;
     let target = id.clone();
     let pi = run(owner.clone(), move |host| {
@@ -1333,6 +1448,7 @@ async fn start_guarded(
         Ok(host.controller.pi_launch_context(&target, revision))
     })
     .await?;
+
     let probed_pi = matches!(&pi, Ok(Some(_)));
     let preflight = match pi {
         Ok(Some(pi)) => crate::pi_models::verify(pi)
@@ -1397,6 +1513,19 @@ async fn start_guarded(
         })
         .await?;
     }
+    let mesh = if acquired.is_ok() {
+        match mesh_request {
+            Some(request) => match owner.4.as_ref() {
+                Some(app) => crate::mesh_compute::prepare_agent(app, request)
+                    .await
+                    .map(Some),
+                None => Err("Shared compute native host is unavailable".into()),
+            },
+            None => Ok(None),
+        }
+    } else {
+        Ok(None)
+    };
     run(owner, move |host| {
         let replay_floor = host.take_start(&id, ticket)?.replay_floor;
         let key = match acquired {
@@ -1413,14 +1542,35 @@ async fn start_guarded(
         // The OS credential prompt can outlast the agent (e.g. its listener
         // exited); eligibility must still hold right before Restart enables it.
         check_guard(host, &id, guard)?;
-        if let Err(error) = host.controller.action_with_preflight(
-            &id,
-            action,
-            revision,
-            &key,
-            replay_floor,
-            &preflight?,
-        ) {
+        let launch = match mesh {
+            Ok(launch) => launch,
+            Err(error) => {
+                host.controller.record_error(&id, error);
+                return host.snapshot();
+            }
+        };
+        let preflight = preflight?;
+        let result = match launch {
+            Some(launch) => launch.with_current(|config| {
+                host.controller.action_with_mesh(
+                    &id,
+                    action,
+                    revision,
+                    &key,
+                    replay_floor,
+                    (&preflight, config),
+                )
+            }),
+            None => host.controller.action_with_preflight(
+                &id,
+                action,
+                revision,
+                &key,
+                replay_floor,
+                &preflight,
+            ),
+        };
+        if let Err(error) = result {
             host.controller.record_error(&id, error);
         }
         host.snapshot()
diff --git a/src-tauri/src/agents/tests.rs b/src-tauri/src/agents/tests.rs
index 9d4b0bbaf..48e0ae805 100644
--- a/src-tauri/src/agents/tests.rs
+++ b/src-tauri/src/agents/tests.rs
@@ -45,6 +45,7 @@ impl AgentHost {
             Arc::new(AtomicBool::new(false)),
             Arc::new(tokio::sync::Mutex::new(())),
             owner::Owner::Native(crate::identity::IdentityHost::fixture_owner()),
+            None,
         )
     }
 }
@@ -464,11 +465,17 @@ fn real_ipc_snapshot_save_cas_stop_and_launch_gate() {
     assert_eq!(before["createAvailable"], true);
     // Windows omits Databricks, whose sign-in it refuses; Unix lists it first.
     let openai = json!({"value":"openai", "label":"OpenAI"});
-    let providers = if cfg!(windows) {
+    let mut providers = if cfg!(windows) {
         json!([openai])
     } else {
         json!([{"value":"databricks_v2", "label":"Databricks v2"}, openai])
     };
+    if cfg!(feature = "mesh") {
+        providers
+            .as_array_mut()
+            .unwrap()
+            .push(json!({"value":"relay-mesh", "label":"Buzz shared compute"}));
+    }
     assert_eq!(
         before["harnessOptions"][0],
         json!({
@@ -2862,6 +2869,40 @@ async fn initialization_failure_and_shutdown_refuse_queued_registration() {
     }
 }
 
+#[cfg(feature = "mesh")]
+#[tokio::test]
+async fn shared_compute_restore_waits_for_community_before_attempting_credentials() {
+    let (dir, host, _app, _view) = fixture();
+    let id = seed(dir.path());
+    let path = dir.path().join("store/agents.json");
+    let mut data: Value = serde_json::from_slice(&std::fs::read(&path).unwrap()).unwrap();
+    data["agents"][0]["harness"]["provider"] = json!("relay-mesh");
+    data["agents"][0]["startOnAppLaunch"] = json!(true);
+    std::fs::write(&path, serde_json::to_vec(&data).unwrap()).unwrap();
+    host.restore().await;
+    host.with(|h| {
+        assert!(h.queued.contains_key(&id));
+        assert!(h.snapshot()?.data.agents[0].error.is_none());
+        Ok(())
+    })
+    .unwrap();
+    let mesh = crate::mesh_compute::MeshHost::default();
+    crate::mesh_compute::retire_selection(&mesh, &host, "https://other.example", "viewer")
+        .await
+        .unwrap();
+    assert!(host.with(|h| Ok(h.queued.contains_key(&id))).unwrap());
+    host.restore_mesh("https://other.example".into()).await;
+    assert!(host.with(|h| Ok(h.queued.contains_key(&id))).unwrap());
+    let relay = host
+        .with(|h| Ok(h.controller.mesh_request(&id)?.unwrap().relay))
+        .unwrap();
+    host.restore_mesh(crate::mesh_compute::agent_community(&relay).unwrap())
+        .await;
+    let data = host.with(|h| h.snapshot()).unwrap().data;
+    // Matching selection resumes the normal start gate; the synthetic runtime refuses it.
+    assert_eq!(data.agents[0].error.as_deref(), Some(RUNTIME_GATE));
+}
+
 #[cfg(windows)]
 #[test]
 fn windows_claude_manual_setup_uses_runnable_launchers() {
@@ -3218,6 +3259,7 @@ fn kept_agents_of_another_or_missing_owner_never_reach_their_credentials() {
         host.1.clone(),
         host.2.clone(),
         owner::Owner::Native(crate::identity::IdentityHost::default()),
+        host.4.clone(),
     );
     let missing = start(signed_out);
     assert!(!missing.contains("different Buzz identity"), "{missing}");
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index 5e2d6fc75..3daffd1b6 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -31,6 +31,8 @@ mod enterprise_relay_url;
 mod host_command;
 mod host_process;
 mod host_request;
+mod mesh_compute;
+use mesh_compute::{mesh_compute_inventory, mesh_compute_status, mesh_compute_stop, MeshHost};
 mod identity;
 mod image_clipboard;
 
@@ -436,6 +438,9 @@ async fn update_restart<R: tauri::Runtime>(app: tauri::AppHandle<R>) -> Result<(
 }
 fn commands<R: tauri::Runtime>() -> impl Fn(tauri::ipc::Invoke<R>) -> bool + Send + Sync + 'static {
     tauri::generate_handler![
+        mesh_compute_inventory,
+        mesh_compute_status,
+        mesh_compute_stop,
         pairing::pairing_account,
         pairing::pairing_start,
         pairing::pairing_status,
@@ -568,6 +573,23 @@ fn commands<R: tauri::Runtime>() -> impl Fn(tauri::ipc::Invoke<R>) -> bool + Sen
 }
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
 pub fn run() {
+    // Donor parity: model/download futures require upstream's 8 MiB worker stacks.
+    // Keep the runtime owned for the complete app lifetime, not a second Mesh node.
+    #[cfg(feature = "mesh")]
+    let _mesh_runtime = match tokio::runtime::Builder::new_multi_thread()
+        .enable_all()
+        .thread_stack_size(8 * 1024 * 1024)
+        .build()
+    {
+        Ok(runtime) => {
+            tauri::async_runtime::set(runtime.handle().clone());
+            Some(runtime)
+        }
+        Err(error) => {
+            eprintln!("Mesh async runtime unavailable: {error}");
+            return;
+        }
+    };
     let context = app_context();
     // A pending Sign out finishes before any window, webview storage, service or
     // identity read; if it can't, Buzz explains and exits without opening.
@@ -586,6 +608,7 @@ pub fn run() {
     });
     let identity = IdentityHost::default();
     let agent_identity = identity.clone();
+
     let builder = tauri::Builder::default();
     let builder = if !tauri::is_dev() {
         // Single instance comes first, as its documentation requires. Its deep-link
@@ -614,6 +637,13 @@ pub fn run() {
             #[cfg(target_os = "macos")]
             notifications::macos::init();
             deep_links::setup(app.handle());
+            #[cfg(feature = "mesh")]
+            app.state::<MeshHost>().initialize_preferences(
+                app.path()
+                    .app_data_dir()
+                    .map(|root| root.join("mesh-sharing.json"))
+                    .map_err(|error| error.to_string()),
+            );
             app.manage(relay::Spools::new(
                 app.path()
                     .app_cache_dir()
@@ -638,6 +668,7 @@ pub fn run() {
                 }
                 Err(error) => eprintln!("Could not start the media listener: {error}"),
             }
+
             // Only app-owned storage is created. Preview uses the OS-resolved legacy
             // parent, never a browser-supplied path or a different environment source.
             let paths = (|| {
@@ -682,7 +713,13 @@ pub fn run() {
                 std::env::var("BUZZ_DEV_VIEWER").ok().as_deref(),
                 app.config().build.dev_url.as_ref(),
             );
-            app.manage(AgentHost::initialize(paths, resources, agent_owner));
+            app.manage(AgentHost::initialize(
+                paths,
+                resources,
+                agent_owner,
+                app.handle().clone(),
+            ));
+
             Ok(())
         });
     #[cfg(target_os = "macos")]
@@ -704,6 +741,8 @@ pub fn run() {
     builder
         .manage(image_clipboard::ImageClipboard::default())
         .manage(identity)
+        .manage(MeshHost::default())
+
         .manage(archive::ArchiveHost::default())
         .manage(pairing::Pairing::default())
         .manage(relay::Uploads::default())
@@ -726,8 +765,14 @@ pub fn run() {
                 browser_action,
                 browser_status
             ];
+            #[cfg(feature = "mesh")]
+            let mesh_commands: fn(tauri::ipc::Invoke<tauri::Wry>) -> bool = tauri::generate_handler![mesh_compute::mesh_compute_catalog, mesh_compute::sharing::mesh_compute_share, mesh_compute::mesh_compute_start, mesh_compute::mesh_compute_select, mesh_compute::mesh_compute_release, mesh_compute::mesh_compute_disarm];
             // Browser embeds a real native view; existing commands also support MockRuntime.
             move |request: tauri::ipc::Invoke<tauri::Wry>| {
+                #[cfg(feature = "mesh")]
+                if matches!(request.message.command(), "mesh_compute_catalog" | "mesh_compute_share" | "mesh_compute_start" | "mesh_compute_select" | "mesh_compute_release" | "mesh_compute_disarm") {
+                    return mesh_commands(request);
+                }
                 if request.message.command().starts_with("browser_") {
                     browser_commands(request)
                 } else {
@@ -782,12 +827,14 @@ pub fn run() {
             }
             if matches!(event, tauri::RunEvent::Exit) {
                 shut_down(app);
+
             }
         });
 }
 
 /// Best-effort native teardown when Buzz exits, from Quit or a fenced sign-out.
 pub(crate) fn shut_down<R: tauri::Runtime>(app: &tauri::AppHandle<R>) {
+    app.state::<MeshHost>().shutdown();
     app.state::<relay::Spools>()
         .cancel_all(&app.state::<relay::Uploads>());
     app.state::<image_clipboard::ImageClipboard>().release();
diff --git a/src-tauri/src/mesh_compute.rs b/src-tauri/src/mesh_compute.rs
new file mode 100644
index 000000000..c5d8db72c
--- /dev/null
+++ b/src-tauri/src/mesh_compute.rs
@@ -0,0 +1,926 @@
+//! App-owned Mesh lifetime. Plugins cannot supply keystore paths or admission policy.
+
+#[cfg(feature = "mesh")]
+use tauri::Manager;
+
+mod agent;
+#[cfg(feature = "mesh")]
+pub(crate) mod sharing;
+#[cfg(feature = "mesh")]
+pub(crate) use agent::community_origin as agent_community;
+pub(crate) use agent::prepare_agent;
+#[cfg(feature = "mesh")]
+pub(crate) fn selected_for_agent(app: &tauri::AppHandle, relay: &str) -> Result<String, String> {
+    use tauri::Manager;
+    app.state::<MeshHost>()
+        .lease
+        .for_community(&agent_community(relay)?)
+}
+#[cfg(feature = "mesh")]
+mod coordinator;
+#[cfg(feature = "mesh")]
+mod discovery;
+#[cfg(feature = "mesh")]
+mod lease;
+#[cfg(feature = "mesh")]
+mod preferences;
+#[cfg(feature = "mesh")]
+mod publisher;
+
+#[cfg(feature = "mesh")]
+type Admission = (String, String, Vec<String>, Vec<nostr::event::Event>);
+
+#[derive(Default)]
+pub struct MeshHost {
+    #[cfg(feature = "mesh")]
+    preparing: tokio::sync::Mutex<()>,
+    #[cfg(feature = "mesh")]
+    sharing: std::sync::Mutex<Option<sharing::Share>>,
+    #[cfg(feature = "mesh")]
+    preferences: std::sync::Mutex<preferences::Preferences>,
+    #[cfg(feature = "mesh")]
+    lifecycle: buzz_mesh_compute::lifecycle::Lifecycle,
+    #[cfg(feature = "mesh")]
+    lease: lease::Lease,
+    #[cfg(feature = "mesh")]
+    publisher: std::sync::Mutex<Option<tauri::async_runtime::JoinHandle<()>>>,
+    #[cfg(feature = "mesh")]
+    coordinator: std::sync::Mutex<Option<tauri::async_runtime::JoinHandle<()>>>,
+    #[cfg(feature = "mesh")]
+    admission: std::sync::Mutex<Option<Admission>>,
+}
+
+impl MeshHost {
+    #[cfg(feature = "mesh")]
+    pub fn initialize_preferences(&self, path: Result<std::path::PathBuf, String>) {
+        if let Ok(mut prefs) = self.preferences.lock() {
+            prefs.initialize(path);
+        }
+    }
+    pub fn shutdown(&self) {
+        #[cfg(feature = "mesh")]
+        if let Ok(mut task) = self.coordinator.lock() {
+            if let Some(task) = task.take() {
+                task.abort();
+            }
+        }
+        #[cfg(feature = "mesh")]
+        if let Ok(mut publisher) = self.publisher.lock() {
+            if let Some(task) = publisher.take() {
+                task.abort();
+            }
+        }
+        #[cfg(feature = "mesh")]
+        self.lease.clear();
+        #[cfg(feature = "mesh")]
+        if let Err(error) = tauri::async_runtime::block_on(self.lifecycle.stop_and_wait()) {
+            eprintln!("Mesh shutdown could not be confirmed: {error}");
+        }
+    }
+}
+
+#[tauri::command]
+pub async fn mesh_compute_status(
+    host: tauri::State<'_, MeshHost>,
+) -> Result<serde_json::Value, String> {
+    #[cfg(feature = "mesh")]
+    {
+        let (saved, settings_error) = host
+            .preferences
+            .lock()
+            .map(|prefs| (prefs.hint().cloned(), prefs.error().map(str::to_owned)))
+            .unwrap_or_default();
+        let model_ready = if host.lifecycle.phase() == buzz_mesh_compute::lifecycle::Phase::Ready {
+            host.lifecycle.status().await.ok().is_some_and(|status| {
+                status
+                    .payload
+                    .get("llama_ready")
+                    .and_then(serde_json::Value::as_bool)
+                    == Some(true)
+            })
+        } else {
+            false
+        };
+        Ok(serde_json::json!({
+            "available": true,
+            "modelReady": model_ready,
+            "finishingJoin": host.lifecycle.finishing_join(),
+            "boundCommunity": host.lease.current()?.map(|(_, community)| community),
+            "savedSharing": saved,
+            "settingsError": settings_error,
+            "lifecycle": host.lifecycle.phase(),
+            "download": host.lifecycle.download_progress(),
+            "startAvailable": true,
+            "reason": null,
+            "sharing": host.sharing.lock().ok().and_then(|share| share.as_ref().map(|share| share.model.clone()))
+        }))
+    }
+    #[cfg(not(feature = "mesh"))]
+    {
+        let _ = host;
+        Ok(serde_json::json!({
+            "available": false,
+            "reason": "Mesh native runtime is not included in this build"
+        }))
+    }
+}
+
+#[tauri::command]
+pub async fn mesh_compute_stop(host: tauri::State<'_, MeshHost>) -> Result<(), String> {
+    #[cfg(feature = "mesh")]
+    {
+        let _guard = host.preparing.lock().await;
+        {
+            let mut sharing = host
+                .sharing
+                .lock()
+                .map_err(|_| "Mesh sharing unavailable")?;
+            *sharing = None;
+        }
+        host.lease.clear();
+        *host
+            .admission
+            .lock()
+            .map_err(|_| "Mesh admission unavailable")? = None;
+        host.lifecycle.stop();
+        host.lifecycle
+            .stop_and_wait()
+            .await
+            .map_err(|error| error.to_string())
+    }
+    #[cfg(not(feature = "mesh"))]
+    {
+        let _ = host;
+        Err("Mesh native runtime is not included in this build".into())
+    }
+}
+
+#[cfg(all(test, feature = "mesh"))]
+mod smoke;
+
+#[cfg(feature = "mesh")]
+#[tauri::command]
+pub async fn mesh_compute_start(
+    app: tauri::AppHandle,
+    host: tauri::State<'_, MeshHost>,
+    identity: tauri::State<'_, crate::identity::IdentityHost>,
+    lease: String,
+) -> Result<(), String> {
+    start(&app, host.inner(), identity.inner(), &lease).await
+}
+
+#[cfg(feature = "mesh")]
+async fn start(
+    app: &tauri::AppHandle,
+    host: &MeshHost,
+    identity: &crate::identity::IdentityHost,
+    lease: &str,
+) -> Result<(), String> {
+    use buzz_mesh_compute::startup_log;
+    let began = std::time::Instant::now();
+    let _guard = host.preparing.lock().await;
+    startup_log::stage(
+        "prepared",
+        &format!("wait_ms={}", began.elapsed().as_millis()),
+    );
+    let result = start_prepared(app, host, identity, lease).await;
+    startup_log::stage(
+        "start_requested",
+        &format!(
+            "ok={} start_ms={}",
+            result.is_ok(),
+            began.elapsed().as_millis()
+        ),
+    );
+    result
+}
+
+#[cfg(feature = "mesh")]
+async fn start_prepared(
+    app: &tauri::AppHandle,
+    host: &MeshHost,
+    identity: &crate::identity::IdentityHost,
+    lease: &str,
+) -> Result<(), String> {
+    host.lease.community(lease)?;
+    if matches!(
+        host.lifecycle.phase(),
+        buzz_mesh_compute::lifecycle::Phase::Starting | buzz_mesh_compute::lifecycle::Phase::Ready
+    ) {
+        return Ok(());
+    }
+    if host.lifecycle.phase() != buzz_mesh_compute::lifecycle::Phase::Stopped {
+        return Err("Previous Mesh runtime shutdown is not confirmed".into());
+    }
+    let community = host.lease.community(lease)?;
+    let discovery_began = std::time::Instant::now();
+    let (owners, targets, evidence) = tokio::time::timeout(
+        std::time::Duration::from_secs(10),
+        discovery::read(identity, &community),
+    )
+    .await
+    .map_err(|_| {
+        buzz_mesh_compute::startup_log::stage("discovery_read", "ok=false timeout");
+        "Community discovery timed out"
+    })??;
+    buzz_mesh_compute::startup_log::stage(
+        "discovery_read",
+        &format!(
+            "targets={} read_ms={}",
+            targets.len(),
+            discovery_began.elapsed().as_millis()
+        ),
+    );
+    start_with_evidence(app, identity, lease, owners, targets, evidence, false).await
+}
+
+#[cfg(feature = "mesh")]
+async fn start_with_evidence(
+    app: &tauri::AppHandle,
+    identity: &crate::identity::IdentityHost,
+    lease: &str,
+    mut owners: Vec<String>,
+    targets: Vec<buzz_mesh_compute::discovery_types::MeshServeTarget>,
+    evidence: Vec<nostr::event::Event>,
+    recovering_admission: bool,
+) -> Result<(), String> {
+    let host = app.state::<MeshHost>();
+    let community = host.lease.community(lease)?;
+    let viewer = identity.viewer().await?;
+    let sharing = host
+        .sharing
+        .lock()
+        .map_err(|_| "Mesh sharing unavailable")?
+        .clone();
+    let path = mesh_owner_path()?;
+    let owner =
+        buzz_mesh_compute::identity::ensure_owner_at(&path).map_err(|error| error.to_string())?;
+    // Never dial this machine's own advert; it can outlive the runtime it names.
+    let targets = buzz_mesh_compute::discovery::peer_join_tokens(targets, &owner);
+    if targets.is_empty() && sharing.is_none() && !recovering_admission {
+        return Err(
+            "No live community member is sharing compute; start serving on a member first".into(),
+        );
+    }
+    host.lease.with_current(lease, |_| {
+        owners.push(owner.clone());
+        let admission = (
+            uuid::Uuid::new_v4().to_string(),
+            owner.clone(),
+            owners.clone(),
+            evidence,
+        );
+        let mut targets = targets.into_iter();
+        let node = buzz_mesh_compute::config::ClientConfig {
+            api_port: mesh_port("BUZZ_MESH_API_PORT", 19337)?,
+            console_port: mesh_port("BUZZ_MESH_CONSOLE_PORT", 13131)?,
+            owner_key: path,
+            owner_id: owner,
+            trusted_owners: owners,
+            join_token: targets.next(),
+            mesh_name: Some(buzz_mesh_compute::config::mesh_name_for_relay(&community)),
+        };
+        match sharing {
+            Some(share) => host.lifecycle.serve_observed(
+                buzz_mesh_compute::config::ServeConfig {
+                    node,
+                    model: share.model.clone(),
+                    max_vram_gb: share.max_vram_gb,
+                },
+                sharing::observer(
+                    app.clone(),
+                    preferences::Config::pending(viewer, community.clone(), &share),
+                ),
+            ),
+            None => host.lifecycle.start(node),
+        }
+        .map_err(|error| error.to_string())?;
+        *host
+            .admission
+            .lock()
+            .map_err(|_| "Mesh admission unavailable")? = Some(admission);
+        host.preferences
+            .lock()
+            .map_err(|_| "Mesh settings unavailable")?
+            .clear_runtime_error();
+        queue_targets(targets, |token| {
+            host.lifecycle
+                .dial(token)
+                .map_err(|error| error.to_string())
+        });
+        Ok(())
+    })
+}
+
+#[cfg(feature = "mesh")]
+fn mesh_owner_path() -> Result<std::path::PathBuf, String> {
+    buzz_mesh_compute::identity::default_owner_path().map_err(|error| error.to_string())
+}
+#[cfg(feature = "mesh")]
+fn mesh_port(name: &str, fallback: u16) -> Result<u16, String> {
+    match std::env::var(name) {
+        Ok(value) => value
+            .parse::<u16>()
+            .ok()
+            .filter(|port| *port != 0)
+            .ok_or_else(|| format!("Invalid {name}")),
+        Err(std::env::VarError::NotPresent) => Ok(fallback),
+        Err(_) => Err(format!("Invalid {name}")),
+    }
+}
+
+#[cfg(feature = "mesh")]
+pub(crate) async fn retire_selection(
+    host: &MeshHost,
+    agents: &crate::agents::AgentHost,
+    community: &str,
+    viewer: &str,
+) -> Result<(), String> {
+    let changing = host
+        .preferences
+        .lock()
+        .map_err(|_| "Mesh settings unavailable")?
+        .requires_retirement(
+            host.lease
+                .current()?
+                .as_ref()
+                .map(|(_, community)| community.as_str()),
+            community,
+            viewer,
+        );
+    if changing {
+        // Retire pending launches first; running agents must exit before port reuse.
+        let previous = host.lease.current()?;
+        host.lease.clear();
+        let stopped = async {
+            agents.stop_mesh_consumers().await?;
+            host.lifecycle
+                .stop_and_wait()
+                .await
+                .map_err(|error| error.to_string())
+        }
+        .await;
+        if let Err(error) = stopped {
+            host.lease.restore(previous)?;
+            return Err(error);
+        }
+    }
+    Ok(())
+}
+
+#[cfg(feature = "mesh")]
+#[tauri::command]
+pub async fn mesh_compute_select(
+    app: tauri::AppHandle,
+    host: tauri::State<'_, MeshHost>,
+    identity: tauri::State<'_, crate::identity::IdentityHost>,
+    community: String,
+    restore_sharing: Option<bool>,
+    replace_existing: Option<bool>,
+) -> Result<String, String> {
+    let community = agent::community_origin(&community)?;
+    let viewer = identity.viewer().await?;
+    let _guard = host.preparing.lock().await;
+    let viewer_changed = host
+        .preferences
+        .lock()
+        .map_err(|_| "Mesh settings unavailable")?
+        .viewer_changed(&viewer);
+    if !viewer_changed && !replace_existing.unwrap_or(false) {
+        if let Some((lease, _)) = host.lease.current()? {
+            // Ordinary selection describes the view, not a replacement request.
+            return Ok(lease);
+        }
+    }
+    retire_selection(
+        &host,
+        &app.state::<crate::agents::AgentHost>(),
+        &community,
+        &viewer,
+    )
+    .await?;
+    let lease = host
+        .lease
+        .try_select_with(community.clone(), viewer_changed, || {
+            let mut sharing = host
+                .sharing
+                .lock()
+                .map_err(|_| "Mesh sharing unavailable")?;
+            *sharing = None;
+            host.lifecycle.stop();
+            Ok(())
+        })?;
+    host.preferences
+        .lock()
+        .map_err(|_| "Mesh settings unavailable")?
+        .select(viewer, community);
+    let restore = host
+        .preferences
+        .lock()
+        .map_err(|_| "Mesh settings unavailable")?
+        .hint()
+        .filter(|config| config.enabled && restore_sharing.unwrap_or(true))
+        .cloned();
+    publisher::ensure_started(app.clone(), &host)?;
+    coordinator::ensure_started(app.clone(), &host)?;
+    let restore = if host
+        .sharing
+        .lock()
+        .map_err(|_| "Mesh sharing unavailable")?
+        .is_none()
+    {
+        restore
+    } else {
+        None
+    };
+    if restore.is_some() {
+        buzz_mesh_compute::startup_log::stage("entry", "from=restore");
+        // Selection may follow release while the old worker is still stopping.
+        // Confirm shutdown before restoring; never hold a synchronous lock across await.
+        if let Err(error) = host.lifecycle.stop_and_wait().await {
+            host.preferences
+                .lock()
+                .map_err(|_| "Mesh settings unavailable")?
+                .set_error(error.to_string());
+            return Ok(lease);
+        }
+    }
+    drop(_guard);
+    if let Some(config) = restore {
+        // Mesh owns acquisition; discovery re-verifies membership before start.
+        if let Err(error) = sharing::mesh_compute_share(
+            app.clone(),
+            lease.clone(),
+            Some(config.model),
+            config.max_vram_gb,
+            Some(config.auto),
+            None,
+        )
+        .await
+        {
+            host.preferences
+                .lock()
+                .map_err(|_| "Mesh settings unavailable")?
+                .set_error(error);
+        }
+    }
+    let agents = app.state::<crate::agents::AgentHost>().inner().clone();
+    let selected = host.lease.community(&lease)?;
+    tauri::async_runtime::spawn(async move {
+        agents.restore_mesh(selected).await;
+    });
+    Ok(lease)
+}
+#[cfg(feature = "mesh")]
+#[tauri::command]
+pub async fn mesh_compute_release<R: tauri::Runtime>(
+    app: tauri::AppHandle<R>,
+    host: tauri::State<'_, MeshHost>,
+    lease: String,
+) -> Result<(), String> {
+    let _guard = host.preparing.lock().await;
+    if host.lease.community(&lease).is_ok() {
+        host.lease.with_current(&lease, |_| {
+            let mut sharing = host
+                .sharing
+                .lock()
+                .map_err(|_| "Mesh sharing unavailable")?;
+            *sharing = None;
+            host.lifecycle.stop();
+            Ok(())
+        })?;
+        host.lease.revoke(&lease)?;
+        app.state::<crate::agents::AgentHost>()
+            .stop_mesh_consumers()
+            .await?;
+        *host
+            .admission
+            .lock()
+            .map_err(|_| "Mesh admission unavailable")? = None;
+    }
+    Ok(())
+}
+
+#[cfg(feature = "mesh")]
+fn queue_targets(
+    targets: impl IntoIterator<Item = String>,
+    mut dial: impl FnMut(&str) -> Result<(), String>,
+) {
+    for token in targets {
+        if dial(&token).is_err() {
+            eprintln!("Mesh discovery target could not be queued; client remains started");
+        }
+    }
+}
+
+#[cfg(all(test, feature = "mesh"))]
+mod queue_tests {
+    #[test]
+    fn rejected_secondary_target_does_not_fail_the_started_operation() {
+        let mut calls = 0;
+        super::queue_targets(["first".into(), "second".into()], |_| {
+            calls += 1;
+            if calls == 2 {
+                Err("fixture rejection".into())
+            } else {
+                Ok(())
+            }
+        });
+        assert_eq!(calls, 2);
+    }
+}
+
+/// Turn off saved automatic sharing for this viewer and community without a lease
+/// or a confirmed runtime shutdown. Consent only: the runtime replacement fence,
+/// lease and live lifecycle are untouched, so this can never start or stop Mesh.
+#[cfg(feature = "mesh")]
+#[tauri::command]
+pub async fn mesh_compute_disarm(
+    host: tauri::State<'_, MeshHost>,
+    identity: tauri::State<'_, crate::identity::IdentityHost>,
+    community: String,
+    expected_viewer: String,
+) -> Result<(), String> {
+    let community = agent::community_origin(&community)?;
+    // No lease fences this write, so a request issued for one identity must never
+    // be reinterpreted for whichever identity is current when it arrives.
+    let viewer = identity.viewer().await?;
+    if viewer != expected_viewer {
+        return Err("Identity changed before turning off Mesh sharing".into());
+    }
+    let _guard = host.preparing.lock().await;
+    if identity.viewer().await? != viewer {
+        return Err("Identity changed before turning off Mesh sharing".into());
+    }
+    disarm_saved(&host, viewer, community)
+}
+
+#[cfg(feature = "mesh")]
+fn disarm_saved(host: &MeshHost, viewer: String, community: String) -> Result<(), String> {
+    let mut prefs = host
+        .preferences
+        .lock()
+        .map_err(|_| "Mesh settings unavailable")?;
+    prefs.select(viewer, community);
+    prefs.disarm()
+}
+
+/// Signed relay advertisements, not live node health. Does not start Mesh.
+#[tauri::command]
+pub async fn mesh_compute_inventory(
+    host: tauri::State<'_, MeshHost>,
+    identity: tauri::State<'_, crate::identity::IdentityHost>,
+    community: String,
+) -> Result<serde_json::Value, String> {
+    #[cfg(feature = "mesh")]
+    {
+        let mut inventory = discovery::inventory(identity.inner(), &community).await?;
+        name_entries(&host, &mut inventory.entries).await;
+        serde_json::to_value(inventory).map_err(|error| error.to_string())
+    }
+    #[cfg(not(feature = "mesh"))]
+    {
+        let _ = (host, identity, community);
+        Err("Mesh native runtime is not included in this build".into())
+    }
+}
+
+#[cfg(feature = "mesh")]
+#[tauri::command]
+pub async fn mesh_compute_catalog() -> Result<buzz_mesh_compute::catalog::Catalog, String> {
+    tokio::task::spawn_blocking(buzz_mesh_compute::catalog::catalog)
+        .await
+        .map_err(|error| format!("Mesh catalog task failed: {error}"))?
+        .map_err(|error| error.to_string())
+}
+
+#[cfg(all(test, feature = "mesh"))]
+mod persistence_tests {
+    use super::*;
+    use tauri::Manager;
+
+    #[tokio::test]
+    async fn revoked_selection_retries_failed_cleanup_before_reusing_binding() {
+        use serde_json::{json, Value};
+        let (dir, agents, _app, view) = crate::agents::tests::fixture();
+        let id = crate::agents::tests::seed(dir.path());
+        let path = dir.path().join("store/agents.json");
+        let mut data: Value = serde_json::from_slice(&std::fs::read(&path).unwrap()).unwrap();
+        data["agents"][0]["harness"]["provider"] = json!("relay-mesh");
+        data["agents"][0]["startOnAppLaunch"] = json!(true);
+        let saved = serde_json::to_vec(&data).unwrap();
+        std::fs::write(&path, &saved).unwrap();
+        agents.restore().await;
+        let host = MeshHost::default();
+        host.preferences
+            .lock()
+            .unwrap()
+            .select("viewer".into(), "https://a.example".into());
+        let lease = host.lease.select("https://a.example".into()).unwrap();
+        host.lease.revoke(&lease).unwrap();
+        // Simulate the exact cleanup error boundary: persisted inventory unreadable.
+        std::fs::write(&path, b"invalid").unwrap();
+        assert!(agents.stop_mesh_consumers().await.is_err());
+        assert!(
+            retire_selection(&host, &agents, "https://b.example", "viewer")
+                .await
+                .is_err()
+        );
+        assert!(host.lease.current().unwrap().is_none());
+        std::fs::write(&path, &saved).unwrap();
+        retire_selection(&host, &agents, "https://b.example", "viewer")
+            .await
+            .unwrap();
+        // A cancelled restore cannot restart when its old community returns.
+        agents.restore_mesh("https://relay.example".into()).await;
+        let snapshot =
+            crate::agents::tests::invoke(&view, "agent_control_snapshot", json!({})).unwrap();
+        let agent = snapshot["agents"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .find(|agent| agent["id"] == id)
+            .unwrap();
+        assert_eq!(agent["status"], "stopped");
+    }
+
+    #[test]
+    fn hash_only_adverts_use_known_names_or_an_honest_fallback() {
+        let entry = |id: &str, name: Option<&str>| buzz_mesh_compute::inventory::Entry {
+            device_id: None,
+            member_pubkey: "m".into(),
+            model_id: id.into(),
+            model_name: name.map(str::to_owned),
+            device_name: None,
+            vram_gb: None,
+        };
+        let known =
+            "local-gguf/sha256-acd36c32a5ecd1b01db5806d19bc2fdbac3f23920120c3f0b1acdf571f57a399";
+        let unknown =
+            "local-gguf/sha256-7756e8943d5ec98b1cd76895d33d20b8c8bf7609a71540fc9b6fa512bdedd0de";
+        let mut entries = vec![
+            entry(known, Some(known)),
+            entry(unknown, None),
+            entry("unsloth/Real-GGUF:Q4", Some("unsloth/Real-GGUF:Q4")),
+            entry("named", Some("Friendly")),
+        ];
+        let mut names = serde_json::Map::new();
+        names.insert(known.into(), "unsloth/Qwen3.5-9B-GGUF:Q4_K_M".into());
+        apply_names(&mut entries, &names);
+        assert_eq!(
+            entries[0].model_name.as_deref(),
+            Some("unsloth/Qwen3.5-9B-GGUF:Q4_K_M")
+        );
+        // The routing id stays exact; the label is honest, not the hash.
+        assert_eq!(entries[1].model_id, unknown);
+        assert_eq!(
+            entries[1].model_name.as_deref(),
+            Some("Model name unavailable (7756e8943d5e)")
+        );
+        assert_eq!(
+            entries[2].model_name.as_deref(),
+            Some("unsloth/Real-GGUF:Q4")
+        );
+        assert_eq!(entries[3].model_name.as_deref(), Some("Friendly"));
+        // Non-ASCII ids must not split a character.
+        let mut odd = vec![entry("local-gguf/sha256-aaaaaaaaaaaé-tail", None)];
+        apply_names(&mut odd, &serde_json::Map::new());
+        assert_eq!(
+            odd[0].model_name.as_deref(),
+            Some("Model name unavailable (aaaaaaaaaaaé)")
+        );
+    }
+
+    #[test]
+    fn disarm_without_a_lease_persists_only_for_that_viewer_and_community() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("mesh-sharing.json");
+        let host = MeshHost::default();
+        host.initialize_preferences(Ok(path.clone()));
+        let community = "https://fixture.example";
+        {
+            let mut prefs = host.preferences.lock().unwrap();
+            prefs.select("viewer".into(), community.into());
+            let share = sharing::Share {
+                model: "fixture".into(),
+                max_vram_gb: None,
+            };
+            let mut config =
+                preferences::Config::pending("viewer".into(), community.into(), &share);
+            config.enabled = true;
+            prefs.checkpoint(config).unwrap();
+        }
+        // No lease exists (lost after a failed selection); the lifecycle is not consulted.
