Native Android (Kotlin Multiplatform) client for the Reticulum LoRa mesh network. Replaces the browser-based webclient with a real native app — foreground service for persistent connections, system notifications on incoming LXMF, ships as a signed APK. No external dependencies. No accounts, no API keys, no central server, no analytics, no Google Play Services, no Firebase. Identity generated on-device, all crypto runs locally, persistence is Room (SQLite). The only outbound traffic is whatever transport you attach (BLE / Bluetooth Classic to your own RNode, or TCP to an rnsd you pick — including 127.0.0.1 for offline LAN testing). The Nodes tab embeds OpenStreetMap tiles when at least one observed destination carries lat/lon — that's the only HTTP fetch in the app. Capabilities Transports — BLE NUS, Bluetooth Classic / RFCOMM (SPP), and direct TCP to a remote rnsd TCPServerInterface. Any combination simultaneously, with independent reconnect supervisors per kind. Per-link traffic pins to the kind that established the link; outbound LXMF + initiator LINKREQUEST to a known peer routes via hop-count-aware per-destination affinity (sticky on the shortest path so a TCP-attached mesh's re-emit of a peer's own LoRa announce can't hijack a working direct route). Only announces and path requests fan out to every attached transport. Inbound dedup is global. LoRa radio config (freq / BW / SF / CR / TX power) pushed to every attached RNode on connect, re-pushable from Settings. LXMF messaging — Sideband-parity link delivery as the primary outbound path (encrypted single-link DATA + per-packet PROOF awaits), with up to 5 link-establishment attempts at 10s intervals (matching LXMF's MAX_DELIVERY_ATTEMPTS / DELIVERY_RETRY_WAIT) so a single LoRa half-duplex collision on the LINKREQUEST or LRPROOF doesn't kill the whole send. Opportunistic single-packet fallback only after the full retry budget is exhausted. Multi-hop transit via §2.3 HEADER_2 conversion. Per-packet PROOF receipts on inbound link DATA, with full Ed25519 signature verification against the responder's long-term key per spec §6.5.1 (closed a silent-message-loss vector found in the v1 security review). Inbox surfaces every sender we've received from; favorites pin a thread to the top, toggleable in place from either the Nodes tab or the Messages tab. Tap any messagable row in Nodes to jump straight into a conversation without having to favorite first. Image attachments (JPEG auto-compressed through a quality ladder to fit the Resource wire budget, EXIF-orientation-corrected so portrait and landscape shots display upright; tap an image to open it full-screen at the largest size the screen allows for its aspect ratio). Signal-style tap-back emoji reactions and swipe-right-to-reply quoting. LXMF propagation node sync (/offer + /get with the §2.3 fix and §11.1 16-byte path_hash). NomadNet browser — micron parser at upstream MicronParser.py parity (backtick escapes, tables, page-level #!c= / #!bg= / #!fg= headers, partials / server-side includes). Single-packet and Resource-fragmented pages. Form inputs (text / checkbox / radio) submit as field_<name> keys per Node.py. In-page link navigation (same-node + cross-node), history-aware Back, link reuse across page nav, opt-in LINKIDENTIFY for ALLOW_LIST pages. Page cache with "last pulled Xm ago", reload, clear. Search box + Favorites + Cached chips. Selectable text + LXMF link targets directly from rendered pages. Reticulum Relay Chat (experimental) — opt-in IRC-style group chat layered on RNS Links — the RRC protocol, CBOR envelopes exchanged over an identified Link to a hub. Enable it in Settings to get a Rooms tab: add a hub by its destination hash, or one-tap-promote a discovered rrc.hub straight from the Nodes list (RRC hubs are recognized and labelled there), then connect, join rooms, and chat. Hub / room / message history persists in its own rrc_* tables. Off by default and still under development — not yet interop-verified against a live hub; ordinary LXMF messaging is unaffected whether it's on or off. Identity & contacts — per-install Reticulum identity (X25519 + Ed25519, ratchet, persisted in Room / SQLDelight). QR card on Settings to share, scan others' from Nodes. Identity export / import via passphrase-encrypted .rmid archives (PBKDF2-HMAC-SHA256 → HKDF-split → AES-256-CBC + HMAC-SHA256, encrypt-then-MAC) — back up before reinstalling, migrate to a new phone, recover from device loss. Saves through the Android share sheet, imports through the file picker. Wrong passphrase / tampered bytes are indistinguishable on the wire by design. Local-only nicknames per contact (userLabel, never sent on the wire) win over the announced display name everywhere; tap the pencil on any Nodes row to set or clear. Manual hash entry + QR scanner for adding contacts before they announce. Visibility — relay-aware Graph (me → relay → leaf via cached HEADER_2 transport_ids), Nodes map (osmdroid + OpenStreetMap) for destinations carrying lat/lon, per-row metadata (hop count, RSSI, last-heard age, stale/far warnings), per-message link-quality footers (RSSI + hop count on each incoming bubble), diagnostics log with copy/clear. Bottom-nav Settings icon turns red when no transport is connected. Notifications surface incoming messages while backgrounded; tap an incoming notification to open the matching conversation. Spec compliance & hardening — §2.3 originator HEADER_1→HEADER_2 conversion (DATA + LINKREQ), §11.1 16-byte request_path_hash, §11.2 request_id verification, §6.5 link-addressed dest_type = LINK, §6.5.1 Ed25519-verified link DATA proofs, §6.7.1 Token-encrypted KEEPALIVE bodies, §6.7.3 LINKCLOSE body verification, §10.2 / §10.5 Resource framing + RESOURCE_REQ, validateAnnounce recomputes SHA256(name_hash ‖ identity_hash)[:16] to reject impersonation announces, Resource size + bz2 decompression-bomb caps. Surviving gaps tracked in todo.md (initiator-side KEEPALIVE, LXMF stamps).