+        assert!(host.lease.current().unwrap().is_none());
+        let phase = host.lifecycle.phase();
+        disarm_saved(&host, "other-viewer".into(), community.into()).unwrap();
+        disarm_saved(&host, "viewer".into(), "https://other.example".into()).unwrap();
+        let mut reopened = preferences::Preferences::default();
+        reopened.initialize(Ok(path.clone()));
+        reopened.select("viewer".into(), community.into());
+        assert!(reopened.hint().unwrap().enabled);
+        disarm_saved(&host, "viewer".into(), community.into()).unwrap();
+        let mut reopened = preferences::Preferences::default();
+        reopened.initialize(Ok(path));
+        reopened.select("viewer".into(), community.into());
+        assert!(!reopened.hint().unwrap().enabled);
+        assert_eq!(reopened.hint().unwrap().model, "fixture");
+        assert_eq!(host.lifecycle.phase(), phase);
+        assert!(host.lease.current().unwrap().is_none());
+    }
+
+    #[tokio::test]
+    async fn disarm_command_rejects_a_request_issued_for_another_identity() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("mesh-sharing.json");
+        let identity = crate::identity::IdentityHost::fixture();
+        let viewer = identity.viewer().await.unwrap();
+        let community = "https://fixture.example";
+        let host = MeshHost::default();
+        host.initialize_preferences(Ok(path.clone()));
+        {
+            let mut prefs = host.preferences.lock().unwrap();
+            prefs.select(viewer.clone(), community.into());
+            let share = sharing::Share {
+                model: "fixture".into(),
+                max_vram_gb: None,
+            };
+            let mut config = preferences::Config::pending(viewer.clone(), community.into(), &share);
+            config.enabled = true;
+            prefs.checkpoint(config).unwrap();
+        }
+        let app = tauri::test::mock_builder()
+            .manage(host)
+            .manage(identity)
+            .build(tauri::test::mock_context(tauri::test::noop_assets()))
+            .unwrap();
+        let error =
+            mesh_compute_disarm(app.state(), app.state(), community.into(), "retired".into())
+                .await
+                .unwrap_err();
+        assert!(error.contains("Identity changed"));
+        let mut reopened = preferences::Preferences::default();
+        reopened.initialize(Ok(path.clone()));
+        reopened.select(viewer.clone(), community.into());
+        assert!(reopened.hint().unwrap().enabled);
+        mesh_compute_disarm(app.state(), app.state(), community.into(), viewer.clone())
+            .await
+            .unwrap();
+        let mut reopened = preferences::Preferences::default();
+        reopened.initialize(Ok(path));
+        reopened.select(viewer, community.into());
+        assert!(!reopened.hint().unwrap().enabled);
+    }
+
+    #[tokio::test]
+    async fn release_and_reopen_preserve_saved_sharing_but_expire_the_lease() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("mesh-sharing.json");
+        let host = MeshHost::default();
+        host.initialize_preferences(Ok(path.clone()));
+        let community = "https://fixture.example";
+        let lease = host.lease.select(community.into()).unwrap();
+        let share = sharing::Share {
+            model: "fixture".into(),
+            max_vram_gb: None,
+        };
+        {
+            let mut prefs = host.preferences.lock().unwrap();
+            prefs.select("viewer".into(), community.into());
+            let mut config =
+                preferences::Config::pending("viewer".into(), community.into(), &share);
+            config.enabled = true;
+            prefs.checkpoint(config).unwrap();
+        }
+        *host.sharing.lock().unwrap() = Some(share);
+        let (_agents_dir, agents, _agents_app, _agents_view) = crate::agents::tests::fixture();
+        let app = tauri::test::mock_builder()
+            .manage(agents)
+            .manage(host)
+            .build(tauri::test::mock_context(tauri::test::noop_assets()))
+            .unwrap();
+        mesh_compute_release(app.handle().clone(), app.state(), lease.clone())
+            .await
+            .unwrap();
+        let host = app.state::<MeshHost>();
+        assert!(host.lease.community(&lease).is_err());
+        assert!(host.sharing.lock().unwrap().is_none());
+        let mut reopened = preferences::Preferences::default();
+        reopened.initialize(Ok(path));
+        reopened.select("viewer".into(), "https://other.example".into());
+        assert!(reopened.hint().is_none());
+        reopened.select("viewer".into(), community.into());
+        assert!(reopened.hint().unwrap().enabled);
+        assert_eq!(reopened.hint().unwrap().model, "fixture");
+        // A late disposal of the old lease cannot release a new selection.
+        let next = host.lease.select(community.into()).unwrap();
+        mesh_compute_release(app.handle().clone(), app.state(), lease)
+            .await
+            .unwrap();
+        assert!(host.lease.community(&next).is_ok());
+    }
+}
+
+/// Label `local-gguf/sha256-…` advertisements (older publishers) with the readable
+/// ref from this node's own Mesh catalog, when Mesh is running here.
+#[cfg(feature = "mesh")]
+async fn name_entries(host: &MeshHost, entries: &mut [buzz_mesh_compute::inventory::Entry]) {
+    let unnamed = |e: &buzz_mesh_compute::inventory::Entry| {
+        e.model_name.as_deref().map_or(true, |n| n == e.model_id)
+    };
+    if !entries.iter().any(unnamed) {
+        return;
+    }
+    // 1. A running local node knows peers' readable refs from Mesh's own catalog.
+    let mut names = serde_json::Map::new();
+    if host.lifecycle.phase() == buzz_mesh_compute::lifecycle::Phase::Ready {
+        if let Ok(status) = host.lifecycle.status().await {
+            if let Some(serde_json::Value::Object(map)) =
+                publisher::display_names(&status.console_url).await
+            {
+                names = map;
+            }
+        }
+    }
+    apply_names(entries, &names);
+}
+
+/// Label hash-only entries from known names; never present a hash as a name.
+#[cfg(feature = "mesh")]
+fn apply_names(
+    entries: &mut [buzz_mesh_compute::inventory::Entry],
+    names: &serde_json::Map<String, serde_json::Value>,
+) {
+    for entry in entries
+        .iter_mut()
+        .filter(|e| e.model_name.as_deref().map_or(true, |n| n == e.model_id))
+    {
+        if let Some(name) = names.get(&entry.model_id).and_then(|v| v.as_str()) {
+            entry.model_name = Some(name.to_owned());
+        } else if let Some(hash) = entry.model_id.strip_prefix("local-gguf/") {
+            // Character-safe: signed adverts carry arbitrary strings.
+            let short: String = hash
+                .trim_start_matches("sha256-")
+                .chars()
+                .take(12)
+                .collect();
+            entry.model_name = Some(format!("Model name unavailable ({short})"));
+        }
+    }
+}
+
+/// Read verified community advertisements without starting a node or touching cloud credentials.
+pub(crate) async fn agent_models<R: tauri::Runtime>(
+    app: &tauri::AppHandle<R>,
+    relay: Option<&str>,
+) -> Result<Vec<(String, String)>, String> {
+    #[cfg(feature = "mesh")]
+    {
+        use tauri::Manager;
+        let host = app.state::<MeshHost>();
+        let identity = app.state::<crate::identity::IdentityHost>();
+        let (lease, community) = host
+            .lease
+            .current()?
+            .ok_or("Enable Shared compute in this community first")?;
+        if let Some(relay) = relay {
+            let mut url = url::Url::parse(relay).map_err(|_| "Invalid agent community")?;
+            let scheme = match url.scheme() {
+                "wss" => "https",
+                "ws" => "http",
+                other => other,
+            }
+            .to_owned();
+            url.set_scheme(&scheme)
+                .map_err(|_| "Invalid agent community")?;
+            let selected = url::Url::parse(&community).map_err(|_| "Invalid Mesh community")?;
+            let same = url.scheme() == selected.scheme()
+                && url.host_str().map(|host| host.trim_end_matches('.'))
+                    == selected.host_str().map(|host| host.trim_end_matches('.'))
+                && url.port_or_known_default() == selected.port_or_known_default();
+            if !same {
+                return Err("Select the agent’s community before browsing shared models".into());
+            }
+        }
+        let mut inventory = discovery::inventory(&identity, &community).await?;
+        host.lease.community(&lease)?;
+        name_entries(&host, &mut inventory.entries).await;
+        if let Some(error) = inventory.unavailable {
+            return Err(error);
+        }
+        let mut models = std::collections::BTreeMap::new();
+        for entry in inventory.entries {
+            if !matches!(entry.model_id.trim(), "" | "auto" | "mesh") {
+                models
+                    .entry(entry.model_id.clone())
+                    .or_insert(entry.model_name.unwrap_or(entry.model_id));
+            }
+        }
+        Ok(models.into_iter().collect())
+    }
+    #[cfg(not(feature = "mesh"))]
+    {
+        let _ = (app, relay);
+        Err("Mesh native runtime is not included in this build".into())
+    }
+}
diff --git a/src-tauri/src/mesh_compute/agent.rs b/src-tauri/src/mesh_compute/agent.rs
new file mode 100644
index 000000000..11b5a3747
--- /dev/null
+++ b/src-tauri/src/mesh_compute/agent.rs
@@ -0,0 +1,319 @@
+//! Mainline pre-start path: reuse the selected node, then probe its inference route.
+use buzz_agent_controller::{MeshLaunch, MeshRequest};
+#[cfg(feature = "mesh")]
+use tauri::Manager;
+
+pub(crate) struct Prepared {
+    #[cfg(feature = "mesh")]
+    app: tauri::AppHandle,
+    #[cfg(feature = "mesh")]
+    lease: String,
+    config: MeshLaunch,
+}
+impl Prepared {
+    // Keep selection stable through final controller admission, not across async reads.
+    pub(crate) fn with_current<T>(
+        self,
+        launch: impl FnOnce(MeshLaunch) -> Result<T, String>,
+    ) -> Result<T, String> {
+        #[cfg(feature = "mesh")]
+        {
+            let host = self.app.state::<super::MeshHost>();
+            host.lease.with_current(&self.lease, |_| {
+                if host.lifecycle.phase() != buzz_mesh_compute::lifecycle::Phase::Ready {
+                    return Err("Shared compute stopped before agent launch".into());
+                }
+                launch(self.config)
+            })
+        }
+        #[cfg(not(feature = "mesh"))]
+        {
+            let _ = (self.config, launch);
+            Err("Mesh native runtime is not included in this build".into())
+        }
+    }
+}
+
+#[cfg(feature = "mesh")]
+pub(crate) fn community_origin(raw: &str) -> Result<String, String> {
+    let mut url = url::Url::parse(raw).map_err(|_| "Invalid agent community")?;
+    if url.scheme() == "wss" {
+        url.set_scheme("https")
+            .map_err(|_| "Invalid agent community")?;
+    }
+    crate::relay::mesh_origin(url.as_str())?;
+    if let Some(host) = url.host_str().filter(|host| host.ends_with('.')) {
+        let host = host.trim_end_matches('.').to_owned();
+        url.set_host(Some(&host))
+            .map_err(|_| "Invalid agent community")?;
+    }
+    Ok(url.origin().ascii_serialization())
+}
+
+pub(crate) async fn prepare_agent(
+    app: &tauri::AppHandle,
+    request: MeshRequest,
+) -> Result<Prepared, String> {
+    #[cfg(not(feature = "mesh"))]
+    {
+        let _ = (app, request);
+        Err("Mesh native runtime is not included in this build".into())
+    }
+    #[cfg(feature = "mesh")]
+    {
+        use buzz_mesh_compute::lifecycle::Phase;
+        let host = app.state::<super::MeshHost>();
+        let identity = app.state::<crate::identity::IdentityHost>();
+        let community = community_origin(&request.relay)?;
+        let lease = host.lease.for_community(&community)?;
+        if host.lifecycle.phase() == Phase::Stopped {
+            buzz_mesh_compute::startup_log::stage("entry", "from=agent");
+            super::start(app, &host, &identity, &lease).await?;
+        }
+        let port = super::mesh_port("BUZZ_MESH_API_PORT", 19337)?;
+        let client = reqwest::Client::builder()
+            .no_proxy()
+            .timeout(std::time::Duration::from_secs(30))
+            .build()
+            .map_err(|e| e.to_string())?;
+        let deadline = tokio::time::Instant::now() + std::time::Duration::from_secs(120);
+        let mut last = "Shared compute is starting".to_owned();
+        let ready = async {
+            loop {
+                host.lease.community(&lease)?;
+                match host.lifecycle.phase() {
+                    Phase::Failed(reason) => return Err(reason),
+                    Phase::Stopped | Phase::Stopping => {
+                        return Err("Shared compute stopped before agent launch".into())
+                    }
+                    Phase::Starting => {}
+                    Phase::Ready => match probe(&client, port, &request.model).await {
+                        Ok(model) => {
+                            buzz_mesh_compute::startup_log::stage("first_probe_ok", "");
+                            return Ok(model);
+                        }
+                        Err(error) => last = error,
+                    },
+                }
+                tokio::time::sleep(std::time::Duration::from_secs(2)).await;
+            }
+        };
+        let model = tokio::time::timeout_at(deadline, ready)
+            .await
+            .map_err(|_| {
+                buzz_mesh_compute::startup_log::stage("first_probe_ok", "ok=false timeout");
+                format!("Shared compute inference did not become ready: {last}")
+            })??;
+        host.lease.community(&lease)?;
+        let config = MeshLaunch::new(
+            request.agent_id,
+            request.revision,
+            request.relay,
+            model,
+            port,
+        )?;
+        Ok(Prepared {
+            app: app.clone(),
+            lease,
+            config,
+        })
+    }
+}
+
+/// Baseline readiness (legacy `mesh_readiness::wait_for_mesh_inference`): a real
+/// chat request decides. The catalog only explains a failure; it never gates.
+#[cfg(feature = "mesh")]
+async fn probe(client: &reqwest::Client, port: u16, model: &str) -> Result<String, String> {
+    let base = format!("http://127.0.0.1:{port}/v1");
+    let wire = match model.trim() {
+        "" | "auto" | "mesh" => "mesh",
+        named => named,
+    };
+    let response = client
+        .post(format!("{base}/chat/completions"))
+        .bearer_auth("mesh-local")
+        .json(&serde_json::json!({"model": wire, "messages": [{"role":"user","content":"Reply OK"}], "max_tokens":1, "stream":false}))
+        .send()
+        .await;
+    let failure = match response {
+        Ok(response) if response.status().is_success() => return Ok(wire.to_owned()),
+        Ok(response) => format!("HTTP {}", response.status()),
+        Err(error) => error.to_string(),
+    };
+    let visible = async {
+        let catalog = client
+            .get(format!("{base}/models"))
+            .bearer_auth("mesh-local")
+            .send()
+            .await
+            .ok()?
+            .json::<serde_json::Value>()
+            .await
+            .ok()?;
+        let ids: Vec<String> = catalog["data"]
+            .as_array()?
+            .iter()
+            .filter_map(|m| m["id"].as_str().map(str::to_owned))
+            .collect();
+        // The virtual route counts as synced once any concrete model is listed.
+        Some(if wire == "mesh" {
+            ids.iter().any(|id| id != "mesh")
+        } else {
+            ids.iter().any(|id| id == wire)
+        })
+    }
+    .await;
+    Err(match visible {
+        Some(false) => format!("{failure} (model not yet visible in the Mesh catalog)"),
+        _ => failure,
+    })
+}
+
+#[cfg(all(test, feature = "mesh"))]
+mod tests {
+    use super::*;
+    use tokio::io::{AsyncReadExt, AsyncWriteExt};
+
+    struct Fixture {
+        port: u16,
+        stop: tokio::sync::oneshot::Sender<()>,
+        server: tokio::task::JoinHandle<Vec<String>>,
+    }
+    impl Fixture {
+        /// Stop only after the awaited probe, then return the recorded requests.
+        async fn finish(self) -> Vec<String> {
+            let _ = self.stop.send(());
+            self.server.await.unwrap()
+        }
+    }
+
+    /// Loopback fixture answering `/v1/models` and `/v1/chat/completions` by path.
+    async fn fixture(catalog: (u16, &'static str), chat: u16) -> Fixture {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let port = listener.local_addr().unwrap().port();
+        let (stop, mut stopped) = tokio::sync::oneshot::channel::<()>();
+        let server = tokio::spawn(async move {
+            let mut seen = Vec::new();
+            loop {
+                let mut socket = tokio::select! {
+                    _ = &mut stopped => break,
+                    accepted = listener.accept() => accepted.unwrap().0,
+                };
+                let mut request = Vec::new();
+                loop {
+                    let mut buf = [0; 1024];
+                    let n = socket.read(&mut buf).await.unwrap();
+                    if n == 0 {
+                        break;
+                    }
+                    request.extend_from_slice(&buf[..n]);
+                    if let Some(end) = request.windows(4).position(|w| w == b"\r\n\r\n") {
+                        let header = String::from_utf8_lossy(&request[..end]).to_lowercase();
+                        let length: usize = header
+                            .lines()
+                            .find_map(|line| {
+                                line.strip_prefix("content-length:")
+                                    .map(|v| v.trim().parse().unwrap())
+                            })
+                            .unwrap_or(0);
+                        if request.len() >= end + 4 + length {
+                            break;
+                        }
+                    }
+                }
+                let text = String::from_utf8(request).unwrap();
+                let (code, body) = if text.starts_with("POST /v1/chat/completions") {
+                    let body: serde_json::Value =
+                        serde_json::from_str(text.split("\r\n\r\n").nth(1).unwrap()).unwrap();
+                    assert_eq!(body["max_tokens"], 1);
+                    seen.push(format!("chat:{}", body["model"].as_str().unwrap()));
+                    (chat, "{}")
+                } else {
+                    assert!(text.starts_with("GET /v1/models"));
+                    seen.push("models".into());
+                    catalog
+                };
+                socket.write_all(format!("HTTP/1.1 {code} Fixture\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}", body.len()).as_bytes()).await.unwrap();
+            }
+            seen
+        });
+        Fixture { port, stop, server }
+    }
+
+    fn client() -> reqwest::Client {
+        reqwest::Client::builder()
+            .no_proxy()
+            .timeout(std::time::Duration::from_secs(2))
+            .build()
+            .unwrap()
+    }
+
+    // Live 0.78.1 shape: a remote peer's model with no context_length.
+    const BUDGETLESS: &str = r#"{"data":[{"id":"mesh"},{"id":"unsloth/Qwen3.5-9B-GGUF:Q4_K_M","metadata":{"workload_class":"causal_generation"}}]}"#;
+
+    #[tokio::test]
+    async fn successful_inference_is_ready_even_without_a_context_budget() {
+        let f = fixture((200, BUDGETLESS), 200).await;
+        assert_eq!(probe(&client(), f.port, "auto").await.unwrap(), "mesh");
+        assert_eq!(f.finish().await, vec!["chat:mesh"]);
+    }
+
+    #[tokio::test]
+    async fn catalog_failure_or_missing_entry_does_not_gate_working_inference() {
+        let f = fixture((500, "oops"), 200).await;
+        assert_eq!(probe(&client(), f.port, "auto").await.unwrap(), "mesh");
+        assert_eq!(f.finish().await, vec!["chat:mesh"]);
+        let f = fixture((200, BUDGETLESS), 200).await;
+        assert_eq!(
+            probe(&client(), f.port, "lagging/model:Q4").await.unwrap(),
+            "lagging/model:Q4"
+        );
+        assert_eq!(f.finish().await, vec!["chat:lagging/model:Q4"]);
+    }
+
+    #[tokio::test]
+    async fn failed_inference_uses_the_catalog_only_to_explain() {
+        let f = fixture((200, BUDGETLESS), 503).await;
+        let error = probe(&client(), f.port, "lagging/model:Q4")
+            .await
+            .unwrap_err();
+        assert!(
+            error.contains("503") && error.contains("not yet visible"),
+            "{error}"
+        );
+        assert_eq!(f.finish().await, vec!["chat:lagging/model:Q4", "models"]);
+        let f = fixture((200, BUDGETLESS), 503).await;
+        let error = probe(&client(), f.port, "auto").await.unwrap_err();
+        assert!(
+            error.contains("503") && !error.contains("not yet visible"),
+            "{error}"
+        );
+        assert_eq!(f.finish().await, vec!["chat:mesh", "models"]);
+    }
+}
+
+#[cfg(all(test, feature = "mesh"))]
+mod community_tests {
+    use super::community_origin;
+    #[test]
+    fn saved_agent_and_ui_share_one_origin_without_accepting_paths_or_credentials() {
+        for raw in [
+            "wss://meshllm.communities.buzz.xyz",
+            "https://MESHLLM.communities.buzz.xyz:443/",
+            "wss://meshllm.communities.buzz.xyz./",
+        ] {
+            assert_eq!(
+                community_origin(raw).unwrap(),
+                "https://meshllm.communities.buzz.xyz"
+            );
+        }
+        for raw in [
+            "wss://relay.example/path",
+            "https://user:pass@relay.example",
+            "https://relay.example?x",
+            "http://relay.example",
+        ] {
+            assert!(community_origin(raw).is_err());
+        }
+    }
+}
diff --git a/src-tauri/src/mesh_compute/coordinator.rs b/src-tauri/src/mesh_compute/coordinator.rs
new file mode 100644
index 000000000..2ece8e65b
--- /dev/null
+++ b/src-tauri/src/mesh_compute/coordinator.rs
@@ -0,0 +1,520 @@
+//! Donor roster and peer-join duties, scoped to the app-owned node.
+use buzz_mesh_compute::{
+    discovery::{availability_from_events, current_member_pubkeys, owner_ids_from_events},
+    lifecycle::Phase,
+    roster::{Decision, Observation, Reconcile},
+};
+use std::time::Duration;
+use tauri::Manager;
+
+pub(super) fn ensure_started(app: tauri::AppHandle, host: &super::MeshHost) -> Result<(), String> {
+    let mut task = host
+        .coordinator
+        .lock()
+        .map_err(|_| "Mesh coordinator unavailable")?;
+    if task
+        .as_ref()
+        .is_some_and(|task| !task.inner().is_finished())
+    {
+        return Ok(());
+    }
+    *task = Some(tauri::async_runtime::spawn(async move {
+        let mut generation = None;
+        let mut roster = Reconcile::default();
+        let mut roster_at = tokio::time::Instant::now() + Duration::from_secs(60);
+        let mut delay = Duration::from_secs(15);
+        loop {
+            tokio::time::sleep(delay).await;
+            let check_roster = tokio::time::Instant::now() >= roster_at;
+            if check_roster {
+                roster_at = tokio::time::Instant::now() + Duration::from_secs(60);
+            }
+            match reconcile(&app, &mut generation, &mut roster, check_roster).await {
+                Ok(()) => delay = Duration::from_secs(15),
+                Err(error) => {
+                    eprintln!("Mesh community reconciliation failed: {error}");
+                    delay = (delay * 2).min(Duration::from_secs(120));
+                }
+            }
+        }
+    }));
+    Ok(())
+}
+
+async fn reconcile(
+    app: &tauri::AppHandle,
+    generation: &mut Option<String>,
+    roster: &mut Reconcile,
+    check_roster: bool,
+) -> Result<(), String> {
+    let host = app.state::<super::MeshHost>();
+    let identity = app.state::<crate::identity::IdentityHost>();
+    let Some((lease, community)) = host.lease.current()? else {
+        return Ok(());
+    };
+    if !matches!(host.lifecycle.phase(), Phase::Starting | Phase::Ready) {
+        return Ok(());
+    }
+    let Some((node, owner, owners, admitted_evidence)) = host
+        .admission
+        .lock()
+        .map_err(|_| "Mesh admission unavailable")?
+        .clone()
+    else {
+        return Ok(());
+    };
+    if generation.as_ref() != Some(&node) {
+        *generation = Some(node.clone());
+        *roster = Reconcile::default();
+    }
+    let viewer = identity.viewer().await?;
+    // A successful membership read must take effect before optional status reads.
+    let membership = match tokio::time::timeout(
+        Duration::from_secs(10),
+        super::discovery::read_membership(&identity, &community),
+    )
+    .await
+    {
+        Ok(Ok(events)) => events,
+        result => {
+            roster.observe(&owners, Observation::ReadFailed, false);
+            return Err(match result {
+                Ok(Err(error)) => error,
+                _ => "Community membership read timed out".into(),
+            });
+        }
+    };
+    // Serialize admission against Share, Stop, selection, and agent startup.
+    let _guard = host.preparing.lock().await;
+    host.lease.community(&lease)?;
+    if identity.viewer().await? != viewer {
+        return Err("Identity changed during Mesh reconciliation".into());
+    }
+    if host
+        .admission
+        .lock()
+        .map_err(|_| "Mesh admission unavailable")?
+        .as_ref()
+        .map(|value| &value.0)
+        != Some(&node)
+    {
+        return Ok(());
+    }
+    if !matches!(host.lifecycle.phase(), Phase::Starting | Phase::Ready) {
+        return Ok(());
+    }
+    let admitted_at = admitted_evidence
+        .iter()
+        .filter(|event| event.kind.as_u16() == 13534)
+        .map(|event| event.created_at)
+        .max();
+    let observed_at = membership.iter().map(|event| event.created_at).max();
+    if observed_at < admitted_at {
+        return Err("Ignoring older Mesh membership snapshot".into());
+    }
+    let removed = !current_member_pubkeys(&membership).contains(&viewer);
+    let retained_records = retained_evidence(&admitted_evidence, &membership);
+    let mut retained = owner_ids_from_events(&retained_records);
+    retained.push(owner.clone());
+    if !removed && owners.iter().any(|id| !retained.contains(id)) {
+        // Authoritative removal is not a liveness short-read. Stop the old admission
+        // before trying optional discovery; a failed restart remains safely stopped.
+        host.lifecycle
+            .stop_and_wait()
+            .await
+            .map_err(|e| e.to_string())?;
+        // Restart only with retained admission; failed status discovery cannot widen it.
+        return recover_routes(
+            &membership,
+            &retained_records,
+            &retained,
+            async {
+                tokio::time::timeout(
+                    Duration::from_secs(10),
+                    super::discovery::read_events(&identity, &community),
+                )
+                .await
+                .map_err(|_| "Community status discovery timed out".to_owned())?
+            },
+            |targets| {
+                super::start_with_evidence(
+                    app,
+                    &identity,
+                    &lease,
+                    retained.clone(),
+                    targets,
+                    retained_records.clone(),
+                    true,
+                )
+            },
+        )
+        .await;
+    }
+
+    if removed {
+        // Stop is requested even if lease revocation or agent cleanup fails.
+        host.lifecycle.stop();
+        host.lease.revoke(&lease)?;
+        let consumers = app.state::<crate::agents::AgentHost>();
+        finish_revocation(consumers.stop_mesh_consumers(), async {
+            host.lifecycle
+                .stop_and_wait()
+                .await
+                .map_err(|error| error.to_string())
+        })
+        .await?;
+        return Err("Community membership was removed; shared compute has stopped".into());
+    }
+    let events = tokio::time::timeout(
+        Duration::from_secs(10),
+        super::discovery::read_events(&identity, &community),
+    )
+    .await
+    .map_err(|_| "Community status discovery timed out")??;
+    // A second status read cannot roll back the separately verified roster.
+    let events = retained_evidence(&events, &membership);
+    if check_roster {
+        let mut fresh = owner_ids_from_events(&events);
+        fresh.push(owner.clone());
+        let observation = Observation::Members(fresh);
+        match roster.observe(
+            &owners,
+            observation,
+            host.lifecycle.phase() == Phase::Starting,
+        ) {
+            Decision::ViewerRemoved => {
+                host.lease.revoke(&lease)?;
+                *host
+                    .admission
+                    .lock()
+                    .map_err(|_| "Mesh admission unavailable")? = None;
+                host.preferences
+                    .lock()
+                    .map_err(|_| "Mesh settings unavailable")?
+                    .set_error(
+                        "Community membership was removed; shared compute has stopped".into(),
+                    );
+                host.lifecycle
+                    .stop_and_wait()
+                    .await
+                    .map_err(|e| e.to_string())?;
+                return Ok(());
+            }
+            Decision::Grow(_) | Decision::Shrink(_) => {
+                // Keep saved sharing intent; this is not the user's Stop sharing.
+                host.lifecycle
+                    .stop_and_wait()
+                    .await
+                    .map_err(|e| e.to_string())?;
+                let result = super::start_prepared(app, &host, &identity, &lease).await;
+                if let Err(error) = &result {
+                    host.preferences.lock().map_err(|_| "Mesh settings unavailable")?
+                        .set_error(format!("Shared compute could not restart after membership changed: {error}. Reconnect to retry."));
+                }
+                return result;
+            }
+            Decision::Keep | Decision::AwaitConfirmation => {}
+        }
+    }
+    if host.lifecycle.phase() != Phase::Ready {
+        return Ok(());
+    }
+    let status = host.lifecycle.status().await.map_err(|e| e.to_string())?;
+    let peers = visible_peer_ids(&status.payload);
+    let availability = availability_from_events(events);
+    let mut failure = None;
+    for target in availability.serve_targets.into_iter().filter(|target| {
+        target.owner_id.as_deref() != Some(owner.as_str())
+            && !target_is_visible(target.endpoint_id.as_deref(), &peers)
+    }) {
+        host.lease.community(&lease)?;
+        if let Err(error) = host.lifecycle.dial(&target.endpoint_addr) {
+            failure = Some(error.to_string());
+        }
+    }
+    failure.map_or(Ok(()), Err)
+}
+
+async fn finish_revocation(
+    agents: impl std::future::Future<Output = Result<(), String>>,
+    node: impl std::future::Future<Output = Result<(), String>>,
+) -> Result<(), String> {
+    let (agents, node) = tokio::join!(agents, node);
+    node?;
+    agents
+}
+
+// Optional routing failure must not prevent rebuilding the reduced admission.
+async fn recover_routes<F, R>(
+    membership: &[nostr::event::Event],
+    admitted: &[nostr::event::Event],
+    owners: &[String],
+    discovery: F,
+    restart: impl FnOnce(Vec<buzz_mesh_compute::discovery_types::MeshServeTarget>) -> R,
+) -> Result<(), String>
+where
+    F: std::future::Future<Output = Result<Vec<nostr::event::Event>, String>>,
+    R: std::future::Future<Output = Result<(), String>>,
+{
+    let events = discovery.await;
+    restart(retained_targets(
+        events.as_deref().unwrap_or(admitted),
+        membership,
+        owners,
+    ))
+    .await
+}
+
+// Fresh routes may be used only for the retained admission set. They never widen it.
+fn retained_targets(
+    events: &[nostr::event::Event],
+    membership: &[nostr::event::Event],
+    owners: &[String],
+) -> Vec<buzz_mesh_compute::discovery_types::MeshServeTarget> {
+    availability_from_events(retained_evidence(events, membership))
+        .serve_targets
+        .into_iter()
+        .filter(|target| {
+            target
+                .owner_id
+                .as_ref()
+                .is_some_and(|owner| owners.contains(owner))
+        })
+        .collect()
+}
+
+// Reuse only previously verified owner bindings; new admission needs full discovery.
+fn retained_evidence(
+    admitted: &[nostr::event::Event],
+    membership: &[nostr::event::Event],
+) -> Vec<nostr::event::Event> {
+    let members = current_member_pubkeys(membership);
+    membership
+        .iter()
+        .filter(|event| event.kind.as_u16() == 13534)
+        .chain(admitted.iter().filter(|event| {
+            event.kind.as_u16() != 13534 && members.contains(&event.pubkey.to_hex())
+        }))
+        .cloned()
+        .collect()
+}
+
+fn visible_peer_ids(payload: &serde_json::Value) -> Vec<String> {
+    payload
+        .get("peers")
+        .and_then(serde_json::Value::as_array)
+        .into_iter()
+        .flatten()
+        .filter_map(|peer| peer.get("id").and_then(serde_json::Value::as_str))
+        .map(|id| id.trim().to_ascii_lowercase())
+        .filter(|id| !id.is_empty())
+        .collect()
+}
+fn target_is_visible(endpoint: Option<&str>, peers: &[String]) -> bool {
+    let Some(endpoint) = endpoint else {
+        return false;
+    };
+    let endpoint = endpoint.trim().to_ascii_lowercase();
+    !endpoint.is_empty()
+        && peers.iter().any(|peer| {
+            !peer.is_empty() && (endpoint.starts_with(peer) || peer.starts_with(&endpoint))
+        })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn fresh_membership_revokes_captured_owner_without_status_and_never_admits_new_owner() {
+        use nostr::{
+            event::{EventBuilder, FinalizeEvent, Kind, Tag},
+            key::Keys,
+        };
+        let relay = Keys::generate();
+        let a = Keys::generate();
+        let b = Keys::generate();
+        let new = Keys::generate();
+        let dir = tempfile::tempdir().unwrap();
+        let owner_a =
+            buzz_mesh_compute::identity::load_owner_at(&dir.path().join("a.json")).unwrap();
+        let owner_b =
+            buzz_mesh_compute::identity::load_owner_at(&dir.path().join("b.json")).unwrap();
+        let roster =
+            |members: &[&Keys]| {
+                EventBuilder::new(Kind::Custom(13534), "")
+                    .tags(members.iter().map(|member| {
+                        Tag::parse(["member", &member.public_key().to_hex()]).unwrap()
+                    }))
+                    .finalize(&relay)
+                    .unwrap()
+            };
+        let status = |member: &Keys, owner| {
+            buzz_mesh_compute::publication::status_event(
+                owner,
+                &member.public_key().to_hex(),
+                false,
+                None,
+                None,
+                None,
+            )
+            .unwrap()
+            .finalize(member)
+            .unwrap()
+        };
+        let admitted = vec![
+            roster(&[&a, &b]),
+            status(&a, &owner_a),
+            status(&b, &owner_b),
+        ];
+        let membership = vec![roster(&[&a, &new])];
+        // Optional advertisements are unavailable: only captured bindings are present.
+        let retained = retained_evidence(&admitted, &membership);
+        assert_eq!(owner_ids_from_events(&retained), vec![owner_a.owner_id()]);
+        assert!(!retained.iter().any(|event| event.pubkey == b.public_key()));
+        assert_eq!(current_member_pubkeys(&retained).len(), 2);
+    }
+
+    #[tokio::test]
+    async fn recovery_uses_fresh_retained_routes_not_expired_admission_or_new_owners() {
+        use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+        use nostr::{
+            event::{EventBuilder, FinalizeEvent, Kind, Tag},
+            key::Keys,
+            types::time::Timestamp,
+        };
+        let relay = Keys::generate();
+        let member = Keys::generate();
+        let newcomer = Keys::generate();
+        let dir = tempfile::tempdir().unwrap();
+        let owner =
+            buzz_mesh_compute::identity::load_owner_at(&dir.path().join("owner.json")).unwrap();
+        let new_owner =
+            buzz_mesh_compute::identity::load_owner_at(&dir.path().join("new.json")).unwrap();
+        let token = URL_SAFE_NO_PAD.encode(
+            serde_json::to_vec(&serde_json::json!({
+                "id": hex::encode(owner.verifying_key().as_bytes()),
+                "addrs": [{"Ip": "192.168.1.20:47916"}]
+            }))
+            .unwrap(),
+        );
+        let raw = serde_json::json!({"hosted_models": ["fixture-model"]});
+        let old = buzz_mesh_compute::publication::status_event(
+            &owner,
+            &member.public_key().to_hex(),
+            true,
+            Some(&raw),
+            Some(&token),
+            None,
+        )
+        .unwrap()
+        .custom_created_at(Timestamp::from_secs(Timestamp::now().as_secs() - 180))
+        .finalize(&member)
+        .unwrap();
+        let fresh = buzz_mesh_compute::publication::status_event(
+            &owner,
+            &member.public_key().to_hex(),
+            true,
+            Some(&raw),
+            Some(&token),
+            None,
+        )
+        .unwrap()
+        .finalize(&member)
+        .unwrap();
+        let new = buzz_mesh_compute::publication::status_event(
+            &new_owner,
+            &newcomer.public_key().to_hex(),
+            true,
+            Some(&raw),
+            Some(&token),
+            None,
+        )
+        .unwrap()
+        .finalize(&newcomer)
+        .unwrap();
+        let membership = vec![EventBuilder::new(Kind::Custom(13534), "")
+            .tags([
+                Tag::parse(["member", &member.public_key().to_hex()]).unwrap(),
+                Tag::parse(["member", &newcomer.public_key().to_hex()]).unwrap(),
+            ])
+            .finalize(&relay)
+            .unwrap()];
+        let owners = vec![owner.owner_id()];
+        assert!(retained_targets(std::slice::from_ref(&old), &membership, &owners).is_empty());
+        recover_routes(
+            &membership,
+            &[old],
+            &owners,
+            async { Ok(vec![fresh, new]) },
+            |targets| {
+                assert_eq!(targets.len(), 1);
+                assert_eq!(targets[0].owner_id.as_ref(), Some(&owner.owner_id()));
+                std::future::ready(Ok(()))
+            },
+        )
+        .await
+        .unwrap();
+    }
+
+    #[tokio::test]
+    async fn revocation_finishes_node_stop_even_when_agent_cleanup_fails() {
+        let stopped = std::cell::Cell::new(false);
+        let error = finish_revocation(async { Err("agent cleanup failed".into()) }, async {
+            stopped.set(true);
+            Ok(())
+        })
+        .await
+        .unwrap_err();
+        assert!(stopped.get());
+        assert_eq!(error, "agent cleanup failed");
+        assert_eq!(
+            finish_revocation(async { Err("agent failed".into()) }, async {
+                Err("node failed".into())
+            })
+            .await
+            .unwrap_err(),
+            "node failed"
+        );
+    }
+
+    #[tokio::test]
+    async fn removal_restarts_with_empty_routes_when_optional_discovery_fails() {
+        let restarted = std::cell::Cell::new(false);
+        recover_routes(
+            &[],
+            &[],
+            &["retained-owner".into()],
+            async { Err("relay unavailable".into()) },
+            |targets| {
+                assert!(targets.is_empty());
+                restarted.set(true);
+                std::future::ready(Ok(()))
+            },
+        )
+        .await
+        .unwrap();
+        assert!(restarted.get());
+        let error = recover_routes(
+            &[],
+            &[],
+            &[],
+            async { Err("relay unavailable".into()) },
+            |_| std::future::ready(Err("restart failed".into())),
+        )
+        .await
+        .unwrap_err();
+        assert_eq!(error, "restart failed");
+    }
+
+    #[test]
+    fn donor_peer_shape_and_short_ids_are_preserved() {
+        let peers = visible_peer_ids(
+            &serde_json::json!({"peers":[{"id":" ABC123 "},{"id":"def456"},{"name":"ignored"}]}),
+        );
+        assert_eq!(peers, ["abc123", "def456"]);
+        assert!(target_is_visible(Some("ABC1234567890"), &peers));
+        assert!(!target_is_visible(Some("other"), &peers));
+        assert!(!target_is_visible(Some("  "), &peers));
+        assert!(!target_is_visible(None, &peers));
+    }
+}
diff --git a/src-tauri/src/mesh_compute/discovery.rs b/src-tauri/src/mesh_compute/discovery.rs
new file mode 100644
index 000000000..f56f21020
--- /dev/null
+++ b/src-tauri/src/mesh_compute/discovery.rs
@@ -0,0 +1,105 @@
+//! Every invocation captures one community URL; no authority cache crosses communities.
+use crate::{identity::IdentityHost, relay};
+use buzz_mesh_compute::{
+    discovery::{availability_from_events, current_member_pubkeys, owner_ids_from_events},
+    discovery_query,
+};
+use nostr::key::PublicKey;
+
+pub(super) async fn read(
+    host: &IdentityHost,
+    community: &str,
+) -> Result<
+    (
+        Vec<String>,
+        Vec<buzz_mesh_compute::discovery_types::MeshServeTarget>,
+        Vec<nostr::event::Event>,
+    ),
+    String,
+> {
+    let events = member_events(host, community).await?;
+    let owners = owner_ids_from_events(&events);
+    let targets = availability_from_events(events.clone()).serve_targets;
+    Ok((owners, targets, events))
+}
+
+/// Read authoritative membership independently of optional model advertisements.
+pub(super) async fn read_membership(
+    host: &IdentityHost,
+    community: &str,
+) -> Result<Vec<nostr::event::Event>, String> {
+    let viewer = host.viewer().await?;
+    let info = relay::mesh_read(host, community, None).await?;
+    let authority = info
+        .get("self")
+        .and_then(serde_json::Value::as_str)
+        .ok_or("Relay did not advertise its identity")?;
+    let authority = PublicKey::from_hex(authority).map_err(|_| "Invalid relay identity")?;
+    let data = relay::mesh_read(
+        host,
+        community,
+        Some(buzz_mesh_compute::discovery::authoritative_membership_filter(&authority)),
+    )
+    .await?;
+    let values = data.as_array().ok_or("Invalid Mesh membership response")?;
+    let events = values
+        .iter()
+        .cloned()
+        .filter_map(|value| serde_json::from_value(value).ok())
+        .collect();
+    let events = buzz_mesh_compute::discovery::verify_evidence(events, &authority)
+        .map_err(|error| error.to_string())?;
+    if host.viewer().await? != viewer {
+        return Err("Identity changed during Mesh membership read".into());
+    }
+    Ok(events)
+}
+
+pub(super) async fn read_events(
+    host: &IdentityHost,
+    community: &str,
+) -> Result<Vec<nostr::event::Event>, String> {
+    let viewer = host.viewer().await?;
+    let info = relay::mesh_read(host, community, None).await?;
+    let authority = info
+        .get("self")
+        .and_then(serde_json::Value::as_str)
+        .ok_or("Relay did not advertise its identity")?;
+    let authority = PublicKey::from_hex(authority).map_err(|_| "Invalid relay identity")?;
+    let events = discovery_query::discover(&authority, |filter| async move {
+        let data = relay::mesh_read(host, community, Some(filter))
+            .await
+            .map_err(std::io::Error::other)?;
+        let values = data
+            .as_array()
+            .ok_or_else(|| std::io::Error::other("Invalid Mesh query result"))?;
+        Ok(values.clone())
+    })
+    .await
+    .map_err(|error| error.to_string())?;
+    if host.viewer().await? != viewer {
+        return Err("Identity changed during Mesh discovery".into());
+    }
+    Ok(events)
+}
+
+pub(super) async fn inventory(
+    host: &IdentityHost,
+    community: &str,
+) -> Result<buzz_mesh_compute::inventory::Inventory, String> {
+    let events = member_events(host, community).await?;
+    Ok(buzz_mesh_compute::inventory::project(
+        availability_from_events(events.clone()),
+    ))
+}
+
+async fn member_events(
+    host: &IdentityHost,
+    community: &str,
+) -> Result<Vec<nostr::event::Event>, String> {
+    let events = read_events(host, community).await?;
+    if !current_member_pubkeys(&events).contains(&host.viewer().await?) {
+        return Err("Current identity is not a member of this Mesh community".into());
+    }
+    Ok(events)
+}
diff --git a/src-tauri/src/mesh_compute/lease.rs b/src-tauri/src/mesh_compute/lease.rs
new file mode 100644
index 000000000..52a564192
--- /dev/null
+++ b/src-tauri/src/mesh_compute/lease.rs
@@ -0,0 +1,200 @@
+//! Native fencing of host-UI intent, not native active-community state.
+use std::sync::Mutex;
+
+#[derive(Default)]
+pub(super) struct Lease(Mutex<Option<(String, String)>>);
+impl Lease {
+    pub fn current(&self) -> Result<Option<(String, String)>, String> {
+        self.0
+            .lock()
+            .map(|current| current.clone())
+            .map_err(|_| "Mesh selection unavailable".into())
+    }
+
+    pub fn for_community(&self, community: &str) -> Result<String, String> {
+        let current = self.0.lock().map_err(|_| "Mesh selection unavailable")?;
+        current
+            .as_ref()
+            .filter(|(_, selected)| selected == community)
+            .map(|(id, _)| id.clone())
+            .ok_or_else(|| "Enable Shared compute in the agent’s community first".into())
+    }
+
+    #[cfg(test)]
+    pub fn select(&self, community: String) -> Result<String, String> {
+        self.select_with(community, || {})
+    }
+    #[cfg(test)]
+    pub fn select_with(&self, community: String, changed: impl FnOnce()) -> Result<String, String> {
+        self.try_select_with(community, false, || {
+            changed();
+            Ok(())
+        })
+    }
+    pub fn try_select_with(
+        &self,
+        community: String,
+        force_change: bool,
+        changed: impl FnOnce() -> Result<(), String>,
+    ) -> Result<String, String> {
+        let id = uuid::Uuid::new_v4().to_string();
+        let mut current = self.0.lock().map_err(|_| "Mesh lease unavailable")?;
+        let same = current
+            .as_ref()
+            .is_some_and(|(_, previous)| previous == &community);
+        if !same || force_change {
+            changed()?;
+        }
+        *current = Some((id.clone(), community));
+        Ok(id)
+    }
+    pub fn community(&self, id: &str) -> Result<String, String> {
+        self.with_current(id, |community| Ok(community.to_owned()))
+    }
+    pub fn with_current<T>(
+        &self,
+        id: &str,
+        action: impl FnOnce(&str) -> Result<T, String>,
+    ) -> Result<T, String> {
+        let current = self.0.lock().map_err(|_| "Mesh lease unavailable")?;
+        let (_, community) = current
+            .as_ref()
+            .filter(|(key, _)| key == id)
+            .ok_or("Mesh selection expired")?;
+        action(community)
+    }
+    pub fn revoke(&self, id: &str) -> Result<bool, String> {
+        let mut current = self.0.lock().map_err(|_| "Mesh lease unavailable")?;
+        if current.as_ref().is_some_and(|(key, _)| key == id) {
+            *current = None;
+            Ok(true)
+        } else {
+            Ok(false)
+        }
+    }
+    pub fn restore(&self, previous: Option<(String, String)>) -> Result<(), String> {
+        let mut current = self.0.lock().map_err(|_| "Mesh selection unavailable")?;
+        if current.is_none() {
+            *current = previous;
+        }
+        Ok(())
+    }
+    pub fn clear(&self) {
+        if let Ok(mut current) = self.0.lock() {
+            *current = None;
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::{
+        atomic::{AtomicBool, Ordering},
+        Arc,
+    };
+    #[test]
+    fn failed_replacement_restores_owner_but_never_overwrites_newer_selection() {
+        let lease = Lease::default();
+        let old = lease.select("https://a.example".into()).unwrap();
+        let prior = lease.current().unwrap();
+        lease.clear();
+        lease.restore(prior.clone()).unwrap();
+        assert_eq!(lease.for_community("https://a.example").unwrap(), old);
+        lease.clear();
+        let new = lease.select("https://b.example".into()).unwrap();
+        lease.restore(prior).unwrap();
+        assert_eq!(lease.for_community("https://b.example").unwrap(), new);
+        assert!(lease.for_community("https://a.example").is_err());
+    }
+
+    #[tokio::test]
+    async fn revoked_discovery_cannot_commit_a_start() {
+        let lease = Arc::new(Lease::default());
+        let id = lease.select("https://fixture.example".into()).unwrap();
+        let started = Arc::new(AtomicBool::new(false));
+        let (entered, observed) = tokio::sync::oneshot::channel();
+        let (release, gate) = tokio::sync::oneshot::channel();
+        let task = {
+            let lease = lease.clone();
+            let id = id.clone();
+            let started = started.clone();
+            tokio::spawn(async move {
+                lease.community(&id)?;
+                entered.send(()).unwrap();
+                gate.await.unwrap();
+                lease.with_current(&id, |_| {
+                    started.store(true, Ordering::SeqCst);
+                    Ok(())
+                })
+            })
+        };
+        observed.await.unwrap();
+        assert!(lease.revoke(&id).unwrap());
+        release.send(()).unwrap();
+        assert!(task.await.unwrap().is_err());
+        assert!(!started.load(Ordering::SeqCst));
+    }
+    #[test]
+    fn changing_community_fences_old_start_and_old_cleanup() {
+        let lease = Lease::default();
+        let old = lease.select("https://old.example".into()).unwrap();
+        let new = lease.select("https://new.example".into()).unwrap();
+        assert!(lease.community(&old).is_err());
+        assert!(!lease.revoke(&old).unwrap());
+        assert_eq!(lease.community(&new).unwrap(), "https://new.example");
+    }
+    #[test]
+    fn forced_identity_change_stops_same_community_and_failed_checkpoint_keeps_selection() {
+        let lease = Lease::default();
+        let old = lease.select("https://same.example".into()).unwrap();
+        let changed = AtomicBool::new(false);
+        let new = lease
+            .try_select_with("https://same.example".into(), true, || {
+                changed.store(true, Ordering::SeqCst);
+                Ok(())
+            })
+            .unwrap();
+        assert!(changed.load(Ordering::SeqCst));
+        assert!(lease.community(&old).is_err());
+        assert!(lease
+            .try_select_with("https://other.example".into(), false, || Err(
+                "disk failed".into()
+            ))
+            .is_err());
+        assert_eq!(lease.community(&new).unwrap(), "https://same.example");
+    }
+    #[test]
+    fn same_community_rotates_lease_without_stopping() {
+        let lease = Lease::default();
+        let old = lease.select("https://same.example".into()).unwrap();
+        let new = lease
+            .select_with("https://same.example".into(), || panic!("must not stop"))
+            .unwrap();
+        assert_ne!(old, new);
+        assert!(!lease.revoke(&old).unwrap());
+        assert!(lease.community(&new).is_ok());
+    }
+}
+
+#[cfg(test)]
+mod agent_selection_tests {
+    use super::*;
+    #[test]
+    fn agent_can_only_use_the_current_plugin_selection() {
+        let lease = Lease::default();
+        assert!(lease.for_community("https://one.example").is_err());
+        let selected = lease.select("https://one.example".into()).unwrap();
+        assert_eq!(
+            lease.for_community("https://one.example").unwrap(),
+            selected
+        );
+        assert!(lease.for_community("https://two.example").is_err());
+        lease.revoke(&selected).unwrap();
+        assert!(lease
+            .with_current(&selected, |_| -> Result<(), String> {
+                panic!("revoked selection cannot spawn")
+            })
+            .is_err());
+    }
+}
diff --git a/src-tauri/src/mesh_compute/preferences.rs b/src-tauri/src/mesh_compute/preferences.rs
new file mode 100644
index 000000000..5ae2bcf4b
--- /dev/null
+++ b/src-tauri/src/mesh_compute/preferences.rs
@@ -0,0 +1,410 @@
+//! Donor mesh-sharing.json checkpoints, bound to the selected viewer and community.
+use super::sharing::Share;
+use std::{io::Write, path::PathBuf};
+
+#[derive(Clone, Debug, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub(super) struct Config {
+    pub viewer: String,
+    pub community: String,
+    pub model: String,
+    pub max_vram_gb: Option<u64>,
+    pub enabled: bool,
+    #[serde(default)]
+    pub auto: bool,
+}
+impl Config {
+    pub fn pending(viewer: String, community: String, share: &Share) -> Self {
+        Self {
+            viewer,
+            community,
+            model: share.model.clone(),
+            max_vram_gb: share.max_vram_gb,
+            enabled: false,
+            auto: false,
+        }
+    }
+}
+
+// Preserve older/unparseable checkpoints; only the bound schema can restore consent.
+fn checkpoint_path(path: PathBuf) -> Result<PathBuf, String> {
+    match std::fs::read(&path) {
+        Ok(bytes) if serde_json::from_slice::<Config>(&bytes).is_ok() => Ok(path),
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(path),
+        _ => Ok(path.with_file_name("mesh-sharing-viewer.json")),
+    }
+}
+
+#[derive(Default)]
+pub(super) struct Preferences {
+    path: Option<PathBuf>,
+    config: Option<Config>,
+    selected: Option<(String, String)>,
+    error: Option<String>,
+}
+impl Preferences {
+    pub fn initialize(&mut self, path: Result<PathBuf, String>) {
+        match path.and_then(checkpoint_path).and_then(|path| {
+            let config = match std::fs::read(&path) {
+                Ok(bytes) => {
+                    let mut config: Config = serde_json::from_slice(&bytes)
+                        .map_err(|e| format!("Invalid Mesh sharing settings: {e}"))?;
+                    let legacy = serde_json::from_slice::<serde_json::Value>(&bytes)
+                        .map_err(|e| e.to_string())?
+                        .get("auto")
+                        .is_none();
+                    if legacy {
+                        config.auto =
+                            buzz_mesh_compute::catalog::is_legacy_recommendation(&config.model);
+                    }
+                    config.model =
+                        buzz_mesh_compute::catalog::canonical_curated_model_id(&config.model)
+                            .to_owned();
+                    if config.viewer.is_empty()
+                        || config.community.is_empty()
+                        || config.model.is_empty()
+                        || config.max_vram_gb == Some(0)
+                    {
+                        return Err("Invalid Mesh sharing settings".into());
+                    }
+                    Some(config)
+                }
+                Err(error) if error.kind() == std::io::ErrorKind::NotFound => None,
+                Err(error) => return Err(format!("Could not read Mesh sharing settings: {error}")),
+            };
+            Ok((path, config))
+        }) {
+            Ok((path, config)) => {
+                self.path = Some(path);
+                self.config = config;
+            }
+            Err(error) => self.error = Some(error),
+        }
+    }
+    pub fn viewer_changed(&self, viewer: &str) -> bool {
+        self.selected
+            .as_ref()
+            .is_some_and(|(selected, _)| selected != viewer)
+    }
+    // A revoked lease is not a pristine launch: prior consumers may still need cleanup.
+    pub fn requires_retirement(&self, bound: Option<&str>, community: &str, viewer: &str) -> bool {
+        self.viewer_changed(viewer)
+            || bound.is_some_and(|current| current != community)
+            || (bound.is_none() && self.selected.is_some())
+    }
+    pub fn select(&mut self, viewer: String, community: String) {
+        self.selected = Some((viewer, community));
+    }
+    pub fn hint(&self) -> Option<&Config> {
+        self.config.as_ref().filter(|config| {
+            self.selected.as_ref() == Some(&(config.viewer.clone(), config.community.clone()))
+        })
+    }
+    pub fn set_error(&mut self, error: String) {
+        self.error = Some(error);
+    }
+    pub fn clear_runtime_error(&mut self) {
+        if self.error.as_ref().is_some_and(|error| {
+            error.starts_with("Shared compute could not restart after membership changed:")
+        }) {
+            self.error = None;
+        }
+    }
+    pub fn error(&self) -> Option<&str> {
+        self.error.as_deref()
+    }
+    pub fn checkpoint(&mut self, config: Config) -> Result<(), String> {
+        let result = self.write(&config);
+        match result {
+            Ok(()) => {
+                self.config = Some(config);
+                self.error = None;
+                Ok(())
+            }
+            Err(error) => {
+                self.error = Some(error.clone());
+                Err(error)
+            }
+        }
+    }
+    fn write(&self, config: &Config) -> Result<(), String> {
+        let path = self
+            .path
+            .as_ref()
+            .ok_or("Mesh settings storage unavailable")?;
+        let parent = path.parent().ok_or("Mesh settings directory unavailable")?;
+        std::fs::create_dir_all(parent)
+            .map_err(|e| format!("Could not create Mesh settings directory: {e}"))?;
+        let bytes = serde_json::to_vec_pretty(config).map_err(|e| e.to_string())?;
+        // Same atomic tempfile/rename pattern as agent-controller; never truncate the old file.
+        let mut temp = tempfile::NamedTempFile::new_in(parent).map_err(|e| e.to_string())?;
+        temp.write_all(&bytes).map_err(|e| e.to_string())?;
+        temp.as_file().sync_all().map_err(|e| e.to_string())?;
+        temp.persist(path).map_err(|e| e.to_string())?;
+        #[cfg(unix)]
+        std::fs::File::open(parent)
+            .and_then(|dir| dir.sync_all())
+            .map_err(|_| {
+                "Mesh settings were replaced but durability is uncertain; reload before retrying"
+            })?;
+        Ok(())
+    }
+    pub fn disarm(&mut self) -> Result<(), String> {
+        if let Some(mut config) = self.hint().cloned() {
+            config.enabled = false;
+            self.checkpoint(config)?;
+        }
+        Ok(())
+    }
+    pub fn phase(
+        &mut self,
+        expected: &Config,
+        phase: &buzz_mesh_compute::lifecycle::Phase,
+        reached_ready: bool,
+    ) -> Result<(), String> {
+        if self.hint().map_or(true, |current| {
+            current.viewer != expected.viewer
+                || current.community != expected.community
+                || current.model != expected.model
+                || current.max_vram_gb != expected.max_vram_gb
+        }) {
+            return Ok(());
+        }
+        // Normal shutdown deliberately leaves enabled armed for restore through Mesh.
+        if *phase == buzz_mesh_compute::lifecycle::Phase::Ready
+            || (matches!(phase, buzz_mesh_compute::lifecycle::Phase::Failed(_)) && !reached_ready)
+        {
+            let mut config = self.hint().cloned().ok_or("Mesh selection expired")?;
+            config.enabled = *phase == buzz_mesh_compute::lifecycle::Phase::Ready;
+            self.checkpoint(config)?;
+        }
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn first_selection_preserves_restore_but_revoked_binding_requires_retirement() {
+        let mut prefs = super::Preferences::default();
+        assert!(!prefs.requires_retirement(None, "a", "viewer"));
+        prefs.select("viewer".into(), "a".into());
+        assert!(!prefs.requires_retirement(Some("a"), "a", "viewer"));
+        assert!(prefs.requires_retirement(Some("a"), "b", "viewer"));
+        // Revocation removed the lease, not proof that all old consumers stopped.
+        assert!(prefs.requires_retirement(None, "b", "viewer"));
+        assert!(prefs.requires_retirement(None, "a", "viewer"));
+        assert!(prefs.requires_retirement(Some("a"), "a", "other-viewer"));
+    }
+
+    use super::*;
+    use buzz_mesh_compute::lifecycle::Phase;
+    fn config() -> Config {
+        Config::pending(
+            "viewer".into(),
+            "https://fixture.example".into(),
+            &Share {
+                model: "fixture".into(),
+                max_vram_gb: None,
+            },
+        )
+    }
+    fn store(path: PathBuf) -> Preferences {
+        let mut store = Preferences::default();
+        store.initialize(Ok(path));
+        store.select("viewer".into(), "https://fixture.example".into());
+        store
+    }
+    #[test]
+    fn ready_arms_quit_preserves_failed_disarms_and_model_hint_survives_reopen() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("mesh-sharing.json");
+        let mut prefs = store(path.clone());
+        prefs.checkpoint(config()).unwrap();
+        assert!(!store(path.clone()).hint().unwrap().enabled);
+        prefs.phase(&config(), &Phase::Ready, false).unwrap();
+        prefs.phase(&config(), &Phase::Stopped, false).unwrap();
+        assert!(store(path.clone()).hint().unwrap().enabled);
+        prefs
+            .phase(&config(), &Phase::Failed("runtime crash".into()), true)
+            .unwrap();
+        assert!(store(path.clone()).hint().unwrap().enabled);
+        prefs
+            .phase(&config(), &Phase::Failed("load failed".into()), false)
+            .unwrap();
+        let reopened = store(path.clone());
+        assert!(!reopened.hint().unwrap().enabled);
+        assert_eq!(reopened.hint().unwrap().model, "fixture");
+        prefs.phase(&config(), &Phase::Ready, false).unwrap();
+        prefs.disarm().unwrap();
+        assert!(!store(path).hint().unwrap().enabled);
+    }
+    #[test]
+    fn different_viewer_or_community_cannot_restore_or_rearm_old_intent() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("mesh-sharing.json");
+        let mut prefs = store(path);
+        prefs.checkpoint(config()).unwrap();
+        for (viewer, community) in [
+            ("other", "https://fixture.example"),
+            ("viewer", "https://other.example"),
+        ] {
+            prefs.select(viewer.into(), community.into());
+            assert!(prefs.hint().is_none());
+            prefs.phase(&config(), &Phase::Ready, false).unwrap();
+            assert!(!prefs.config.as_ref().unwrap().enabled);
+        }
+    }
+    #[test]
+    fn failed_write_preserves_prior_checkpoint_and_old_model_cannot_arm_replacement() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("mesh-sharing.json");
+        let mut prefs = store(path.clone());
+        prefs.checkpoint(config()).unwrap();
+        let mut replacement = config();
+        replacement.model = "replacement".into();
+        prefs.checkpoint(replacement.clone()).unwrap();
+        prefs.phase(&config(), &Phase::Ready, false).unwrap();
+        assert!(!store(path.clone()).hint().unwrap().enabled);
+        assert_eq!(store(path.clone()).hint().unwrap().model, "replacement");
+        let blocked = dir.path().join("blocked");
+        std::fs::write(&blocked, b"not a directory").unwrap();
+        prefs.path = Some(blocked.join("mesh-sharing.json"));
+        assert!(prefs.phase(&replacement, &Phase::Ready, false).is_err());
+        assert!(!prefs.hint().unwrap().enabled);
+        assert!(!store(path).hint().unwrap().enabled);
+    }
+    #[test]
+    fn donor_settings_are_preserved_and_never_bind_or_resume_without_confirmation() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("mesh-sharing.json");
+        let legacy = br#"{"enabled":true,"startOnNextLaunch":true,"modelId":"old","maxVramGb":null,"relayUrl":"wss://fixture.example"}"#;
+        std::fs::write(&path, legacy).unwrap();
+        let mut prefs = store(path.clone());
+        assert!(prefs.error().is_none());
+        assert!(prefs.hint().is_none());
+        assert_eq!(std::fs::read(&path).unwrap(), legacy);
+        assert!(!dir.path().join("mesh-sharing-viewer.json").exists());
+        prefs.checkpoint(config()).unwrap();
+        prefs.phase(&config(), &Phase::Ready, false).unwrap();
+        assert!(store(path.clone()).hint().unwrap().enabled);
+        assert_eq!(std::fs::read(&path).unwrap(), legacy);
+        let mut other = store(path);
+        other.select("someone-else".into(), "https://fixture.example".into());
+        assert!(other.hint().is_none());
+    }
+
+    #[test]
+    fn empty_legacy_and_older_shapes_allow_explicit_sharing_without_modifying_source() {
+        for bytes in [
+            r#"{"enabled":false,"startOnNextLaunch":false,"modelId":"","maxVramGb":null,"relayUrl":null}"#,
+            r#"{"enabled":false,"modelId":"old","maxVramGb":null}"#,
+            "{invalid",
+        ] {
+            let dir = tempfile::tempdir().unwrap();
+            let path = dir.path().join("mesh-sharing.json");
+            std::fs::write(&path, bytes).unwrap();
+            let mut prefs = store(path.clone());
+            assert!(prefs.hint().is_none());
+            assert!(prefs.error().is_none());
+            prefs.checkpoint(config()).unwrap();
+            assert_eq!(std::fs::read_to_string(path).unwrap(), bytes);
+        }
+    }
+
+    #[test]
+    fn invalid_settings_and_failed_write_do_not_silently_arm() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("mesh-sharing.json");
+        std::fs::write(&path, b"{invalid").unwrap();
+        let mut prefs = store(path);
+        assert!(prefs.error().is_none());
+        assert!(prefs.hint().is_none());
+        prefs.checkpoint(config()).unwrap();
+        let blocked = dir.path().join("blocked");
+        std::fs::write(&blocked, b"not a directory").unwrap();
+        let mut prefs = store(blocked.join("mesh-sharing.json"));
+        assert!(prefs.checkpoint(config()).is_err());
+        assert!(prefs.hint().is_none());
+    }
+}
+
+#[cfg(test)]
+mod recovery_tests {
+    use super::Preferences;
+    #[test]
+    fn reconnect_clears_runtime_error_without_hiding_storage_failure() {
+        let mut prefs = Preferences::default();
+        prefs.set_error("Shared compute could not restart after membership changed: offline. Reconnect to retry.".into());
+        prefs.clear_runtime_error();
+        assert!(prefs.error().is_none());
+        prefs.set_error("Could not write sharing settings".into());
+        prefs.clear_runtime_error();
+        assert_eq!(prefs.error(), Some("Could not write sharing settings"));
+    }
+}
+
+#[cfg(test)]
+mod auto_tests {
+    use super::*;
+    #[test]
+    fn legacy_curated_models_become_auto_but_custom_and_explicit_overrides_do_not() {
+        for (model, expected) in [
+            ("unsloth/gemma-4-E4B-it-GGUF:Q4_K_M", true),
+            ("unsloth/Qwen3.5-9B-GGUF:Q4_K_M", true),
+            ("unsloth/Qwen3.8-27B-GGUF:UD-Q4_K_M", true),
+            ("unsloth/Qwen3.8-27B-GGUF:UD-Q4_K_XL", true),
+            ("/models/local.gguf", false),
+            ("other/model:Q4", false),
+        ] {
+            let dir = tempfile::tempdir().unwrap();
+            let path = dir.path().join("mesh-sharing.json");
+            let legacy = serde_json::json!({"viewer":"viewer", "community":"https://fixture.example", "model":model, "maxVramGb":null, "enabled":false});
+            std::fs::write(&path, legacy.to_string()).unwrap();
+            let mut prefs = Preferences::default();
+            prefs.initialize(Ok(path.clone()));
+            prefs.select("viewer".into(), "https://fixture.example".into());
+            assert_eq!(prefs.hint().unwrap().auto, expected, "{model}");
+            assert!(!prefs.hint().unwrap().enabled);
+            // Migration is read-only until the next explicit settings write.
+            assert_eq!(std::fs::read_to_string(&path).unwrap(), legacy.to_string());
+            let mut explicit = prefs.hint().unwrap().clone();
+            explicit.auto = false;
+            prefs.checkpoint(explicit).unwrap();
+            let mut reopened = Preferences::default();
+            reopened.initialize(Ok(path));
+            reopened.select("viewer".into(), "https://fixture.example".into());
+            assert!(!reopened.hint().unwrap().auto);
+        }
+    }
+    #[test]
+    fn runtime_checkpoint_cannot_undo_a_reset_to_auto() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("mesh-sharing.json");
+        let mut prefs = Preferences::default();
+        prefs.initialize(Ok(path.clone()));
+        prefs.select("viewer".into(), "https://fixture.example".into());
+        let config = Config::pending(
+            "viewer".into(),
+            "https://fixture.example".into(),
+            &Share {
+                model: "custom".into(),
+                max_vram_gb: None,
+            },
+        );
+        prefs.checkpoint(config.clone()).unwrap();
+        let mut reset = config.clone();
+        reset.auto = true;
+        prefs.checkpoint(reset).unwrap();
+        prefs
+            .phase(&config, &buzz_mesh_compute::lifecycle::Phase::Ready, false)
+            .unwrap();
+        assert!(prefs.hint().unwrap().auto);
+        assert!(prefs.hint().unwrap().enabled);
+        let mut reopened = Preferences::default();
+        reopened.initialize(Ok(path));
+        reopened.select("viewer".into(), "https://fixture.example".into());
+        assert!(reopened.hint().unwrap().auto);
+        assert_eq!(reopened.hint().unwrap().model, "custom");
+    }
+}
diff --git a/src-tauri/src/mesh_compute/publisher.rs b/src-tauri/src/mesh_compute/publisher.rs
new file mode 100644
index 000000000..4aeacec54
--- /dev/null
+++ b/src-tauri/src/mesh_compute/publisher.rs
@@ -0,0 +1,334 @@
+//! One app-owned publisher; no public Nostr discovery or raw SDK payload forwarding.
+use buzz_mesh_compute::{identity::load_owner_at, lifecycle::Phase, publication};
+use std::time::Duration;
+use tauri::Manager;
+
+const INTERVAL: Duration = Duration::from_secs(45);
+
+/// Serializes periodic publication and the immediate Share-Off withdrawal so an
+/// in-flight serving snapshot can never be signed after the stopped note.
+static PUBLISH: tokio::sync::Mutex<()> = tokio::sync::Mutex::const_new(());
+
+/// Last `created_at` signed for our replaceable status address.
+static LAST_CREATED: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
+
+/// Replaceable events resolve by `created_at` (whole seconds), so two notes signed
+/// in the same second can tie. Under `PUBLISH`, wait (bounded by the caller's
+/// timeout) until the real clock passes the last stamp instead of future-dating,
+/// so a later process's real-time notes are never outranked by a future stamp.
+/// Ordering is strict within one process; a restart in the same second can tie.
+async fn next_created_at<C, S, F>(mut now: C, sleep: S, last: &std::sync::atomic::AtomicU64) -> u64
+where
+    C: FnMut() -> u64,
+    S: Fn(Duration) -> F,
+    F: std::future::Future<Output = ()>,
+{
+    use std::sync::atomic::Ordering;
+    let previous = last.load(Ordering::SeqCst);
+    let mut stamp = now();
+    while stamp <= previous {
+        sleep(Duration::from_millis(100)).await;
+        stamp = now();
+    }
+    last.store(stamp, Ordering::SeqCst);
+    stamp
+}
+
+fn unix_now() -> u64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_secs())
+        .unwrap_or(0)
+}
+const TIMEOUT: Duration = Duration::from_secs(10);
+
+pub(super) fn ensure_started(app: tauri::AppHandle, host: &super::MeshHost) -> Result<(), String> {
+    let mut task = host
+        .publisher
+        .lock()
+        .map_err(|_| "Mesh publisher unavailable")?;
+    if task
+        .as_ref()
+        .is_some_and(|task| !task.inner().is_finished())
+    {
+        return Ok(());
+    }
+    *task = Some(tauri::async_runtime::spawn(async move {
+        let mut previous: Option<(String, String)> = None;
+        loop {
+            heartbeat(publish(&app, &mut previous)).await;
+        }
+    }));
+    Ok(())
+}
+
+// Classic cadence is 45 seconds after each bounded publication attempt.
+async fn heartbeat(operation: impl std::future::Future<Output = Result<(), String>>) {
+    match tokio::time::timeout(TIMEOUT, operation).await {
+        Ok(Ok(())) => {}
+        Ok(Err(error)) => eprintln!("Mesh status publication failed: {error}"),
+        Err(_) => eprintln!("Mesh status publication timed out"),
+    }
+    tokio::time::sleep(INTERVAL).await;
+}
+
+/// Publish while Mesh runs, plus exactly one stopped note for the run that just
+/// ended in this same community. Nothing is published before first use.
+fn should_publish(
+    running: bool,
+    previous: Option<&(String, String)>,
+    community: &str,
+    viewer: &str,
+) -> bool {
+    running || previous.is_some_and(|(c, v)| c == community && v == viewer)
+}
+
+fn needs_stop_note(previous: &(String, String), selected: Option<&str>, viewer: &str) -> bool {
+    selected != Some(previous.0.as_str()) && previous.1 == viewer
+}
+
+async fn publish(
+    app: &tauri::AppHandle,
+    previous: &mut Option<(String, String)>,
+) -> Result<(), String> {
+    // Read state and sign under the same lock as withdrawal.
+    let _serial = PUBLISH.lock().await;
+    let host = app.state::<super::MeshHost>();
+    let identity = app.state::<crate::identity::IdentityHost>();
+    let selection = host.lease.current()?;
+    let viewer = identity.viewer().await?;
+    let retired = previous.clone().filter(|old| {
+        needs_stop_note(
+            old,
+            selection.as_ref().map(|(_, current)| current.as_str()),
+            &viewer,
+        )
+    });
+    let Some((lease, community)) = selection else {
+        *previous = None;
+        if let Some((community, member)) = retired {
+            let _ = tokio::time::timeout(
+                Duration::from_secs(2),
+                send(&identity, &community, &member, false, None),
+            )
+            .await;
+        }
+        return Ok(());
+    };
+    // Enrollment follows legacy Buzz: the member↔owner binding is published only
+    // once Mesh actually runs here (Share or a Mesh agent), never merely because
+    // the plugin is enabled. After a run ends, one stopped note is published.
+    let running = matches!(host.lifecycle.phase(), Phase::Starting | Phase::Ready);
+    if !should_publish(running, previous.as_ref(), &community, &viewer) {
+        // A replaced community's run still gets its bounded stopped note.
+        if let Some((community, member)) = retired {
+            *previous = None;
+            let _ = tokio::time::timeout(
+                Duration::from_secs(2),
+                send(&identity, &community, &member, false, None),
+            )
+            .await;
+        }
+        return Ok(());
+    }
+    let status = if host.lifecycle.phase() == Phase::Ready {
+        let mut status = host.lifecycle.status().await.map_err(|e| e.to_string())?;
+        // Mesh's own catalog maps content-addressed GGUF keys to readable refs.
+        if let Some(names) = display_names(&status.console_url).await {
+            status.payload[publication::DISPLAY_NAMES_KEY] = names;
+        }
+        Some(status)
+    } else {
+        None
+    };
+    host.lease.community(&lease)?;
+    if identity.viewer().await? != viewer {
+        return Err("Identity changed during Mesh publication".into());
+    }
+    let serving = host.lifecycle.is_serving();
+    send(&identity, &community, &viewer, serving, status.as_ref()).await?;
+    // After the stopped note for a finished run, stay quiet until Mesh runs again.
+    *previous = running.then_some((community, viewer));
+    // Active-community publication takes priority; retirement cannot starve it.
+    // Failed retirement is not retried: routing ignores advertisements after 120s.
+    if let Some((community, member)) = retired {
+        let _ = tokio::time::timeout(
+            Duration::from_secs(2),
+            send(&identity, &community, &member, false, None),
+        )
+        .await;
+    }
+    Ok(())
+}
+
+/// Best-effort read of the local node's `/api/models`; publication never waits on it long.
+pub(super) async fn display_names(console_url: &str) -> Option<serde_json::Value> {
+    let response = reqwest::Client::new()
+        .get(format!("{}/api/models", console_url.trim_end_matches('/')))
+        .timeout(Duration::from_secs(3))
+        .send()
+        .await
+        .ok()?
+        .error_for_status()
+        .ok()?;
+    let models: serde_json::Value = serde_json::from_slice(&response.bytes().await.ok()?).ok()?;
+    Some(publication::display_names_from_models(&models))
+}
+
+/// Withdraw this member's serving advertisement right after Share Off, as legacy
+/// `mesh_stop_node` did with `publish_stopped_status_once_at`. Best-effort and bounded;
+/// the periodic publisher still follows up.
+pub(super) async fn publish_stopped(
+    identity: &crate::identity::IdentityHost,
+    community: &str,
+    member: &str,
+) {
+    let _serial = PUBLISH.lock().await;
+    match tokio::time::timeout(
+        Duration::from_secs(5),
+        send(identity, community, member, false, None),
+    )
+    .await
+    {
+        Ok(Ok(())) => {}
+        Ok(Err(error)) => eprintln!("Mesh stopped-status publication failed: {error}"),
+        Err(_) => eprintln!("Mesh stopped-status publication timed out"),
+    }
+}
+
+async fn send(
+    identity: &crate::identity::IdentityHost,
+    community: &str,
+    member: &str,
+    serving: bool,
+    status: Option<&buzz_mesh_compute::lifecycle::NodeStatus>,
+) -> Result<(), String> {
+    let path = super::mesh_owner_path()?;
+    // The first hardware survey can be slow, so it joins the blocking owner load.
+    let (owner, device) = tauri::async_runtime::spawn_blocking(move || {
+        load_owner_at(&path)
+            .map(|owner| (owner, publication::local_device()))
+            .map_err(|e| e.to_string())
+    })
+    .await
+    .map_err(|_| "Mesh owner loading failed")??;
+    let builder = match status {
+        Some(status) => publication::sdk_status_event(&owner, member, serving, status, device),
+        None => publication::status_event(&owner, member, false, None, None, None),
+    }
+    .map_err(|e| e.to_string())?;
+    let event = identity
+        .sign(crate::identity::EventTemplate {
+            kind: builder.kind.as_u16(),
+            created_at: next_created_at(unix_now, tokio::time::sleep, &LAST_CREATED).await,
+            tags: builder
+                .tags
+                .iter()
+                .map(|tag| tag.as_slice().to_vec())
+                .collect(),
+            content: builder.content,
+        })
+        .await?;
+    if event["pubkey"].as_str() != Some(member) {
+        return Err("Identity changed during Mesh publication".into());
+    }
+    crate::relay::mesh_publish(identity, community, event).await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn same_second_notes_wait_for_a_later_real_second_instead_of_future_dating() {
+        use std::sync::atomic::{AtomicU64, Ordering};
+        let clock = std::sync::Arc::new(AtomicU64::new(1_000));
+        let last = AtomicU64::new(0);
+        let read = |c: std::sync::Arc<AtomicU64>| move || c.load(Ordering::SeqCst);
+        let serving = next_created_at(read(clock.clone()), |_| async {}, &last).await;
+        // Off in the same second: sleeping lets the real clock advance; no future stamp.
+        let tick = clock.clone();
+        let stopped = next_created_at(
+            read(clock.clone()),
+            move |_| {
+                tick.fetch_add(1, Ordering::SeqCst);
+                async {}
+            },
+            &last,
+        )
+        .await;
+        assert_eq!((serving, stopped), (1_000, 1_001));
+        assert!(
+            stopped <= clock.load(Ordering::SeqCst),
+            "never ahead of real time"
+        );
+        // A restarted process (fresh `last`) stamps real time, never a future value.
+        // This proves no future-dating, not strict cross-process ordering: a restart
+        // within the same second can still tie (a known limitation).
+        let fresh = AtomicU64::new(0);
+        assert_eq!(
+            next_created_at(read(clock.clone()), |_| async {}, &fresh).await,
+            1_001
+        );
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn successful_publication_waits_45_seconds_before_next_attempt() {
+        let (started, observed) = tokio::sync::oneshot::channel();
+        let task = tokio::spawn(heartbeat(async {
+            started.send(()).unwrap();
+            Ok(())
+        }));
+        observed.await.unwrap();
+        tokio::time::advance(Duration::from_secs(44)).await;
+        assert!(!task.is_finished());
+        tokio::time::advance(Duration::from_secs(1)).await;
+        task.await.unwrap();
+    }
+    #[tokio::test(start_paused = true)]
+    async fn timed_out_publication_is_dropped_at_10_seconds_then_waits_45() {
+        struct Dropped(Option<tokio::sync::oneshot::Sender<()>>);
+        impl Drop for Dropped {
+            fn drop(&mut self) {
+                if let Some(tx) = self.0.take() {
+                    let _ = tx.send(());
+                }
+            }
+        }
+        let (started, observed) = tokio::sync::oneshot::channel();
+        let (dropped, mut drop_observed) = tokio::sync::oneshot::channel();
+        let task = tokio::spawn(heartbeat(async move {
+            let _guard = Dropped(Some(dropped));
+            started.send(()).unwrap();
+            std::future::pending::<Result<(), String>>().await
+        }));
+        observed.await.unwrap();
+        tokio::time::advance(Duration::from_secs(9)).await;
+        assert!(matches!(
+            drop_observed.try_recv(),
+            Err(tokio::sync::oneshot::error::TryRecvError::Empty)
+        ));
+        tokio::time::advance(Duration::from_secs(1)).await;
+        drop_observed.await.unwrap();
+        tokio::time::advance(Duration::from_secs(44)).await;
+        assert!(!task.is_finished());
+        tokio::time::advance(Duration::from_secs(1)).await;
+        task.await.unwrap();
+    }
+    #[test]
+    fn leaving_or_switching_community_sends_stop_only_for_the_same_member() {
+        let previous = ("https://old.example".into(), "member".into());
+        assert!(needs_stop_note(&previous, None, "member"));
+        assert!(needs_stop_note(
+            &previous,
+            Some("https://new.example"),
+            "member"
+        ));
+        assert!(!needs_stop_note(
+            &previous,
+            Some("https://old.example"),
+            "member"
+        ));
+        assert!(!needs_stop_note(&previous, None, "other-member"));
+    }
+}
diff --git a/src-tauri/src/mesh_compute/sharing.rs b/src-tauri/src/mesh_compute/sharing.rs
new file mode 100644
index 000000000..262123cce
--- /dev/null
+++ b/src-tauri/src/mesh_compute/sharing.rs
@@ -0,0 +1,485 @@
+//! Serving intent belongs to the selected community and the existing node.
+use tauri::Manager;
+
+pub(super) fn observer(
+    app: tauri::AppHandle,
+    config: super::preferences::Config,
+) -> impl Fn(buzz_mesh_compute::lifecycle::Phase) + Send + Sync + 'static {
+    let reached_ready = std::sync::atomic::AtomicBool::new(false);
+    move |phase| {
+        if phase == buzz_mesh_compute::lifecycle::Phase::Ready {
+            reached_ready.store(true, std::sync::atomic::Ordering::SeqCst);
+        }
+        let host = app.state::<super::MeshHost>();
+        // Same-community UI remounts rotate the lease without replacing the worker.
+        // Bind checkpoints to the still-selected community and exact intent instead.
+        let result = host
+            .lease
+            .for_community(&config.community)
+            .and_then(|lease| {
+                host.lease.with_current(&lease, |_| {
+                    let mut intent = host
+                        .sharing
+                        .lock()
+                        .map_err(|_| "Mesh sharing unavailable")?;
+                    if intent.as_ref().map_or(true, |share| {
+                        share.model != config.model || share.max_vram_gb != config.max_vram_gb
+                    }) {
+                        return Ok(());
+                    }
+                    let result = host
+                        .preferences
+                        .lock()
+                        .map_err(|_| "Mesh settings unavailable")?
+                        .phase(
+                            &config,
+                            &phase,
+                            reached_ready.load(std::sync::atomic::Ordering::SeqCst),
+                        );
+                    if matches!(phase, buzz_mesh_compute::lifecycle::Phase::Failed(_)) {
+                        *intent = None;
+                    }
+                    result
+                })
+            });
+        if let Err(error) = result {
+            eprintln!("Mesh sharing checkpoint: {error}");
+        }
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(super) struct Share {
+    pub model: String,
+    pub max_vram_gb: Option<u64>,
+}
+impl Share {
+    fn new(model: String, max_vram_gb: Option<u64>) -> Result<Self, String> {
+        let model = buzz_mesh_compute::catalog::canonical_curated_model_id(&model).to_owned();
+        if model.is_empty() {
+            return Err("Choose a model before sharing compute".into());
+        }
+        if max_vram_gb == Some(0) {
+            return Err("Shared compute memory limit must be positive".into());
+        }
+        Ok(Self { model, max_vram_gb })
+    }
+}
+
+#[tauri::command]
+pub async fn mesh_compute_share(
+    app: tauri::AppHandle,
+    lease: String,
+    model: Option<String>,
+    max_vram_gb: Option<u64>,
+    auto: Option<bool>,
+    reset_only: Option<bool>,
+) -> Result<(), String> {
+    let automatic = auto.unwrap_or(false);
+    let resetting = reset_only.unwrap_or(false);
+    let host = app.state::<super::MeshHost>();
+    let identity = app.state::<crate::identity::IdentityHost>();
+    let stopping = model.is_none();
+    let viewer = identity.viewer().await?;
+    let member = viewer.clone();
+    {
+        let _guard = host.preparing.lock().await;
+        let community = host.lease.community(&lease)?;
+        let needs_reset_model = resetting
+            && host
+                .preferences
+                .lock()
+                .map_err(|_| "Mesh settings unavailable")?
+                .hint()
+                .is_none();
+        // The UI currently has no memory override; a future limit must inform Auto's ladder.
+        let recommended = if (automatic && model.is_some() && !resetting) || needs_reset_model {
+            Some(
+                tokio::task::spawn_blocking(buzz_mesh_compute::catalog::recommended_model)
+                    .await
+                    .map_err(|error| format!("Mesh hardware survey failed: {error}"))?,
+            )
+        } else {
+            None
+        };
+        let share = if resetting {
+            None
+        } else {
+            model
+                .map(|model| Share::new(recommended.clone().unwrap_or(model), max_vram_gb))
+                .transpose()?
+        };
+        if resetting {
+            return host.lease.with_current(&lease, |_| {
+                let mut prefs = host
+                    .preferences
+                    .lock()
+                    .map_err(|_| "Mesh settings unavailable")?;
+                let mut config = prefs.hint().cloned().unwrap_or_else(|| {
+                    super::preferences::Config::pending(
+                        viewer.clone(),
+                        community.clone(),
+                        &Share {
+                            model: recommended.clone().unwrap_or_default(),
+                            max_vram_gb: None,
+                        },
+                    )
+                });
+                config.auto = true;
+                // Preserve the current resolved model and consent; reset never starts or stops.
+                prefs.checkpoint(config)
+            });
+        }
+        if stopping
+            && host
+                .sharing
+                .lock()
+                .map_err(|_| "Mesh sharing unavailable")?
+                .is_none()
+        {
+            // Failure can clear live intent while leaving the saved model armed.
+            host.preferences
+                .lock()
+                .map_err(|_| "Mesh settings unavailable")?
+                .disarm()?;
+            return Ok(()); // Share Off must leave an existing consumer alone.
+        }
+        if !stopping
+            && changing_state(
+                &host.lifecycle.phase(),
+                host.sharing
+                    .lock()
+                    .map_err(|_| "Mesh sharing unavailable")?
+                    .is_some(),
+            )
+        {
+            return Err("Mesh is changing state; wait before sharing again".into());
+        }
+        // Explicit Share Off clears intent even if shutdown cannot be confirmed.
+        // The failed lifecycle still refuses replacement; never silently re-serve.
+        if stopping {
+            host.lease.with_current(&lease, |_| {
+                let mut sharing = host
+                    .sharing
+                    .lock()
+                    .map_err(|_| "Mesh sharing unavailable")?;
+                host.preferences
+                    .lock()
+                    .map_err(|_| "Mesh settings unavailable")?
+                    .disarm()?;
+                *sharing = None;
+                Ok(())
+            })?;
+        }
+        if let Some(share) = &share {
+            host.lease.with_current(&lease, |_| {
+                host.preferences
+                    .lock()
+                    .map_err(|_| "Mesh settings unavailable")?
+                    .checkpoint({
+                        let mut config =
+                            super::preferences::Config::pending(viewer, community, share);
+                        config.auto = automatic;
+                        config
+                    })
+            })?;
+        }
+        if !stopping {
+            // Do not replace the worker until its shutdown is confirmed.
+            host.lifecycle
+                .stop_and_wait()
+                .await
+                .map_err(|e| e.to_string())?;
+            host.lease.with_current(&lease, |_| {
+                *host
+                    .sharing
+                    .lock()
+                    .map_err(|_| "Mesh sharing unavailable")? = share;
+                Ok(())
+            })?;
+        }
+    }
+    // Reuses discovery and the same private SDK slot. Solo serving needs no target.
+    if stopping {
+        finish_off(&ProdOff {
+            app: &app,
+            host: &host,
+            identity: &identity,
+            lease: &lease,
+            member: &member,
+        })
+        .await
+    } else {
+        buzz_mesh_compute::startup_log::stage("entry", "from=share");
+        let result = super::start(&app, &host, &identity, &lease).await;
+        if result.is_err() {
+            let _ = host.lease.with_current(&lease, |_| {
+                *host
+                    .sharing
+                    .lock()
+                    .map_err(|_| "Mesh sharing unavailable")? = None;
+                Ok(())
+            });
+        }
+        result
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn serving_requires_a_model_and_positive_memory_limit() {
+        assert!(Share::new("  ".into(), None).is_err());
+        assert!(Share::new("model".into(), Some(0)).is_err());
+        assert_eq!(
+            Share::new(" model ".into(), Some(16)).unwrap(),
+            Share {
+                model: "model".into(),
+                max_vram_gb: Some(16),
+            }
+        );
+    }
+}
+
+/// Whether Share On must wait. A serve runtime that is starting and any
+/// shutdown are left to finish. A consumer client that is still connecting
+/// owns no sharing intent, and a join that never settles must not lock the
+/// member out of sharing, so it is stopped (confirmed) and replaced.
+fn changing_state(phase: &buzz_mesh_compute::lifecycle::Phase, serving: bool) -> bool {
+    use buzz_mesh_compute::lifecycle::Phase;
+    match phase {
+        Phase::Stopping => true,
+        Phase::Starting => serving,
+        _ => false,
+    }
+}
+
+#[cfg(test)]
+mod changing_state_tests {
+    use super::changing_state;
+    use buzz_mesh_compute::lifecycle::Phase;
+
+    #[test]
+    fn only_a_connecting_consumer_may_be_replaced_by_share_on() {
+        assert!(!changing_state(&Phase::Starting, false));
+        assert!(changing_state(&Phase::Starting, true));
+        assert!(changing_state(&Phase::Stopping, false));
+        assert!(changing_state(&Phase::Stopping, true));
+        assert!(!changing_state(&Phase::Ready, false));
+        assert!(!changing_state(&Phase::Stopped, false));
+    }
+}
+
+/// Effects of a Share Off after consent is cleared. Production drives the real
+/// lifecycle, publisher and host; tests substitute a recording fake.
+pub(super) trait OffEffects {
+    /// Stop only if the captured lease is still current; `Ok(false)` means retired.
+    async fn stop(&self) -> Result<bool, String>;
+    fn community(&self) -> Option<String>;
+    async fn has_consumers(&self) -> bool;
+    async fn withdraw(&self, community: &str);
+    async fn start_client(&self) -> Result<(), String>;
+    fn report(&self, error: String);
+}
+
+/// Confirmed stop, then withdraw the serving advert (legacy `mesh_stop_node`),
+/// then re-arm one consumer client only when running Mesh agents need it (legacy
+/// coordinator → `ensure_relay_mesh_for_record`). A failed stop does neither; a
+/// retired lease withdraws nothing it no longer owns. Re-arm failure keeps the
+/// cleared consent but is reported on the existing settings-error surface.
+pub(super) async fn finish_off(fx: &impl OffEffects) -> Result<(), String> {
+    if !fx.stop().await? {
+        // A replacement owns the slot now: touch nothing of it.
+        return Ok(());
+    }
+    let Some(community) = fx.community() else {
+        return Ok(());
+    };
+    fx.withdraw(&community).await;
+    if fx.has_consumers().await {
+        if let Err(error) = fx.start_client().await {
+            fx.report(format!(
+                "Sharing is off, but shared compute for running agents could not restart: {error}"
+            ));
+        }
+    }
+    Ok(())
+}
+
+/// Validate the captured lease inside the acquired `preparing` guard before the
+/// destructive stop, so a delayed Off can never stop a replacement's node.
+async fn stop_if_current(host: &super::MeshHost, lease: &str) -> Result<bool, String> {
+    let _guard = host.preparing.lock().await;
+    if host.lease.community(lease).is_err() {
+        return Ok(false);
+    }
+    host.lifecycle
+        .stop_and_wait()
+        .await
+        .map_err(|e| e.to_string())?;
+    Ok(true)
+}
+
+struct ProdOff<'a> {
+    app: &'a tauri::AppHandle,
+    host: &'a super::MeshHost,
+    identity: &'a crate::identity::IdentityHost,
+    lease: &'a str,
+    member: &'a str,
+}
+
+impl OffEffects for ProdOff<'_> {
+    async fn stop(&self) -> Result<bool, String> {
+        stop_if_current(self.host, self.lease).await
+    }
+    fn community(&self) -> Option<String> {
+        self.host.lease.community(self.lease).ok()
+    }
+    async fn has_consumers(&self) -> bool {
+        self.app
+            .state::<crate::agents::AgentHost>()
+            .has_mesh_consumers()
+            .await
+    }
+    async fn withdraw(&self, community: &str) {
+        super::publisher::publish_stopped(self.identity, community, self.member).await;
+    }
+    async fn start_client(&self) -> Result<(), String> {
+        super::start(self.app, self.host, self.identity, self.lease).await
+    }
+    fn report(&self, error: String) {
+        eprintln!("{error}");
+        // Only the still-current selection's settings may carry this error.
+        let _ = self.host.lease.with_current(self.lease, |_| {
+            self.host
+                .preferences
+                .lock()
+                .map_err(|_| "Mesh settings unavailable")?
+                .set_error(error);
+            Ok(())
+        });
+    }
+}
+
+#[cfg(test)]
+mod off_tests {
+    use super::*;
+    use std::sync::Mutex;
+
+    struct Fake {
+        stop: Result<bool, String>,
+        lease: bool,
+        consumers: bool,
+        start: Result<(), String>,
+        calls: Mutex<Vec<String>>,
+    }
+    impl Fake {
+        fn new(
+            stop: Result<bool, String>,
+            lease: bool,
+            consumers: bool,
+            start: Result<(), String>,
+        ) -> Self {
+            Self {
+                stop,
+                lease,
+                consumers,
+                start,
+                calls: Mutex::new(Vec::new()),
+            }
+        }
+        fn log(&self, call: &str) {
+            self.calls.lock().unwrap().push(call.into());
+        }
+        fn calls(&self) -> Vec<String> {
+            self.calls.lock().unwrap().clone()
+        }
+    }
+    impl OffEffects for Fake {
+        async fn stop(&self) -> Result<bool, String> {
+            self.log("stop");
+            self.stop.clone()
+        }
+        fn community(&self) -> Option<String> {
+            self.lease.then(|| "https://a.example".into())
+        }
+        async fn has_consumers(&self) -> bool {
+            self.consumers
+        }
+        async fn withdraw(&self, community: &str) {
+            self.log(&format!("withdraw:{community}"));
+        }
+        async fn start_client(&self) -> Result<(), String> {
+            self.log("start_client");
+            self.start.clone()
+        }
+        fn report(&self, error: String) {
+            self.log(&format!("report:{error}"));
+        }
+    }
+
+    #[tokio::test]
+    async fn confirmed_off_with_running_consumers_stops_withdraws_then_starts_one_client() {
+        let fx = Fake::new(Ok(true), true, true, Ok(()));
+        finish_off(&fx).await.unwrap();
+        assert_eq!(
+            fx.calls(),
+            ["stop", "withdraw:https://a.example", "start_client"]
+        );
+    }
+
+    #[tokio::test]
+    async fn no_consumers_withdraw_only_and_failed_stop_does_neither() {
+        let fx = Fake::new(Ok(true), true, false, Ok(()));
+        finish_off(&fx).await.unwrap();
+        assert_eq!(fx.calls(), ["stop", "withdraw:https://a.example"]);
+        let fx = Fake::new(Err("Mesh shutdown timed out".into()), true, true, Ok(()));
+        assert_eq!(
+            finish_off(&fx).await.unwrap_err(),
+            "Mesh shutdown timed out"
+        );
+        assert_eq!(fx.calls(), ["stop"]);
+    }
+
+    #[tokio::test]
+    async fn delayed_off_never_stops_a_replacement_node() {
+        let host = std::sync::Arc::new(super::super::MeshHost::default());
+        let old = host.lease.select("https://a.example".into()).unwrap();
+        // Off's stop is queued behind a replacement holding `preparing`.
+        let held = host.preparing.lock().await;
+        let (h, lease) = (host.clone(), old.clone());
+        let off = tokio::spawn(async move { stop_if_current(&h, &lease).await });
+        tokio::task::yield_now().await;
+        let replacement = host.lease.select("https://b.example".into()).unwrap();
+        drop(held);
+        assert_eq!(off.await.unwrap(), Ok(false), "retired Off must not stop");
+        assert!(host.lease.community(&replacement).is_ok());
+        assert_eq!(stop_if_current(&host, &replacement).await, Ok(true));
+    }
+
+    #[tokio::test]
+    async fn retired_lease_withdraws_nothing_and_starts_no_replacement() {
+        let fx = Fake::new(Ok(false), true, true, Ok(()));
+        finish_off(&fx).await.unwrap();
+        assert_eq!(fx.calls(), ["stop"]);
+    }
+
+    #[tokio::test]
+    async fn rearm_failure_keeps_off_successful_but_reports_the_cause() {
+        // e.g. discovery found no sharer: start returns before any lifecycle change.
+        let fx = Fake::new(
+            Ok(true),
+            true,
+            true,
+            Err("No live community member is sharing compute".into()),
+        );
+        finish_off(&fx).await.unwrap();
+        let calls = fx.calls();
+        assert_eq!(
+            &calls[..3],
+            ["stop", "withdraw:https://a.example", "start_client"]
+        );
+        assert!(calls[3].starts_with("report:Sharing is off, but shared compute for running agents could not restart: No live community member"));
+    }
+}
diff --git a/src-tauri/src/mesh_compute/smoke.rs b/src-tauri/src/mesh_compute/smoke.rs
new file mode 100644
index 000000000..bd996387f
--- /dev/null
+++ b/src-tauri/src/mesh_compute/smoke.rs
@@ -0,0 +1,92 @@
+//! Explicit opt-in SDK smoke. No Tauri app, IdentityHost or saved agents are initialized.
+use super::MeshHost;
+use buzz_mesh_compute::{config::ClientConfig, identity::ensure_owner_at, lifecycle::Phase};
+use std::time::Duration;
+
+fn request(owner: &str, path: &std::path::Path) -> ClientConfig {
+    ClientConfig {
+        api_port: 19337,
+        console_port: 13131,
+        owner_key: path.to_owned(),
+        owner_id: owner.to_owned(),
+        trusted_owners: vec![owner.to_owned()],
+        join_token: None,
+        mesh_name: Some("buzz-native-smoke".into()),
+    }
+}
+
+#[tokio::test]
+#[ignore = "native smoke: requires dedicated HOME/runtime cache and free 19337/13131"]
+async fn native_mesh_host_start_stop_restart() {
+    let home = std::env::var("BUZZ_MESH_SMOKE_HOME").expect("explicit smoke HOME required");
+    assert_eq!(std::env::var("HOME").unwrap(), home);
+    assert!(std::path::Path::new(&home).join("SMOKE_ONLY").is_file());
+    for port in [19337, 13131] {
+        std::net::TcpListener::bind((std::net::Ipv4Addr::LOCALHOST, port))
+            .expect("smoke port already occupied");
+    }
+    let temp = tempfile::tempdir_in(&home).unwrap();
+    let path = temp.path().join("owner.json");
+    let owner = ensure_owner_at(&path).unwrap();
+    let host = MeshHost::default();
+    let http = reqwest::Client::builder()
+        .timeout(Duration::from_secs(3))
+        .build()
+        .unwrap();
+    println!("smoke_pid={}", std::process::id());
+    for round in 1..=2 {
+        host.lifecycle.start(request(&owner, &path)).unwrap();
+        let result = tokio::time::timeout(Duration::from_secs(90), async {
+            loop {
+                if let Phase::Failed(reason) = host.lifecycle.phase() {
+                    panic!("startup: {reason}");
+                }
+                if host.lifecycle.phase() == Phase::Ready {
+                    break;
+                }
+                tokio::time::sleep(Duration::from_millis(100)).await;
+            }
+            let response = http
+                .get("http://127.0.0.1:19337/v1/models")
+                .send()
+                .await
+                .unwrap();
+            let status = response.status();
+            let body = response.text().await.unwrap();
+            println!("round={round} models_status={status} models_body={body}");
+            assert!(status.is_success() || status.as_u16() == 503);
+            let ps = std::process::Command::new("ps")
+                .args(["-p", &std::process::id().to_string(), "-o", "pid,ppid,comm"])
+                .output()
+                .unwrap();
+            println!(
+                "round={round} before_stop_ps={}",
+                String::from_utf8_lossy(&ps.stdout)
+            );
+        })
+        .await;
+        // Always request stop, including when the readiness deadline expires.
+        host.lifecycle.stop();
+        assert!(host.lifecycle.start(request(&owner, &path)).is_err());
+        let stopped = host.lifecycle.stop_and_wait().await;
+        println!(
+            "round={round} stop={stopped:?} phase={:?}",
+            host.lifecycle.phase()
+        );
+        stopped.unwrap();
+        let ps = std::process::Command::new("ps")
+            .args(["-p", &std::process::id().to_string(), "-o", "pid,ppid,comm"])
+            .output()
+            .unwrap();
+        println!(
+            "round={round} after_stop_ps={}",
+            String::from_utf8_lossy(&ps.stdout)
+        );
+        result.expect("native startup deadline expired");
+        for port in [19337, 13131] {
+            std::net::TcpListener::bind((std::net::Ipv4Addr::LOCALHOST, port))
+                .expect("listener remained after confirmed stop");
+        }
+        assert_eq!(ensure_owner_at(&path).unwrap(), owner);
+    }
+}
diff --git a/src-tauri/src/relay.rs b/src-tauri/src/relay.rs
index 0cc749ec4..ded6b53e7 100644
--- a/src-tauri/src/relay.rs
+++ b/src-tauri/src/relay.rs
@@ -1807,3 +1807,58 @@ fn media_type(value: Option<&str>) -> (String, bool) {
 }
 #[cfg(test)]
 mod tests;
+
+/// Mesh uses the same bounded, authenticated HTTP client as other native relay reads.
+#[cfg(feature = "mesh")]
+pub(crate) async fn mesh_read(
+    host: &IdentityHost,
+    community: &str,
+    filter: Option<serde_json::Value>,
+) -> Result<serde_json::Value> {
+    let (path, method) = if filter.is_some() {
+        ("/query", "POST")
+    } else {
+        ("/", "GET")
+    };
+    let url = request_url(community, path, method)?;
+    let body = filter.map(|filter| serde_json::json!([filter]).to_string());
+    let response = send(host, url, method, body, method == "POST", MAX_RESPONSE).await?;
+    if !(200..300).contains(&response.status) {
+        return Err("Mesh relay read failed".into());
+    }
+    serde_json::from_str(&response.body).map_err(|_| "Invalid Mesh relay response".into())
+}
+
+#[cfg(feature = "mesh")]
+pub(crate) fn mesh_origin(community: &str) -> Result<()> {
+    origin(community).map(|_| ())
+}
+
+/// Native Mesh coordinator only; never exposes arbitrary signing/publication to plugins.
+#[cfg(feature = "mesh")]
+pub(crate) async fn mesh_publish(
+    host: &IdentityHost,
+    community: &str,
+    event: serde_json::Value,
+) -> Result<()> {
+    verify_owned_event(host, &event).await?;
+    let url = request_url(community, "/events", "POST")?;
+    let response = send(
+        host,
+        url,
+        "POST",
+        Some(event.to_string()),
+        true,
+        MAX_RESPONSE,
+    )
+    .await?;
+    let receipt: serde_json::Value =
+        serde_json::from_str(&response.body).map_err(|_| "Invalid Mesh publication receipt")?;
+    if !(200..300).contains(&response.status)
+        || receipt["accepted"] != true
+        || receipt["event_id"] != event["id"]
+    {
+        return Err("Mesh status publication was not accepted".into());
+    }
+    Ok(())
+}
diff --git a/src/app/SettingsSidebar.test.tsx b/src/app/SettingsSidebar.test.tsx
index 8115293df..9272fa5dd 100644
--- a/src/app/SettingsSidebar.test.tsx
+++ b/src/app/SettingsSidebar.test.tsx
@@ -12,6 +12,8 @@ import {
   GlobeIcon,
 } from "../shared/design-system/icons";
 
+import { CpuIcon, ChatCircleIcon } from "../shared/design-system/icons";
+
 afterEach(cleanup);
 
 it("keeps Administration separate and uses each card's navigation icon", () => {
@@ -133,3 +135,66 @@ it.each([null, "primary"])(
     expect(onSection).toHaveBeenCalledWith("profile");
   },
 );
+
+it("uses a contributed icon and preserves the chat fallback", () => {
+  const client = {
+    selected: "primary",
+    memberships: [{ id: "primary", name: "Primary" }],
+  };
+  const connection = { scope: "icon-test" };
+  const entries = [
+    {
+      id: "compute",
+      key: "mesh/compute",
+      pluginId: "mesh",
+      revision: "one",
+      title: "Compute",
+      component: () => null,
+      icon: CpuIcon,
+    },
+    {
+      id: "other",
+      key: "other/card",
+      pluginId: "other",
+      revision: "one",
+      title: "Other",
+      component: () => null,
+    },
+  ];
+  render(
+    <SettingsSidebar
+      communities={
+        {
+          snapshot: () => client,
+          subscribe: () => () => {},
+          relay: { snapshot: () => connection, subscribe: () => () => {} },
+        } as unknown as Communities
+      }
+      cards={
+        {
+          snapshot: () => entries,
+          subscribe: () => () => {},
+        } as unknown as SettingsCards
+      }
+      onBack={() => {}}
+      onSection={() => {}}
+    />,
+  );
+  const reference = render(
+    <>
+      <CpuIcon data-testid="cpu-reference" />
+      <ChatCircleIcon data-testid="chat-reference" />
+    </>,
+  );
+  expect(
+    screen.getByRole("button", { name: "Compute" }).querySelector("svg")
+      ?.innerHTML,
+  ).toBe(reference.getByTestId("cpu-reference").innerHTML);
+  expect(
+    screen.getByRole("button", { name: "Other" }).querySelector("svg")
+      ?.innerHTML,
+  ).toBe(reference.getByTestId("chat-reference").innerHTML);
+  expect(
+    screen.getByRole("button", { name: "Compute" }).closest("section"),
+  ).toHaveTextContent("Primary");
+});
diff --git a/src/app/pages.integration.test.mjs b/src/app/pages.integration.test.mjs
index 6d1db5b7f..9483a3d88 100644
--- a/src/app/pages.integration.test.mjs
+++ b/src/app/pages.integration.test.mjs
@@ -58,9 +58,12 @@ test("the app runtime exposes ready bundled pages and removes them on disable",
       );
       assert.equal(
         plugin.enabledByDefault,
-        !["buzz.bestie", "buzz.todos", "buzz.channel-templates"].includes(
-          plugin.manifest.id,
-        ),
+        ![
+          "buzz.bestie",
+          "buzz.todos",
+          "buzz.channel-templates",
+          "buzz.mesh-compute",
+        ].includes(plugin.manifest.id),
         plugin.manifest.id,
       );
     }
diff --git a/src/bundled/agents/AgentCreateDialog.tsx b/src/bundled/agents/AgentCreateDialog.tsx
index 7b464c3da..70951887f 100644
--- a/src/bundled/agents/AgentCreateDialog.tsx
+++ b/src/bundled/agents/AgentCreateDialog.tsx
@@ -113,6 +113,8 @@ export function AgentCreateDialog({
   owner,
   source,
   initialSettings,
+  sharedCompute = false,
+  preset,
   onClose,
   onCreated,
   onOpenHarnesses,
@@ -128,6 +130,10 @@ export function AgentCreateDialog({
   owner: string;
   source?: AgentView;
   initialSettings?: CloneSettings | CatalogSeed | undefined;
+  sharedCompute?: boolean;
+  /** Prefilled name and instructions; the owner still reviews before creating. */
+  preset?: { name: string; systemPrompt: string } | undefined;
+
   onClose(): void;
   /** The new identity exists, even if starting or profile setup fails later. */
   onCreated?: ((agent: AgentView) => void) | undefined;
@@ -166,7 +172,22 @@ export function AgentCreateDialog({
           name: `${source.name} copy`,
         }
       : seededDraft(state, initialSettings);
-    return { ...initial, environment: { BUZZ_ACP_AGENTS: "10" } };
+    return {
+      ...initial,
+      ...(preset
+        ? { name: preset.name, systemPrompt: preset.systemPrompt }
+        : {}),
+      ...(sharedCompute
+        ? {
+            name: preset?.name ?? "Community agent",
+            command: "buzz-agent",
+            args: "[]",
+            provider: "relay-mesh",
+            model: "auto",
+          }
+        : {}),
+      environment: { BUZZ_ACP_AGENTS: "10" },
+    };
   });
   // Catalog seeds carry more than the clone notice describes.
   const cloned = !!initialSettings && !("origin" in initialSettings);
diff --git a/src/bundled/agents/AgentSettingsFields.tsx b/src/bundled/agents/AgentSettingsFields.tsx
index 78da02dab..8db33810c 100644
--- a/src/bundled/agents/AgentSettingsFields.tsx
+++ b/src/bundled/agents/AgentSettingsFields.tsx
@@ -18,6 +18,7 @@ import {
 } from "./agent-edit";
 import { AgentEnvironmentEditor } from "./AgentEnvironmentEditor";
 import { AgentHarnessEditor } from "./AgentHarnessEditor";
+import { SharedComputeModelPicker } from "./SharedComputeModelPicker";
 import { AgentModelPicker } from "./AgentModelPicker";
 import { CodexConfigurationFields } from "./CodexConfigurationFields";
 import { ProviderApiKeyField } from "./ProviderApiKeyField";
@@ -319,6 +320,14 @@ export function AgentSettingsFields({
                 </div>
               )}
             </div>
+          ) : buzzAgent && buzzProvider === "relay-mesh" ? (
+            <SharedComputeModelPicker
+              id={id}
+              draft={draft}
+              control={control}
+              disabled={disabled}
+              onChange={change}
+            />
           ) : codex ? (
             <CodexConfigurationFields
               id={id}
diff --git a/src/bundled/agents/SharedComputeModelPicker.test.tsx b/src/bundled/agents/SharedComputeModelPicker.test.tsx
new file mode 100644
index 000000000..1f9f2cc3c
--- /dev/null
+++ b/src/bundled/agents/SharedComputeModelPicker.test.tsx
@@ -0,0 +1,170 @@
+// @vitest-environment jsdom
+import "@testing-library/jest-dom/vitest";
+import { useState } from "react";
+import { afterEach, expect, it, vi } from "vitest";
+import { cleanup, render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { SharedComputeModelPicker } from "./SharedComputeModelPicker";
+import { agentDraft } from "./agent-edit";
+import { createAgentControl } from "../../features/agents/control";
+import { controlFixture } from "../../features/agents/control-testing";
+
+afterEach(cleanup);
+
+it("offers Auto and discovered models without cloud settings or custom entry", async () => {
+  const f = controlFixture();
+  const run = vi.fn(async () => ({
+    host: "",
+    models: [{ id: "community-model", name: "Community model" }],
+    modelOverridden: false,
+    disconnected: false,
+  }));
+  f.host.models = { begin: async () => 1, run, cancel: async () => {} };
+  const control = createAgentControl(f.host);
+  const user = userEvent.setup();
+  function Editor() {
+    const [draft, setDraft] = useState({
+      ...agentDraft(f.agent),
+      command: "buzz-agent",
+      provider: "relay-mesh",
+      model: "auto",
+    });
+    return (
+      <SharedComputeModelPicker
+        draft={draft}
+        control={control}
+        disabled={false}
+        onChange={(patch) => setDraft((current) => ({ ...current, ...patch }))}
+      />
+    );
+  }
+  const view = render(<Editor />);
+  try {
+    await screen.findByText(/No API key required/);
+    expect(run).toHaveBeenCalledWith(
+      1,
+      expect.objectContaining({ host: "", filter: "", action: "connect" }),
+    );
+    expect(screen.queryByRole("textbox")).not.toBeInTheDocument();
+    await user.click(screen.getByRole("combobox", { name: "Model" }));
+    await user.click(
+      await screen.findByRole("option", { name: "Community model" }),
+    );
+    expect(screen.getByRole("combobox", { name: "Model" })).toHaveTextContent(
+      "Community model",
+    );
+    expect(run).toHaveBeenCalledTimes(1);
+    await waitFor(() =>
+      expect(screen.getByRole("combobox", { name: "Model" })).toHaveAttribute(
+        "aria-expanded",
+        "false",
+      ),
+    );
+    await user.click(screen.getByRole("combobox", { name: "Model" }));
+    await user.click(
+      await screen.findByRole("option", {
+        name: "Auto (collective when available)",
+      }),
+    );
+    expect(run).toHaveBeenCalledTimes(1);
+  } finally {
+    view.unmount();
+    control.dispose();
+  }
+});
+
+it("retains saved selection on failure and retries to an empty catalog with Auto", async () => {
+  const f = controlFixture();
+  const run = vi
+    .fn()
+    .mockRejectedValueOnce("Community unavailable")
+    .mockResolvedValue({
+      host: "",
+      models: [],
+      modelOverridden: false,
+      disconnected: false,
+    });
+  f.host.models = { begin: async () => 1, run, cancel: async () => {} };
+  const control = createAgentControl(f.host);
+  const change = vi.fn();
+  const user = userEvent.setup();
+  const view = render(
+    <SharedComputeModelPicker
+      id={f.agent.id}
+      draft={{
+        ...agentDraft(f.agent),
+        command: "buzz-agent",
+        provider: "relay-mesh",
+        model: "saved-model",
+      }}
+      control={control}
+      disabled={false}
+      onChange={change}
+    />,
+  );
+  try {
+    await screen.findByText("Community unavailable");
+    expect(run).toHaveBeenLastCalledWith(
+      1,
+      expect.objectContaining({
+        id: f.agent.id,
+        expectedRevision: f.agent.revision,
+        edit: expect.objectContaining({ name: "Model discovery" }),
+      }),
+    );
+    expect(screen.getByRole("combobox", { name: "Model" })).toHaveTextContent(
+      "saved-model",
+    );
+    expect(change).not.toHaveBeenCalled();
+    await user.click(screen.getByRole("button", { name: "Retry models" }));
+    await screen.findByText(/No shared models advertised yet/);
+    await waitFor(() => expect(run).toHaveBeenCalledTimes(2));
+    expect(change).not.toHaveBeenCalled();
+  } finally {
+    view.unmount();
+    control.dispose();
+  }
+});
+
+it("keeps incomplete arguments editable and only refetches discovery inputs", async () => {
+  const f = controlFixture();
+  const run = vi.fn(async () => ({
+    host: "",
+    models: [],
+    modelOverridden: false,
+    disconnected: false,
+  }));
+  f.host.models = { begin: async () => 1, run, cancel: async () => {} };
+  const control = createAgentControl(f.host);
+  let draft = {
+    ...agentDraft(f.agent),
+    command: "buzz-agent",
+    provider: "relay-mesh",
+    model: "auto",
+  };
+  const props = { control, disabled: false, onChange: vi.fn() };
+  const view = render(<SharedComputeModelPicker {...props} draft={draft} />);
+  try {
+    await screen.findByText(/No shared models advertised yet/);
+    expect(run).toHaveBeenCalledTimes(1);
+    draft = {
+      ...draft,
+      name: "New name",
+      systemPrompt: "New instructions",
+      model: "saved",
+    };
+    view.rerender(<SharedComputeModelPicker {...props} draft={draft} />);
+    expect(run).toHaveBeenCalledTimes(1);
+    draft = { ...draft, args: "[" };
+    view.rerender(<SharedComputeModelPicker {...props} draft={draft} />);
+    await screen.findByText("Arguments must be a JSON array of strings.");
+    expect(run).toHaveBeenCalledTimes(1);
+    draft = { ...draft, args: '["--verbose"]' };
+    view.rerender(<SharedComputeModelPicker {...props} draft={draft} />);
+    await screen.findByText(/No shared models advertised yet/);
+    expect(run).toHaveBeenCalledTimes(2);
+  } finally {
+    view.unmount();
+    control.dispose();
+  }
+});
diff --git a/src/bundled/agents/SharedComputeModelPicker.tsx b/src/bundled/agents/SharedComputeModelPicker.tsx
new file mode 100644
index 000000000..a5cfd428a
--- /dev/null
+++ b/src/bundled/agents/SharedComputeModelPicker.tsx
@@ -0,0 +1,149 @@
+import { useEffect, useState } from "react";
+import type { AgentControl } from "../../features/agents/control";
+import type { ModelCatalog } from "../../features/agents/models";
+import { Button } from "../../shared/design-system/ui/Button";
+import { Select } from "../../shared/design-system/ui/Select";
+import { agentEdit, type AgentDraft } from "./agent-edit";
+
+/** Donor shared-compute selection: automatic routing plus community models. */
+export function SharedComputeModelPicker({
+  id,
+  draft,
+  control,
+  disabled,
+  onChange,
+}: {
+  id?: string | undefined;
+  draft: AgentDraft;
+  control: AgentControl;
+  disabled: boolean;
+  onChange(patch: Partial<AgentDraft>): void;
+}) {
+  const [attempt, setAttempt] = useState(0);
+  const [catalog, setCatalog] = useState<ModelCatalog | null>(null);
+  const [error, setError] = useState("");
+  const [busy, setBusy] = useState(false);
+  // Native resolves saved write-only values and inherited defaults. Model choice
+  // alone does not invalidate discovery or trigger another network request.
+  const request = JSON.stringify({
+    id,
+    expectedRevision: id ? draft.revision : undefined,
+    draft: {
+      command: draft.command,
+      args: draft.args,
+      provider: draft.provider,
+      workspace: draft.workspace,
+      environment: draft.environment,
+    },
+  });
+  // biome-ignore lint/correctness/useExhaustiveDependencies: attempt is explicit retry.
+  useEffect(() => {
+    const run = new AbortController();
+    setCatalog(null);
+    setError("");
+    setBusy(true);
+    if (!control.models) {
+      setError("Model discovery requires a rebuilt desktop app.");
+      setBusy(false);
+      return () => run.abort();
+    }
+    let edit: ReturnType<typeof agentEdit>;
+    const context = JSON.parse(request);
+    try {
+      edit = agentEdit(
+        {
+          ...context.draft,
+          // Discovery applies this edit only to a native clone, never Save.
+          // Saved-agent validation still requires a nonempty name.
+          name: "Model discovery",
+          systemPrompt: "",
+          sessionPolicy: null,
+          model: "",
+        },
+        true,
+      );
+    } catch (failure) {
+      setError((failure as Error).message);
+      setBusy(false);
+      return () => run.abort();
+    }
+    void control.models
+      .request(
+        {
+          id: context.id,
+          expectedRevision: context.expectedRevision,
+          edit,
+          host: "",
+          filter: "",
+          action: "connect",
+        },
+        run.signal,
+      )
+      .then(
+        (result) => {
+          if (!run.signal.aborted) setCatalog(result);
+        },
+        (failure) => {
+          if (!run.signal.aborted) setError((failure as Error).message);
+        },
+      )
+      .finally(() => {
+        if (!run.signal.aborted) setBusy(false);
+      });
+    return () => run.abort();
+  }, [request, control, attempt]);
+  const models = catalog?.models ?? [];
+  const explicit = !["", "auto", "mesh"].includes(draft.model);
+  const missing = explicit && !models.some((model) => model.id === draft.model);
+  return (
+    <div className="space-y-2">
+      <Select
+        label="Model"
+        variant="field"
+        disabled={disabled}
+        value={explicit ? draft.model : "auto"}
+        groups={[
+          {
+            label: "",
+            options: [
+              { value: "auto", label: "Auto (collective when available)" },
+              ...models.map((model) => ({
+                value: model.id,
+                label: model.name,
+              })),
+              ...(missing
+                ? [
+                    {
+                      value: draft.model,
+                      label: `${draft.model} (saved; not currently listed)`,
+                    },
+                  ]
+                : []),
+            ],
+          },
+        ]}
+        onValueChange={(model) => onChange({ model })}
+      />
+      <p className="text-body-sm text-secondary" role="status">
+        {busy
+          ? "Loading community models…"
+          : error ||
+            (models.length
+              ? "Uses compute shared in this community. No API key required."
+              : "No shared models advertised yet. Auto remains available; share compute before starting the agent.")}
+      </p>
+      <Button
+        disabled={disabled || busy}
+        onClick={() => setAttempt(attempt + 1)}
+      >
+        {error ? "Retry models" : "Refresh models"}
+      </Button>
+      {catalog?.modelOverridden && (
+        <p className="text-body-sm text-warning">
+          A saved BUZZ_AGENT_MODEL environment override takes precedence over
+          this selection.
+        </p>
+      )}
+    </div>
+  );
+}
diff --git a/src/bundled/channels/MemberAdministration.test.tsx b/src/bundled/channels/MemberAdministration.test.tsx
index 89084b35e..bd314fd3f 100644
--- a/src/bundled/channels/MemberAdministration.test.tsx
+++ b/src/bundled/channels/MemberAdministration.test.tsx
@@ -967,9 +967,12 @@ it("retains roster and displays rejection with explicit refresh recovery", async
       "Permission changed",
     ),
   ).not.toBeInTheDocument();
-  expect(
-    screen.getByRole("button", { name: /Open profile for Morgan/ }),
-  ).toBeVisible();
+  // The rejection can arrive before the members step finishes entering.
+  await vi.waitFor(() =>
+    expect(
+      screen.getByRole("button", { name: /Open profile for Morgan/ }),
+    ).toBeVisible(),
+  );
   await t.user.click(
     screen.getByRole("button", { name: "Refresh member data" }),
   );
diff --git a/src/bundled/index.ts b/src/bundled/index.ts
index a66d8e32f..95a8251fa 100644
--- a/src/bundled/index.ts
+++ b/src/bundled/index.ts
@@ -1,5 +1,8 @@
+import meshManifest from "./mesh-compute/manifest.json";
+import * as mesh from "./mesh-compute";
 import voiceNotesManifest from "./voice-notes/manifest.json";
 import * as voiceNotes from "./voice-notes";
+
 import pairingManifest from "./pairing/manifest.json";
 import * as pairing from "./pairing";
 import todosManifest from "./todos/manifest.json";
@@ -61,6 +64,11 @@ import moderationManifest from "./moderation/manifest.json";
 import * as moderation from "./moderation";
 
 export const bundledPlugins: readonly BundledPlugin[] = [
+  {
+    manifest: { ...meshManifest, apiVersion: 1 },
+    module: mesh,
+    enabledByDefault: false,
+  },
   {
     manifest: { ...voiceNotesManifest, apiVersion: 1 },
     module: voiceNotes,
diff --git a/src/bundled/mesh-compute/CommunityAgent.test.tsx b/src/bundled/mesh-compute/CommunityAgent.test.tsx
new file mode 100644
index 000000000..c78d175c3
--- /dev/null
+++ b/src/bundled/mesh-compute/CommunityAgent.test.tsx
@@ -0,0 +1,105 @@
+// @vitest-environment jsdom
+import "@testing-library/jest-dom/vitest";
+import {
+  cleanup,
+  fireEvent,
+  render,
+  screen,
+  within,
+} from "@testing-library/react";
+import { afterEach, expect, it } from "vitest";
+import { createAgentControl } from "../../features/agents/control";
+import { controlFixture } from "../../features/agents/control-testing";
+import { CommunityAgent } from "./CommunityAgent";
+import { COMMUNITY_AGENT_PRESETS } from "./communityAgentPresets";
+import { stubAvatarBrowserApis } from "../../features/agents/avatar-testing";
+stubAvatarBrowserApis();
+afterEach(cleanup);
+it("opens the existing creation dialog with shared compute and Auto without creating an identity", async () => {
+  const fixture = controlFixture();
+  fixture.data.defaultWorkspace = "/fixture/workspace";
+  fixture.data.createAvailable = true;
+  fixture.data.harnessOptions?.[0]?.providers.push({
+    value: "relay-mesh",
+    label: "Buzz shared compute",
+  });
+  const control = createAgentControl(fixture.host);
+  await control.refresh();
+  const view = render(
+    <CommunityAgent
+      control={control}
+      destination="wss://relay.example.test"
+      owner={"de".repeat(32)}
+    />,
+  );
+  expect(screen.queryByRole("dialog")).not.toBeInTheDocument();
+  fireEvent.click(screen.getByRole("button", { name: "Create Custom agent" }));
+  const dialog = await screen.findByRole("dialog");
+  expect(within(dialog).getByLabelText("Name")).toHaveValue("Community agent");
+  expect(
+    within(dialog).getByRole("combobox", { name: /^Model$/ }),
+  ).toHaveTextContent("Auto");
+  expect(within(dialog).getByText("Buzz shared compute")).toBeInTheDocument();
+  expect(fixture.calls.map((call) => call.action)).toEqual([
+    "snapshot",
+    "snapshot",
+  ]);
+  view.unmount();
+});
+it("prefills a preset's name and instructions on shared compute, still only after review", async () => {
+  const fixture = controlFixture();
+  fixture.data.defaultWorkspace = "/fixture/workspace";
+  fixture.data.createAvailable = true;
+  fixture.data.harnessOptions?.[0]?.providers.push({
+    value: "relay-mesh",
+    label: "Buzz shared compute",
+  });
+  const control = createAgentControl(fixture.host);
+  await control.refresh();
+  render(
+    <CommunityAgent
+      control={control}
+      destination="wss://relay.example.test"
+      owner={"de".repeat(32)}
+    />,
+  );
+  const emoji = COMMUNITY_AGENT_PRESETS.find(
+    (preset) => preset.id === "emoji-maker",
+  );
+  expect(
+    screen.getByText(/custom emoji for the community palette/),
+  ).toHaveTextContent("Needs ffmpeg on the host machine.");
+  fireEvent.click(screen.getByRole("button", { name: "Set up Emoji maker" }));
+  const dialog = await screen.findByRole("dialog");
+  expect(within(dialog).getByLabelText("Name")).toHaveValue("Emoji maker");
+  expect(within(dialog).getByLabelText("Agent instructions")).toHaveValue(
+    emoji?.systemPrompt,
+  );
+  expect(
+    within(dialog).getByRole("combobox", { name: /^Model$/ }),
+  ).toHaveTextContent("Auto");
+  expect(within(dialog).getByText("Buzz shared compute")).toBeInTheDocument();
+  expect(fixture.calls.map((call) => call.action)).not.toContain("create");
+});
+it("lists each example with an icon and offers a custom agent last", async () => {
+  const control = createAgentControl(controlFixture().host);
+  await control.refresh();
+  render(
+    <CommunityAgent
+      control={control}
+      destination="wss://relay.example.test"
+      owner={"de".repeat(32)}
+    />,
+  );
+  const rows = within(
+    screen.getByRole("list", { name: "Community agent examples" }),
+  ).getAllByRole("listitem");
+  expect(rows).toHaveLength(COMMUNITY_AGENT_PRESETS.length + 1);
+  for (const row of rows) expect(row.querySelector("svg")).not.toBeNull();
+  expect(rows.at(-1)).toHaveTextContent("Custom agent");
+  expect(
+    within(rows.at(-1) as HTMLElement).getByRole("button", {
+      name: "Create Custom agent",
+    }),
+  ).toBeVisible();
+});
diff --git a/src/bundled/mesh-compute/CommunityAgent.tsx b/src/bundled/mesh-compute/CommunityAgent.tsx
new file mode 100644
index 000000000..6eb910db0
--- /dev/null
+++ b/src/bundled/mesh-compute/CommunityAgent.tsx
@@ -0,0 +1,104 @@
+import { useId, useState, useSyncExternalStore, type ReactNode } from "react";
+import type { AgentControl } from "../../features/agents/control";
+import { AgentCreateDialog } from "../agents/AgentCreateDialog";
+import { Button } from "../../shared/design-system/ui/Button";
+import { InlineHeader } from "../../shared/design-system/ui/Header";
+import { PencilSimpleIcon } from "../../shared/design-system/icons";
+import {
+  COMMUNITY_AGENT_PRESETS,
+  type CommunityAgentPreset,
+} from "./communityAgentPresets";
+import styles from "./Compute.module.css";
+
+/** Reuse the normal owner-reviewed create/start/profile flow; never create on mount. */
+export function CommunityAgent({
+  control,
+  destination,
+  owner,
+}: {
+  control: AgentControl;
+  destination: string;
+  owner: string;
+}) {
+  const state = useSyncExternalStore(control.subscribe, control.snapshot);
+  const titleId = useId();
+  // undefined: closed; null: custom (blank) agent; otherwise the chosen preset.
+  const [open, setOpen] = useState<CommunityAgentPreset | null>();
+  const start = (preset: CommunityAgentPreset | null) => {
+    setOpen(preset);
+    void control.refresh();
+  };
+  return (
+    <section aria-labelledby={titleId} className={styles.sharing}>
+      <InlineHeader
+        id={titleId}
+        level={2}
+        title="Put the community mesh to work"
+        subtitle="Anyone can use compute shared by the community, even if this machine can’t contribute. Pick an example or start from scratch; Buzz handles the compute setup."
+      />
+      <ul aria-label="Community agent examples" className={styles.presets}>
+        {COMMUNITY_AGENT_PRESETS.map((preset) => (
+          <PresetRow
+            key={preset.id}
+            icon={<preset.icon size={20} />}
+            name={preset.name}
+            summary={
+              preset.requires
+                ? `${preset.summary} Needs ${preset.requires}.`
+                : preset.summary
+            }
+            onSelect={() => start(preset)}
+          />
+        ))}
+        <PresetRow
+          icon={<PencilSimpleIcon size={20} />}
+          name="Custom agent"
+          summary="Start blank: name it and write its instructions yourself."
+          action="Create"
+          onSelect={() => start(null)}
+        />
+      </ul>
+      {open !== undefined && (
+        <AgentCreateDialog
+          control={control}
+          state={state}
+          destination={destination}
+          owner={owner}
+          sharedCompute
+          preset={open ?? undefined}
+          onClose={() => setOpen(undefined)}
+        />
+      )}
+    </section>
+  );
+}
+
+function PresetRow({
+  icon,
+  name,
+  summary,
+  action = "Set up",
+  onSelect,
+}: {
+  icon: ReactNode;
+  name: string;
+  summary: string;
+  action?: string;
+  onSelect(): void;
+}) {
+  return (
+    <li className={styles.preset}>
+      <span className={styles.presetIcon} aria-hidden="true">
+        {icon}
+      </span>
+      <div className={styles.presetBody}>
+        <p className="m-0 text-body">{name}</p>
+        <p className="m-0 text-body-sm text-secondary">{summary}</p>
+      </div>
+      {/* Visible verb starts the accessible name, so speech and labels agree. */}
+      <Button size="sm" aria-label={`${action} ${name}`} onClick={onSelect}>
+        {action}
+      </Button>
+    </li>
+  );
+}
diff --git a/src/bundled/mesh-compute/CommunityMesh.test.tsx b/src/bundled/mesh-compute/CommunityMesh.test.tsx
new file mode 100644
index 000000000..739d01137
--- /dev/null
+++ b/src/bundled/mesh-compute/CommunityMesh.test.tsx
@@ -0,0 +1,267 @@
+// @vitest-environment jsdom
+import "@testing-library/jest-dom/vitest";
+import {
+  act,
+  cleanup,
+  render,
+  screen,
+  waitFor,
+  within,
+} from "@testing-library/react";
+import { afterEach, expect, it, vi } from "vitest";
+import type { RelayData } from "../../features/relay/service";
+import { CommunityMesh, modelLabel } from "./CommunityMesh";
+const native = vi.hoisted(() => ({ invoke: vi.fn(), isTauri: () => true }));
+vi.mock("@tauri-apps/api/core", () => native);
+afterEach(() => {
+  cleanup();
+  vi.resetAllMocks();
+});
+function relay(
+  viewer?: string,
+  names?: { resolve(pubkey: string, fallback?: string): string | undefined },
+) {
+  const profiles = new Map([["a".repeat(64), { name: "Alice" }]]);
+  const snapshot = {
+    viewer,
+    session: {
+      names: names && {
+        ...names,
+        snapshot: () => 0,
+        subscribe: () => () => {},
+      },
+      profiles: {
+        snapshot: () => profiles,
+        subscribe: () => () => {},
+        ensure: vi.fn().mockResolvedValue(undefined),
+      },
+    },
+  };
+  return {
+    snapshot: () => snapshot,
+    subscribe: () => () => {},
+  } as unknown as RelayData;
+}
+it("reads automatically without starting a node, distinguishes empty, unavailable and errors, and retries", async () => {
+  native.invoke.mockResolvedValueOnce({ unavailable: null, entries: [] });
+  const source = relay();
+  const view = render(
+    <CommunityMesh community="https://fixture.example" relay={source} />,
+  );
+  await screen.findByText("No one is sharing compute yet.");
+  expect(native.invoke).toHaveBeenCalledExactlyOnceWith(
+    "mesh_compute_inventory",
+    { community: "https://fixture.example" },
+  );
+  native.invoke.mockResolvedValueOnce({
+    unavailable: "Status is stale",
+    entries: [],
+  });
+  // The page's single Refresh reruns the read through refreshKey.
+  view.rerender(
+    <CommunityMesh
+      community="https://fixture.example"
+      relay={source}
+      refreshKey={1}
+    />,
+  );
+  expect(await screen.findByRole("alert")).toHaveTextContent("Status is stale");
+  expect(
+    screen.queryByText("No one is sharing compute yet."),
+  ).not.toBeInTheDocument();
+  native.invoke.mockRejectedValueOnce(new Error("Identity unavailable"));
+  view.rerender(
+    <CommunityMesh
+      community="https://fixture.example"
+      relay={source}
+      refreshKey={2}
+    />,
+  );
+  expect(await screen.findByRole("alert")).toHaveTextContent(
+    "Identity unavailable",
+  );
+});
+it("rejects a late previous-community response and resolves names from session profiles", async () => {
+  let release!: (value: unknown) => void;
+  const pending = new Promise((resolve) => {
+    release = resolve;
+  });
+  native.invoke.mockReturnValueOnce(pending).mockResolvedValueOnce({
+    unavailable: null,
+    entries: [
+      {
+        memberPubkey: "a".repeat(64),
+        modelId: "model",
+        modelName: "Model",
+        deviceId: "device",
+        deviceName: "Studio",
+        vramGb: 32,
+      },
+    ],
+  });
+  const source = relay();
+  const view = render(
+    <CommunityMesh community="https://old.example" relay={source} />,
+  );
+  view.rerender(
+    <CommunityMesh community="https://new.example" relay={source} />,
+  );
+  expect(await screen.findByRole("listitem")).toHaveTextContent(
+    "Studio · AliceModel32 GB",
+  );
+  // Thomas's community summary: contributors, shared memory, model count.
+  expect(
+    screen.getByText("1 person is contributing compute."),
+  ).toBeInTheDocument();
+  expect(screen.getByText("Shared memory").nextSibling).toHaveTextContent(
+    "32 GB",
+  );
+  await act(async () => {
+    release({ unavailable: null, entries: [] });
+    await pending;
+  });
+  expect(
+    screen.queryByText("No one is sharing compute yet."),
+  ).not.toBeInTheDocument();
+  expect(screen.getByRole("listitem")).toHaveTextContent("Alice");
+});
+it("totals shared memory once per device and omits it when capacity is unknown", async () => {
+  const entry = (
+    member: string,
+    model: string,
+    deviceId: string | null,
+    vramGb: number | null,
+  ) => ({
+    memberPubkey: member.repeat(64),
+    modelId: model,
+    modelName: model,
+    deviceId,
+    deviceName: null,
+    vramGb,
+  });
+  native.invoke.mockResolvedValueOnce({
+    unavailable: null,
+    entries: [
+      entry("a", "m1", "dev-1", 32),
+      entry("a", "m2", "dev-1", 32),
+      entry("b", "m3", "dev-2", 16),
+    ],
+  });
+  const source = relay();
+  const view = render(
+    <CommunityMesh community="https://fixture.example" relay={source} />,
+  );
+  // Two models on one 32 GB device plus a 16 GB device: 48 GB, not 80 GB.
+  expect(await screen.findByText("48 GB")).toBeInTheDocument();
+  // Two models on one device collapse onto that device's row.
+  const rows = within(
+    screen.getByRole("list", { name: "Shared devices" }),
+  ).getAllByRole("listitem");
+  expect(rows).toHaveLength(2);
+  expect(rows[0]).toHaveTextContent("m1, m2");
+  expect(screen.getByText("Devices").nextSibling).toHaveTextContent("2");
+  expect(
+    screen.getByText("2 people are contributing compute."),
+  ).toBeInTheDocument();
+  native.invoke.mockResolvedValueOnce({
+    unavailable: null,
+    entries: [entry("a", "m1", "dev-1", 32), entry("b", "m3", null, null)],
+  });
+  view.rerender(
+    <CommunityMesh
+      community="https://fixture.example"
+      relay={source}
+      refreshKey={1}
+    />,
+  );
+  await waitFor(() =>
+    expect(screen.getByText("Shared memory").nextSibling).toHaveTextContent(
+      "Not reported",
+    ),
+  );
+});
+it("lists your own devices first and never merges entries without a device identity", async () => {
+  const you = "c".repeat(64);
+  const entry = (
+    member: string,
+    model: string,
+    deviceId: string | null,
+    deviceName: string | null,
+  ) => ({
+    memberPubkey: member,
+    modelId: `org/${model}`,
+    modelName: model,
+    deviceId,
+    deviceName,
+    vramGb: null,
+  });
+  native.invoke.mockResolvedValueOnce({
+    unavailable: null,
+    entries: [
+      entry("a".repeat(64), "Qwen 9B", null, null),
+      entry("a".repeat(64), "Gemma E4B", null, null),
+      entry(you, "Qwen 27B", "studio", "Studio"),
+    ],
+  });
+  render(
+    <CommunityMesh community="https://fixture.example" relay={relay(you)} />,
+  );
+  const list = await screen.findByRole("list", { name: "Shared devices" });
+  const rows = within(list).getAllByRole("listitem");
+  expect(rows).toHaveLength(3);
+  expect(rows[0]).toHaveTextContent("Studio · YouQwen 27B");
+  for (const row of rows.slice(1))
+    expect(row).toHaveTextContent(/^\S?Unnamed device · Alice/);
+  expect(list).toHaveTextContent("Gemma E4B");
+  expect(list).toHaveTextContent("Qwen 9B");
+});
+it("names every contributor, never by key fragment, and prefers the shared naming layer", async () => {
+  const agent = "b".repeat(64);
+  const anonymous = "e".repeat(64);
+  const entry = (member: string, deviceName: string) => ({
+    memberPubkey: member,
+    modelId: "org/model",
+    modelName: "Model",
+    deviceId: deviceName,
+    deviceName,
+    vramGb: 8,
+  });
+  native.invoke.mockResolvedValueOnce({
+    unavailable: null,
+    entries: [
+      entry("a".repeat(64), "Studio"),
+      entry(agent, "Runner"),
+      entry(anonymous, "Laptop"),
+    ],
+  });
+  // e.g. one of this app's own agents, which has no published profile yet.
+  const names = {
+    resolve: (pubkey: string, fallback?: string) =>
+      pubkey === agent ? "Builder bot" : fallback,
+  };
+  render(
+    <CommunityMesh
+      community="https://fixture.example"
+      relay={relay(undefined, names)}
+    />,
+  );
+  const list = await screen.findByRole("list", { name: "Shared devices" });
+  expect(list).toHaveTextContent("Studio · Alice");
+  expect(list).toHaveTextContent("Runner · Builder bot");
+  expect(list).toHaveTextContent("Laptop · Unnamed member");
+  expect(list).not.toHaveTextContent("npub");
+  expect(
+    screen.getByRole("heading", { name: "Community mesh" }),
+  ).toBeInTheDocument();
+});
+it("labels Mesh model refs by name and quantization", () => {
+  expect(modelLabel("unsloth/Qwen3.8-27B-GGUF:UD-Q4_K_M")).toBe(
+    "Qwen3.8-27B · UD-Q4_K_M",
+  );
+  expect(
+    modelLabel("meshllm/Qwen3.5-35B-A3B-UD-Q4_K_XL-layers@69cbd9fc1f928305"),
+  ).toBe("Qwen3.5-35B-A3B-UD-Q4_K_XL-layers");
+  expect(modelLabel("hf://meshllm/qwen3-8b@main")).toBe("qwen3-8b");
+  expect(modelLabel("local-gguf/sha256-7756e8943d5ec98b")).toBe("Local model");
+  expect(modelLabel("Qwen 27B")).toBe("Qwen 27B");
+});
diff --git a/src/bundled/mesh-compute/CommunityMesh.tsx b/src/bundled/mesh-compute/CommunityMesh.tsx
new file mode 100644
index 000000000..e839548d2
--- /dev/null
+++ b/src/bundled/mesh-compute/CommunityMesh.tsx
@@ -0,0 +1,254 @@
+import { invoke, isTauri } from "@tauri-apps/api/core";
+import { useEffect, useId, useState, useSyncExternalStore } from "react";
+import { communityDestination } from "../../features/communities/destination";
+import type { RelayData } from "../../features/relay/service";
+import styles from "./Compute.module.css";
+import { Avatar } from "../../shared/design-system/ui/Avatar";
+import { InlineHeader } from "../../shared/design-system/ui/Header";
+import { UsersIcon } from "../../shared/design-system/icons";
+import { useIdentityNames } from "../../features/identity-names/react";
+
+type Inventory = {
+  unavailable: string | null;
+  entries: {
+    deviceId: string | null;
+    memberPubkey: string;
+    modelId: string;
+    modelName: string | null;
+    deviceName: string | null;
+    vramGb: number | null;
+  }[];
+};
+
+export function CommunityMesh({
+  community,
+  relay,
+  refreshKey = 0,
+}: {
+  community: string;
+  relay: RelayData;
+  refreshKey?: number;
+}) {
+  const snapshot = useSyncExternalStore(relay.subscribe, relay.snapshot);
+  const directory = snapshot.session.profiles;
+  const profiles = useSyncExternalStore(
+    directory.subscribe,
+    directory.snapshot,
+  );
+  const resolveName = useIdentityNames(snapshot.session.names);
+  const titleId = useId();
+  const [result, setResult] = useState<{
+    snapshot: typeof snapshot;
+    inventory?: Inventory;
+    error?: string;
+  }>();
+  useEffect(() => {
+    void refreshKey; // The page Refresh reruns this read, without a polling owner.
+    let active = true;
+    setResult(undefined);
+    if (!isTauri()) return;
+    void (async () => {
+      try {
+        const inventory = await invoke<Inventory>("mesh_compute_inventory", {
+          community: communityDestination(community).url,
+        });
+        if (!active || snapshot !== relay.snapshot()) return;
+        setResult({ snapshot, inventory });
+        void directory
+          .ensure(
+            inventory.entries.map((entry) => entry.memberPubkey),
+            "foreground",
+          )
+          .catch(() => {});
+      } catch (error) {
+        if (active && snapshot === relay.snapshot())
+          setResult({ snapshot, error: String(error) });
+      }
+    })();
+    return () => {
+      active = false;
+    };
+  }, [community, snapshot, directory, relay, refreshKey]);
+  const current = result?.snapshot === snapshot ? result : undefined;
+  const inventory = current?.inventory;
+  const error = current?.error ?? inventory?.unavailable;
+  const entries = inventory?.entries ?? [];
+  const contributors = new Set(entries.map((entry) => entry.memberPubkey)).size;
+  const modelCount = new Set(entries.map((entry) => entry.modelId)).size;
+  // One device may advertise several models: count each identified device once.
+  // Unknown device identity or capacity is not guessed into the total.
+  const devices = new Map<string, number>();
+  let unknownCapacity = false;
+  for (const entry of entries) {
+    if (entry.deviceId == null || entry.vramGb == null) {
+      unknownCapacity = true;
+      continue;
+    }
+    devices.set(`${entry.memberPubkey}\u0000${entry.deviceId}`, entry.vramGb);
+  }
+  // The shared naming layer covers profile names, this app's own agents, and
+  // qualifies namesakes among the contributors. Never show a key fragment.
+  const memberKeys = [...new Set(entries.map((entry) => entry.memberPubkey))];
+  const memberName = (pubkey: string) =>
+    resolveName(
+      pubkey,
+      profiles.get(pubkey)?.name || "Unnamed member",
+      memberKeys,
+    );
+  const shared = groupDevices(entries, snapshot.viewer, memberName);
+  const sharedGb =
+    devices.size && !unknownCapacity
+      ? [...devices.values()].reduce((total, gb) => total + gb, 0)
+      : null;
+  return (
+    <section aria-labelledby={titleId} className={styles.sharing}>
+      <InlineHeader
+        id={titleId}
+        level={2}
+        icon={<UsersIcon size={20} />}
+        title="Community mesh"
+        subtitle={
+          !inventory?.entries.length
+            ? "Devices members are sharing with this community."
+            : contributors === 1
+              ? "1 person is contributing compute."
+              : `${contributors} people are contributing compute.`
+        }
+      />
+      {!isTauri() ? (
+        <p role="status">Open Buzz desktop to see community mesh.</p>
+      ) : error ? (
+        <p role="alert">{error}</p>
+      ) : !inventory ? (
+        <p role="status">Loading community mesh…</p>
+      ) : inventory.entries.length === 0 ? (
+        <p role="status">No one is sharing compute yet.</p>
+      ) : (
+        <>
+          <dl className={styles.metrics}>
+            <div>
+              <dt className="text-metadata">Shared memory</dt>
+              <dd className="m-0 text-heading tabular-nums">
+                {sharedGb == null
+                  ? "Not reported"
+                  : `${Math.round(sharedGb)} GB`}
+              </dd>
+            </div>
+            <div>
+              <dt className="text-metadata">Devices</dt>
+              <dd className="m-0 text-heading tabular-nums">{shared.length}</dd>
+            </div>
+            <div>
+              <dt className="text-metadata">Models available</dt>
+              <dd className="m-0 text-heading tabular-nums">{modelCount}</dd>
+            </div>
+          </dl>
+          <ul aria-label="Shared devices" className={styles.devices}>
+            {shared.map((device) => {
+              const picture = profiles.get(device.memberPubkey)?.picture;
+              return (
+                <li key={device.key} className={styles.device}>
+                  <Avatar
+                    alt=""
+                    fallback={memberName(device.memberPubkey)}
+                    src={
+                      picture
+                        ? snapshot.session.media(picture, "small")
+                        : undefined
+                    }
+                    size="default"
+                  />
+                  <div className={styles.deviceBody}>
+                    <p className="m-0 text-body">
+                      {device.name ?? "Unnamed device"}
+                      <span className="text-secondary">
+                        {" · "}
+                        {device.owner}
+                      </span>
+                    </p>
+                    <p className="m-0 text-body-sm text-secondary">
+                      {device.models.map((model, index) => (
+                        <span key={model} title={model}>
+                          {index > 0 && ", "}
+                          {modelLabel(model)}
+                        </span>
+                      ))}
+                    </p>
+                  </div>
+                  <p
+                    className={`m-0 text-body-sm text-secondary ${styles.deviceMemory}`}
+                  >
+                    {device.vramGb == null
+                      ? "Not reported"
+                      : `${Math.round(device.vramGb)} GB`}
+                  </p>
+                </li>
+              );
+            })}
+          </ul>
+        </>
+      )}
+    </section>
+  );
+}
+
+type SharedDevice = {
+  key: string;
+  memberPubkey: string;
+  self: boolean;
+  owner: string;
+  name: string | null;
+  vramGb: number | null;
+  models: string[];
+};
+
+/**
+ * One row per advertised device; its models collapse onto that row. An entry
+ * without a device identity stays its own row rather than being merged by
+ * guesswork. The viewer's own devices lead, then members and devices by name.
+ */
+function groupDevices(
+  entries: Inventory["entries"],
+  viewer: string | undefined,
+  memberName: (pubkey: string) => string,
+): SharedDevice[] {
+  const devices = new Map<string, SharedDevice>();
+  for (const entry of entries) {
+    const key = `${entry.memberPubkey}\u0000${entry.deviceId ?? `model:${entry.modelId}`}`;
+    const device = devices.get(key) ?? {
+      key,
+      memberPubkey: entry.memberPubkey,
+      self: entry.memberPubkey === viewer,
+      owner:
+        entry.memberPubkey === viewer ? "You" : memberName(entry.memberPubkey),
+      name: entry.deviceName,
+      vramGb: entry.vramGb,
+      models: [],
+    };
+    device.name ??= entry.deviceName;
+    device.vramGb ??= entry.vramGb;
+    const model = entry.modelName || entry.modelId;
+    if (!device.models.includes(model)) device.models.push(model);
+    devices.set(key, device);
+  }
+  return [...devices.values()].sort(
+    (left, right) =>
+      Number(right.self) - Number(left.self) ||
+      left.owner.localeCompare(right.owner) ||
+      (left.name ?? "").localeCompare(right.name ?? ""),
+  );
+}
+
+/**
+ * Mesh advertises routing refs (`org/Name-GGUF:QUANT`). Show the model and
+ * quantization; the exact ref stays available as the row's tooltip.
+ */
+export function modelLabel(ref: string): string {
+  const bare = ref.replace(/^[a-z][a-z0-9+.-]*:\/\//i, "");
+  const [path = bare, quant] = bare.split(":");
+  const name = (path.split("/").at(-1) ?? path)
+    .replace(/[-_.]gguf$/i, "")
+    .replace(/@[\w.-]+$/, "");
+  if (/^sha256-[0-9a-f]+$/i.test(name)) return "Local model";
+  return quant ? `${name} · ${quant}` : name;
+}
diff --git a/src/bundled/mesh-compute/Compute.module.css b/src/bundled/mesh-compute/Compute.module.css
new file mode 100644
index 000000000..4769735e4
--- /dev/null
+++ b/src/bundled/mesh-compute/Compute.module.css
@@ -0,0 +1,153 @@
+/* Consumer content layout from feat/community-compute-plugin @ b4a910e. */
+.content {
+  max-width: 60rem;
+  margin-inline: auto;
+  display: grid;
+  grid-template-columns: minmax(0, 1fr);
+  overflow-wrap: anywhere;
+  gap: var(--space-control-inset);
+}
+
+/* Compact sharing card from feat/community-compute-plugin @ b4a910e. */
+.sharing {
+  display: grid;
+  gap: var(--space-row-gap);
+  padding: var(--space-control-inset);
+  border: 1px solid var(--border-primary);
+  border-radius: var(--radius-panel);
+}
+
+.metrics {
+  display: flex;
+  flex-wrap: wrap;
+  margin: 0;
+  row-gap: var(--space-row-gap);
+  column-gap: var(--space-section-gap);
+}
+
+.sharingHeader {
+  display: flex;
+  align-items: flex-start;
+  gap: var(--space-control-inset);
+}
+
+/* Sharing status hexagon from block/buzz MeshComputeSettingsCard. */
+.hex {
+  position: relative;
+  display: inline-flex;
+  flex-shrink: 0;
+  align-items: center;
+  justify-content: center;
+  width: 1.75rem;
+  height: 1.75rem;
+  color: var(--text-secondary);
+}
+
+.hex[data-state="working"] {
+  color: var(--text-primary);
+}
+
+.hex[data-state="sharing"] {
+  color: var(--text-success);
+}
+
+.hexPing {
+  position: absolute;
+  inset: 0;
+  display: inline-flex;
+  opacity: 0.3;
+  animation: hex-ping 1s cubic-bezier(0, 0, 0.2, 1) infinite;
+}
+
+.hexTrack {
+  fill: none;
+  stroke: currentColor;
+  opacity: 0.2;
+}
+
+.hexTrace {
+  fill: none;
+  stroke: currentColor;
+  animation: hex-trace 1.1s linear infinite;
+}
+
+@keyframes hex-ping {
+  75%,
+  100% {
+    transform: scale(1.8);
+    opacity: 0;
+  }
+}
+
+@keyframes hex-trace {
+  to {
+    stroke-dashoffset: -100;
+  }
+}
+
+.fit[data-fit="comfortable"] {
+  color: var(--text-success);
+}
+
+.fit[data-fit="tight"],
+.fit[data-fit="tradeoff"] {
+  color: var(--text-warning);
+}
+
+.fit[data-fit="too_large"] {
+  color: var(--text-danger);
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .hexPing,
+  .hexTrace {
+    animation: none;
+    transition: none;
+  }
+}
+
+.devices,
+.presets {
+  display: grid;
+  margin: 0;
+  padding: 0;
+  list-style: none;
+  border: 1px solid var(--border-standard);
+  border-radius: var(--radius-panel);
+}
+
+.device,
+.preset {
+  display: flex;
+  align-items: center;
+  gap: var(--space-control-inset);
+  padding: var(--space-row-gap) var(--space-control-inset);
+}
+
+.device + .device,
+.preset + .preset {
+  border-top: 1px solid var(--border-standard);
+}
+
+.deviceBody,
+.presetBody {
+  flex: 1;
+  min-width: 0;
+}
+
+.deviceMemory {
+  flex-shrink: 0;
+  white-space: nowrap;
+}
+
+.presetIcon {
+  display: inline-flex;
+  flex-shrink: 0;
+  align-items: center;
+  justify-content: center;
+  width: 2rem;
+  height: 2rem;
+  color: var(--text-secondary);
+  background: var(--bg-hover);
+  border-radius: var(--radius-control);
+}
diff --git a/src/bundled/mesh-compute/ConsumerComputeView.tsx b/src/bundled/mesh-compute/ConsumerComputeView.tsx
new file mode 100644
index 000000000..0a41b2f35
--- /dev/null
+++ b/src/bundled/mesh-compute/ConsumerComputeView.tsx
@@ -0,0 +1,55 @@
+// Consumer presentation adapted from feat/community-compute-plugin @ b4a910e.
+// Host lifecycle/leases remain owned by this plugin, not the donor's sharing service.
+import type { ReactNode } from "react";
+import { Button } from "../../shared/design-system/ui/Button";
+import { FullPageSurface } from "../../shared/design-system/ui/FullPageSurface";
+import styles from "./Compute.module.css";
+
+export function ConsumerComputeView({
+  communityName,
+  children,
+  status,
+  error,
+  refreshDisabled,
+  refresh,
+}: {
+  communityName: string | undefined;
+  children?: ReactNode;
+  status?: string | undefined;
+  error: string | undefined | null;
+  refreshDisabled: boolean;
+  refresh: () => void;
+}) {
+  return (
+    <FullPageSurface aria-label="Compute consumer">
+      <div className="h-full overflow-auto p-panel-inset text-body">
+        <div className={styles.content}>
+          <h1 className="m-0 text-title text-primary">Shared compute</h1>
+          {communityName && (
+            <p className="text-body text-secondary">
+              Shared compute for <strong>{communityName}</strong>
+            </p>
+          )}
+          <p className="text-body-sm text-secondary">
+            Use compute from your community, and optionally share this machine.
+          </p>
+          {status && <p role="status">{status}</p>}
+          {children}
+          <Button
+            variant="ghost"
+            size="sm"
+            onClick={refresh}
+            disabled={refreshDisabled}
+          >
+            Refresh
+          </Button>
+          {error && (
+            <p role="alert" className="text-body-sm text-danger">
+              {error}
+            </p>
+          )}
+        </div>
+      </div>
+    </FullPageSurface>
+  );
+}
diff --git a/src/bundled/mesh-compute/ShareHex.tsx b/src/bundled/mesh-compute/ShareHex.tsx
new file mode 100644
index 000000000..def6fca84
--- /dev/null
+++ b/src/bundled/mesh-compute/ShareHex.tsx
@@ -0,0 +1,46 @@
+// Sharing status glyph from block/buzz MeshComputeSettingsCard
+// (sandro/shared-compute-fresh). Decorative: the status line owns the words.
+import {
+  HexagonFilledIcon,
+  HexagonIcon,
+} from "../../shared/design-system/icons";
+import styles from "./Compute.module.css";
+
+export type ShareHexState = "idle" | "working" | "sharing";
+
+const HEX = "16,2 28,9 28,23 16,30 4,23 4,9";
+
+export function ShareHex({ state }: { state: ShareHexState }) {
+  return (
+    <span
+      aria-hidden="true"
+      className={styles.hex}
+      data-state={state}
+      data-testid="share-hex"
+    >
+      {state === "sharing" ? (
+        <>
+          <span className={styles.hexPing}>
+            <HexagonFilledIcon size={28} />
+          </span>
+          <HexagonFilledIcon size={28} />
+        </>
+      ) : state === "working" ? (
+        // A fixed outline with a short stroke tracing its edge.
+        <svg aria-hidden="true" viewBox="0 0 32 32" width={28} height={28}>
+          <polygon className={styles.hexTrack} points={HEX} strokeWidth="2" />
+          <polygon
+            className={styles.hexTrace}
+            pathLength="100"
+            points={HEX}
+            strokeDasharray="18 82"
+            strokeLinecap="round"
+            strokeWidth="2.5"
+          />
+        </svg>
+      ) : (
+        <HexagonIcon size={24} />
+      )}
+    </span>
+  );
+}
diff --git a/src/bundled/mesh-compute/ShareModelPicker.test.tsx b/src/bundled/mesh-compute/ShareModelPicker.test.tsx
new file mode 100644
index 000000000..2ec518afb
--- /dev/null
+++ b/src/bundled/mesh-compute/ShareModelPicker.test.tsx
@@ -0,0 +1,262 @@
+// @vitest-environment jsdom
+import "@testing-library/jest-dom/vitest";
+import {
+  act,
+  fireEvent,
+  render,
+  screen,
+  waitFor,
+  cleanup,
+} from "@testing-library/react";
+import { useState } from "react";
+import { afterEach, expect, it, vi } from "vitest";
+import { ShareModelPicker } from "./ShareModelPicker";
+const invoke = vi.hoisted(() => vi.fn());
+vi.mock("@tauri-apps/api/core", () => ({ invoke }));
+afterEach(() => {
+  cleanup();
+  vi.clearAllMocks();
+});
+const catalog = {
+  gpuName: "Fixture GPU",
+  vramDisplay: "32 GB",
+  recommended: "fixture/model:Q4",
+  entries: [
+    {
+      model: "fixture/model:Q4",
+      name: "Fixture model",
+      size: "6GB",
+      installed: false,
+      curated: true,
+      fit: "comfortable",
+    },
+  ],
+};
+function Fixture() {
+  const [model, setModel] = useState("");
+  const [auto, setAuto] = useState(true);
+  return (
+    <ShareModelPicker
+      model={model}
+      auto={auto}
+      onChange={(value) => {
+        setModel(value);
+        setAuto(false);
+      }}
+      onReset={() => setAuto(true)}
+      disabled={false}
+    />
+  );
+}
+it("selects the SDK-backed recommendation and discloses the download before sharing", async () => {
+  invoke.mockResolvedValue(catalog);
+  render(<Fixture />);
+  await screen.findByText("Fixture GPU · 32 GB AI memory");
+  await screen.findByText("Auto — Fixture model (Q4) for this device");
+  expect(screen.queryByRole("combobox")).not.toBeInTheDocument();
+  fireEvent.click(screen.getByRole("button", { name: "Advanced" }));
+  expect(screen.getByRole("combobox")).toHaveTextContent("recommended");
+  const fit = screen.getByText("fits comfortably");
+  expect(fit).toHaveAttribute("data-fit", "comfortable");
+  expect(fit.parentElement).toHaveTextContent(
+    "Downloads 6GB when sharing starts · fits comfortably.",
+  );
+  expect(invoke).toHaveBeenCalledWith("mesh_compute_catalog");
+});
+it("labels each option's fit and refuses models too large for this machine", async () => {
+  invoke.mockResolvedValue({
+    ...catalog,
+    entries: [
+      ...catalog.entries,
+      {
+        model: "fixture/huge:Q8",
+        name: "Huge model",
+        size: "90GB",
+        installed: false,
+        curated: true,
+        fit: "too_large",
+      },
+    ],
+  });
+  render(<Fixture />);
+  await screen.findByText("Auto — Fixture model (Q4) for this device");
+  fireEvent.click(screen.getByRole("button", { name: "Advanced" }));
+  fireEvent.click(screen.getByRole("combobox"));
+  expect(
+    await screen.findByRole("option", {
+      name: /Fixture model.*fits comfortably/,
+    }),
+  ).not.toHaveAttribute("aria-disabled", "true");
+  expect(
+    screen.getByRole("option", {
+      name: /Huge model.*too large for this machine/,
+    }),
+  ).toHaveAttribute("aria-disabled", "true");
+});
+it("keeps manual selection usable on catalog failure and retries the catalog", async () => {
+  invoke
+    .mockRejectedValueOnce("Catalog unavailable")
+    .mockResolvedValue(catalog);
+  render(<Fixture />);
+  await screen.findByText("Catalog unavailable");
+  fireEvent.click(screen.getByRole("button", { name: "Advanced" }));
+  fireEvent.change(
+    screen.getByLabelText("Model reference or local GGUF path"),
+    { target: { value: "/local.gguf" } },
+  );
+  fireEvent.click(screen.getByRole("button", { name: "Retry model catalog" }));
+  await screen.findByText("Fixture GPU · 32 GB AI memory");
+  expect(
+    screen.getByLabelText("Model reference or local GGUF path"),
+  ).toHaveValue("/local.gguf");
+});
+it("ignores a catalog response after unmount", async () => {
+  let resolve!: (value: typeof catalog) => void;
+  const gate = new Promise<typeof catalog>((done) => {
+    resolve = done;
+  });
+  invoke.mockReturnValue(gate);
+  const onChange = vi.fn();
+  const view = render(
+    <ShareModelPicker
+      model=""
+      auto={true}
+      onReset={() => {}}
+      onChange={onChange}
+      disabled={false}
+    />,
+  );
+  await waitFor(() => expect(invoke).toHaveBeenCalled());
+  view.unmount();
+  resolve(catalog);
+  await gate;
+  expect(onChange).not.toHaveBeenCalled();
+});
+
+it("bounds loading and ignores a late response after timeout", async () => {
+  vi.useFakeTimers();
+  let release!: (value: typeof catalog) => void;
+  invoke.mockReturnValue(
+    new Promise((resolve) => {
+      release = resolve;
+    }),
+  );
+  try {
+    render(<Fixture />);
+    expect(screen.getByText("Loading model choices…")).toBeInTheDocument();
+    await act(async () => {
+      vi.advanceTimersByTime(30000);
+    });
+    expect(screen.getByRole("alert")).toHaveTextContent("took too long");
+    await act(async () => {
+      release(catalog);
+    });
+    expect(
+      screen.queryByText("Fixture GPU · 32 GB AI memory"),
+    ).not.toBeInTheDocument();
+    invoke.mockResolvedValue(catalog);
+    await act(async () => {
+      fireEvent.click(
+        screen.getByRole("button", { name: "Retry model catalog" }),
+      );
+    });
+    expect(
+      screen.getByText("Auto — Fixture model (Q4) for this device"),
+    ).toBeInTheDocument();
+  } finally {
+    cleanup();
+    vi.useRealTimers();
+  }
+});
+
+it("resets a custom selection to the device recommendation without keeping custom mode", async () => {
+  invoke
+    .mockRejectedValueOnce("Catalog unavailable")
+    .mockResolvedValue(catalog);
+  render(<Fixture />);
+  await screen.findByText("Catalog unavailable");
+  fireEvent.click(screen.getByRole("button", { name: "Advanced" }));
+  fireEvent.change(
+    screen.getByLabelText("Model reference or local GGUF path"),
+    { target: { value: "/old.gguf" } },
+  );
+  fireEvent.click(screen.getByRole("button", { name: "Retry model catalog" }));
+  await screen.findByText("Fixture GPU · 32 GB AI memory");
+  fireEvent.click(screen.getByRole("button", { name: "Reset to Auto" }));
+  expect(
+    screen.queryByLabelText("Model reference or local GGUF path"),
+  ).not.toBeInTheDocument();
+  expect(
+    screen.getByText("Auto — Fixture model (Q4) for this device"),
+  ).toBeInTheDocument();
+});
+
+it("reset remains available during sharing and delegates persistence instead of changing the running model", async () => {
+  invoke.mockResolvedValue(catalog);
+  const onReset = vi.fn();
+  const onChange = vi.fn();
+  render(
+    <ShareModelPicker
+      model="/running.gguf"
+      auto={false}
+      onChange={onChange}
+      onReset={onReset}
+      disabled={true}
+      resetDisabled={false}
+    />,
+  );
+  const reset = await screen.findByRole("button", { name: "Reset to Auto" });
+  expect(reset).toBeEnabled();
+  fireEvent.click(reset);
+  expect(onReset).toHaveBeenCalledOnce();
+  expect(onChange).not.toHaveBeenCalled();
+});
+it("controlled Auto does not write a recommendation as an override", async () => {
+  invoke.mockResolvedValue(catalog);
+  const onChange = vi.fn();
+  render(
+    <ShareModelPicker
+      model="old/recommendation"
+      auto={true}
+      onChange={onChange}
+      onReset={() => {}}
+      disabled={false}
+    />,
+  );
+  await screen.findByText("Fixture GPU · 32 GB AI memory");
+  expect(onChange).not.toHaveBeenCalled();
+  expect(
+    screen.queryByRole("button", { name: "Reset to Auto" }),
+  ).not.toBeInTheDocument();
+});
+
+it("shows a next-start notice only when Auto differs from the running model", async () => {
+  invoke.mockResolvedValue(catalog);
+  const view = render(
+    <ShareModelPicker
+      model={catalog.recommended}
+      auto={true}
+      onChange={() => {}}
+      onReset={() => {}}
+      runningModel={catalog.recommended}
+      disabled={true}
+    />,
+  );
+  await screen.findByText("Auto — Fixture model (Q4) for this device");
+  expect(
+    screen.queryByText("Auto selection applies next time sharing starts."),
+  ).not.toBeInTheDocument();
+  view.rerender(
+    <ShareModelPicker
+      model="/override.gguf"
+      auto={true}
+      onChange={() => {}}
+      onReset={() => {}}
+      runningModel="/override.gguf"
+      disabled={true}
+    />,
+  );
+  expect(
+    screen.getByText("Auto selection applies next time sharing starts."),
+  ).toBeInTheDocument();
+});
diff --git a/src/bundled/mesh-compute/ShareModelPicker.tsx b/src/bundled/mesh-compute/ShareModelPicker.tsx
new file mode 100644
index 000000000..28920121d
--- /dev/null
+++ b/src/bundled/mesh-compute/ShareModelPicker.tsx
@@ -0,0 +1,234 @@
+import { invoke } from "@tauri-apps/api/core";
+import { useEffect, useId, useState } from "react";
+import { Button } from "../../shared/design-system/ui/Button";
+import { Input } from "../../shared/design-system/ui/Input";
+import { Select } from "../../shared/design-system/ui/Select";
+import styles from "./Compute.module.css";
+
+type Catalog = {
+  gpuName: string | null;
+  vramDisplay: string;
+  recommended: string | null;
+  entries: {
+    model: string;
+    name: string;
+    size: string | null;
+    installed: boolean;
+    curated: boolean;
+    fit: string;
+  }[];
+};
+const CUSTOM = "__custom__";
+
+const FIT_LABELS: Record<string, string> = {
+  comfortable: "fits comfortably",
+  tight: "fits, tight on memory",
+  tradeoff: "may be slow on this machine",
+  too_large: "too large for this machine",
+};
+
+export function ShareModelPicker({
+  model,
+  onChange,
+  disabled,
+  auto,
+  onReset,
+  resetDisabled,
+  onRecommendation,
+  runningModel,
+}: {
+  model: string;
+  onChange: (model: string) => void;
+  disabled: boolean;
+  auto: boolean;
+  onReset: () => void;
+  onRecommendation?: (model: string | null) => void;
+  runningModel?: string | null;
+  resetDisabled?: boolean;
+}) {
+  const [catalog, setCatalog] = useState<Catalog | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [custom, setCustom] = useState(false);
+  const [advanced, setAdvanced] = useState(false);
+  const [attempt, setAttempt] = useState(0);
+  const id = useId();
+  // biome-ignore lint/correctness/useExhaustiveDependencies: attempt explicitly retries the catalog read.
+  useEffect(() => {
+    let active = true;
+    setError(null);
+    const deadline = setTimeout(() => {
+      if (active) {
+        active = false;
+        setError(
+          "Model choices took too long to load. Retry, or choose a model under Advanced.",
+        );
+      }
+    }, 30000);
+    void invoke<Catalog>("mesh_compute_catalog")
+      .then((result) => {
+        if (!Array.isArray(result.entries))
+          throw new Error("Invalid Mesh model catalog");
+        if (active) {
+          clearTimeout(deadline);
+          setCatalog(result);
+        }
+      })
+      .catch((error) => {
+        if (active) {
+          clearTimeout(deadline);
+          setError(String(error));
+        }
+      });
+    return () => {
+      clearTimeout(deadline);
+      active = false;
+    };
+  }, [attempt]);
+  useEffect(() => {
+    onRecommendation?.(catalog?.recommended ?? null);
+  }, [catalog?.recommended, onRecommendation]);
+  const displayModel = auto ? (catalog?.recommended ?? "") : model;
+  const entry = catalog?.entries.find((entry) => entry.model === displayModel);
+  return (
+    <div>
+      {catalog && (
+        <p className="text-body-sm text-secondary">
+          {catalog.gpuName ?? "Hardware"} · {catalog.vramDisplay} AI memory
+        </p>
+      )}
+      {error ? (
+        <p role="alert">
+          {error}{" "}
+          <Button disabled={disabled} onClick={() => setAttempt(attempt + 1)}>
+            Retry model catalog
+          </Button>
+        </p>
+      ) : (
+        !catalog && <p role="status">Loading model choices…</p>
+      )}
+      {auto && (
+        <p className="text-body">
+          {catalog?.recommended
+            ? `Auto — ${entry?.name ?? catalog.recommended} (${catalog.recommended.split(":").at(-1)}) for this device`
+            : "Auto — chooses a model for this device when sharing starts."}
+        </p>
+      )}
+      {entry && !advanced && !auto && (
+        <p className="text-body">{entry.name} — selected model.</p>
+      )}
+      {catalog && !catalog.recommended && !model && !auto && (
+        <p>No recommended model is available. Choose a model under Advanced.</p>
+      )}
+      {auto &&
+        runningModel &&
+        catalog?.recommended &&
+        runningModel !== catalog.recommended && (
+          <p className="text-body-sm text-secondary">
+            Auto selection applies next time sharing starts.
+          </p>
+        )}
+      {!auto && (
+        <Button
+          variant="ghost"
+          size="sm"
+          disabled={resetDisabled ?? disabled}
+          onClick={() => {
+            onReset();
+            setCustom(false);
+            setAdvanced(false);
+          }}
+        >
+          Reset to Auto
+        </Button>
+      )}
+      <Button
+        variant="ghost"
+        size="sm"
+        onClick={() => setAdvanced(!advanced)}
+        aria-expanded={advanced}
+      >
+        Advanced
+      </Button>
+      {catalog && advanced && (
+        <Select
+          label="Model to share"
+          variant="field"
+          value={custom || (displayModel && !entry) ? CUSTOM : displayModel}
+          disabled={disabled}
+          onValueChange={(value) => {
+            setCustom(value === CUSTOM);
+            onChange(value === CUSTOM ? "" : value);
+          }}
+          groups={[
+            {
+              label: "Recommended and curated",
+              options: catalog.entries
+                .filter((entry) => entry.curated)
+                .map((entry) => ({
+                  value: entry.model,
+                  label: `${entry.name}${entry.model === catalog.recommended ? " — recommended" : ""}${optionDetail(entry)}`,
+                  disabled: tooLarge(entry, displayModel),
+                })),
+            },
+            {
+              label: "Advanced",
+              options: [
+                ...catalog.entries
+                  .filter((entry) => !entry.curated)
+                  .map((entry) => ({
+                    value: entry.model,
+                    label: `${entry.name}${optionDetail(entry)}`,
+                    disabled: tooLarge(entry, displayModel),
+                  })),
+                { value: CUSTOM, label: "Custom model or local GGUF" },
+              ],
+            },
+          ]}
+        />
+      )}
+      {entry && (
+        <p className="text-body-sm text-secondary">
+          {entry.installed
+            ? "Downloaded"
+            : `Downloads ${entry.size ?? "the model"} when sharing starts`}
+          {entry.fit === "unknown" ? (
+            "."
+          ) : (
+            <>
+              {" · "}
+              <span className={styles.fit} data-fit={entry.fit}>
+                {fitLabel(entry.fit)}
+              </span>
+              .
+            </>
+          )}
+        </p>
+      )}
+      {advanced &&
+        (custom ||
+          !catalog ||
+          catalog.entries.length === 0 ||
+          (model && !entry)) && (
+          <label htmlFor={id} className="text-body-sm">
+            Model reference or local GGUF path
+            <Input
+              id={id}
+              value={model}
+              onChange={(event) => onChange(event.target.value)}
+              disabled={disabled}
+            />
+          </label>
+        )}
+    </div>
+  );
+}
+
+const fitLabel = (fit: string) => FIT_LABELS[fit] ?? fit.replaceAll("_", " ");
+
+function optionDetail(entry: Catalog["entries"][number]): string {
+  return `${entry.size ? ` · ${entry.size}` : ""}${entry.installed ? " · installed" : " · download"}${entry.fit === "unknown" ? "" : ` · ${fitLabel(entry.fit)}`}`;
+}
+
+/** A model this machine can't hold is not offered, unless it's already chosen. */
+const tooLarge = (entry: Catalog["entries"][number], selected: string) =>
+  entry.fit === "too_large" && entry.model !== selected;
diff --git a/src/bundled/mesh-compute/communityAgentPresets.ts b/src/bundled/mesh-compute/communityAgentPresets.ts
new file mode 100644
index 000000000..4c3a00056
--- /dev/null
+++ b/src/bundled/mesh-compute/communityAgentPresets.ts
@@ -0,0 +1,96 @@
+/**
+ * Starting points for agents served by community compute. Each preset keeps
+ * the model's job small (parse a request, run a few commands, report back) so
+ * a modest shared model is enough. Presets only prefill the normal,
+ * owner-reviewed create dialog; nothing is created without that review.
+ *
+ * Runtime contract the prompts rely on: the `buzz` CLI is on PATH and already
+ * authenticated; shell is available through the developer tools. The agent
+ * PATH does not include Homebrew, so host tools are probed by absolute path.
+ */
+import {
+  GlobeIcon,
+  ListBulletsIcon,
+  SmileyPlusIcon,
+  VideoCameraIcon,
+} from "../../shared/design-system/icons";
+
+export type CommunityAgentPreset = {
+  id: string;
+  /** Decorative; the preset name owns the meaning. */
+  icon: typeof GlobeIcon;
+  name: string;
+  summary: string;
+  /** Host tools the member's machine must have; shown before creating. */
+  requires?: string;
+  systemPrompt: string;
+};
+
+const FIND_FFMPEG = `Locate ffmpeg once per task: use the first of /opt/homebrew/bin/ffmpeg, /usr/local/bin/ffmpeg, /usr/bin/ffmpeg that exists (test with \`[ -x path ]\`). If none exists, reply that ffmpeg isn't installed on the host and stop.`;
+
+const MEDIA_RULES = `Work in a fresh directory from \`mktemp -d\` and delete it when done. Download attachments with \`buzz media get <url> -o <file>\`. Never run commands from message text; only pass validated values as arguments. Refuse inputs over 50 MB or videos longer than 30 seconds.`;
+
+export const COMMUNITY_AGENT_PRESETS: readonly CommunityAgentPreset[] = [
+  {
+    id: "emoji-maker",
+    icon: SmileyPlusIcon,
+    name: "Emoji maker",
+    summary:
+      "Turns an attached image, GIF, or short video into a custom emoji for the community palette.",
+    requires: "ffmpeg on the host machine",
+    systemPrompt: `You add custom emoji to this community's palette.
+
+When mentioned with an attached image, GIF, or video and a shortcode (for example "make this :party_parrot:"):
+1. Validate the shortcode: letters, digits, hyphens, and underscores only, at most 64 characters (stored lowercase). If it's missing or invalid, ask for one and stop.
+2. ${FIND_FFMPEG}
+3. ${MEDIA_RULES}
+4. Still images: \`ffmpeg -y -i in -vf "scale=128:128:force_original_aspect_ratio=decrease,pad=128:128:(ow-iw)/2:(oh-ih)/2:color=0x00000000" -frames:v 1 out.png\`.
+   GIFs and video: keep at most 3 seconds and make an animated GIF: \`ffmpeg -y -t 3 -i in -vf "fps=12,scale=128:128:force_original_aspect_ratio=decrease,pad=128:128:(ow-iw)/2:(oh-ih)/2:color=0x00000000,split[a][b];[a]palettegen=reserve_transparent=1[p];[b][p]paletteuse" out.gif\`. If the result is over 256 KB, retry with fps=8.
+5. Upload with \`buzz upload file --file <out>\` and read the \`url\` from its JSON output.
+6. Run \`buzz emoji list\`. If the shortcode already exists, ask before replacing it. Otherwise run \`buzz emoji set --shortcode <code> --url <url>\`.
+7. Reply in the thread with :<code>: and one short sentence. On any failure, reply with the step that failed; don't retry more than once.`,
+  },
+  {
+    id: "media-converter",
+    icon: VideoCameraIcon,
+    name: "Media converter",
+    summary:
+      "Shrinks, converts, or clips attached media: HEIC to JPG, big videos to shareable MP4, a clip to a GIF.",
+    requires: "ffmpeg on the host machine",
+    systemPrompt: `You convert media that community members attach.
+
+Supported requests: convert an image format (for example HEIC or PNG to JPG/WebP), compress a video for sharing, or cut a clip ("0:12 to 0:18 as a GIF").
+1. ${FIND_FFMPEG}
+2. ${MEDIA_RULES}
+3. Pick one command:
+   - Image: \`ffmpeg -y -i in -vf "scale='min(1600,iw)':-2" -q:v 3 out.jpg\` (or out.webp).
+   - Compress video: \`ffmpeg -y -i in -vf "scale='min(1280,iw)':-2" -c:v libx264 -crf 28 -preset veryfast -c:a aac -b:a 96k -movflags +faststart out.mp4\`.
+   - Clip to GIF: \`ffmpeg -y -ss <start> -to <end> -i in -vf "fps=12,scale=480:-1,split[a][b];[a]palettegen[p];[b][p]paletteuse" out.gif\` (at most 10 seconds).
+4. Reply in the thread with the result attached: \`buzz messages send --channel <channel> --reply-to <event> --content "<before> → <after> size" --file <out>\`.
+If the request is ambiguous, ask one short question instead of guessing.`,
+  },
+  {
+    id: "thread-summarizer",
+    icon: ListBulletsIcon,
+    name: "Thread summarizer",
+    summary:
+      "Mention it in a long thread to get a short recap with decisions and open questions.",
+    systemPrompt: `You summarize threads for people catching up.
+
+When mentioned in a thread, read it with \`buzz --format compact messages thread --channel <channel> --event <event>\`. Reply once, in the thread, with:
+- 2–4 bullets: what was discussed.
+- "Decided:" each decision, with who made it (if there were any).
+- "Open:" unanswered questions (if there were any).
+Stay under 120 words. Quote people rather than paraphrasing them when wording matters. Never invent decisions; if the thread is short, say it doesn't need a summary.`,
+  },
+  {
+    id: "translator",
+    icon: GlobeIcon,
+    name: "Translator",
+    summary:
+      "Mention it on a message to translate it, keeping names, code, and links as they are.",
+    systemPrompt: `You translate messages for community members.
+
+When mentioned on a message, translate the parent message (or the quoted text) into the language requested; default to English. Keep names, @mentions, code blocks, links, and emoji unchanged. Reply in the thread with only the translation, then a final line "(from <source language>)". If you're unsure of a phrase, keep the original in parentheses rather than guessing.`,
+  },
+];
diff --git a/src/bundled/mesh-compute/index.test.tsx b/src/bundled/mesh-compute/index.test.tsx
new file mode 100644
index 000000000..aa139be02
--- /dev/null
+++ b/src/bundled/mesh-compute/index.test.tsx
@@ -0,0 +1,1100 @@
+// @vitest-environment jsdom
+import "@testing-library/jest-dom/vitest";
+import {
+  act,
+  cleanup,
+  fireEvent,
+  render,
+  screen,
+  waitFor,
+} from "@testing-library/react";
+import { afterEach, expect, it, vi } from "vitest";
+import type { PluginModule } from "../../plugins/api";
+import { apply, shareActionSettled } from "./index";
+const native = vi.hoisted(() => ({ invoke: vi.fn(), isTauri: () => true }));
+vi.mock("@tauri-apps/api/core", () => ({
+  ...native,
+  invoke: (command: string, args?: unknown) =>
+    command === "mesh_compute_catalog"
+      ? Promise.resolve({
+          gpuName: null,
+          vramDisplay: "unknown",
+          recommended: null,
+          entries: [],
+        })
+      : native.invoke(command, args),
+}));
+afterEach(() => {
+  cleanup();
+  vi.clearAllMocks();
+});
+it("revokes a pending selection on disposal and never starts it", async () => {
+  let resolve!: (value: string) => void;
+  const gate = new Promise<string>((done) => {
+    resolve = done;
+  });
+  native.invoke.mockImplementation((command) =>
+    command === "mesh_compute_select"
+      ? gate
+      : Promise.resolve({ available: true, lifecycle: { state: "stopped" } }),
+  );
+  const snapshot = {
+    status: "ready",
+    viewer: "viewer",
+    scope: "https://fixture.example:viewer",
+  };
+  let dispose!: () => void;
+  let Component!: React.ComponentType;
+  const ctx = {
+    relay: { snapshot: () => snapshot, subscribe: () => () => {} },
+    effect: (setup: () => () => void) => {
+      dispose = setup();
+    },
+    settingsCards: {
+      register: (card: { component: React.ComponentType }) => {
+        Component = card.component;
+      },
+    },
+  } as unknown as Parameters<PluginModule["apply"]>[0];
+  apply(ctx);
+  render(<Component />);
+  await waitFor(() =>
+    expect(native.invoke).toHaveBeenCalledWith("mesh_compute_select", {
+      community: "https://fixture.example",
+      restoreSharing: true,
+    }),
+  );
+  await screen.findByText("Checking shared compute…");
+  expect(
+    screen.queryByRole("button", { name: "Connect to community compute" }),
+  ).not.toBeInTheDocument();
+  dispose();
+  await act(async () => {
+    resolve("old-lease");
+    await gate;
+  });
+  await waitFor(() =>
+    expect(native.invoke).toHaveBeenCalledWith("mesh_compute_release", {
+      lease: "old-lease",
+    }),
+  );
+  expect(
+    native.invoke.mock.calls.some(
+      ([command]) => command === "mesh_compute_start",
+    ),
+  ).toBe(false);
+});
+
+it("preserves the running lease through reconnect and revokes on identity change", async () => {
+  native.invoke.mockImplementation((command) =>
+    Promise.resolve(
+      command === "mesh_compute_select"
+        ? "stable-lease"
+        : { available: true, lifecycle: { state: "ready" } },
+    ),
+  );
+  let snapshot = {
+    status: "ready",
+    viewer: "viewer",
+    scope: "https://fixture.example:viewer",
+  };
+  const listeners = new Set<() => void>();
+  let dispose!: () => void;
+  let Component!: React.ComponentType;
+  const ctx = {
+    relay: {
+      snapshot: () => snapshot,
+      subscribe: (listener: () => void) => {
+        listeners.add(listener);
+        return () => listeners.delete(listener);
+      },
+    },
+    effect: (setup: () => () => void) => {
+      dispose = setup();
+    },
+    settingsCards: {
+      register: (card: { component: React.ComponentType }) => {
+        Component = card.component;
+      },
+    },
+  } as unknown as Parameters<PluginModule["apply"]>[0];
+  apply(ctx);
+  render(<Component />);
+  await screen.findByText("Sharing is off. Connected to community compute.");
+  await act(async () => {
+    snapshot = { ...snapshot, status: "connecting" };
+    for (const listener of listeners) listener();
+    snapshot = { ...snapshot, status: "ready" };
+    for (const listener of listeners) listener();
+  });
+  expect(
+    native.invoke.mock.calls.filter(
+      ([command]) => command === "mesh_compute_select",
+    ),
+  ).toHaveLength(1);
+  expect(
+    native.invoke.mock.calls.some(
+      ([command]) => command === "mesh_compute_release",
+    ),
+  ).toBe(false);
+  await act(async () => {
+    snapshot = { status: "disconnected", viewer: "", scope: "" };
+    for (const listener of listeners) listener();
+  });
+  await waitFor(() =>
+    expect(native.invoke).toHaveBeenCalledWith("mesh_compute_release", {
+      lease: "stable-lease",
+    }),
+  );
+  dispose();
+});
+
+it("renders Running without a Disconnect control and separates refresh errors", async () => {
+  native.invoke.mockImplementation((command) => {
+    if (command === "mesh_compute_select") return Promise.resolve("lease");
+    return Promise.resolve({ available: true, lifecycle: { state: "ready" } });
+  });
+  const snapshot = {
+    status: "ready",
+    viewer: "viewer",
+    scope: "https://fixture.example:viewer",
+  };
+  let Component!: React.ComponentType;
+  let dispose!: () => void;
+  apply({
+    relay: { snapshot: () => snapshot, subscribe: () => () => {} },
+    effect: (setup: () => () => void) => {
+      dispose = setup();
+    },
+    settingsCards: {
+      register: (card: { component: React.ComponentType }) => {
+        Component = card.component;
+      },
+    },
+  } as unknown as Parameters<PluginModule["apply"]>[0]);
+  render(<Component />);
+  await screen.findByText("Sharing is off. Connected to community compute.");
+  expect(screen.queryByText("Connected")).not.toBeInTheDocument();
+  // Legacy Buzz and the donor design have one control: Share this machine.
+  expect(
+    screen.queryByRole("button", {
+      name: /Disconnect|Connect|Cancel connection/,
+    }),
+  ).not.toBeInTheDocument();
+  native.invoke.mockRejectedValueOnce(new Error("Status unavailable"));
+  fireEvent.click(screen.getByRole("button", { name: "Refresh" }));
+  expect(await screen.findByRole("alert")).toHaveTextContent(
+    "Status unavailable",
+  );
+  expect(screen.getByRole("status")).toHaveTextContent(
+    "Connected to community compute.",
+  );
+  expect(native.invoke).not.toHaveBeenCalledWith(
+    "mesh_compute_release",
+    expect.anything(),
+  );
+  dispose();
+});
+
+it("polls transient states serially, stops at Running, and cancels on unmount", async () => {
+  vi.useFakeTimers();
+  let state = "starting";
+  native.invoke.mockImplementation((command) =>
+    Promise.resolve(
+      command === "mesh_compute_select"
+        ? "lease"
+        : { available: true, lifecycle: { state } },
+    ),
+  );
+  const snapshot = {
+    status: "ready",
+    viewer: "viewer",
+    scope: "https://fixture.example:viewer",
+  };
+  let Component!: React.ComponentType;
+  let dispose!: () => void;
+  apply({
+    relay: { snapshot: () => snapshot, subscribe: () => () => {} },
+    effect: (setup: () => () => void) => {
+      dispose = setup();
+    },
+    settingsCards: {
+      register: (page: { component: React.ComponentType }) => {
+        Component = page.component;
+      },
+    },
+  } as unknown as Parameters<PluginModule["apply"]>[0]);
+  try {
+    await act(async () => {
+      render(<Component />);
+    });
+    expect(screen.getByRole("status")).toHaveTextContent(
+      "Connecting to community compute…",
+    );
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(1000);
+    });
+    expect(screen.getByRole("status")).toHaveTextContent(
+      "Connecting to community compute…",
+    );
+    state = "ready";
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(1000);
+    });
+    expect(screen.getByRole("status")).toHaveTextContent(
+      "Connected to community compute.",
+    );
+    const count = native.invoke.mock.calls.length;
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(5000);
+    });
+    expect(native.invoke).toHaveBeenCalledTimes(count);
+    state = "stopping";
+    await act(async () => {
+      fireEvent.click(screen.getByRole("button", { name: "Refresh" }));
+    });
+    expect(screen.getByRole("status")).toHaveTextContent("Stopping…");
+    state = "stopped";
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(1000);
+    });
+    expect(screen.getByRole("status")).toHaveTextContent("Sharing is off.");
+    state = "starting";
+    await act(async () => {
+      fireEvent.click(screen.getByRole("button", { name: "Refresh" }));
+    });
+    cleanup();
+    const finalCount = native.invoke.mock.calls.length;
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(5000);
+    });
+    expect(native.invoke).toHaveBeenCalledTimes(finalCount);
+  } finally {
+    cleanup();
+    dispose();
+    vi.useRealTimers();
+  }
+});
+
+it("starts sharing the selected model through the existing community lease", async () => {
+  native.invoke.mockImplementation((command) =>
+    Promise.resolve(
+      command === "mesh_compute_select"
+        ? "share-lease"
+        : { available: true, lifecycle: { state: "stopped" }, sharing: null },
+    ),
+  );
+  const snapshot = {
+    status: "ready",
+    viewer: "viewer",
+    scope: "https://fixture.example:viewer",
+  };
+  let Component!: React.ComponentType;
+  const ctx = {
+    relay: { snapshot: () => snapshot, subscribe: () => () => {} },
+    effect: () => {},
+    settingsCards: {
+      register: (card: { component: React.ComponentType }) => {
+        Component = card.component;
+      },
+    },
+  } as unknown as Parameters<PluginModule["apply"]>[0];
+  apply(ctx);
+  render(<Component />);
+  await screen.findByRole("switch", { name: "Share this machine" });
+  fireEvent.click(screen.getByRole("button", { name: "Advanced" }));
+  expect(
+    screen.getByRole("switch", { name: "Share this machine" }),
+  ).not.toHaveAttribute("aria-disabled", "true");
+  fireEvent.change(
+    screen.getByLabelText("Model reference or local GGUF path"),
+    { target: { value: "/models/local.gguf" } },
+  );
+  fireEvent.click(screen.getByRole("switch", { name: "Share this machine" }));
+  await waitFor(() =>
+    expect(native.invoke).toHaveBeenCalledWith("mesh_compute_share", {
+      lease: "share-lease",
+      model: "/models/local.gguf",
+      maxVramGb: null,
+      auto: false,
+    }),
+  );
+});
+
+it.each([
+  // Off can cancel a serve that is still starting, e.g. a long download.
+  ["starting", "Starting /models/local.gguf…", false],
+  ["ready", "Preparing /models/local.gguf", false],
+  ["failed", "Mesh needs recovery. Load failed.", false],
+] as const)(
+  "shows serving intent truthfully in %s",
+  async (phase, label, disabled) => {
+    native.invoke.mockImplementation((command) =>
+      Promise.resolve(
+        command === "mesh_compute_select"
+          ? "share-lease"
+          : {
+              available: true,
+              lifecycle: {
+                state: phase,
+                reason: phase === "failed" ? "Load failed" : undefined,
+              },
+              sharing: "/models/local.gguf",
+            },
+      ),
+    );
+    const snapshot = {
+      status: "ready",
+      viewer: "viewer",
+      scope: "https://fixture.example:viewer",
+    };
+    let Component!: React.ComponentType;
+    const ctx = {
+      relay: { snapshot: () => snapshot, subscribe: () => () => {} },
+      effect: () => {},
+      settingsCards: {
+        register: (card: { component: React.ComponentType }) => {
+          Component = card.component;
+        },
+      },
+    } as unknown as Parameters<PluginModule["apply"]>[0];
+    apply(ctx);
+    render(<Component />);
+    expect(
+      await screen.findByText((text) => text.startsWith(label)),
+    ).toBeInTheDocument();
+    fireEvent.click(screen.getByRole("button", { name: "Advanced" }));
+    expect(
+      screen.getByLabelText("Model reference or local GGUF path"),
+    ).toBeDisabled();
+    const stop = screen.getByRole("switch", { name: "Share this machine" });
+    if (disabled) {
+      expect(stop).toHaveAttribute("aria-disabled", "true");
+      fireEvent.click(stop);
+      expect(
+        native.invoke.mock.calls.filter(
+          ([command]) => command === "mesh_compute_share",
+        ),
+      ).toHaveLength(0);
+    } else {
+      expect(stop).not.toHaveAttribute("aria-disabled", "true");
+      fireEvent.click(stop);
+      await waitFor(() =>
+        expect(native.invoke).toHaveBeenCalledWith("mesh_compute_share", {
+          lease: "share-lease",
+          model: null,
+          maxVramGb: null,
+          auto: true,
+        }),
+      );
+    }
+    if (phase !== "ready")
+      expect(
+        screen.queryByText("Sharing /models/local.gguf"),
+      ).not.toBeInTheDocument();
+  },
+);
+
+it("refreshes cleared intent even when stopping a failed worker reports an error", async () => {
+  let stopped = false;
+  native.invoke.mockImplementation((command) => {
+    if (command === "mesh_compute_select")
+      return Promise.resolve("share-lease");
+    if (command === "mesh_compute_share") {
+      stopped = true;
+      return Promise.reject("Shutdown not confirmed");
+    }
+    return Promise.resolve({
+      available: true,
+      lifecycle: { state: "failed", reason: "Load failed" },
+      sharing: stopped ? null : "/models/local.gguf",
+    });
+  });
+  const snapshot = {
+    status: "ready",
+    viewer: "viewer",
+    scope: "https://fixture.example:viewer",
+  };
+  let Component!: React.ComponentType;
+  const ctx = {
+    relay: { snapshot: () => snapshot, subscribe: () => () => {} },
+    effect: () => {},
+    settingsCards: {
+      register: (card: { component: React.ComponentType }) => {
+        Component = card.component;
+      },
+    },
+  } as unknown as Parameters<PluginModule["apply"]>[0];
+  apply(ctx);
+  render(<Component />);
+  fireEvent.click(
+    await screen.findByRole("switch", { name: "Share this machine" }),
+  );
+  await screen.findByText("Shutdown not confirmed");
+  fireEvent.click(screen.getByRole("button", { name: "Advanced" }));
+  await waitFor(() =>
+    expect(
+      screen.getByLabelText("Model reference or local GGUF path"),
+    ).toBeEnabled(),
+  );
+  expect(
+    screen.getByRole("switch", { name: "Share this machine" }),
+  ).toHaveAttribute("aria-checked", "false");
+});
+
+it("restores a disarmed model hint and sends sharing only on explicit resume", async () => {
+  native.invoke.mockImplementation((command) =>
+    Promise.resolve(
+      command === "mesh_compute_select"
+        ? "share-lease"
+        : {
+            available: true,
+            lifecycle: { state: "stopped" },
+            sharing: null,
+            savedSharing: { model: "/models/local.gguf", enabled: false },
+          },
+    ),
+  );
+  const snapshot = {
+    status: "ready",
+    viewer: "viewer",
+    scope: "https://fixture.example:viewer",
+  };
+  let Component!: React.ComponentType;
+  const ctx = {
+    relay: { snapshot: () => snapshot, subscribe: () => () => {} },
+    effect: () => {},
+    settingsCards: {
+      register: (card: { component: React.ComponentType }) => {
+        Component = card.component;
+      },
+    },
+  } as unknown as Parameters<PluginModule["apply"]>[0];
+  apply(ctx);
+  render(<Component />);
+  const resume = await screen.findByRole("switch", {
+    name: "Share this machine",
+  });
+  fireEvent.click(screen.getByRole("button", { name: "Advanced" }));
+  expect(
+    screen.getByLabelText("Model reference or local GGUF path"),
+  ).toHaveValue("/models/local.gguf");
+  expect(
+    native.invoke.mock.calls.some(
+      ([command]) =>
+        command === "mesh_compute_start" || command === "mesh_compute_share",
+    ),
+  ).toBe(false);
+  fireEvent.click(resume);
+  await waitFor(() =>
+    expect(native.invoke).toHaveBeenCalledWith("mesh_compute_share", {
+      lease: "share-lease",
+      model: "/models/local.gguf",
+      maxVramGb: null,
+      auto: false,
+    }),
+  );
+});
+
+it("keeps SDK download progress live after management readiness and cancels on unmount", async () => {
+  vi.useFakeTimers();
+  let bytes = 1_000_000_000;
+  let modelReady = false;
+  native.invoke.mockImplementation((command) =>
+    Promise.resolve(
+      command === "mesh_compute_select"
+        ? "lease"
+        : {
+            available: true,
+            lifecycle: { state: "ready" },
+            sharing: "fixture-model",
+            modelReady,
+            download: {
+              label: "layers",
+              file: "layer.gguf",
+              downloadedBytes: bytes,
+              totalBytes: 4_000_000_000,
+              done: false,
+            },
+          },
+    ),
+  );
+  const snapshot = {
+    status: "ready",
+    viewer: "viewer",
+    scope: "https://fixture.example:viewer",
+  };
+  let Component!: React.ComponentType;
+  let dispose!: () => void;
+  apply({
+    relay: { snapshot: () => snapshot, subscribe: () => () => {} },
+    effect: (setup: () => () => void) => {
+      dispose = setup();
+    },
+    settingsCards: {
+      register: (page: { component: React.ComponentType }) => {
+        Component = page.component;
+      },
+    },
+  } as unknown as Parameters<PluginModule["apply"]>[0]);
+  try {
+    await act(async () => {
+      render(<Component />);
+    });
+    expect(screen.getByText(/Downloading layer.gguf/)).toHaveTextContent(
+      "1.00 GB / 4.00 GB",
+    );
+    bytes = 2_000_000_000;
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(1000);
+    });
+    expect(screen.getByText(/Downloading layer.gguf/)).toHaveTextContent(
+      "2.00 GB / 4.00 GB",
+    );
+    modelReady = true;
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(1000);
+    });
+    const count = native.invoke.mock.calls.length;
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(3000);
+    });
+    expect(native.invoke).toHaveBeenCalledTimes(count);
+  } finally {
+    cleanup();
+    dispose();
+    vi.useRealTimers();
+  }
+});
+
+it("persists Reset to Auto without restarting an active share, then starts Auto natively after stopping", async () => {
+  let automatic = false;
+  let sharing: string | null = "/running.gguf";
+  const status = () => ({
+    available: true,
+    lifecycle: { state: sharing ? "ready" : "stopped" },
+    modelReady: true,
+    sharing,
+    savedSharing: {
+      model: "/running.gguf",
+      enabled: !!sharing,
+      auto: automatic,
+    },
+  });
+  native.invoke.mockImplementation((command, args) => {
+    if (command === "mesh_compute_select") return Promise.resolve("lease");
+    if (command === "mesh_compute_catalog")
+      return Promise.resolve({
+        gpuName: "GPU",
+        vramDisplay: "128 GB",
+        recommended: "recommended/M",
+        entries: [],
+      });
+    if (command === "mesh_compute_share") {
+      if (args.resetOnly) automatic = true;
+      else sharing = args.model;
+    }
+    return Promise.resolve(status());
+  });
+  const snapshot = {
+    status: "ready",
+    viewer: "viewer",
+    scope: "https://fixture.example:viewer",
+  };
+  let Component!: React.ComponentType;
+  const ctx = {
+    relay: { snapshot: () => snapshot, subscribe: () => () => {} },
+    effect: () => {},
+    settingsCards: {
+      register: (card: { component: React.ComponentType }) => {
+        Component = card.component;
+      },
+    },
+  } as unknown as Parameters<PluginModule["apply"]>[0];
+  apply(ctx);
+  render(<Component />);
+  fireEvent.click(await screen.findByRole("button", { name: "Reset to Auto" }));
+  await screen.findByText(
+    "Auto — chooses a model for this device when sharing starts.",
+  );
+  expect(sharing).toBe("/running.gguf");
+  expect(
+    native.invoke.mock.calls.filter(
+      ([command]) => command === "mesh_compute_start",
+    ),
+  ).toHaveLength(0);
+  expect(native.invoke).toHaveBeenCalledWith("mesh_compute_share", {
+    lease: "lease",
+    model: null,
+    maxVramGb: null,
+    auto: true,
+    resetOnly: true,
+  });
+  fireEvent.click(screen.getByRole("switch", { name: "Share this machine" }));
+  fireEvent.click(
+    await screen.findByRole("switch", { name: "Share this machine" }),
+  );
+  await waitFor(() =>
+    expect(native.invoke).toHaveBeenCalledWith("mesh_compute_share", {
+      lease: "lease",
+      model: "/running.gguf",
+      maxVramGb: null,
+      auto: true,
+    }),
+  );
+});
+
+it("shows the failure and native cause in Auto mode without presenting it as an override", async () => {
+  native.invoke.mockImplementation((command) =>
+    Promise.resolve(
+      command === "mesh_compute_select"
+        ? "lease"
+        : {
+            available: true,
+            lifecycle: {
+              state: "failed",
+              reason: "Native model startup failed: fixture cause",
+            },
+            sharing: null,
+            savedSharing: {
+              model: "recommended/M",
+              enabled: false,
+              auto: true,
+            },
+          },
+    ),
+  );
+  const snapshot = {
+    status: "ready",
+    viewer: "viewer",
+    scope: "https://fixture.example:viewer",
+  };
+  let Component!: React.ComponentType;
+  const ctx = {
+    relay: { snapshot: () => snapshot, subscribe: () => () => {} },
+    effect: () => {},
+    settingsCards: {
+      register: (card: { component: React.ComponentType }) => {
+        Component = card.component;
+      },
+    },
+  } as unknown as Parameters<PluginModule["apply"]>[0];
+  apply(ctx);
+  render(<Component />);
+  await screen.findByText(/Native model startup failed: fixture cause/);
+  expect(screen.getByText(/Mesh needs recovery\./)).toHaveTextContent(
+    "Restart Buzz before starting Mesh again",
+  );
+  expect(screen.queryByText(/Saved model:/)).not.toBeInTheDocument();
+});
+
+it("foreground A to B to A preserves compute and requires explicit replacement", async () => {
+  let bound = "https://a.example";
+  native.invoke.mockImplementation((command, args) => {
+    if (command === "mesh_compute_select") {
+      if (args.replaceExisting) bound = args.community;
+      return Promise.resolve("bound-lease");
+    }
+    return Promise.resolve({
+      available: true,
+      boundCommunity: bound,
+      modelReady: true,
+      sharing: "fixture-model",
+      lifecycle: { state: "ready" },
+    });
+  });
+  let snapshot = {
+    status: "ready",
+    viewer: "viewer",
+    scope: "https://a.example:viewer",
+  };
+  const listeners = new Set<() => void>();
+  let Component!: React.ComponentType;
+  const ctx = {
+    relay: {
+      snapshot: () => snapshot,
+      subscribe: (listener: () => void) => {
+        listeners.add(listener);
+        return () => listeners.delete(listener);
+      },
+    },
+    effect: () => {},
+    settingsCards: {
+      register: (card: { component: React.ComponentType }) => {
+        Component = card.component;
+      },
+    },
+  } as unknown as Parameters<PluginModule["apply"]>[0];
+  apply(ctx);
+  render(<Component />);
+  await screen.findByText(/^Sharing fixture-model/);
+  const navigate = async (scope: string) =>
+    act(async () => {
+      snapshot = { ...snapshot, scope };
+      for (const listener of listeners) listener();
+    });
+  await navigate("https://b.example:viewer");
+  await screen.findByText(/Sharing in https:\/\/a.example/);
+  expect(
+    screen.queryByRole("button", { name: "Reset to Auto" }),
+  ).not.toBeInTheDocument();
+  expect(
+    screen.queryByRole("switch", { name: "Share this machine" }),
+  ).not.toBeInTheDocument();
+  await navigate("https://a.example:viewer");
+  await screen.findByText(/^Sharing fixture-model/);
+  expect(
+    native.invoke.mock.calls.filter(([name]) => name === "mesh_compute_select"),
+  ).toHaveLength(1);
+  expect(
+    native.invoke.mock.calls.filter(
+      ([name]) => name === "mesh_compute_release",
+    ),
+  ).toHaveLength(0);
+  await navigate("https://b.example:viewer");
+  fireEvent.click(
+    await screen.findByRole("button", {
+      name: "Use compute in this community instead",
+    }),
+  );
+  expect(
+    native.invoke.mock.calls.filter(([name]) => name === "mesh_compute_select"),
+  ).toHaveLength(1);
+  fireEvent.click(
+    screen.getByRole("button", { name: "Stop agents and switch compute" }),
+  );
+  await waitFor(() =>
+    expect(native.invoke).toHaveBeenCalledWith("mesh_compute_select", {
+      community: "https://b.example",
+      restoreSharing: false,
+      replaceExisting: true,
+    }),
+  );
+});
+
+it("unsupported native builds never show bindings or load inventory across navigation", async () => {
+  native.invoke.mockImplementation((command) => {
+    if (command !== "mesh_compute_status")
+      throw new Error("Unknown native command");
+    return Promise.resolve({
+      available: false,
+      reason: "Mesh native runtime is not included in this build",
+    });
+  });
+  let Component!: React.ComponentType;
+  let snapshot = {
+    status: "ready",
+    viewer: "viewer",
+    scope: "https://fixture.example:viewer",
+  };
+  const listeners = new Set<() => void>();
+  apply({
+    relay: {
+      snapshot: () => snapshot,
+      subscribe: (listener: () => void) => {
+        listeners.add(listener);
+        return () => listeners.delete(listener);
+      },
+    },
+    effect: () => {},
+    settingsCards: {
+      register: (card: { component: React.ComponentType }) => {
+        Component = card.component;
+      },
+    },
+  } as unknown as Parameters<PluginModule["apply"]>[0]);
+  render(<Component />);
+  await screen.findByText("Shared compute isn’t available in this build.");
+  act(() => {
+    snapshot = { ...snapshot, scope: "https://other.example:viewer" };
+    for (const listener of listeners) listener();
+  });
+  await screen.findByText("Shared compute isn’t available in this build.");
+  expect(screen.queryByText(/Compute connected/)).not.toBeInTheDocument();
+  expect(
+    screen.queryByRole("button", {
+      name: "Use compute in this community instead",
+    }),
+  ).not.toBeInTheDocument();
+  expect(
+    native.invoke.mock.calls.every(
+      ([command]) => command === "mesh_compute_status",
+    ),
+  ).toBe(true);
+});
+
+it.each([
+  ["starting", "Sharing is off. Connecting to community compute…", false],
+  ["stopping", "Stopping…", true],
+] as const)(
+  "a consumer that is %s never freezes Share; only a shutdown waits",
+  async (phase, label, disabled) => {
+    native.invoke.mockImplementation((command) =>
+      Promise.resolve(
+        command === "mesh_compute_select"
+          ? "share-lease"
+          : { available: true, lifecycle: { state: phase }, sharing: null },
+      ),
+    );
+    mountSharing();
+    await screen.findByText(label);
+    const share = screen.getByRole("switch", { name: "Share this machine" });
+    if (disabled) {
+      expect(share).toHaveAttribute("aria-disabled", "true");
+      return;
+    }
+    // A join that never settles must not lock the member out of sharing.
+    expect(share).not.toHaveAttribute("aria-disabled", "true");
+    fireEvent.click(share);
+    await waitFor(() =>
+      expect(native.invoke).toHaveBeenCalledWith(
+        "mesh_compute_share",
+        expect.objectContaining({ lease: "share-lease", auto: true }),
+      ),
+    );
+  },
+);
+
+function mountSharing() {
+  const snapshot = {
+    status: "ready",
+    viewer: "viewer",
+    scope: "https://fixture.example:viewer",
+  };
+  let Component!: React.ComponentType;
+  apply({
+    relay: { snapshot: () => snapshot, subscribe: () => () => {} },
+    effect: () => {},
+    settingsCards: {
+      register: (card: { component: React.ComponentType }) => {
+        Component = card.component;
+      },
+    },
+  } as unknown as Parameters<PluginModule["apply"]>[0]);
+  render(<Component />);
+}
+
+it("failed with saved sharing: Off persists the disarm, then On stays blocked until restart", async () => {
+  let enabled = true;
+  native.invoke.mockImplementation((command, args) => {
+    if (command === "mesh_compute_select") return Promise.resolve("lease");
+    if (command === "mesh_compute_share") {
+      expect(args).toMatchObject({ lease: "lease", model: null });
+      enabled = false;
+      return Promise.resolve();
+    }
+    return Promise.resolve({
+      available: true,
+      lifecycle: { state: "failed", reason: "Startup failed" },
+      sharing: null,
+      savedSharing: { model: "m/Q4", enabled, auto: true },
+    });
+  });
+  mountSharing();
+  const toggle = await screen.findByRole("switch", {
+    name: "Share this machine",
+  });
+  await waitFor(() => expect(toggle).toHaveAttribute("aria-checked", "true"));
+  expect(
+    screen.getByText(/Sharing is still enabled for next launch/),
+  ).toBeInTheDocument();
+  expect(toggle).not.toHaveAttribute("aria-disabled", "true");
+  fireEvent.click(toggle);
+  await waitFor(() => expect(toggle).toHaveAttribute("aria-checked", "false"));
+  // Consent is cleared; the unconfirmed runtime is never presented as stopped.
+  expect(
+    screen.getByText(/Shutdown could not be confirmed\. Restart Buzz/),
+  ).toBeInTheDocument();
+  expect(toggle).toHaveAttribute("aria-disabled", "true");
+  fireEvent.click(toggle);
+  expect(
+    native.invoke.mock.calls.filter(([c]) => c === "mesh_compute_share"),
+  ).toHaveLength(1);
+});
+
+it("a failed disarm write leaves sharing visibly enabled with the error", async () => {
+  native.invoke.mockImplementation((command) => {
+    if (command === "mesh_compute_select") return Promise.resolve("lease");
+    if (command === "mesh_compute_share")
+      return Promise.reject("Could not write sharing settings");
+    return Promise.resolve({
+      available: true,
+      lifecycle: { state: "failed", reason: "Startup failed" },
+      sharing: null,
+      savedSharing: { model: "m/Q4", enabled: true, auto: true },
+    });
+  });
+  mountSharing();
+  const toggle = await screen.findByRole("switch", {
+    name: "Share this machine",
+  });
+  await waitFor(() => expect(toggle).toHaveAttribute("aria-checked", "true"));
+  fireEvent.click(toggle);
+  expect(await screen.findByRole("alert")).toHaveTextContent(
+    "Could not write sharing settings",
+  );
+  expect(toggle).toHaveAttribute("aria-checked", "true");
+});
+
+it("a transient selection failure is retried without restoring sharing before Off", async () => {
+  let selects = 0;
+  native.invoke.mockImplementation((command, args) => {
+    if (command === "mesh_compute_select")
+      return ++selects === 1
+        ? Promise.reject("Previous Mesh runtime shutdown is not confirmed")
+        : Promise.resolve("fresh-lease");
+    if (command === "mesh_compute_share") {
+      expect(args).toMatchObject({ lease: "fresh-lease", model: null });
+      return Promise.resolve();
+    }
+    return Promise.resolve({
+      available: true,
+      lifecycle: { state: "stopped" },
+      sharing: null,
+      savedSharing: { model: "m/Q4", enabled: true, auto: true },
+    });
+  });
+  mountSharing();
+  const toggle = await screen.findByRole("switch", {
+    name: "Share this machine",
+  });
+  await waitFor(() => expect(toggle).toHaveAttribute("aria-checked", "true"));
+  fireEvent.click(toggle);
+  await waitFor(() =>
+    expect(native.invoke).toHaveBeenCalledWith(
+      "mesh_compute_share",
+      expect.objectContaining({ lease: "fresh-lease", model: null }),
+    ),
+  );
+  const selectCalls = native.invoke.mock.calls.filter(
+    ([c]) => c === "mesh_compute_select",
+  );
+  expect(selectCalls).toHaveLength(2);
+  // The recovery selection must not restore (start) the armed share.
+  expect(selectCalls[1]?.[1]).toMatchObject({ restoreSharing: false });
+  expect(
+    native.invoke.mock.calls.some(([c]) => c === "mesh_compute_start"),
+  ).toBe(false);
+});
+
+it("unsafe failed runtime with no lease: Off disarms consent without selection or shutdown", async () => {
+  let enabled = true;
+  native.invoke.mockImplementation((command, args) => {
+    // Native select must confirm shutdown first; a sticky failure always rejects.
+    if (command === "mesh_compute_select")
+      return Promise.reject("Mesh shutdown timed out; restart Buzz");
+    if (command === "mesh_compute_disarm") {
+      expect(args).toEqual({
+        community: "https://fixture.example",
+        expectedViewer: "viewer",
+      });
+      enabled = false;
+      return Promise.resolve();
+    }
+    if (command === "mesh_compute_share")
+      throw new Error("share must not be reached without a lease");
+    return Promise.resolve({
+      available: true,
+      lifecycle: { state: "failed", reason: "Mesh shutdown timed out" },
+      sharing: null,
+      savedSharing: { model: "m/Q4", enabled, auto: true },
+    });
+  });
+  mountSharing();
+  const toggle = await screen.findByRole("switch", {
+    name: "Share this machine",
+  });
+  await waitFor(() => expect(toggle).toHaveAttribute("aria-checked", "true"));
+  fireEvent.click(toggle);
+  await waitFor(() => expect(toggle).toHaveAttribute("aria-checked", "false"));
+  expect(native.invoke).toHaveBeenCalledWith("mesh_compute_disarm", {
+    community: "https://fixture.example",
+    expectedViewer: "viewer",
+  });
+  expect(
+    screen.getByText(/Shutdown could not be confirmed\. Restart Buzz/),
+  ).toBeInTheDocument();
+  expect(toggle).toHaveAttribute("aria-disabled", "true");
+});
+
+for (const retire of ["identity", "dispose"] as const) {
+  it(`a retired Off (${retire}) never disarms after its selection rejects`, async () => {
+    let snapshot = {
+      status: "ready",
+      viewer: "viewer",
+      scope: "https://fixture.example:viewer",
+    };
+    const listeners = new Set<() => void>();
+    let rejectRetry!: (reason: string) => void;
+    let selects = 0;
+    native.invoke.mockImplementation((command) => {
+      if (command === "mesh_compute_select") {
+        selects++;
+        if (selects === 1) return Promise.reject("first selection failed");
+        if (selects === 2)
+          return new Promise((_, reject) => {
+            rejectRetry = reject;
+          });
+        return Promise.resolve("other-lease");
+      }
+      return Promise.resolve({
+        available: true,
+        lifecycle: { state: "failed", reason: "stuck" },
+        sharing: null,
+        savedSharing: { model: "m/Q4", enabled: true, auto: true },
+      });
+    });
+    let Component!: React.ComponentType;
+    let dispose!: () => void;
+    apply({
+      relay: {
+        snapshot: () => snapshot,
+        subscribe: (listener: () => void) => {
+          listeners.add(listener);
+          return () => listeners.delete(listener);
+        },
+      },
+      effect: (setup: () => () => void) => {
+        dispose = setup();
+      },
+      settingsCards: {
+        register: (card: { component: React.ComponentType }) => {
+          Component = card.component;
+        },
+      },
+    } as unknown as Parameters<PluginModule["apply"]>[0]);
+    render(<Component />);
+    const toggle = await screen.findByRole("switch", {
+      name: "Share this machine",
+    });
+    await waitFor(() => expect(toggle).toHaveAttribute("aria-checked", "true"));
+    fireEvent.click(toggle);
+    // The Off action is now waiting on its retried selection.
+    await waitFor(() => expect(selects).toBe(2));
+    await act(async () => {
+      if (retire === "identity") {
+        snapshot = {
+          status: "ready",
+          viewer: "other",
+          scope: "https://other.example:other",
+        };
+        for (const listener of listeners) listener();
+      } else {
+        dispose();
+      }
+    });
+    const retired = shareActionSettled();
+    try {
+      await act(async () => {
+        rejectRetry("Mesh shutdown timed out; restart Buzz");
+        // Wait for the retired Off action itself to finish, not a timer tick.
+        await retired;
+      });
+    } finally {
+      rejectRetry("released");
+    }
+    expect(
+      native.invoke.mock.calls.some(([c]) => c === "mesh_compute_disarm"),
+    ).toBe(false);
+  });
+}
diff --git a/src/bundled/mesh-compute/index.tsx b/src/bundled/mesh-compute/index.tsx
new file mode 100644
index 000000000..e59ddea9c
--- /dev/null
+++ b/src/bundled/mesh-compute/index.tsx
@@ -0,0 +1,590 @@
+import { invoke, isTauri } from "@tauri-apps/api/core";
+import { useEffect, useState, useSyncExternalStore } from "react";
+import type { PluginModule } from "../../plugins/api";
+
+import { Button } from "../../shared/design-system/ui/Button";
+import { Switch } from "../../shared/design-system/ui/Switch";
+import { CpuIcon } from "../../shared/design-system/icons";
+import { ShareModelPicker } from "./ShareModelPicker";
+import { CommunityAgent } from "./CommunityAgent";
+import { CommunityMesh } from "./CommunityMesh";
+import { ConsumerComputeView } from "./ConsumerComputeView";
+import { ShareHex, type ShareHexState } from "./ShareHex";
+import styles from "./Compute.module.css";
+
+type MeshStatus = {
+  available: boolean;
+  modelReady?: boolean;
+  finishingJoin?: boolean;
+  boundCommunity?: string | null;
+  // Configured intent, not proof of serving; lifecycle supplies the actual phase.
+  sharing?: string | null;
+  savedSharing?: { model: string; enabled: boolean; auto?: boolean } | null;
+  settingsError?: string | null;
+  download?: {
+    label: string;
+    file: string | null;
+    downloadedBytes: number | null;
+    totalBytes: number | null;
+    done: boolean;
+  } | null;
+  lifecycle?: {
+    state: "stopped" | "starting" | "ready" | "stopping" | "failed";
+    reason?: string;
+  };
+  reason?: string;
+};
+export const inject = ["relay", "settingsCards", "agentControl"];
+
+// Settles when the most recent Share action has fully finished, so tests can
+// prove a retired action completed instead of waiting an arbitrary tick.
+let lastShareAction: Promise<void> = Promise.resolve();
+export const shareActionSettled = () => lastShareAction;
+export const apply: PluginModule["apply"] = (ctx) => {
+  let lease: Promise<string | undefined> | undefined;
+  let scope: string | undefined;
+  let viewer: string | undefined;
+  let disposed = false;
+  let selectionQueue: Promise<unknown> = Promise.resolve();
+  const select = (
+    community: string,
+    restoreSharing = true,
+    replaceExisting = false,
+  ) => {
+    const selected = selectionQueue
+      .catch(() => {})
+      .then(async () => {
+        const support = await invoke<MeshStatus>("mesh_compute_status");
+        if (!support.available) return undefined;
+        return invoke<string>("mesh_compute_select", {
+          community,
+          restoreSharing,
+          ...(replaceExisting ? { replaceExisting: true } : {}),
+        });
+      });
+    selectionQueue = selected;
+    return selected;
+  };
+  const release = (old: Promise<string | undefined> | undefined) => {
+    void old
+      ?.then((lease) =>
+        lease ? invoke("mesh_compute_release", { lease }) : undefined,
+      )
+      .catch(() => {});
+  };
+  // A rejected selection must not strand every later action behind a dead
+  // promise: retry the current community once, then surface the real error.
+  const currentLease = async () => {
+    const selected = lease;
+    if (!selected) throw new Error("Connect to a community first");
+    try {
+      return { selected, id: await selected };
+    } catch (error) {
+      if (!scope || selected !== lease) throw error;
+      // Recovery for an action must never restore (start) saved sharing first.
+      const retry = select(scope, false);
+      lease = retry;
+      return { selected: retry, id: await retry };
+    }
+  };
+  const sync = () => {
+    const snapshot = ctx.relay.snapshot();
+    const identityChanged = viewer !== undefined && snapshot.viewer !== viewer;
+    if (snapshot.status !== "ready" && !identityChanged) return;
+    if (identityChanged) {
+      release(lease);
+      lease = undefined;
+      scope = undefined;
+    }
+    viewer = snapshot.viewer;
+    const next =
+      snapshot.status === "ready" &&
+      snapshot.viewer &&
+      snapshot.scope?.endsWith(`:${snapshot.viewer}`)
+        ? snapshot.scope.slice(0, -(snapshot.viewer.length + 1))
+        : undefined;
+    // Foreground navigation is not permission to move the app-owned compute.
+    if (scope && next && !identityChanged) return;
+    if (next === scope) return;
+    scope = next;
+    const old = lease;
+    lease = isTauri() && next ? select(next) : undefined;
+    void lease?.catch(() => {});
+    release(old);
+  };
+  sync();
+  const unsubscribe = ctx.relay.subscribe(sync);
+  ctx.effect(() => () => {
+    disposed = true;
+    unsubscribe();
+    release(lease);
+    lease = undefined;
+  });
+
+  function CommunityComputePage({
+    community,
+  }: {
+    community?: { id: string; name: string };
+  }) {
+    const snapshot = useSyncExternalStore(
+      ctx.relay.subscribe,
+      ctx.relay.snapshot,
+    );
+    const [status, setStatus] = useState<MeshStatus | null>(null);
+    const [error, setError] = useState<string | null>(null);
+    useEffect(() => {
+      let active = true;
+      setStatus(null);
+      setError(null);
+      if (isTauri()) {
+        const selected = lease;
+        // A rejected selection still shows authoritative status and its error;
+        // the next action retries the selection.
+        void (selected ?? Promise.resolve())
+          .catch((reason) => {
+            if (active && snapshot === ctx.relay.snapshot())
+              setError(String(reason));
+          })
+          .then(() => invoke<MeshStatus>("mesh_compute_status"))
+          .then(
+            (result) => {
+              if (active && snapshot === ctx.relay.snapshot())
+                setStatus(result);
+            },
+            (error) => {
+              if (active && snapshot === ctx.relay.snapshot())
+                setError(String(error));
+            },
+          );
+      }
+      return () => {
+        active = false;
+      };
+    }, [snapshot]);
+    const [busy, setBusy] = useState(false);
+    // One page Refresh also rereads the community list (no second Refresh).
+    const [refreshCount, setRefreshCount] = useState(0);
+    // Controls wait for this community's selection instead of rejecting clicks.
+    const [leaseReady, setLeaseReady] = useState(false);
+    // biome-ignore lint/correctness/useExhaustiveDependencies: lease follows the relay snapshot.
+    useEffect(() => {
+      let active = true;
+      const selected = lease;
+      setLeaseReady(!selected);
+      void selected?.then(
+        (id) => {
+          if (active) setLeaseReady(Boolean(id));
+        },
+        () => {
+          // A rejected selection is retried by the next action.
+          if (active) setLeaseReady(true);
+        },
+      );
+      return () => {
+        active = false;
+      };
+    }, [snapshot.viewer, snapshot.scope]);
+    const [replaceConfirmed, setReplaceConfirmed] = useState(false);
+    const viewedCommunity =
+      snapshot.status === "ready" && snapshot.viewer && snapshot.scope
+        ? snapshot.scope.slice(0, -(snapshot.viewer.length + 1))
+        : undefined;
+    const boundCommunity = status?.available ? status.boundCommunity : null;
+    const otherCommunity = Boolean(
+      viewedCommunity && boundCommunity && viewedCommunity !== boundCommunity,
+    );
+    const replace = async () => {
+      if (!viewedCommunity || busy) return;
+      setBusy(true);
+      setError(null);
+      const previousLease = lease;
+      try {
+        lease = select(viewedCommunity, false, true);
+        await lease;
+        scope = viewedCommunity;
+        if (!disposed && snapshot === ctx.relay.snapshot()) {
+          setStatus(await invoke<MeshStatus>("mesh_compute_status"));
+          setReplaceConfirmed(false);
+        }
+      } catch (error) {
+        lease = previousLease;
+        setError(String(error));
+      } finally {
+        setBusy(false);
+      }
+    };
+    const [model, setModel] = useState("");
+    const [auto, setAuto] = useState(true);
+    const [recommended, setRecommended] = useState<string | null>(null);
+    // biome-ignore lint/correctness/useExhaustiveDependencies: identity and community changes retire the prior model selection.
+    useEffect(() => {
+      setModel("");
+      setAuto(true);
+      setRecommended(null);
+    }, [snapshot.viewer, snapshot.scope]);
+    useEffect(() => {
+      if (status?.savedSharing?.model) {
+        setModel(status.savedSharing.model);
+        setAuto(status.savedSharing.auto ?? false);
+      }
+    }, [status?.savedSharing?.model, status?.savedSharing?.auto]);
+    const reset = async () => {
+      setBusy(true);
+      setError(null);
+      try {
+        const { selected, id } = await currentLease();
+        if (!id) throw new Error("Mesh native runtime is unavailable");
+        if (disposed || selected !== lease)
+          throw new Error("Community changed");
+        await invoke("mesh_compute_share", {
+          lease: id,
+          model: null,
+          maxVramGb: null,
+          auto: true,
+          resetOnly: true,
+        });
+        const result = await invoke<MeshStatus>("mesh_compute_status");
+        if (!disposed && snapshot === ctx.relay.snapshot()) {
+          setStatus(result);
+          setAuto(true);
+        }
+      } catch (reason) {
+        if (!disposed && snapshot === ctx.relay.snapshot()) {
+          setError(String(reason));
+          const result = await invoke<MeshStatus>("mesh_compute_status").catch(
+            () => null,
+          );
+          if (result && !disposed && snapshot === ctx.relay.snapshot())
+            setStatus(result);
+        }
+      } finally {
+        if (!disposed) setBusy(false);
+      }
+    };
+    const share = (clearSaved = false) => {
+      const action = runShare(clearSaved);
+      lastShareAction = action;
+      return action;
+    };
+    const runShare = async (clearSaved: boolean) => {
+      setBusy(true);
+      setError(null);
+      try {
+        const turningOff = clearSaved || Boolean(status?.sharing);
+        // Capture the operation's owner before awaiting; identity or community
+        // changes while waiting retire this action.
+        const community = scope;
+        const owner = viewer;
+        const current = () =>
+          !disposed &&
+          snapshot === ctx.relay.snapshot() &&
+          scope === community &&
+          viewer === owner;
+        let selected: Promise<string | undefined> | undefined;
+        let id: string | undefined;
+        try {
+          ({ selected, id } = await currentLease());
+        } catch (reason) {
+          // Without a lease (e.g. an unrecovered failed runtime blocks selection),
+          // Off still clears saved consent; it never starts or stops Mesh.
+          if (!turningOff || !community || !owner || !current()) throw reason;
+          await invoke("mesh_compute_disarm", {
+            community,
+            expectedViewer: owner,
+          });
+          const result = await invoke<MeshStatus>("mesh_compute_status");
+          if (!disposed && snapshot === ctx.relay.snapshot()) setStatus(result);
+          return;
+        }
+        if (!id) throw new Error("Mesh native runtime is unavailable");
+        if (disposed || selected !== lease)
+          throw new Error("Community changed");
+        await invoke("mesh_compute_share", {
+          lease: id,
+          model:
+            clearSaved || status?.sharing
+              ? null
+              : auto
+                ? (recommended ?? model)
+                : model,
+          maxVramGb: null,
+          auto,
+        });
+        const result = await invoke<MeshStatus>("mesh_compute_status");
+        if (!disposed && snapshot === ctx.relay.snapshot()) setStatus(result);
+      } catch (error) {
+        if (!disposed && snapshot === ctx.relay.snapshot()) {
+          setError(String(error));
+          // Share Off may clear intent even when shutdown fails.
+          const result = await invoke<MeshStatus>("mesh_compute_status").catch(
+            () => null,
+          );
+          if (result && !disposed && snapshot === ctx.relay.snapshot())
+            setStatus(result);
+        }
+      } finally {
+        if (!disposed) setBusy(false);
+      }
+    };
+    const refresh = async () => {
+      setRefreshCount((value) => value + 1);
+      setBusy(true);
+      setError(null);
+      try {
+        const result = await invoke<MeshStatus>("mesh_compute_status");
+        if (!disposed && snapshot === ctx.relay.snapshot()) setStatus(result);
+      } catch (error) {
+        if (!disposed && snapshot === ctx.relay.snapshot())
+          setError(String(error));
+      } finally {
+        if (!disposed) setBusy(false);
+      }
+    };
+    const phase = status?.lifecycle?.state;
+    // Saved consent and live intent, not runtime health.
+    const shareOn = Boolean(status?.sharing || status?.savedSharing?.enabled);
+    // Serving proof, not consent: only a ready runtime with a loaded model glows.
+    const preparing =
+      phase === "ready" && status?.sharing && !status.modelReady;
+    const hexState: ShareHexState =
+      phase === "ready" && status?.sharing && status.modelReady
+        ? "sharing"
+        : busy || phase === "starting" || phase === "stopping" || preparing
+          ? "working"
+          : "idle";
+    useEffect(() => {
+      if (
+        busy ||
+        error ||
+        (status?.lifecycle?.state !== "starting" &&
+          status?.lifecycle?.state !== "stopping" &&
+          !(
+            status?.lifecycle?.state === "ready" &&
+            status.sharing &&
+            !status.modelReady
+          ))
+      )
+        return;
+      let active = true;
+      const timer = setTimeout(() => {
+        void invoke<MeshStatus>("mesh_compute_status").then(
+          (result) => {
+            if (active && !disposed && snapshot === ctx.relay.snapshot())
+              setStatus(result);
+          },
+          (reason) => {
+            if (active && !disposed && snapshot === ctx.relay.snapshot())
+              setError(String(reason));
+          },
+        );
+      }, 1000);
+      return () => {
+        active = false;
+        clearTimeout(timer);
+      };
+    }, [status, busy, error, snapshot]);
+    return (
+      <ConsumerComputeView
+        communityName={community?.name}
+        status={
+          !isTauri()
+            ? "Open Buzz desktop to use shared compute."
+            : !status
+              ? "Checking shared compute…"
+              : status.available === false
+                ? "Shared compute isn’t available in this build."
+                : undefined
+        }
+        error={error ?? status?.settingsError ?? status?.reason}
+        refreshDisabled={busy || !isTauri()}
+        refresh={() => void refresh()}
+      >
+        {otherCommunity && (
+          <section aria-label="Bound compute community">
+            <p>
+              {status?.sharing ? "Sharing" : "Compute connected"} in{" "}
+              {boundCommunity}. Navigation does not move it.
+            </p>
+            {replaceConfirmed ? (
+              <>
+                <p>
+                  Stop that community’s local Mesh agents and compute before
+                  switching to {viewedCommunity}?
+                </p>
+                <Button disabled={busy} onClick={() => void replace()}>
+                  Stop agents and switch compute
+                </Button>
+                <Button
+                  disabled={busy}
+                  onClick={() => setReplaceConfirmed(false)}
+                >
+                  Cancel
+                </Button>
+              </>
+            ) : (
+              <Button disabled={busy} onClick={() => setReplaceConfirmed(true)}>
+                Use compute in this community instead
+              </Button>
+            )}
+          </section>
+        )}
+        {isTauri() && status?.available && !otherCommunity && (
+          <section aria-label="Share compute" className={styles.sharing}>
+            <div className={styles.sharingHeader}>
+              <ShareHex state={hexState} />
+              <div>
+                <h2 className="m-0 text-body">
+                  {hexState === "sharing"
+                    ? "You’re sharing compute"
+                    : "Share your compute"}
+                </h2>
+                <p className="m-0 text-body-sm text-secondary">
+                  Let {community?.name ?? "this community"} run prompts on this
+                  machine. Auto picks the best model for your hardware; Advanced
+                  lets you choose. Sharing resumes when you reopen Buzz.
+                </p>
+              </div>
+            </div>
+            <Switch
+              label="Share this machine"
+              checked={shareOn}
+              disabled={
+                busy ||
+                !leaseReady ||
+                // Only a shutdown must finish first. Off may cancel a serve that
+                // is still starting (e.g. a long download), and On may replace a
+                // consumer that is still connecting; native enforces the same.
+                phase === "stopping" ||
+                snapshot.status !== "ready" ||
+                // Turning on: never replace an unrecovered failed runtime.
+                (!shareOn && (phase === "failed" || (!auto && !model.trim())))
+              }
+              onCheckedChange={(next) => {
+                if (next) void share();
+                else void share(!status.sharing);
+              }}
+            />
+            <p role="status" className="text-body-sm">
+              {leaseReady
+                ? shareStatus(status, phase, community?.name)
+                : "Checking shared compute…"}
+            </p>
+            {status.sharing && status.download && !status.download.done && (
+              <DownloadProgress download={status.download} />
+            )}
+            <ShareModelPicker
+              model={model}
+              auto={auto}
+              onRecommendation={setRecommended}
+              runningModel={status.sharing ?? null}
+              onReset={() => void reset()}
+              resetDisabled={busy || snapshot.status !== "ready"}
+              onChange={(value) => {
+                setModel(value);
+                setAuto(false);
+              }}
+              disabled={
+                busy ||
+                phase === "starting" ||
+                phase === "stopping" ||
+                Boolean(status.sharing)
+              }
+            />
+          </section>
+        )}
+        {community &&
+          snapshot.viewer &&
+          ctx.agentControl &&
+          status?.available &&
+          !otherCommunity && (
+            <CommunityAgent
+              key={`${community.id}:${snapshot.viewer}`}
+              control={ctx.agentControl}
+              destination={community.id}
+              owner={snapshot.viewer}
+            />
+          )}
+        {isTauri() && status?.available && community && (
+          <CommunityMesh
+            key={community.id}
+            community={community.id}
+            relay={ctx.relay}
+            refreshKey={refreshCount}
+          />
+        )}
+      </ConsumerComputeView>
+    );
+  }
+  ctx.settingsCards.register({
+    id: "mesh",
+    title: "Shared compute",
+    icon: CpuIcon,
+    component: CommunityComputePage,
+  });
+};
+
+/** One status line in the style of the original Compute page. */
+function shareStatus(
+  status: MeshStatus,
+  phase: string | undefined,
+  communityName: string | undefined,
+): string {
+  const where = communityName ?? "your community";
+  const model = status.sharing;
+  const enabled = Boolean(model || status.savedSharing?.enabled);
+  if (phase === "failed") {
+    const cause = status.lifecycle?.reason
+      ? ` ${status.lifecycle.reason}.`
+      : "";
+    return enabled
+      ? `Mesh needs recovery.${cause} Sharing is still enabled for next launch; turn it off to disable automatic sharing. Restart Buzz before starting Mesh again.`
+      : `Mesh needs recovery.${cause} Shutdown could not be confirmed. Restart Buzz before starting Mesh again.`;
+  }
+  if (phase === "stopping")
+    return status.finishingJoin
+      ? "Stopping, finishing a peer connection…"
+      : "Stopping…";
+  if (!model) {
+    if (status.savedSharing?.enabled)
+      return "Sharing is enabled but not running. Turn it off and on to start it again.";
+    // Consumer-only node (started for agents): Thomas's "connected" wording.
+    if (phase === "starting")
+      return "Sharing is off. Connecting to community compute…";
+    if (phase === "ready")
+      return "Sharing is off. Connected to community compute.";
+    return "Sharing is off.";
+  }
+  if (phase === "starting") return `Starting ${model}…`;
+  if (phase === "ready")
+    return status.modelReady
+      ? `Sharing ${model} with ${where}.`
+      : `Preparing ${model} — not serving yet.`;
+  return `Selected for sharing: ${model}`;
+}
+
+function DownloadProgress({
+  download,
+}: {
+  download: NonNullable<MeshStatus["download"]>;
+}) {
+  const received = download.downloadedBytes ?? 0;
+  const total = download.totalBytes ?? 0;
+  const percent =
+    total > 0 ? Math.min(100, Math.round((received / total) * 100)) : undefined;
+  return (
+    <div>
+      <progress
+        aria-label="Model download"
+        max={100}
+        value={percent}
+        className="w-full"
+      />
+      <span className="text-body-sm text-secondary">
+        {`Downloading ${download.file ?? download.label}`}
+        {percent === undefined
+          ? "…"
+          : ` · ${percent}% (${(received / 1e9).toFixed(2)} GB / ${(total / 1e9).toFixed(2)} GB)`}
+      </span>
+    </div>
+  );
+}
diff --git a/src/bundled/mesh-compute/manifest.json b/src/bundled/mesh-compute/manifest.json
new file mode 100644
index 000000000..989009b8d
--- /dev/null
+++ b/src/bundled/mesh-compute/manifest.json
@@ -0,0 +1 @@
+{ "id": "buzz.mesh-compute", "name": "Shared compute", "apiVersion": 1 }
diff --git a/src/features/settings/service.ts b/src/features/settings/service.ts
index 23c2998b7..504999494 100644
--- a/src/features/settings/service.ts
+++ b/src/features/settings/service.ts
@@ -6,6 +6,7 @@ import {
   createContributions,
   type Contribution,
 } from "../../plugins/contributions";
+
 export type SettingsCard = {
   id: string;
   title: string;
diff --git a/src/shared/design-system/icons/index.ts b/src/shared/design-system/icons/index.ts
index 6fb716493..24f122801 100644
--- a/src/shared/design-system/icons/index.ts
+++ b/src/shared/design-system/icons/index.ts
@@ -407,6 +407,12 @@ export const HashArrowInIcon = defineIcon("custom", HashArrowInArtwork, {
   intendedSizes: [{ width: 16, height: 16 }],
 });
 
+import TablerCpuIcon from "@tabler/icons-react/dist/esm/icons/IconCpu.mjs";
+export const CpuIcon = defineIcon("tabler", TablerCpuIcon);
+import TablerHexagonIcon from "@tabler/icons-react/dist/esm/icons/IconHexagon.mjs";
+export const HexagonIcon = defineIcon("tabler", TablerHexagonIcon);
+import TablerHexagonFilledIcon from "@tabler/icons-react/dist/esm/icons/IconHexagonFilled.mjs";
+export const HexagonFilledIcon = defineIcon("tabler", TablerHexagonFilledIcon);
 export const ClaudeLogoIcon = defineIcon("custom", ClaudeLogoArtwork, {
   meaning: "Claude harness",
   category: "Custom brand mark",
diff --git a/tests/browser/agent-models.spec.mjs b/tests/browser/agent-models.spec.mjs
index 29d5aae5c..c15b9d1c9 100644
--- a/tests/browser/agent-models.spec.mjs
+++ b/tests/browser/agent-models.spec.mjs
@@ -245,3 +245,79 @@ test("on-demand model search preserves custom drafts and fences cancellation/con
     await server.close();
   }
 });
+
+// Browser boundary: provider switch replaces the generic cloud editor with the
+// real shared Select popup, and its chosen value survives native-shaped Save.
+test("Buzz shared compute selects Auto or a community model and saves without cloud fields", async ({
+  page,
+}) => {
+  const server = await createServer({
+    ...config,
+    configFile: false,
+    logLevel: "error",
+    server: { host: "127.0.0.1", port: 0, strictPort: false },
+  });
+  await server.listen();
+  const errors = watchPageErrors(page);
+  try {
+    await page.goto(
+      `http://127.0.0.1:${server.httpServer.address().port}/tests/fixtures/agent-control.html?mesh`,
+    );
+    await page
+      .getByRole("article", { name: "Agent Fixture agent", exact: true })
+      .getByRole("button", { name: "Actions for Fixture agent", exact: true })
+      .click();
+    await page.getByRole("menuitem", { name: "Edit", exact: true }).click();
+    const editor = page.getByRole("dialog", {
+      name: "Edit agent",
+      exact: true,
+    });
+    await editor
+      .getByRole("button", { name: "Environment", exact: true })
+      .click();
+    await editor
+      .getByRole("combobox", { name: "Harness", exact: true })
+      .click();
+    await page.getByRole("option", { name: "Buzz Agent", exact: true }).click();
+    await editor
+      .getByRole("combobox", { name: "Provider", exact: true })
+      .click();
+    await page
+      .getByRole("option", { name: "Buzz shared compute", exact: true })
+      .click();
+    await expect(editor.getByText(/No API key required/)).toBeVisible();
+    await expect(
+      editor.getByLabel("Databricks workspace (HTTPS origin)"),
+    ).toHaveCount(0);
+    await expect(
+      editor.getByRole("textbox", {
+        name: "Model ID (custom or blank)",
+        exact: true,
+      }),
+    ).toHaveCount(0);
+    await editor.getByRole("combobox", { name: "Model", exact: true }).click();
+    await expect(
+      page.getByRole("option", {
+        name: "Auto (collective when available)",
+        exact: true,
+      }),
+    ).toBeVisible();
+    await page
+      .getByRole("option", { name: "Friendly Model", exact: true })
+      .click();
+    await editor
+      .getByRole("button", { name: "Save changes", exact: true })
+      .click();
+    await expect(editor).toHaveCount(0);
+    await expect(page.getByText("Saved.", { exact: true })).toBeVisible();
+    expect(
+      await page.evaluate(() => ({
+        provider: window.agentControlFixture.agent.harness.provider,
+        model: window.agentControlFixture.agent.harness.model,
+      })),
+    ).toEqual({ provider: "relay-mesh", model: "catalog.schema.real-model" });
+    expect(errors.unexplained()).toEqual([]);
+  } finally {
+    await server.close();
+  }
+});
diff --git a/tests/browser/mesh-compute.spec.mjs b/tests/browser/mesh-compute.spec.mjs
new file mode 100644
index 000000000..b68538bea
--- /dev/null
+++ b/tests/browser/mesh-compute.spec.mjs
@@ -0,0 +1,51 @@
+import { selectSettingsSection } from "./navigation.mjs";
+import { test, expect } from "./fixture.mjs";
+
+// Browser boundary: enabling the opt-in Mesh plugin must expose its consumer view in Settings → Compute.
+test("enabling Mesh compute opens Settings Compute", async ({ page, app }) => {
+  await page.goto(app.origin);
+  const button = (name) => page.getByRole("button", { name, exact: true });
+  await button("Your profile").click();
+  await page.getByRole("menuitem", { name: "Settings", exact: true }).click();
+  await selectSettingsSection(page, "Plugins");
+  const enabled = page.getByRole("switch", {
+    name: "Enable Shared compute",
+    exact: true,
+  });
+  await enabled.click();
+  await expect(enabled).toBeChecked();
+  // Contributed cards own their region label rather than the built-in section wrapper.
+  await page
+    .getByRole("complementary", { name: "Settings sidebar", exact: true })
+    .getByRole("button", { name: "Shared compute", exact: true })
+    .click();
+  const compute = page
+    .getByRole("complementary", { name: "Settings sidebar", exact: true })
+    .getByRole("button", { name: "Shared compute", exact: true });
+  await expect(compute.locator("xpath=ancestor::section[1]")).toContainText(
+    "Primary",
+  );
+  await expect(
+    page
+      .getByRole("complementary", { name: "Settings sidebar", exact: true })
+      .getByText("Shared compute", { exact: true }),
+  ).toHaveCount(1);
+  await expect(
+    page.getByRole("heading", { name: "Shared compute", exact: true }),
+  ).toBeVisible();
+  await expect(
+    page
+      .getByRole("region", { name: "Compute consumer", exact: true })
+      .getByRole("status")
+      .filter({ hasText: "Open Buzz desktop to use shared compute." }),
+  ).toHaveText("Open Buzz desktop to use shared compute.");
+  await expect(
+    page.getByText("Shared compute for Primary", { exact: true }),
+  ).toBeVisible();
+  await expect(
+    page.getByRole("region", { name: "Community mesh", exact: true }),
+  ).toHaveCount(0);
+  await expect(page.getByText(/Compute connected in/)).toHaveCount(0);
+  await expect(button("Connect to community compute")).toHaveCount(0);
+  await expect(page.getByText("This destination couldn’t open")).toHaveCount(0);
+});
diff --git a/tests/browser/mesh-share.spec.mjs b/tests/browser/mesh-share.spec.mjs
new file mode 100644
index 000000000..550edb29f
--- /dev/null
+++ b/tests/browser/mesh-share.spec.mjs
@@ -0,0 +1,81 @@
+import { test, expect } from "@playwright/test";
+import { createServer } from "./vite-server.mjs";
+import config from "../fixtures/agent-control.vite.mjs";
+import { watchPageErrors } from "./page-errors.mjs";
+
+// Browser-only boundary: the real sharing page, model Select popup and narrow
+// geometry. Synthetic IPC does not certify SDK serving or live agent replies.
+test("sharing page presents the ladder and supports share/stop at desktop and narrow widths", async ({
+  page,
+}, testInfo) => {
+  const server = await createServer({
+    ...config,
+    configFile: false,
+    logLevel: "error",
+    server: { host: "127.0.0.1", port: 0, strictPort: false },
+  });
+  await server.listen();
+  const errors = watchPageErrors(page);
+  try {
+    await page.goto(
+      `http://127.0.0.1:${server.httpServer.address().port}/tests/fixtures/mesh-share.html`,
+    );
+    await expect(
+      page.getByText("Auto — Qwen 27B (Q4_K_M) for this device"),
+    ).toBeVisible();
+    await page.getByRole("button", { name: "Advanced", exact: true }).click();
+    await expect(
+      page.getByRole("combobox", { name: "Model to share" }),
+    ).toContainText("Qwen 27B — recommended");
+    await page.getByRole("combobox", { name: "Model to share" }).click();
+    await expect(page.getByRole("option", { name: /Gemma E4B/ })).toBeVisible();
+    await expect(page.getByRole("option", { name: /Qwen 9B/ })).toBeVisible();
+    await page.getByRole("option", { name: /Qwen 27B/ }).click();
+    await page.getByRole("switch", { name: "Share this machine" }).click();
+    await expect(
+      page.getByRole("switch", { name: "Share this machine" }),
+    ).toHaveAttribute("aria-checked", "true");
+    expect(
+      await page.evaluate(
+        () =>
+          window.meshShareFixture.calls.find(
+            (call) => call.command === "mesh_compute_share",
+          ).args.model,
+      ),
+    ).toBe("unsloth/Qwen3.8-27B-GGUF:Q4_K_M");
+    for (const [width, mode] of [
+      [1200, "light"],
+      [390, "dark"],
+    ]) {
+      await page.setViewportSize({ width, height: 950 });
+      await page.evaluate(
+        (mode) =>
+          document.documentElement.setAttribute("data-color-mode", mode),
+        mode,
+      );
+      await expect(
+        page.getByRole("switch", { name: "Share this machine" }),
+      ).toBeInViewport();
+      await expect
+        .poll(() =>
+          page.evaluate(() =>
+            [...document.querySelectorAll("main div, main section")].every(
+              (element) => element.scrollWidth <= element.clientWidth + 1,
+            ),
+          ),
+        )
+        .toBe(true);
+      await page.screenshot({
+        path: testInfo.outputPath(`sharing-${width}-${mode}.png`),
+        fullPage: true,
+      });
+    }
+    await page.getByRole("switch", { name: "Share this machine" }).click();
+    await expect(
+      page.getByRole("switch", { name: "Share this machine" }),
+    ).toHaveAttribute("aria-checked", "false");
+    expect(errors.unexplained()).toEqual([]);
+  } finally {
+    await server.close();
+  }
+});
diff --git a/tests/fixtures/agent-control.tsx b/tests/fixtures/agent-control.tsx
index b604fa758..981d9244b 100644
--- a/tests/fixtures/agent-control.tsx
+++ b/tests/fixtures/agent-control.tsx
@@ -144,6 +144,12 @@ imageObserver.observe(document.documentElement, {
   attributeFilter: ["src"],
 });
 const fixture = controlFixture();
+if (new URLSearchParams(location.search).has("mesh")) {
+  fixture.data.harnessOptions?.[0]?.providers?.push({
+    value: "relay-mesh",
+    label: "Buzz shared compute",
+  });
+}
 // Browser journeys start with an explicitly manual-start agent. The shared
 // control fixture remains explicit-on for the profile preference tests.
 fixture.agent.startOnAppLaunch = false;
diff --git a/tests/fixtures/mesh-share.html b/tests/fixtures/mesh-share.html
new file mode 100644
index 000000000..0d7daf91e
--- /dev/null
+++ b/tests/fixtures/mesh-share.html
@@ -0,0 +1,5 @@
+<!doctype html>
+<html lang="en" data-color-mode="light">
+  <head><meta charset="UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><title>Mesh sharing fixture</title></head>
+  <body><div id="root"></div><script type="module" src="./mesh-share.tsx"></script></body>
+</html>
diff --git a/tests/fixtures/mesh-share.tsx b/tests/fixtures/mesh-share.tsx
new file mode 100644
index 000000000..1d727d17f
--- /dev/null
+++ b/tests/fixtures/mesh-share.tsx
@@ -0,0 +1,100 @@
+import { createRoot } from "react-dom/client";
+import type { ComponentType } from "react";
+import { apply } from "../../src/bundled/mesh-compute/index";
+import type { PluginModule } from "../../src/plugins/api";
+import "../../src/shared/styles/globals.css";
+
+// Synthetic IPC only: no native host, credentials, network discovery or models.
+const model = "unsloth/Qwen3.8-27B-GGUF:Q4_K_M";
+let sharing: string | null = null;
+let enabled = false;
+let state = "stopped";
+const snapshot = {
+  status: "ready",
+  viewer: "fixture",
+  scope: "https://fixture.example:fixture",
+};
+const calls: { command: string; args: unknown }[] = [];
+Object.assign(window, {
+  isTauri: true,
+  __TAURI_INTERNALS__: {
+    invoke: async (command: string, args?: { model?: string | null }) => {
+      calls.push({ command, args });
+      switch (command) {
+        case "mesh_compute_select":
+          return "lease";
+        case "mesh_compute_status":
+          return {
+            available: true,
+            sharing,
+            savedSharing: enabled ? { model: sharing, enabled } : null,
+            lifecycle: { state },
+          };
+        case "mesh_compute_inventory":
+          return { unavailable: null, entries: [] };
+        case "mesh_compute_catalog":
+          return {
+            gpuName: "Apple fixture GPU",
+            vramDisplay: "64 GB",
+            recommended: model,
+            entries: [
+              {
+                model: "unsloth/gemma-4-E4B-it-GGUF:Q4_K_M",
+                name: "Gemma E4B",
+                size: "4 GB",
+                installed: true,
+                curated: true,
+                fit: "comfortable",
+              },
+              {
+                model: "unsloth/Qwen3.5-9B-GGUF:Q4_K_M",
+                name: "Qwen 9B",
+                size: "6 GB",
+                installed: true,
+                curated: true,
+                fit: "comfortable",
+              },
+              {
+                model,
+                name: "Qwen 27B",
+                size: "17 GB",
+                installed: true,
+                curated: true,
+                fit: "comfortable",
+              },
+            ],
+          };
+        case "mesh_compute_share":
+          sharing = args?.model ?? null;
+          enabled = !!sharing;
+          state = enabled ? "ready" : "stopped";
+          return;
+        case "mesh_compute_release":
+          state = "stopped";
+          sharing = null;
+          return;
+        default:
+          throw new Error(`Unexpected fixture command: ${command}`);
+      }
+    },
+  },
+  meshShareFixture: { calls },
+});
+let Page: ComponentType<{ community?: { id: string; name: string } }> = () =>
+  null;
+apply({
+  relay: { snapshot: () => snapshot, subscribe: () => () => {} },
+  effect: () => {},
+  settingsCards: {
+    register: (card: { component: typeof Page }) => {
+      Page = card.component;
+    },
+  },
+} as unknown as Parameters<PluginModule["apply"]>[0]);
+const root = document.getElementById("root");
+if (!root) throw new Error("Missing fixture root");
+createRoot(root).render(
+  <main data-buzz-ui="" className="p-6 bg-surface text-primary">
+    <Page />
+  </main>,
+);
diff --git a/tests/integration/native-command-acl.test.mjs b/tests/integration/native-command-acl.test.mjs
new file mode 100644
index 000000000..5d1be2966
--- /dev/null
+++ b/tests/integration/native-command-acl.test.mjs
@@ -0,0 +1,69 @@
+import assert from "node:assert/strict";
+import { readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import test from "node:test";
+
+const root = new URL("../../", import.meta.url);
+const read = (path) => readFileSync(new URL(path, root), "utf8");
+const build = read("src-tauri/build.rs");
+const commandList = build.match(
+  /AppManifest::new\(\)\.commands\(&\[([\s\S]*?)\]/,
+)?.[1];
+assert.ok(commandList, "Tauri application command manifest must be found");
+const commands = new Set(
+  [...commandList.matchAll(/"([a-z_]+)"/g)].map((match) => match[1]),
+);
+const { permissions } = JSON.parse(read("src-tauri/capabilities/default.json"));
+
+function* sources(directory) {
+  for (const entry of readdirSync(new URL(directory, root), {
+    withFileTypes: true,
+  })) {
+    const path = join(directory, entry.name);
+    if (entry.isDirectory()) yield* sources(path);
+    else if (/\.tsx?$/.test(path) && !/\.(test|spec)\./.test(path)) yield path;
+  }
+}
+
+// Literal calls cover the Mesh plugin and native adapters. Dynamic wrappers
+// remain covered by their behavior tests; this is not a runtime ACL evaluator.
+test("literal frontend IPC commands are declared and allowed by the main capability", () => {
+  const found = new Set();
+  for (const path of sources("src")) {
+    const source = read(path);
+    if (!source.includes('"@tauri-apps/api/core"')) continue;
+    for (const [, command] of source.matchAll(
+      /\binvoke(?:<[^;]*?>)?\(\s*["']([a-z_]+)["']/g,
+    )) {
+      found.add(command);
+      assert.ok(
+        commands.has(command),
+        `${path}: ${command} missing from AppManifest`,
+      );
+      assert.ok(
+        permissions.includes(`allow-${command.replaceAll("_", "-")}`),
+        `${path}: ${command} missing from main capability`,
+      );
+    }
+  }
+  // Prevent accidental loss of coverage if the scanner stops matching Mesh.
+  for (const command of [
+    "mesh_compute_catalog",
+    "mesh_compute_share",
+    "mesh_compute_select",
+    "mesh_compute_release",
+    "mesh_compute_disarm",
+    "mesh_compute_status",
+  ]) {
+    assert.ok(found.has(command), `scanner must find ${command}`);
+  }
+});
+
+test("every declared app command has a main-window permission, including host stop", () => {
+  for (const command of commands) {
+    assert.ok(
+      permissions.includes(`allow-${command.replaceAll("_", "-")}`),
+      `${command} missing from main capability`,
+    );
+  }
+});